Dataset Information

Evaluation of a mandatory phishing training program for high-risk employees at a US healthcare system.

ABSTRACT: OBJECTIVE:The study sought to understand the impact of a phishing training program on phishing click rates for employees at a single, anonymous US healthcare institution. MATERIALS AND METHODS:We stratified our population into 2 groups: offenders and nonoffenders. Offenders were defined as those that had clicked on at least 5 simulated phishing emails and nonoffenders were those that had not. We calculated click rates for offenders and nonoffenders, before and after a mandatory training program for offenders was implemented. RESULTS:A total of 5416 unique employees received all 20 campaigns during the intervention period; 772 clicked on at least 5 emails and were labeled offenders. Only 975 (17.9%) of our set clicked on 0 phishing emails over the course of the 20 campaigns; 3565 (65.3%) clicked on at least 2 emails. There was a decrease in click rates for each group over the 20 campaigns. The mandatory training program, initiated after campaign 15, did not have a substantial impact on click rates, and the offenders remained more likely to click on a phishing simulation. DISCUSSION:Phishing is a common threat vector against hospital employees and an important cybersecurity risk to healthcare systems. Our work suggests that, under simulation, employee click rates decrease with repeated simulation, but a mandatory training program targeted at high-risk employees did not meaningfully decrease the click rates of this population. CONCLUSIONS:Employee phishing click rates decrease over time, but a mandatory training program for the highest-risk employees did not decrease click rates when compared with lower-risk employees.

SUBMITTER: Gordon WJ

PROVIDER: S-EPMC6515532 | biostudies-literature | 2019 Jun

REPOSITORIES: biostudies-literature

ACCESS DATA

Publications

Evaluation of a mandatory phishing training program for high-risk employees at a US healthcare system.

Gordon William J WJ Wright Adam A Glynn Robert J RJ Kadakia Jigar J Mazzone Christina C Leinbach Elizabeth E Landman Adam A

Journal of the American Medical Informatics Association : JAMIA 20190601 6

<h4>Objective</h4>The study sought to understand the impact of a phishing training program on phishing click rates for employees at a single, anonymous US healthcare institution.<h4>Materials and methods</h4>We stratified our population into 2 groups: offenders and nonoffenders. Offenders were defined as those that had clicked on at least 5 simulated phishing emails and nonoffenders were those that had not. We calculated click rates for offenders and nonoffenders, before and after a mandatory tr ...[more]

PMID: 30861069

Similar Datasets

Project description:BACKGROUND:Hospitals have been one of the major targets for phishing attacks. Despite efforts to improve information security compliance, hospitals still significantly suffer from such attacks, impacting the quality of care and the safety of patients. OBJECTIVE:This study aimed to investigate why hospital employees decide to click on phishing emails by analyzing actual clicking data. METHODS:We first gauged the factors that influence clicking behavior using the theory of planned behavior (TPB) and integrating trust theories. We then conducted a survey in hospitals and used structural equation modeling to investigate the components of compliance intention. We matched employees' survey results with their actual clicking data from phishing campaigns. RESULTS:Our analysis (N=397) reveals that TPB factors (attitude, subjective norms, and perceived behavioral control), as well as collective felt trust and trust in information security technology, are positively related to compliance intention. However, compliance intention is not significantly related to compliance behavior. Only the level of employees' workload is positively associated with the likelihood of employees clicking on a phishing link. CONCLUSIONS:This is one of the few studies in information security and decision making that observed compliance behavior by analyzing clicking data rather than using self-reported data. We show that, in the context of phishing emails, intention and compliance might not be as strongly linked as previously assumed; hence, hospitals must remain vigilant with vulnerabilities that cannot be easily managed. Importantly, given the significant association between workload and noncompliance behavior (ie, clicking on phishing links), hospitals should better manage employees' workload to increase information security. Our findings can help health care organizations augment employees' compliance with their cybersecurity policies and reduce the likelihood of clicking on phishing links.

