Pr(Responding to Phishing Attack) = + Status + Status + β0 β1*Student β2*Faculty β3*Trait Mindfulness + to Trust + to Take Risks + Self Efficacy + β4*Propensity β5*Propensity β6*Computer β7* Phishing Identification Expertise + Customization + Training β8*Phishing β9*Situation-Specific Approach + Training Approach + Training Format β10*Mindfulness β11*Graphical (2) The participant status was recoded from a three-value categorical variable (i.e., student, staff, faculty) to two dichotomous dummy variables (student status, faculty status). This model also examines the effect of phishing email customization, training approach, and training format on the likelihood of responding to a phishing attack and is the central analysis of this research. Factor scores were calculated via a confirmatory factor analysis (CFA) using MPlus 6.1 and utilized in the model. This procedure provided mean-centered, composite score for each covariate. participants’ Forty-seven participants in the training sample (including the survey-only condition) logged in to the fictitious website, resulting in a response rate of 13.2 percent. Descriptive statistics showing the number of participant responses and response rate in each condition are shown in Table 7. These findings are consistent with past industry reports on phishing response rates which indicate between a 10-15 percent rate of response for novice individuals (). Figure 2 displays the timing of the responses to the phishing attack during the first four 24 hour periods after the first email was sent (10:00 AM). The attack generated the greatest response on the first day and decreased sharply on subsequent days. During the first 36 hours, responses were greatest in the evening when participants were most likely at home. Table Participant responses to phishing email – Generic Phishing Custom Phishing Conditions Messagea Messagea Survey Only 8 (24.2%) 9 (22.5%) Concrete Text 4 (11.8%) 6 (15.0%) Graphics 5 (15.2%) 5 (11.9%) Abstract Text 3 (7.5%) 4 (12.5%) Graphics 2 (7.4%) 1 (2.9%)
Pr(Responding to Phishing Attack) = β0 + β1*Student Status + β2*Faculty Status + β3*Trait Mindfulness + β4*Propensity to Trust + β5*Propensity to Take Risks + β6*Computer Self Efficacy + β7* Phishing Identification Expertise + β8*Phishing Customization + β9*Situation-Specific Training Approach + β10*Mindfulness Training Approach + β11*Graphical Training Format (2) The participant status was recoded from a three-value categorical variable (i.e., student, staff, faculty) to two dichotomous dummy variables (student status, faculty status). This model also examines the effect of phishing email customization, training approach, and training format on the likelihood of responding to a phishing attack and is the central analysis of this research. Factor scores were calculated via a confirmatory factor analysis (CFA) using MPlus 6.1 and utilized in the model. This procedure provided participants’ mean-centered, composite score for each covariate. Forty-seven participants in the training sample (including the survey-only condition) logged in to the fictitious website, resulting in a response rate of 13.2 percent. Descriptive statistics showing the number of participant responses and response rate in each condition are shown in Table 7. These findings are consistent with past industry reports on phishing response rates which indicate between a 10-15 percent rate of response for novice individuals (). Figure 2 displays the timing of the responses to the phishing attack during the first four 24 hour periods after the first email was sent (10:00 AM). The attack generated the greatest response on the first day and decreased sharply on subsequent days. During the first 36 hours, responses were greatest in the evening when participants were most likely at home. Table – Participant responses to phishing email Conditions Generic Phishing Messagea Custom Phishing Messagea Survey Only 8 (24.2%) 9 (22.5%) Concrete Text 4 (11.8%) 6 (15.0%) Graphics 5 (15.2%) 5 (11.9%) Abstract Text 3 (7.5%) 4 (12.5%) Graphics 2 (7.4%) 1 (2.9%)
PhishingTraining_MS_ver2.docx