Human?centered cybersecurity risks constitute a significant portion of the hazards facing any modern institution. Recent high profile data security breaches such as the equifax and facebook scandals…

Human?centered cybersecurity risks constitute a significant portion of the hazards facing any modern institution. Recent high profile data security breaches such as the equifax and facebook scandals are currently highlighting the need for a broad understanding of basic cybersecurity among both professionals and the average citizen. More locally, fairmont state university (FSU) has experienced an uptick in the volume of phishing attempts against students, faculty, and staff in recent months. This project will give four to six talented cybersecurity and mathematics students at FSU the opportunity to analyze social engineering attacks. The project will utilize statistics and machine learning techniques to analyze cybersecurity data. Pending FSU institutional review board approval, an experiment will also be conducted that will test vulnerability to phishing e?mails, vulnerability to USB drops, and the effectiveness of certain kinds of training on preventing further potential security breaches. Phishing and other types of social engineering are a common way that malicious entities obtain private information. A USB?drop experiment was conducted at university of illinois at urbana?champaign ([tischer 2016] [tischer 2017]) where USB drives were distributed on a university campus which contained files that connected to an external website run by the researchers to collect data. By connecting to the website, information about the browser and hardware of the individual was automatically collected. The website also directed the person who opened the file to a voluntary survey for more personal information. Their results suggest that people on a university campus will not only plug in foreign USB drives, but they will also actually open files on them at a high rate. The effectiveness of phishing training is a heavily studied topic. There are many studies that examine training to counteract phishing ([mayhorn 2010], [siadatii 2017], [kumaraguru 2010]). Training can come in many types, e.g. security training meetings, training embedded into fake phishing e?mails themselves, training via games, and routine reports sent that describe recent phishing e?mail attempts. For an institution like FSU, the damage that can be done by these threats is limited largely to the personal data of employees and students. These issues are heightened for a federal agency like NASA which has national security interests to consider. Moreover, since there is an intersection of personnel between FSU and NASA IV & v, the results of an experiment on FSU campus is naturally interesting to both institutions.