A Design for an Anti-spear-phishing System Aycock

Phishing is a widespread and effective computer-mediated social attack. Phishers have proven highly adaptable in terms of exploiting new communications channels – witness ‘vishing’ and ‘SMiShing’ – and are becoming increasingly sophisticated. At the same time, research has shown that current anti-phishing measures are less than adequate. One concern in terms of malicious software is targeted attacks; the phishing equivalent is ‘spear phishing’, where a phishing attack is directed at a specific organization or even individuals. Spear phishing may present users with some difficult decisions regarding the authenticity of messages. We propose a design for an anti-spear-phishing system to help users in this regard, which will take advantage of the characteristics of spear phishing to detect such targeted attacks. The system we propose would work at two levels: a global level and an institutional level. We conjecture that taking these indicators together will yield an effective defence against spear phishing.