Stimulus Materials Training Approach Participants who underwent training were welcomed to the training by a message from the university CIO, which stressed the importance of the training and thanked them for their participation. Next, participants were told that the university was experiencing an increase in phishing attacks and were shown information about the adverse consequences of responding to a phishing attack (e.g., endangering personal and institutional resources, compromising confidential information). Then, participants were exposed to one of the training programs that were designed to test the competing training approaches: a approach that encourages email users to follow several best practice recommendations for secure concrete email use and an approach that encourages email users to mindfully pause and reflect about the abstract validity of requests they receive through email. These training programs and how they reflect the competing theoretical approaches are discussed in more detail below. Following training, participants were asked to practice identifying phishing emails and were instructed to identify two legitimate and two phishing emails. Correct answers and explanations consistent with the training approach (concrete or abstract) were provided immediately after participants submitted their answers. Training concluded with participants completing a knowledge test based on the specific training program that provided correct answers and explanations after the test was complete. The concrete training content was derived from anti-phishing recommendations found in academic, governmental, non-profit, and corporate sources. We first gathered recommendations for email users as set forth by previous anti-phishing researchers (). We then reconciled this list with resources provided by the U.S. Federal Trade Commission, the non-profit group antiphishing.org, and anti-phishing best practices suggested by an international bank. The combined list of recommendations from these sources was long and in some cases, was customized to specific types of interactions (e.g., online purchases or online banking). Across sources, we identified six consistent recommendations shown in Table 3. As a final check to determine the suitability of these recommendations for a university environment, we presented the recommendations to two independent IT security managers employed at
Stimulus Materials Training Approach Participants who underwent training were welcomed to the training by a message from the university CIO, which stressed the importance of the training and thanked them for their participation. Next, participants were told that the university was experiencing an increase in phishing attacks and were shown information about the adverse consequences of responding to a phishing attack (e.g., endangering personal and institutional resources, compromising confidential information). Then, participants were exposed to one of the training programs that were designed to test the competing training approaches: a concrete approach that encourages email users to follow several best practice recommendations for secure email use and an abstract approach that encourages email users to mindfully pause and reflect about the validity of requests they receive through email. These training programs and how they reflect the competing theoretical approaches are discussed in more detail below. Following training, participants were asked to practice identifying phishing emails and were instructed to identify two legitimate and two phishing emails. Correct answers and explanations consistent with the training approach (concrete or abstract) were provided immediately after participants submitted their answers. Training concluded with participants completing a knowledge test based on the specific training program that provided correct answers and explanations after the test was complete. The concrete training content was derived from anti-phishing recommendations found in academic, governmental, non-profit, and corporate sources. We first gathered recommendations for email users as set forth by previous anti-phishing researchers (). We then reconciled this list with resources provided by the U.S. Federal Trade Commission, the non-profit group antiphishing.org, and anti-phishing best practices suggested by an international bank. The combined list of recommendations from these sources was long and in some cases, was customized to specific types of interactions (e.g., online purchases or online banking). Across sources, we identified six consistent recommendations shown in Table 3. As a final check to determine the suitability of these recommendations for a university environment, we presented the recommendations to two independent IT security managers employed at
PhishingTraining_MS_ver2.docx