Experimental Evaluation of Phishing Attack on High School Students

The effectiveness of phishing attacks is being analyzed by many researchers. At the same time, researches often deal with the random sample of people suffered a phishing attack and are limited with analysis of consequences of unrelated cases without conducting an actual phishing experiment. Experiments typically involve a small number of respondents. The novelty of present study is to analyze the educational institution’ susceptibility to phishing attack. Authors demonstrate a methodology of creating a group of targets homogeneous in age, place of study, level of knowledge and to conduct an experiment on a large group of respondents (3,661 people). The methodology of gathering and filtering of email addresses using open sources of information is explained. Emotionally neutral text of a phishing email to minimize the deceptive effect of the letter was formulated. The experiment showed the success rate of the attack on a large sample of students at 10.8%, and demonstrated the vulnerability of the educational institution’s infrastructure to the hidden preparation and conduct of the attack. Novelty of methodology includes use of a phishing letter that includes a questionnaire to gather statistics on responders’ awareness of phishing nature. It made possible to compare respondents’ beliefs with the real susceptibility to phishing based on sensitive data they provided in return to the phishing letter. We show how the data collected by phishing can be personalized and conclude that respondents need further training to detect phishing attacks. We also argue necessary organizational, infrastructural measures, recommendations of necessary mail server configuration changes