Brunken, L;
Buckmann, A;
Hielscher, J;
Sasse, MA;
(2023)
“To Do This Properly, You Need More Resources”: The Hidden Costs of Introducing Simulated Phishing Campaigns.
In:
SEC '23: Proceedings of the 32nd USENIX Conference on Security Symposium.
(pp. pp. 4105-4122).
USENIX Association: USA.
Preview |
Text
usenixsecurity23-brunken.pdf - Published Version Download (586kB) | Preview |
Abstract
Many organizations use phishing simulation campaigns to raise and measure their employees’ security awareness. They can create their own campaigns, or buy phishing-as-a-service from commercial providers; however, the evaluations of the effectiveness in reducing the vulnerability to such attacks have produced mixed results. Recently, researchers have pointed out “hidden costs” – such as reduced productivity and employee trust. What has not been investigated is the cost involved in preparing an organization for a simulated phishing campaign. We present the first case study of an organization going through the process of selecting and purchasing a phishing simulation. We document and analyze the effort of different stakeholders involved, and present reflection from semi-structured interviews with 6 key actors at the end of the procurement process. Our data analysis shows that procuring such simulations can require significant effort from different stakeholders – in our case, at least 50,000C in person hours – and many hidden intangible costs. Evaluating if a product or service meets training requirements, is acceptable to employees, and preparing the technical infrastructure and operational processes for running such a product all require significant time and effort. The prevailing perception that phishing simulation campaigns are a quick and low-cost solution to providing security training to employees thus needs to be challenged.
| Type: | Proceedings paper |
|---|---|
| Title: | “To Do This Properly, You Need More Resources”: The Hidden Costs of Introducing Simulated Phishing Campaigns |
| Event: | 32nd USENIX Security Symposium, USENIX Security 2023 |
| ISBN-13: | 9781713879497 |
| Open access status: | An open access version is available from UCL Discovery |
| Publisher version: | https://dl.acm.org/doi/10.5555/3620237.3620467 |
| Language: | English |
| Additional information: | This version is the version of record. For information on re-use, please refer to the publisher’s terms and conditions. |
| UCL classification: | UCL UCL > Provost and Vice Provost Offices > UCL BEAMS UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science |
| URI: | https://discovery-pp.ucl.ac.uk/id/eprint/10182427 |
Archive Staff Only
 |
View Item |
