Med hjälp av informationsteknologi (IT) kan företag hålla sig konkurrenskraftiga, samtidigt som det öppnar upp för säkerhetshot som informationsstöld. Phishing är ett exempel på säkerhetshot, vilket innefattar att angripare tillämpar digitala enheter för att konstruera manipulativa meddelanden i syftet att få tillgång till konfidentiell information genom individer (Xiong, Proctor, Yang & Lin, 2019). Många företag investerar i teknologiska lösningar för att skydda mot säkerhetshot, varpå mänskliga faktorer ofta ignoreras (Ghafir et al., 2018). Denna studie har därmed undersökt hur skydd mot phishing kopplat till mänskliga faktorer kan stärkas, det vill säga säkerhetsmedvetenhet, säkerhetsutbildningar, säkerhetspolicies, informationssäkerhetskultur, ledning samt säkerhetsbeteende. Med hjälp av kvalitativa metodansatser har respondenter från ett samarbetsföretag intervjuats, för att besvara hur skydd mot phishing kopplat till mänskliga faktorer kan stärkas genom två delfrågor: ”Vilka brister finns avseende skydd mot phishing kopplat till mänskliga faktorer inom organisationer”? samt ”Vilka åtgärder kan organisationer ta för att förbereda anställda mot phishing-angrepp”?Studiens resultat visar att det kan förekomma brister avseende skydd mot phishing kopplat till mänskliga faktorer som ökar risken med att anställda faller för phishing-angrepp, exempelvis att det saknas information i säkerhetsutbildningar för att förbereda anställda mot phishing-angrepp, att anställda inte tar del av säkerhetspolicyn kontinuerligt, avsaknad av uppföljningsutbildningar samt att kunskap från säkerhetsutbildningar och säkerhetspolicyn glömts bort vilket öppnar upp för riskfyllda säkerhetsbeteenden. Åtgärder mot brister som identifierats i studien innefattar bland annat att anställda bör få genomgå specifik säkerhetsutbildning om phishing som exemplifierar olika typer av phishing-angrepp, en ökad kunskapsdelning bland ledning och anställda i form av att anställda rapporterar in phishing-mejl som ledningen kan informera övriga anställda om, belysa allvaret med phishing genom information om konsekvenser vilket kan leda till en attitydförändring avseende säkerhet, regelbundna uppföljningsutbildningar samt motivering och övervakning att anställda tar del och efterföljer säkerhetspolicies.

As technology keeps integrating further into our personal and professional lives, digital security is a growing concern for our individual and public safety. Email phishing is the most common attack vector, often utilized by malicious actors to trick victims into taking irresponsible actions that benefit the attackers. Phishing attacks targeting large organizations have demonstrated the ability to incur costs that reach great magnitudes. Justifiably, many organizations invest in defense solutions against such attacks. This research investigates the different attack and defense strategies that can affect the success rates for phishing attacks. A retrospective data analysis is performed, on the interaction data of employees with simulated training campaigns, at an organization running a security training program for the last three years, and survey and interview studies with the employees are conducted. The results show that personal qualities such as attachment to the organization, and technological ability have an effect on the employees’ susceptibility to phishing attacks. Attack strategies which exploit human emotions, such as fear through the use of authority, and curiosity through the use of current events, are effective at inducing higher interaction rates. Educational training programs are deemed successful at reducing the employees’ susceptibility to phishing attacks. However, such programs should be implemented carefully to avoid resource waste and produce the sought after results. We determine that a holistic defense strategy should combine multiple security layers, by utilizing technical solutions such as email filters to reduce the number of attempts that are viewed by the employees, with well designed educational solutions, such as the training programs, to reduce the number of interactions with phishing emails, and reporting features to mitigate the potential losses incurred from successful attacks. / Allteftersom teknik upptar en större plats i våra liv blir digital säkerhet en växande fråga för samhällets säkerhet. Nätfiske via e-post är den vanligaste attackvektorn i cyberattacker. Nätfiskekampanjer riktade mot större organisationer har visat sig kunna åstadkomma stora kostnader. Detta orsakar många organisationer att investera pengar ämnade till försvar mot nätfiskeattacker. Den här forskningen undersöker möjliga attackstrategier som används för nätfiskeattacker samt deras framgång, och de olika försvarsåtgärderna som organisationer kan ta. Data från ett IT företag över hur dess anställda påverkas och interagerar med ett säkerhetsutbildningsprogram över 3 års tid, samt enkät och intervjustudier analyseras. Resultaten visar att personliga egenskaper som engagemang för företaget och teknisk förmåga påverkar de anställdas mottaglighet för nätfiskeattacker. Attackstrategier som spelar på känslor, såsom rädsla genom användning av auktoritet, eller nyfikenhet genom användning av aktuella händelser, är effektiva. Säkerhetsutbildningar påvisas vara ett framgångsrikt sätt att minska de anställdas mottaglighet för nätfiskeattacker. Utbildningarna bör dock implementeras noggrant för att undvika resursslöseri och för att försäkra deras effektivitet. Forskningen fastställer att en holistisk försvarsstrategi bör kombinera flera säkerhetslager, genom att använda tekniska lösningar som e-postfilter för att minska antalet försök som de anställda utsätts för, med väldesignade utbildningslösningar för att minska mottagligheten till nätfiske-e-postmeddelanden, och rapporteringsfunktioner för att minska effektiviteten av framgångsrika attacker.