Project description:BackgroundThe Coronavirus Disease 2019 (COVID-19) has severely challenged healthcare delivery systems worldwide. Healthcare Workers were unable to assess and manage the cases due to limited knowledge of treating the virus and inadequate infrastructure. Digital interventions played a crucial role in the training of healthcare workers to get through the pandemic. Project Extension for Community Healthcare Outcomes (ECHO) initiated the COVID-ECHO telementoring program for strengthening the knowledge and skills of healthcare workers. The study aimed at assessing the effects of the ECHO telementoring model in the capacity building of healthcare workers in the context of COVID-19 in India.MethodWe adopted a mixed-method approach with a parallel combination design. A quantitative survey was used to measure changes in the knowledge and self-efficacy among doctors and nurses. In-depth Interviews were used for qualitative exploration of perceptions and experiences of all the study participants. Student t-test and ANOVA were used to assess significant differences between mean scores across participant characteristics for different themes. Statistical significance was set at p < 0.05. In-depth Interviews were analyzed using Framework Analysis. The evaluation followed the first five levels of Moore's model.ResultsThe results highlighted the strengthening of knowledge and skills of healthcare workers in the assessment and management of COVID-19 after the ECHO training. Learning and performance ratings were high as 96% reported an increase in knowledge and 98% were able to apply it in their clinical practices. The key challenges identified were technical issues like internet connectivity and lack of interaction due to limited visual connection. The hybrid sessions, use of video camera, feedback mechanism, and inclusion of Continuing Medical Education were recommended by participants to improve the model.ConclusionsThe findings of this study are an important addition to the pre-existing literature supporting the replicability of the ECHO model in the upskilling of healthcare professionals working in underserved and remote areas, not only in the context of COVID-19 but also in other public health domains. To enhance the effectiveness of this ECHO model, the study findings may be used to refine the model and improve the areas of concern.

Project description:BackgroundAthletic training rooms have a high prevalence of bacteria, including multidrug-resistant organisms, increasing the risk for both local and systematic infections in athletes. There are limited data outlining formal protocols or standardized programs to reduce bacterial and viral burden in training rooms as a means of decreasing infection rate at the collegiate and high school levels.HypothesisAdaptation of a hygiene protocol would lead to a reduction in bacterial and viral pathogen counts in athletic training rooms.Study designCohort study.Level of evidenceLevel 3.MethodsTwo high school and 2 collegiate athletic training rooms were studied over the course of the 2017-2018 academic year. A 3-phase protocol, including introduction of disinfectant products followed by student-athlete and athletic trainer education, was implemented at the 4 schools. Multiple surfaces in the athletic training rooms were swabbed at 4 time points throughout the investigation. Bacterial and viral burden from swabs were analyzed for overall bacterial aerobic plate count (APC), bacterial adenosine triphosphate activity, influenza viral load, and multidrug-resistant organisms such as methicillin-resistant Staphylococcus aureus (MRSA) and vancomycin-resistant enterococcus (VRE).ResultsOverall bacterial load, as measured by APC, was reduced by 94.7% (95% CI, 72.6-99.0; P = 0.003) over the course of the investigation after protocol implementation. MRSA and VRE were found on 24% of surfaces prior to intervention and were reduced to 0% by the end of the study. Influenza was initially detected on 25% of surfaces, with no detection after intervention. No cases of athletic training room-acquired infections were reported during the study period.ConclusionA uniform infection control protocol was effective in reducing bacterial and viral burden, including multidrug-resistant organisms, when implemented in the athletic training rooms of 2 high schools and 2 colleges.Clinical relevanceA standardized infection control protocol can be utilized in athletic training rooms to reduce bacterial and viral burden.

Dataset Information

Evaluation of a mandatory phishing training program for high-risk employees at a US healthcare system.

Publications

Evaluation of a mandatory phishing training program for high-risk employees at a US healthcare system.

Similar Datasets

OmicsDI is part of the ELIXIR infrastructure

Tweets