Actionable Recommendations

Cybersecurity Research Series: Spear phishing in a barrel

Since assuming the role of Senior Editor of the Journal of Organizational Computing and Electronic Commerce in January 2018, I have thoroughly enjoyed managing the development of some excellent cybersecurity research papers. A highly proactive review team of distinguished practitioners and academics have helped with the review process and I am forever grateful to them. I plan to share, on an ongoing basis, some actionable recommendations (provided by the lead author) from the accepted papers.

Paper Title: Spear phishing in a barrel: Insights from a targeted phishing campaign

Authors: A. J. Burns, Baylor University; M. Eric Johnson, Vanderbilt University; Deanna D. Caputo, The MITRE Corporation

Accepted for publication in the Journal of Organizational Computing and Electronic Commerce. Forthcoming in 2019.

Actionable Recommendations

  • Train employees to identify phishing emails.

  • Frame training to enhance its personal relevance (e.g., frame in terms of personal loss).

  • Teach employees about adversarial reconnaissance risks.

  • Build herd immunity through enhanced organizational training and communication.

  • Make organizational resources (e.g., training materials, IT help desk attendants) readily available to employees.

  • Create policies and procedures that encourage employees to report phishing attacks.

Cybersecurity Research Series -- Violators versus Non-Violators of Information Security Measures

Since assuming the role of Senior Editor of the Journal of Organizational Computing and Electronic Commerce in January 2018, I have thoroughly enjoyed managing the development of some excellent cybersecurity research papers. A highly proactive review team of distinguished practitioners and academics have helped with the review process and I am forever grateful to them. I plan to share, on an ongoing basis, some actionable recommendations (provided by the lead author) from the accepted papers.

Paper Title: Violators versus Non-Violators of Information Security Measures in Organizations – A Study of Distinguishing Factors

Authors: Habib Ullah Khan, Qatar University; Khalid A. AlShare, Qatar University 

Accepted for publication in the Journal of Organizational Computing and Electronic Commerce. Forthcoming in 2019.

Actionable Recommendations

  • Management needs to communicate and educate employees regarding the organization's IT capability in dealing with information security violations. Non-violators had the impression that their company does have the IT capability to detect violations of information security measures.

  • Organizations should promote an information security culture that emphasizes knowledge sharing and clarity of the information security policy.

  • Make information security rules and measures very clear and simple so they can be easily followed and implemented.

  • Organizations should revisit corrective actions by increasing penalty.

  • Management needs to educate their employees regarding privacy issues such as respecting others privacy and protecting one’s personal information. This could be accomplished by offering training sessions and workshops provided by the experts in the field.

Cybersecurity Research Series -- Cryptojacking Injection

Since assuming the role of Senior Editor of the Journal of Organizational Computing and Electronic Commerce in January 2018, I have thoroughly enjoyed managing the development of some excellent cybersecurity research papers. A highly proactive review team of distinguished practitioners and academics have helped with the review process and I am forever grateful to them. I plan to share, on an ongoing basis, some actionable recommendations (provided by the lead author) from the accepted papers.

Paper Title: Cryptojacking Injection: A Paradigm Shift to Cryptocurrency-based Web-centric Internet Attacks 

Authors: Aaron Zimba, University of Science and Technology Beijing; Zhaoshun Wang, University of Science and Technology Beijing; Mwenge Mulenga,Mulungushi University, Zambia.

Accepted for publication in the Journal of Organizational Computing and Electronic Commerce. Forthcoming in 2019.

Actionable Recommendations

  • Incorporate cryptojacking in the risk and threat analysis of the overall cybersecurity assessments of the organization.

  • Incorporate cryptojacking security awareness in user training, focusing on looking for signs of crypto mining and phishing-type attempts that seek to load crypto mining JavaScript onto endpoint devices.

  • In network-based mitigation strategies, network forensics artifacts should be used as IOCs, while unusual computer behavior patterns and observable characteristics should be used as IOCs in host-based mitigation strategies.

  • For personal computers such as laptops and mobile tablets, add-blockers and anti-crypto mining extensions or plugins can be used to prevent browser-based crypto-mining.

  • The CISO can take a proactive role to find crypto mining C2 servers IPs and domains and confirm them with reputed security sources and blacklist them from the production network.

  • The CISO can take a proactive lead to enforce security policies that will filter URLs harboring crypto mining JavaScript code (and crypto mining associated files) from the production network.

    Accepted Papers

    Kabanda, S., Tanner, M. and Kent, C. “Exploring SME cybersecurity practices in developing countries,” Journal of Organizational Computing and Electronic Commerce, Vol 28, Issue 3, 2018

    Khan, H.U. and Alshare, K.A. “Violators versus non-violators of information security measures in organizations – A study of distinguishing factors,” Journal of Organizational Computing and Electronic Commerce Forthcoming 2019

    Zimba, A., Wang, Z., and Mulenga, M. “Cryptojacking Injection: A Paradigm Shift to Cryptocurrency-based Web-centric Internet Attacks,” Journal of Organizational Computing and Electronic Commerce Forthcoming 2019

    Burns, A.J., Johnson, E.M., and Caputo, D.D. “Spear Phishing in a Barrel: Insights from a Targeted Phishing Campaign,” Journal of Organizational Computing and Electronic Commerce Forthcoming 2019