Breakthrough in Cybersecurity Is No Phish Story

UB researcher develops SCAM model to explain why people fall for spear phishing

Newswise, April 14, 2016 – Corporations, small businesses and public sector entities have tried unsuccessfully for years to educate consumers and employees on how to recognize phishing emails, those authentic-looking messages that encourage users to open a cloaked, though malicious, hyperlink or attachment that appears harmless.

In casual conversation, the problem sounds like a nuisance; on balance sheets, however, it’s monstrous. The estimated financial tally from information loss, identity theft, service disruptions and additional security costs related to phishing exceeds $1 trillion. In fact, phishing accounts for more than one-third of the nearly 800 percent increase in cybercrimes since 2007, according to the Government Accountability Office.

The problem appears unstoppable, but a University at Buffalo cybersecurity expert may have finally hooked the phish that existing training methods have so far been unable to land.

Arun Vishwanath, an associate professor in the Department of Communication at UB, whose research specializes in how to stop online deception, has developed a groundbreaking comprehensive model that, he says, for the first time accounts for the multiple influences that contribute to the success of these attacks.

Vishwanath’s model is a breakthrough in understanding why people fall for these schemes and could finally tilt phishing’s dynamic from successful deception to effective detection.

The study, published in the latest issue of journal Communication Research, proposes and empirically tests a theory-based model that identifies specific user vulnerabilities that arise in a given user.

“When I talk to cybersecurity experts in companies or even in the U.S. government — and I’ve presented this to many of them — I’m told that the model provides a ready framework to understand why their employees fall prey to such attacks,” says Vishwanath.

“This is so important.”

The model encourages a new approach to training that is based on individual, predictive profiles of computer users, rather than relying on the current blanket training approach for everyone, a method that previous research has shown to be of limited effectiveness because people are often victimized hours after they’ve finished their training, according to Vishwanath.

“Using this model, organizations can come up with a dynamic security policy, one that takes into account employee cyber-behaviors and allows access to systems, software and devices based on these behaviors,” he says. “It can also be used to develop a risk-index that assesses the overall risk threshold of individuals and groups.”

Vishwanath’s study, which is part of a larger research program to understand the people-problems of cybersecurity, tested the model by actually simulating different types of phishing attacks on real-world subjects.

“Calling people into a lab doesn’t work for this kind of research because there is a heightened sense of awareness,” he says. “Subjects in labs look at a screen and are asked if they believe they’re looking at a phishing email. In reality, most people don’t focus on emails and appear to be far less suspicious and far more susceptible than when they are in a lab.

“Methodologically, the premise I work with is that we have to play the role of the ‘bad guys’ in order to study how and why people are victimized.”

The Suspicion, Cognition and Automaticity Model (SCAM) explains what contributes to the origin of suspicion by accounting for a user’s email habits and two ways of processing information: heuristics, or thumb rules that lead to snap judgments about a message’s content; and a deeper, systematic processing about an email’s content.

“A fourth measure, cyber-risk beliefs, taps into the individual’s perception about risks associated with online behaviors,” he says.

Vishwanath’s model accounts for these layers and the relationships among them with each measure providing a brush stroke that composes an overall portrait of the different reasons people fall victim to such attacks.

“These things matter,” he says. “Once we understand why certain people fall for attacks we can target them with the appropriate training and education.”

Current training is based on simply teaching people how to recognize a phish that only addresses one of the reasons why people fall for phishing. No wonder training has had limited overall effectiveness in stopping cyber breaches.

The point for Vishwanath is that most anti-phishing measures are trying to stop attacks under the assumption that they know why people fall prey to such attacks, rather than actually figuring out why the attacks are working.

With phishing losses mounting at alarming rates and the level of phishing sophistication evolving in step, Vishwanath says adopting the model is critical.

Millions of phishing attacks occur daily, many following recurring patterns, such as the emails that come now during tax seasons. 

