Phishing simulation exercise in a large hospital: A case study.

Area of Science:

• Cybersecurity in Healthcare
• Human Factors in Information Security

Background:

• Phishing poses a significant threat to healthcare organizations, exploiting human vulnerabilities.
• Phishing simulations are crucial for assessing and improving an organization's human defenses against cyberattacks.
• Factors like staff fatigue and message design influence the detectability of phishing attempts.

Purpose of the Study:

• To evaluate the effectiveness of phishing simulations in a large Italian hospital.
• To compare staff responses to general versus customized phishing emails.
• To identify challenges and best practices for conducting ethical phishing simulations in healthcare settings.

Main Methods:

• A major Italian hospital with over 6000 staff conducted three phishing simulation campaigns.
• Campaigns were spaced approximately four months apart.
• The study compared staff reactions to general phishing emails versus those customized to the organization.

Main Results:

• Customized phishing emails significantly increased staff engagement compared to general ones.
• A higher percentage of staff clicked on customized phishing emails (62%) versus general ones (36%).
• The study encountered organizational issues that impacted the intended execution of the campaigns.

Conclusions:

• Phishing simulations are valuable tools for identifying security weaknesses but require expertise for effective implementation.
• Successful simulations necessitate organizational coordination, precise timing, and minimal staff awareness beforehand.
• Personalizing phishing messages to current events enhances effectiveness but carries risks of staff backlash; lessons learned can benefit other hospitals.