Towards an Empirical Study to Determine the Effectiveness of Support Systems against E-Mail Phishing Attacks

E-mail phishing attacks are still the number one gateway for attackers. Even when the patch level of a network is up to date, if one employee clicks on a link in a phishing e-mail and enters their credentials on a malicious website or downloads malware, the whole organization might get compromised. Anti-phishing support systems highlight different aspects of an e-mail to help users to detect phishing e-mails. However, little is known about their effectiveness, especially in comparison to each other. This paper presents our experimental design to investigate the efficacy of various support systems. For this purpose, we created a fictional scenario and an interactive tool to display e-mails. In addition, we present our preliminary study with the first results to classify test e-mails in different difficulty levels that serve as a basis for our main study.