Assessment of Spear Phishing User Experience and Awareness: An Evaluation Framework Model of Spear Phishing Exposure Level (SPEL) in the Namibian Financial Industry

Abstract

Social engineering has become a major threat to organisations’ IT systems. Users are normally the weakest links in security chains and they put their organisations at risk of internet attacks through various social engineering tricks implemented by online criminals. One of the thriving electronic social engineering attacks that is increasingly targeting electronic banking systems and users is spear phishing attack. Consequently, this research assessed user experience and awareness by evaluating users’ abilities to detect if a specific email is spear phishing. Moreover, the research proposes an evaluation framework for an effective assessment of the organisations’ exposure level to spear phishing threat. In the SPEL evaluation framework, two information security frameworks (ISO27001:2013) and (NIST SP 800 -53) were applied to identify threat vital signs within the organisation, whereas the Protection Motivation Theory (PMT) theory was used in the identification of the user vulnerability signs.