TWC SBE: Small: Building the human firewall: Developing organizational resistance to semantic security threats

语义攻击是其他人通过模仿来自可信来源的电子通信来窃取有价值信息的努力。语义攻击的一个常见示例是网络钓鱼，其中网络钓鱼者向潜在目标发送未经请求的消息。当目标个人响应时，网络钓鱼者就会从个人那里窃取有价值的信息。语义攻击通过已建立的通信渠道（例如，电子邮件、社交媒体）并且难以与合法消息区分。虽然大量的注意力集中在培训和提高个人对语义攻击风险的敏感性上，但很少有研究关注组织可能用于协调组织成员之间的防御行动的策略。这项研究将专业知识整合到理论驱动的项目设计中，并使用多种研究方法，包括调查，访谈和实验，以调查组织如何建立针对语义攻击的人类防火墙。该项目为理解如何开发组织对语义攻击的抵抗力做出了新的重要贡献。为此，本研究的第一阶段将采用一项调查和一系列的行业从业者访谈，定量和定性评估组织目前采用的战略，以应对语义攻击。除了对语义攻击防御的当前技术水平产生重要见解外，这些发现还将指导第二阶段和第三阶段的实验研究。在第二阶段，包括众包、游戏化和第一阶段确定的其他策略在内的策略将在一系列受控实验中进行测试，以检查它们在利用组织成员的能力和注意力来对抗语义攻击方面的有效性。项目第三阶段的目的是审查第二阶段确定的有希望的战略的设计和执行情况。这一阶段的目标是了解如何使最多的人采用和遵循每一项战略，以巩固这些战略提供的任何保护。同样，在这一阶段将使用受控实验，我们将检查个人层面的变量，以了解如何鼓励采用。通过利用综合的、多方法的方法来解决日益严重的语义攻击问题，我们提案中概述的一系列研究将为未来的研究和传播服务于公共利益的经验教训提供新的理论和模型。知识价值：通过识别和系统地测试组织战略的有效性来开发新知识，以应对语义攻击。依靠众包和集成游戏化和其他技术来对抗语义攻击的组织范围的策略提供了一种开发人类防火墙的新方法，其中个人作为集体而不是个人来对抗这些语义攻击。通过研究有效战略的共同解释，我们不仅可以提供有效的战略，还可以提供其有效性的基本理论，这将成为未来组织应对安全威胁的创新的基础。这里开发的研究框架也可能是相关的研究缓解其他安全威胁，除了语义攻击。 更广泛的影响：这项研究的结果可能也有一些重要的实际意义，教育组织领导者和公众有关战略，以应对语义攻击。为了传播这项研究的结果，我们计划举行两次从业人员会议，并开发一个公共服务网站，我们将在其中讨论在项目期间吸取的教训。此外，该网站将提供基础数据，访问研究报告，并由该项目产生的教育计划。进行实验所需的理论和方法背景的结合将大大有助于研究生和本科生研究助理的研究培训。最后，项目成果将通过专业演讲和出版物进行分享。

Semantic attacks are efforts by others to steal valuable information by imitating electronic communications from a trustworthy source. A common example of a semantic attack is phishing where a phisher sends unsolicited messages to potential targets. When a targeted individual responds, the phisher then steals valuable information from the individual. Semantic attacks flow through established channels of communication (e.g., email, social media) and are difficult to distinguish from legitimate messages. While a great deal of attention has focused on training and sensitizing individuals to the risks of semantic attacks, little research has focused on strategies that organizations might use to coordinate defensive actions among organization members. This research integrates expertise in a project design that is theory-driven and uses multiple research methods, including surveys, interviewing, and experimentation to investigate how organizations can build a human firewall against semantic attacks. The project holds strong promise for making new and important contributions to understanding how to develop organizational resistance to semantic attacks. To this end, the first stage of this research will employ a survey and series of interviews with industry practitioners to quantitatively and qualitatively assess the strategies that organizations currently employ to counter semantic attacks. In addition to generating important insights about the current state of the art in semantic attack defense, the findings will guide experimental studies during stages two and three. During stage two, strategies including crowdsourcing, gamification, and other strategies identified during stage one will be tested in a series of controlled experiments to examine their effectiveness in harnessing the abilities and attention of organization members to counter semantic attacks. The third stage of the project aims to examine the design and execution of promising strategies identified in stage two. The objective of this stage will be to learn how each strategy can be adopted and followed by the greatest number of people so as to solidify any protection the strategies offer. Again, controlled experimentation will be used during this stage and we will examine individual-level variables to understand how to encourage adoption. By leveraging an integrated, multi-method approach to the growing problem of semantic attacks, the series of studies outlined in our proposal will lead to new theories and models for future research and dissemination of lessons learned serving public interests.Intellectual Merit: New knowledge will be developed by identifying and systematically testing the efficacy of organizational strategies for countering semantic attacks. The organization-wide strategies that rely on crowdsourcing and integrate gamificiation and other techniques to counter semantic attacks offer a novel approach to developing the human firewall where individuals fight these semantic attacks as a collective rather than as individuals. By examining shared explanations for effective strategies, we would contribute not only effective strategies but the underlying theory for their effectiveness, which would serve as the foundation of future innovations in organizational responses to security threats. The research framework developed here may also be relevant to studying the mitigation of other security threats in addition to semantic attacks. Broader Impacts: Findings from this research are likely to also have a number of important practical implications for educating organizational leaders and the general public about strategies for countering semantic attacks. To disseminate findings from this research, we plan to hold two practitioner meetings and develop a public service website in which we will discuss the lessons learned during the project. Additionally, the website will provide base data, access to research reports, and educational programs produced by this project. The combination of theoretical and methodological backgrounds required to conduct the experiments will contribute immeasurably to the research training of graduate and undergraduate research assistants. Finally, project results will be shared through professional presentations and publications.