These, too, have grown in rate and intensity. For instance, the number of malware-laden IRS phishing emails this month has already gone up by 400 percent.

The malware in these emails open back doors to computer networks that provide hackers with access to people’s personal information. Some intrusions install key loggers that track what the person in typing or the sites they visit. 

And a new class of “ransomware” encrypts every file on a hard driver or server, holding the data hostage until users pay an untraceable ransom in bitcoin.

“If the Internet were the real world it would be the most dangerous city on earth,” he says.

Research Team at IUPUI Develops Social App to Support Alzheimer's

Newswise, March 28, 2016— Every day, more than 15 million unpaid caregivers provide care to people with Alzheimer’s disease, with little outside support and often at the risk of their own health.

Now a team of researchers, including David Wilkerson at the Indiana University School of Social Work at Indiana University-Purdue University Indianapolis, will use an innovation grant awarded by the Regenstrief Institute to see whether a social microvolunteering app developed for Facebook could help provide support many caregivers are now lacking.

The team, which also includes Dr. Daniel Bateman, a gerontology psychiatrist with the IU School of Medicine and Erin Brady, a faculty member at the School of Informatics and Computing at IUPUI, hope to have an answer to that question by early fall.

The three met through their participation in the Sandra Eskenazi Center for Brain Innovation eHealth group and decided to join forces to explore the possibility that their social microvolunteering application could aid caregivers.

The social microvolunteering app communicates with a Facebook community and can push and retrieve information to and from the entire community or only selected groups within the community.

Social microvolunteering is a simple and brief form of volunteer service usually done virtually through social networks and requiring no long-term time commitment.

It connects an individual with a question to a group of potential answerers, leveraging the social networks of a core group of supporters to expand the scale of answerers available and increase the speed of responses.

Brady developed and researched the social microvolunteering idea in an application for people with limited vision. Bateman will help the team understand the needs of caregivers.

Wilkerson's interest has to do with patient-centered care and creating a holistic care environment that includes caregivers and strengthens the resource of caregiving.

If the research project shows the application is effective, it could prove to be an inexpensive way to provide support to millions of caregivers.

The numbers of unpaid caregivers trying to maintain their own lives and care for loved ones with Alzheimer's disease is staggering. In 2014, 15.7 million unpaid caregivers took care of people with Alzheimer's disease, providing a total of 17.9 billion hours of care, according to the Alzheimer's Association.

Providing care comes with its own problems. Experts say caregivers have higher rates of depression, anxiety, insomnia, cardiovascular disease and health care resource use, making caregiver self-management an important target for intervention, according to research studies.

Wilkerson said the team will be investigating small groups of five to eight caregivers; each group will have a Facebook account.

The group will be asked what informational and emotional support questions it would like to get answered in alternating weeks of the research. This aspect of group discussion is anticipated to be a first step in the development of mutual support and will generate questions that will be pushed to the larger Facebook community for the purposes of social microvolunteering.

The social microvolunteering app retrieves their answers, and relevant answers are sent back to the caregiver group for deliberation. The online caregivers' group will discuss online which answers seem the most relevant and then take action. Wilkerson said the caregivers would give authorization through their Facebook page to use the application for the test period.

The team expects to recruit 24 to 26 people, who will be divided up into four groups by April, and then start the project in May

"If our intervention can increase support, it can potentially improve caregiver health and, in conjunction with primary health care interventions, extend the amount of time that people with Alzheimer's can remain at home," Wilkinson noted.

Using a Computer, Social Activities Tied to Reduced Risk of Memory Decline

Newswise, March 18, 2016– Keeping the brain active with social activities and using a computer may help older adults reduce their risk of developing memory and thinking problems, according to a study released today that will be presented at the American Academy of Neurology’s 68th Annual Meeting in Vancouver, Canada, April 15 to 21, 2016.

