Security exploits can include cyber threats such as computer programs that can disturb the normal behavior of computer systems (viruses), unsolicited e-mail (spam), malicious software (malware), monitoring software (spyware), attempting to make computer resources unavailable to their intended users (Distributed Denial-of-Service or DDoS attack), the social engineering, and online identity theft (phishing). One such cyber threat, which is particularly dangerous to computer users is phishing. Phishing is well known as online identity theft, which targets to steal victims' sensitive information such as username, password and online banking details. This paper focuses on designing an innovative and gamified approach to educate individuals about phishing attacks. The study asks how one can integrate self-efficacy, which has a co-relation with the user's knowledge, into an anti-phishing educational game to thwart phishing attacks? One of the main reasons would appear to be a lack of user knowledge to prevent from phishing attacks. Therefore, this research investigates the elements that influence (in this case, either conceptual or procedural knowledge or their interaction effect) and then integrate them into an anti-phishing educational game to enhance people's phishing prevention behaviour through their motivation.
Even though there are usability experts who claim that user education and training does not work @cite_43 , other researchers have revealed that well-designed end-user education could be a recommended approach to combating against cyber-attacks such as MMFs @cite_27 @cite_32 @cite_35 @cite_34 @cite_6 . In line with Herley @cite_1 , also Kirlappos and Sasse @cite_32 and other researchers argue that current security education on malicious IT threats offers, little protection to end users, who access potentially malicious websites @cite_35 @cite_43 @cite_15 .
@cite_35 @cite_1 @cite_32 @cite_6 @cite_43 @cite_27 @cite_15 @cite_34
2268018836 2131906261 1990562690 1539975474
Discussions in the security community often tend to end in agreement that the only way to really address many of our current problems is 'user education'. User education has, in many respects, become the default way to address the fact that our security environment is becoming too complex for us to secure with applications. But is user education the way forward or is it merely a term used to avoid admitting our failure to create a secure environment for our users customers? Is there any reason to expect that the user would be interested in educating themselves? Is there any research indicating that user education actually helps? This paper aims to discuss two questions. First, should we expect our users to be interested in education? After all, they pay us for taking care of security, so that they can get on with their real work. Second, do we have any evidence that user education leads to a higher level of security? Do the users actually change their behaviour in a way that mitigates risks? Are the risks we are seeing today addressable by increasing awareness? To build systems shielding users from fraudulent (or phishing) websites, designers need to know which attack strategies work and why. This paper provides the first empirical evidence about which malicious strategies are successful at deceiving general users. We first analyzed a large set of captured phishing attacks and developed a set of hypotheses about why these strategies might work. We then assessed these hypotheses with a usability study in which 22 participants were shown 20 web sites and asked to determine which ones were fraudulent. We found that 23 of the participants did not look at browser-based cues such as the address bar, status bar and the security indicators, leading to incorrect choices 40 of the time. We also found that some visual deception attacks can fool even the most sophisticated users. These results illustrate that standard security indicators are not effective for a substantial fraction of users, and suggest that alternative approaches are needed. Purpose – The aim of this research is to make users aware of the importance surrounding the issue of security and security awareness while at the same time making educators as well as other individuals aware of the differing effects of cultural dimensions into the learning process.Design methodology approach – An inter‐cultural study was conducted to investigate if users from the USA and Taiwan exposed to the same situational awareness learning would have different performance in those security awareness outcomes.Findings – The findings confirm that American users who received the situational learning outperformed those users who received the traditional face‐to‐face instruction. Taiwanese users did not perform significantly differently between these two treatments.Research limitations implications – The study was only focused on two countries and therefore may limit its implications worldwide. But the study does show that global citizens also react differently to security awareness as would be expected d... We consider the problem of incorporating end-user advice into reinforcement learning (RL). In our setting, the learner alternates between practicing, where learning is based on actual world experience, and end-user critique sessions where advice is gathered. During each critique session the end-user is allowed to analyze a trajectory of the current policy and then label an arbitrary subset of the available actions as good or bad. Our main contribution is an approach for integrating all of the information gathered during practice and critiques in order to effectively optimize a parametric policy. The approach optimizes a loss function that linearly combines losses measured against the world experience and the critique data. We evaluate our approach using a prototype system for teaching tactical battle behavior in a real-time strategy game engine. Results are given for a significant evaluation involving ten end-users showing the promise of this approach and also highlighting challenges involved in inserting end-users into the RL loop.