Phish Scale: Weighing the threat from email scammers
Connecting state and local government leaders
The National Institute of Standards and Technology’s Phish Scale quantifies characteristics of phishing emails that are likely to trick users.
To help chief information security officers train employees not to click on links in increasingly sophisticated phishing emails, the National Institute of Standards and Technology has developed a tool that quantifies an email’s likelihood of tricking users.
Although users can usually spot phishing emails that are contextually irrelevant or similar to samples they’ve already seen, they are, despite years of training, still likely to fall for schemes that seem relevant to their work environment.
NIST’s Phish Scale classifies emails based on how easy or difficult it is to detect potential attacks. It looks at two components of phishing emails: observable cues in the message content like misspellings, generic greetings, unprofessional appearance or requests for sensitive information. It also considers how the scenario described in the email aligns with the user’s job or current events.
Scenario elements of a phishing email -- such as mimicking a common workplace process, referencing current events or warning of consequences of inaction from a supervisor – are rated on a five-point scale and combined with the number of observed cues in the message text to get a final Phish Scale score.
High scoring emails generally have fewer text-based clues and more relevant context, making it harder for users to identify the lures CISOs most want employees to be able to avoid.
With the Phish Scale, CISOs can get a better understanding of why staff can spot phishing lures in some emails and not in others. It also helps them make their phishing exercises more effective.
When developing the Phish Scale, the researchers drew on data from unannounced phishing exercises at NIST. In one exercise targeting NIST laboratory staff, a personalized email appearing to come from a NIST director’s gmail account with the subject line of “PLEASE READ THIS” urged recipients to click on a link purportedly containing safety requirements.
Out of a possible 32 points on the Phish Scale, this email earned 30 points because it mimicked a workplace practice, was highly relevant to recipients, aligned with other workplace events and engendered concern over not clicking, the researchers said in their paper.
As phishing attacks grow more sophisticated, sometimes leveraging stolen credentials or personal information, it’s all the more important for CISOs to better understand phishing attacks and improve awareness training.
“The Phish Scale is intended to help provide a deeper understanding of whether a particular phishing email is harder or easier for a particular target audience to detect,” said NIST researcher Michelle Steves. The tool can help explain why click rates from training exercises are high or low.
“Ultimately, we hope our Phish Scale can be used to help CISOs better understand and characterize their organization’s phishing risk, by essentially profiling the types of phishing premises their users are more or less susceptible to as well as the organization’s actual threats,” NIST officials concluded. “Such data can be used to prioritize training efforts on more targeted interventions, and to prioritize investigative efforts for real-world suspected phishes.”
NEXT STORY: 6 ways mail-in ballots are protected from fraud