Abstract:Chief executive officers (CEOs) can turn out to be the weakest link to an organization’s security and attackers know that if they successfully exploit or impersonate someone who has a high level of access like CEOs or chief finance officers (CFOs), they instantly gain great advantage. The problem comes when attacker manages to take control of email accounts of the CEOs and CFOs and sends an email to another staff in the organization, he/she is likely to take it seriously, act accordingly and quickly as possible, and may be wire cash to an account directed by the “CEO/CFO,” and/or get away with private or sensitive corporate information. Because of the nature of these attack methods, detection and protection are very difficult since the attackers take advantage of the human weakness which is the weakest link. The main aim of this study is to provide a solution to protect every surface of the organization. By developing a human firewall, working with the already existing technical solutions offers the solution to remaining problem of human weakness. This research developed a simulator to train the users with the latest trends the attackers are using making them do it right (flagging, reporting, not clicking suspicions links) and making email security part of their responsibility. This makes employee become human firewall. The results from the simulator are displayed in charts as number of employees who passed the test, number of employees who will click on the malicious links, number of employees who will download the dangerous attachments, number of employees who will reply to phishing emails, average awareness of the organization, and how individual employees performed. While organizations have made progress over the years, security is a never-ending process that requires improvement day by day. Since no one in the organization’s structure is immune including the top most in the cadre (i.e., CEO), complexity in understanding and awareness creation is more wanting than before. Integrating human firewall into existing security measures as the last line of defense in email communication against business email compromise frauds offers this solution because it has preventive as well as reactive measures both geared toward maximizing email security. A simulation of the attacks to analyze the user involvement to breaching the security followed by an evaluation simulation after integrating human firewall to the organization’s email security shows success level. The results from the test show the different success levels, that is, results from pre-assessment definitely show low success level since staff/employees have not been made aware/trained to profile or flag compared to when the employees/staff have gone through the training/awareness. Post-assessment indicates high success level because actions from employees turned into human firewall know how to take proper action, for example, flagging, not clicking malicious links. The organization should update its policies to accommodate and reinforce rules on the employees to ensure that the tool is used regularly and actions taken on user deemed a threat to the organizational email security.

Beyond Technical Barriers: A Multidimensional Conceptual Framework for Understanding and Countering Cyber Scam Susceptibility

Assessment of Cybersecurity Risks and threats on Banking and Financial Services

Seeing Beyond the Surface, Understanding and Tracking Fraudulent Cyber Activities

Framework for Mitigating Phishing E-mail in the Kenyan Banking Industry Using Artificial Intelligence (AI)

Discover and Automate New Adversarial Attack Paths to Reduce Threat Risks for The Security of Organizations

Reviewing Cyber Security Social Engineering Training and Awareness Programs—Pitfalls and Ongoing Issues

Navigating Cybersecurity Training: A Comprehensive Review

Internet-Based Social Engineering Psychology, Attacks, and Defenses: A Survey

Cyber Security Threats and Countermeasures in Digital Age

Mitigation Techniques for Cyber Attacks: A Systematic Mapping Study

Internet-based Social Engineering Attacks, Defenses and Psychology: A Survey

A Comprehensive Review of Cyber Security Vulnerabilities, Threats, Attacks, and Solutions

Human Firewall Simulator for Enhancing Security Awareness against Business Email Compromise

Integration of Cybersecurity, Usability, and Human-Computer Interaction for Securing Energy Management Systems

Factors Affecting Cybersecurity Awareness among University Students

A Comprehensive Study of Cybersecurity Threats and Countermeasures: Strategies for Mitigating Risks in the Digital Age

Quantifying Psychological Sophistication of Malicious Emails

Counterattacking Cyber Threats: A Framework for the Future of Cybersecurity

Exploring Cybercriminal Activities, Behaviors and Profiles

Understanding motivations and characteristics of financially-motivated cybercriminals

Educating and Raising Awareness on Cyber Security Social Engineering: A Literature Review