Understanding phishing discussions on stack overflow and information security stack exchange

Area of Science:

• Cybersecurity
• Human-Computer Interaction
• Software Engineering

Background:

• Phishing is a persistent cybersecurity threat impacting organizations and individuals.
• Understanding how technically skilled users perceive and react to phishing is crucial for effective defense.
• Existing research often focuses on end-users, with less attention on developers' perspectives.

Purpose of the Study:

• To investigate the concerns, pain points, and investigative practices of developers and security professionals regarding phishing.
• To analyze discussions on Stack Overflow (SO) and Information Security (IS) Stack Exchange to understand their engagement with phishing threats.
• To develop a framework for understanding developer activities in combating phishing.

Main Methods:

• Qualitative analysis of 140 phishing-related questions from SO and IS Stack Exchange.
• Inductive open coding to identify themes and patterns in discussions.
• Development of the Developer Phishing Engagement Framework categorizing activities into prevention, detection, mitigation, and planning.

Main Results:

• Stack Overflow discussions emphasize implementation challenges, false positives, and defense usability.
• Information Security Stack Exchange discussions focus on post-incident analysis, impact, and ethical aspects of phishing simulations.
• Developers exhibit a strong threat awareness but encounter workflow disruptions due to inconsistent policies and tool opacity.

Conclusions:

• The Developer Phishing Engagement Framework offers a developer-centric view complementing user-focused models.
• Findings provide insights for creating more effective anti-phishing tools, training programs, and organizational policies.
• Addressing workflow friction is key to enhancing developers' ability to combat phishing effectively.