지속적 실전형 모의훈련을 통한 피싱공격 대응역량 및 행동변화에 관한 연구
A Study on the Change of Capability and Behavior against Phishing Attack by Continuous Practical Simulation Training
0
조회
0
다운로드
5
인용
0
참고문헌
키워드
초록
본 연구는 한 회사에서 실제 업무 중에 있는 임직원들을 대상으로 장기간 여러 차수에 걸쳐 외부 해커들이 공격하는동일한 경로와 방식으로 피싱(phishing)메일을 발송하고, 차수가 경과됨에 따라 메일 수신자들의 피싱 메일에 대한식별능력과 대응행동을 측정하였으며, 훈련 간 부가적으로 외부통제 조건을 변화시켜 수신자들의 대응행동이 추가적으로 어떻게 변화되는지를 분석하였다. 분석결과 단발적 훈련보다는 지속적인 훈련이 임직원들의 피싱메일 식별능력과 감염율 감소에 정(+)의 영향을 주고 있음을 확인하였으며, 사회적 이슈나 시기적 이벤트와 연계한 피싱공격에 더 많은임직원들이 감염이 되며, 감염자에 대한 인사조치와 같은 내부통제정책 강화가 임직원들의 피싱공격 대응행동에 정(+) 의 영향을 주고 있음을 확인할 수 있었다. 이러한 결과에 따라 각 기관이 임직원들의 피싱공격 대응역량 강화를 위한올바른 훈련방향을 제시하고자 한다.
Abstract
This study emulated unscheduled phishing e-mails over a long period of time by imitating the manner in which external hackers attacked a group of employees in a company. We then measured and analyzed the recipient's ability to identify and respond to phishing e-mails as training progressed. In addition, we analyzed the changes in participants' response behavior when changing the external control condition between the training. As a result of the analysis, it was confirmed that the training duration had a positive (+) relationship with the employees' ability to identify phishing e-mails and the infection rate, and more employees read emails and infected with phishing attacks using social issues and seasonal events. It was also confirmed that reinforcement of internal control policy on infected persons affects positively (+) on the phishing attack response behavior of employees. Based on these results, we would like to suggest the right training method for each organization to enhance the ability of employees to cope with phishing attacks.
참고문헌 (26)
- S. Ashraf, "Global Information Assurance Certification Paper" (2005), SANS Institute
- M. Al-Awadi, "Success factors in information security implementation in organizations", IADIS International Conference e-Society (2007)
- S. Al Awawdeh, "An information security awareness program to address common security concerns in IT unit", International Conference on Information Technology, pp.273~278 (2014)
- T. Nikolakopoulos, "Evaluating the human factor in information security", Master, pp.2009
- "Nuclear power hacking is spear phishing" (2014)[URL]
- "Interpark was robbing 10 million personal information by one phishing e-mails impersonating his brother" (2016)[URL]
- P. Kumaraguru, "Lessons from a real world evaluation of anti-phishing training", eCrime Researchers Summit, 2008, pp.1~12 (2008)
- W. G. Anti-Phishing, "Phishing activity trends report 3rd quarter 2016" (2016), Anti-Phishing Working Group
- A. ENISA, "Users’ guide : How to raise information security awareness", ~ (2006)
- T. Carlson, "Information security management : understanding ISO 17799", Lucent Technologies (2001)
- Cha-ho Lim, "Effective information security awareness plan", Journal of The Korea Institute of Information Security & Cryptology, 16(2), pp.30~36 (2006)
- 엄정호, "사이버보안 역량 강화를 위한 맞춤형 사이버훈련체계 개선 방안", 보안공학연구논문지, 12(6), pp.567~580 (2015), 보안공학연구지원센터[DOI]
- 이홍재, "CIPP모형을 활용한 개인정보보호 교육의 효과성 연구: 지방자치단체 공무원의 인식을 중심으로", 지방정부연구, 19(1), pp.95~119 (2015), 한국지방정부학회
- L. James, "Phishing exposed" (2005), Syngress
- "Hackers set up attacks on home PCs, financial firms: study" (2006)[URL]
- S. A. Robila, "Don't be a phish : steps in user education", 38(3), pp.237~241 (2006)
- T. Jagatic, "Social phishing", Communications of the ACM, 50(10), pp.94~100 (2006)
- A. J. Ferguson, "Fostering e-mail security awareness : The West Point carronade", Educase Quarterly, 28(1), pp.54~57 (2005)
- P. Kumaraguru, "Protecting people from phishing : the design and evaluation of an embedded training email system", pp.905~914 (2007)
- Social engineering : A means to violate a computer system, "M. Allen", SANS Institute, ~ (2006)
- Change your company’s culture to combat social engineering attacks, "J. Hiner", ~ (2002)
- D. Timko, "The social engineering threat", Information Systems Security Association Journal (2008)
- M. B. Brewer, "Handbook of research methods in social and personality psychology", pp.3~16 (2000)
- H, "Memory: A contribution to experimental psychology", University Microfilms, (3) (1913)
- "10 tips for spotting a phishing email" (2015)[URL]
- "10 tips on how to identify a phishing or spoofing email" (2015)[URL]