Phishing is a reoccurring issue, which uses social engineering as an attack strategy. The prevention of these attacks is often content-based filters. These solutions are however not always perfect, and phishing emails can still be able to get through the filters. We suggest a new strategy to combat phishing. The strategy is a technical platform which uses the psychology concept nudge. Nudge is a concept that can be used to change a certain behaviour, in this case to make people more cautious when reading their emails.The objective of this thesis is to suggest a nudge using a technical platform regarding possible desensitization. The nudge aims to change email related behaviours to more healthy ones. To get indications if the nudge has benefits, a qualitative survey was made. When using a psychology-based solution, one must address the possibility of desensitization. To minimize possible desensitization, a quantitative analysis was made where different ways to minimize desensitization were assessed. Data for this analysis was gathered by a simulation modeling, where the simulation aimed to replicate a user performing email related events.The conclusion of the simulation results showed that a whitelist approach was the most appropriate for our nudge. The approach minimized the chance of possible desensitization while having a low risk of not performing a nudge when needed. The conclusion of the survey results was that there was an indication of behavioural change and that there existed a risk of possible desensitization. / Nätfiske är ett återkommande problem, som använder sig av social manipulation som attackstrategi. Försvar mot dessa attacker är ofta innehållsbaserade filter. Dessa lösningar är inte alltid perfekta, då nätfiske kan ibland gå förbi filterna. Vi föreslår en ny strategi för att bekämpa nätfiske. Strategin är en teknisk plattform som använder det psykologiska konceptet nudge. Nudge är ett koncept som kan användas för att ändra ett visst beteende, i detta fall för att göra människor mer försiktiga när de läser sina emails.Syftet med detta arbete är att föreslå en nudge i en teknisk plattform där man tar hänsyn till eventuell desensibilisering. Nudgens mål är att ändra emailrelaterade beteenden så att beteendena blir säkrare. En kvalitativ undersökning gjordes för att få indikationer om nudgen har möjliga fördelar. När man använder en psykologibaserad lösning så måste man ta itu med möjligheten av desensibilisering. En kvantitativ analys gjordes där olika sätt att minimera desensibilisering bedömdes, för att sedan kunna minimera desensibiliseringen. Data för denna analys samlades in genom en simuleringsmodellering, där simuleringens syfte var att replikera en användare som utför email-relaterade händelser.Slutsatsen av simuleringsresultaten visade att en whitelist-metod var den mest lämpliga för vår nudge. Metoden minimerade risken för möjlig desensibilisering, samtidigt som den hade en låg risk att inte utföra en nudge när det behövdes. Slutsatsen av undersökningsresultatet från enkäten var att det fanns en indikation för beteendeförändringar och att det fanns en risk för eventuell desensibilisering av nudgen.

No description available.

The Internet has been plagued with endless spam for over 15 years. However, in the last five years spam has morphed from an annoying advertising tool to a social engineering attack vector. Much of today's unwanted email tries to deceive users into replying with passwords, bank account information, or to visit malicious sites which steal login credentials and spread malware. These email-based attacks are known as phishing attacks. Much has been published about these attacks which try to appear real not only to users and subsequently, spam filters. Several sources indicate traditional content filters have a hard time detecting phishing attacks because the emails lack the traditional features and characteristics of spam messages. This thesis tests the hypothesis that by separating the messages into three categories (ham, spam and phish) content filters will yield better filtering performance. Even though experimentation showed three-way classification did not improve performance, several additional premises were tested, including the validity of the claim that phishing emails are too much like legitimate emails and the ability of Naive Bayes classifiers to properly classify emails.

