Reinforcing Cybersecurity Awareness through Simulated Phishing Attacks: Findings from an HEI Case Study

Cybersecurity represents a critical challenge in the protection of educational institutions' digital assets and the sensitive data they hold. Phishing attempts are exploiting user vulnerabilities at an alarming rate, in a context defined by a substantial increase in internet usage and in the personal information shared online. Preliminary findings suggest a varying degree of security literacy, indicating the need for targeted educational interventions. The Technical University of Cluj-Napoca's digital ecosystem encompasses over 20,000 users, including students, faculty, and administrative staff. In November 2023, an attack simulation was conducted through the configuration of various attack scenarios using social engineering techniques via Office 365's educational services. Including elements such as deceptive emails and fraudulent login pages, the initiative aimed to observe phishing behaviours closely. The simulation campaign captured quantitative data on click rates, report rates, and feedback on user confidence and perceived difficulty of the phishing attempts. Furthermore, it engaged participants in reflective practices, enabling the identification of potential improvements in individual and institutional cybersecurity protocols. Training-related data was collected and synthesized from users who exhibited varying rates of compromise. Such a simulation can reveal a broad overview of the ecosystem's vulnerabilities, offering critical insights into the users' level of readiness to counter such threats and fostering a culture of continuous monitoring against cyberattacks. Strategic implications for the structuring of cybersecurity education in higher education institutions are envisioned, along with the development of customized, adaptive learning modules that envision to identified skill gaps and strengthen the overall resilience of the digital infrastructure (Abstract)