“The results show the importance of keeping the mind active as we age,” said study author Janina Krell-Roesch, PhD, with the Mayo Clinic in Scottsdale, Ariz., and member of the American Academy of Neurology. “While this study only shows association, not cause and effect, as people age, they may want to consider participating in activities like these because they may keep a mind healthier, longer.”

For the study, researchers followed 1,929 people, age 70 and older, who were part of the larger Mayo Clinic Study of Aging in Rochester, Minn. The participants had normal memory and thinking abilities at recruitment to the study. They were then followed for an average of four years until they developed mild cognitive impairment or remained impairment-free.

Participants were asked about their engagement in mentally stimulating activities such as computer use, reading, crafting and social activities within 12 months before participation in the study using a questionnaire.

The investigators then wanted to know if participants who engaged in mental activities at least once per week had a lower risk for new onset of mild cognitive impairment as compared to those participants who did not engage in these activities.

The study found that people who used a computer once per week or more were 42 percent less likely to develop memory and thinking problems than those who did not. A total of 193 out of 1,077 people (17.9 percent) in the computer use group developed mild cognitive impairment, compared to 263 out of 852 (30.9 percent) people in the group that did not report computer use.

People who engaged in social activities were 23 percent less likely to develop memory problems than those who did not engage in social activities. A total of 154 out of 767 (20.1 percent) people in the social activities group developed problems, compared to 302 out of 1,162 (26.0 percent) people who did not participate in social activities.

People who reported reading magazines were 30 percent less likely to develop memory problems. Those who engaged in craft activities such as knitting were 16 percent less likely to develop memory problems. Similarly, those who played games were 14 percent less likely to develop memory problems.

The study was supported by the National Institute on Aging, National Institute of Mental Health, the Robert Wood Johnson Foundation, the Robert H. and Clarice Smith and Abigail Van Buren Alzheimer’s Disease Research Program, the European Regional Development Fund and the Arizona Alzheimer’s Consortium.

Learn more about memory and thinking problems at www.aan.com/patients.

The American Academy of Neurology, an association of 30,000 neurologists and neuroscience professionals, is dedicated to promoting the highest quality patient-centered neurologic care. A neurologist is a doctor with specialized training in diagnosing, treating and managing disorders of the brain and nervous system such as Alzheimer’s disease, stroke, migraine, multiple sclerosis, brain injury, Parkinson’s disease and epilepsy.

Popular Blood Pressure App Misses the Mark

Study in 85 volunteers found highly inaccurate measurements and showcases weakness of unregulated mobile health applications, researchers say

Newswise, March 3, 2016 — A popular smartphone app purported to accurately measure blood pressure simply by placing a cellphone on the chest with a finger over the built-in camera lens misses high blood pressure in eight out of 10 patients, potentially putting users’ health at risk, according to research from Johns Hopkins.

Although the app, called Instant Blood Pressure, is no longer available for purchase, it was downloaded more than 100,000 times and is still functional on phones, the researchers say.

“We think there is definitely a role for smartphone technology in health care, but because of the significant risk of harm to users who get inaccurate information, the results of our study speak to the need for scientific validation and regulation of these apps before they reach consumers,” says Timothy B. Plante, M.D., a fellow in the Division of General Internal Medicine at the Johns Hopkins University School of Medicine.

The study, described at the American Heart Association’s Epidemiology and Lifestyle meeting and concurrently online March 2 in JAMA Internal Medicine, was conducted by Plante and Seth Martin, M.D., M.H.S., an assistant professor in the Division of Cardiology at the Johns Hopkins University School of Medicine.

Blood pressure is best measured, the researchers say, using the well-established technique of inflating a cuff attached around the brachial artery in the arm to detect the force of blood flowing when the heart is beating and at rest. Either a trained medical professional or a machine “listens” to sounds from the brachial artery as blood flows under variable pressure from the cuff.

Plante and Martin undertook the study because “we were skeptical that even very talented people could design an app that could accurately measure blood pressure in such a different way,” Martin says. “Because of the absence of any rigorous scientific testing, there was no evidence that it worked or didn’t work.”