Human errors are common in the contemporary cyber ecosystem, and in an organization’s cybersecurity chain, humans are considered the weakest link. Cybercriminals exploit human vulnerabilities using sophisticated attacks such as phishing. Human susceptibility to phishing is a persistent threat, and has a devastating effect on organizational and personal security. Previous researchers found that human susceptibility to phishing increases in presence of some factors such as organizational, individual, and environmental. Various studies highlight time pressure as one of the influencing factors that can negatively or positively impact human behavior. This research study aimed to investigate the effect of time pressure on human cybersecurity behavior regarding the ability to detect phishing. The study used quantitative research and developed a questionnaire comprising interactive phishing emails distributed online to 03 random groups having different time limits to complete the questionnaire. The study received 356 complete responses. The study's result shows a slight change in user behavior under time pressure, and the impact of time pressure can be positive or negative. However, the results are not statistically significant for all demographic groups to accept this slight change in variance. Moreover, this study's results validate previous studies on human susceptibility to phishing and found more than 50 % of respondents vulnerable to phishing. Thus, the results of this study indicate that the factor of time pressure itself does not significantly impact the human ability to detect phishing. However, it is essential to note that other work-related tasks or stress associated with time pressure can influence human behavior in detecting phishing attempts. In conclusion, the author also proposes further testing and some methodology tweaking by modifying the time given to each tested group and adding more elements to the questionnaire. Finally, the study also suggested conducting the same analysis on physically controlled groups in an organizational or institutional setting.

Social engineering (SE) attacks are one of the most common cyber attacks and frauds, which causes a large economical destruction to individuals, companies and governments alike. The attacks are hard to protect from, since SE-attacks is based on exploiting human weaknesses. The goal of this study is to identify indicators of resilience against SE-attacks from individual computer space data, such as network settings, social media profiles, web browsing behaviour and more. This study is based on qualitative methods to collect information, analyse and evaluate data. Resilience is evaluated with models such as theory of planned behaviour and the big five personality traits, as well as personal and demographic information. Indicators of resilience were found in network settings such as service set identifiers (SSID) and routers, web history, social media use and more. The framework developed in this study could be expanded with more aspect of individual data and different evaluation criteria. Further studies can be done about this subject with tools such as artificial intelligence and machine learning. / Sociala manipulationer är bland de vanligaste cyber attackerna och bedrägerierna som orsakar enorma ekonomiska skador varje år för individer, företag och myndigheter. Dessa attacker är svåra att skydda ifrån då sociala manipulationer utnyttjar mänskliga svagheter som ett medel till att stjäla pengar eller information. Målet med studien är att identifiera indikatorer av motstånd mot sociala manipulationsattacker, vilket ska göras med hjälp av individuell data, som kan bestå av nätverksinställningar, sociala medieprofiler, webbaktivitet bland annat. Denna studie är baserat på kvalitativa metoder för att samla, analysera och utvärdera data. Motstånd mot social manipulation utvärderas med hjälp av relevanta teorier och modeller som har med beteende och personligheter att göra, sedan används även personlig och demografisk information i utvärderingen. De indikatorer som identifierades var bland annat inställningar i routrar, webbhistorik och social medianvändning. Det teoretiska ramverket som utvecklades för att utvärdera motstånd mot sociala manipulationsattacker kan utökas med fler aspekter av individuell data. Viktiga samhällshändelser och sammanhang kan vara en intressant faktor som är relaterat till ämnet. Framtida studier skulle kunna kombinera detta ramverk med tekniker som maskinlärning och artificiell intelligens.

The number of recorded cybercrime incidents has skyrocketed over the last few years. A large part of this development is due to society’s increased reliance on the internet and the backbone that supports it. This in turn increases the profitability of cybercrime. Cybercrime has a broad definition, but in essence cybercrime are crimes that are assisted by technology, often taking place on the internet. The true impact cybercrime has on society is difficult to assess, since it has both financial and social impact, depending on what type of crime has been committed. This thesis examines how cybercrime and the Swedish police’s ability to combat cybercrime is portrayed by Swedish news media, as well as which demographics of the Swedish population are the most susceptible to cybercrime over the last ten years. This was achieved by performing a literature review, where both newspaper articles and reports from various law enforcement agencies were examined. A total of 54 news articles and 21 reports from various law enforcement agencies were used in the study. The included material was analyzed and divided into categories using thematic coding, and the results showed that news media does not always give an accurate depiction of the cybercrime landscape in Sweden. Cybercrime reporting in news articles was often found to be over-dramatized and shallow, which may negatively influence the reader's ability to understand the risks of cybercrime. The law enforcement's ability to combat cybercrime is portrayed as underfunded and in need of personnel with the expertise necessary to curb cybercrime. Although efforts to bolster the government's ability to fight cybercrime have been made during the last ten years, work still remains for law enforcement to catch up and keep pace with cybercriminals.

