A Human Firewall Simulator for Enhancing Security Awareness against Business Email Compromise
Abstract/ Overview
Cybercriminals exploit the weakest link in an organization's security, targeting CEOs or CFOs through business email compromise, or CEO fraud. These attacks primarily involve social engineering, tricking employees into committing security-compromising acts. Cybercriminals often pose as senior executives or vendors, transferring money, publishing private data, or installing malware. The impact of these attacks is significant, causing businesses financial setbacks, reputational damage, and legal repercussions. The attacks can lead to CEO fraud, email account compromise, and other security-compromising acts. Despite the importance of technology defenses, human involvement remains crucial in the success or failure of attacks like Business Email Compromise (BEC), which exploits human weaknesses and poses a significant threat to enterprises. The research introduces the Human Firewall Simulator, an interactive training tool designed to enhance security awareness by allowing staff to detect and respond to (BEC) threats. This dynamic platform allows employees to interact with real-world scenarios and engage in active learning beyond traditional classrooms. The simulator is the methodological approach that offers immediate feedback and guidance for correct decision-making, promoting an iterative learning process and extending beyond conventional awareness training by addressing the need for contextualized, customized, and adaptable approaches. Participants are tested on identifying fraudulent emails and suspicious behaviors through scenarios resembling real-world BEC tactics. The simulator uses data collection and analysis to study participant behaviors, identifying susceptibility patterns and progress over time. This data-driven insight improves training modules and targeted interventions, enhancing security awareness programs' effectiveness. A simulated assessment of email security attacks revealed a low success level in pre-assessment due to lack of awareness and training for employees. However, post- assessment showed a high success level, as employees turned into human firewalls took proper actions, such as flagging and not clicking malicious links. This suggests that training and awareness programs can significantly improve email security in organizations. The organization should update its policies to accommodate and reinforce rules for employees to ensure that the tool is used regularly and actions taken by users are not deemed a threat to organizational email security. In the end, the Human Firewall Simulator fosters a vigilant culture within enterprises. Participants leave with a better understanding of threats, stronger reaction skills, and a sense of empowerment regarding BEC attack defense. In order to reduce the growing threats posed by BEC in the digital era, this research pioneers a unique paradigm in cybersecurity education that embraces experiential learning, personalization, and adaptive training approaches.