Unfortunately user education is not going to get us anywhere against this problem. A colleague of mine offers an internal training session on phishing, and warns attendees that he is going to phish them soon afterward. His success rate, on intelligent people who have been given advance warning and training, is close to 100%.

Ms Kundur might do well teaching engineering students, who are presumably motivated and capable of learning how the internet works, about the importance of web origins, the meaning of SSL certificate errors, and specific risks of any given attachment type in an email. But the 99% are never going to get there, and it is a major engineering systems failure that we would even consider asking them. It's like if we manufactured a car where the driver has to know exactly how the fuel injection system works or it risks exploding. Software tends to push risk decisions to users who have no way of understanding the consequences, then we complain when they make the wrong one