A Case Study of Phishing Incident Response in an Educational Organization

Key finding

Handling phishing reports is a distributed process across several teams, each with narrow system access and knowledge. Sudden large campaigns flooded the help desk with reports, disrupting work and slowing mitigations and reflection.

Why it matters

Reminds programs that encouraging reporting only helps if the back end can process reports and close the feedback loop.

Informs

• Makes reporting one click and staffs triage for surges supports

Cite

Althobaiti, K., Jenkins, A. D. G., & Vaniea, K. (2021). A Case Study of Phishing Incident Response in an Educational Organization. Proceedings of the ACM on Human-Computer Interaction (CSCW). https://doi.org/10.1145/3476079