Today, few companies would manage to continuously stay competitive without the proper utilization of information technology (IT). This has increased companies’ dependency of IT and created new threats that need to be addressed to mitigate risks to daily business operations. A large extent of these IT-related threats includes hackers attempting to gain unauthorized access to internal computer networks by exploiting vulnerabilities in the behaviors of employees. A common way to exploit human vulnerabilities is to deceive and manipulate employees through the use of social engineering. Although researchers have attempted to understand social engineering, there is a lack of empirical research capturing multilevel factors explaining what drives employees’ existing behaviors and how these behaviors can be improved. This is addressed in this thesis. The contribution of this thesis includes (i) an instrument to measure security behaviors and its multilevel determinants, (ii) identification of multilevel variables that significantly influence employees’ intent for behavior change, (iii) identification of what behavioral governance factors that lay the foundation for behavior change, (iv) identification that national culture has a significant effect on how organizations cope with behavioral information security threats, and (v) a strategy to ensure adequate information security behaviors throughout an organization. This thesis is a composite thesis of eight papers. Paper 1 describes the instrument measuring multilevel determinants. Paper 2 and 3 describes how security knowledge is established in organizations, and the effect on employee information security awareness. In Paper 4 the root cause of employees’ intention to change their behaviors and resist social engineering is described. Paper 5 and 8 describes how the instrument to measure social engineering security behaviors was developed and validated through scenario-based surveys and phishing experiments. Paper 6 and 7 describes experiments performed to understand reason to why employees fall for social engineering. Finally, paper 2, 5 and 6 examines the moderating effect of national culture. / <p>QC 20160503</p>

L’hameçonnage est une escroquerie moderne qui cible les utilisateurs de communications électroniques et vise à les convaincre de réaliser des actions pour le bénéfice d’un individu nommé hameçonneur. Les attaques d’hameçonnage s’appuient essentiellement sur de l’ingénierie sociale et la plupart de ces attaques utilisent des liens représentés par des noms de domaine et des URLs. Nous proposons donc dans cette thèse de nouvelles solutions, reposant sur une analyse lexicale et sémantique de la composition des noms de domaine et des URLs, pour combattre l’hameçonnage. Ces deux types de pointeurs sont créés et offusqués par les hameçonneurs pour piéger leurs victimes. Ainsi, nous démontrons que les noms de domaine et les URLs utilisés dans des attaques d’hameçonnage présentent des similitudes dans leur composition lexicale et sémantique, et que celles-ci sont différentes des caractéristiques présentées par les noms de domaine et les URL légitimes. Nous utilisons ces caractéristiques pour construire des modèles représentant la composition des URLs et des noms de domaine d’hameçonnage en utilisant des techniques d’apprentissage automatique et des méthodes de traitement du langage naturel. Les modèles construits sont utilisés pour des applications telles que l’identification de noms de domaine et des URLs d’hameçonnage, la notation des URLs et la prédiction des noms de domaine utilisés dans les attaques d’hameçonnage. Les techniques proposées sont évaluées sur des données réelles et elles montrent leur efficacité en répondant aux exigences de vitesse, d’universalité et de fiabilité / Phishing is a kind of modern swindles that targets electronic communications users and aims to persuade them to perform actions for a another’s benefit. Phishing attacks rely mostly on social engineering and that most phishing vectors leverage directing links represented by domain names and URLs, we introduce new solutions to cope with phishing. These solutions rely on the lexical and semantic analysis of the composition of domain names and URLs. Both of these resource pointers are created and obfuscated by phishers to trap their victims. Hence, we demonstrate in this document that phishing domain names and URLs present similarities in their lexical and semantic composition that are different form legitimate domain names and URLs composition. We use this characteristic to build models representing the composition of phishing URLs and domain names using machine learning techniques and natural language processing models. The built models are used for several applications such as the identification of phishing domain names and phishing URLs, the rating of phishing URLs and the prediction of domain names used in phishing attacks. All the introduced techniques are assessed on ground truth data and show their efficiency by meeting speed, coverage and reliability requirements. This document shows that the use of lexical and semantic analysis can be applied to domain names and URLs and that this application is relevant to detect phishing attacks