Phishing is when social engineering is used to deceive a person into sharing sensitive information or downloading
malware. Research on phishing susceptibility has focused on personality traits, demographics, and design factors related to the presentation of phishing. There is very little research on
how a person’s state of mind might impact outcomes of phishing attacks. We conducted a scenario-based in-lab experiment with 26 participants to examine whether workload affects risky cybersecurity behaviours. Participants were tasked to manage 45 emails for 30 minutes, which included 4 phishing emails.
We found that, under high workload, participants had higher
physiological arousal and longer fixations, and spent half as much
time reading email compared to low workload. There was no main effect for workload on phishing clicking, however a post-hoc analysis revealed that participants were more likely to click on
task-relevant phishing emails compared to non-relevant phishing emails during high workload whereas there was no difference during low workload. We discuss the implications of state of mind and attention related to risky cybersecurity behaviour
The Behavior Grid: 35 ways behavior can change
This paper presents a new way of categorizing behavior change in a framework called the Behavior Grid. This...