To conduct such testing, Martin, Plante and colleagues recruited 85 adult volunteers among patients and staff members in clinics associated with Johns Hopkins Medicine. The participants self-reported a range of body mass measurements, races and ethnicities, all factors known to influence blood pressure.

Each participant had his or her resting blood pressure measured twice using a reliable automated blood pressure monitor commonly used in research studies to avoid measurer variation or error. Participants also used the app to measure their own blood pressure twice on the same day.

Results showed that blood pressures measurements from the app were overwhelmingly inaccurate. Close to 80 percent of those with clinically high blood pressure, defined as 140/90 millimeters of mercury or above, measured by the automated blood pressure monitor showed normal blood pressure with the app.

The authors say that it is unclear how the app arrives at a blood pressure number. They suggest in the study that, rather than attempting to measure true blood pressure, the app gives a population-derived estimate based on the user’s age, sex, height, weight and heart rate, the latter of which could be detected by the phone’s microphone.

“Because this app does such a terrible job measuring blood pressure,” says Plante, “it could lead to irreparable harm by masking the true risk of heart attacks and strokes in people who rely on the accuracy of this information.”

Martin and Plante note that mobile health smartphone applications are becoming more commonplace, and many have the potential to greatly improve health by putting personalized medical resources and information literally in the hands of patients through cellphones.

Though the results of this study were discouraging, they say improvements in the technology could make blood pressure measurement apps accurate and useful. The app studied here, which cost $4.99 when it was sold, was removed from Apple’s App Store in late August 2015 for reasons that are unclear.

“The next big step in health care is to further engage folks in their own care and motivate them to reduce risks associated with diseases like high blood pressure,” Plante says. “But care must be taken to make sure they get the accurate ways to do that.”

Other researchers who participated in this study include Bruno Urrea, M.D.; Roger S. Blumenthal, M.D.; Edgar R. Miller III, M.D., Ph.D.; and Lawrence J. Appel, M.D., M.P.H., all of Johns Hopkins, and Zane T. MacFarlane, of Pomona College.

The work was funded by the PJ Schafer Cardiovascular Research Fund.

Doctors’ E-Mail Reminders Help Keep People More Engaged in Their Health Care

Newswise, February 13, 2016 — Research led by UCLA professor on ‘OpenNotes’ model finds that follow-up emails are critical to keeping patients in the know

A study led by Dr. John Mafi, a professor at the David Geffen School of Medicine at UCLA, has found that a simple note from a primary care doctor can be a critical way to keep patients involved in their own health care.

The research, published today in the peer-reviewed Journal of the American Medical Informatics Association, examined a growing national program that provides patients with easy online access to their doctors’ notes about their appointments.

The program, OpenNotes, began in 2010, when 105 primary care physicians invited nearly 14,000 of their patients to view their electronic notes about their clinic visits.

The initiative was intended to better engage patients in their own care and improve communication between patients and their doctors.

It turned out to be quite a success: Patients demonstrated better recall of their medical plans, felt more in control of their care and were more likely to take their medications.

Doctors found that sharing their notes with patients had little negative impact on their workflow. Five years later, more than 5 million patients are participating in the OpenNotes movement.

And recently, four nonprofits contributed a total of $10 million to expand the program to 50 million patients.

But even as the program began to grow, two major questions arose: Would patients continue to access the notes after the initial enthusiasm died down?

And, how important were the doctors’ reminders in prompting patients to remain active participants in their own care?

The study suggests that the reminders are indeed very important.

Led by Mafi, an assistant professor of medicine in the division of general internal medicine and health services research at the Geffen School, the researchers found that patients tended to view clinic notes substantially less once they stopped receiving the reminders, while patients who continued receiving them tended to continue accessing the notes.

Mafi said patients immediately forget between 40 percent and 80 percent of what their doctors tell them — and they get about half of what they do remember wrong.

“Poor patient–doctor communication represents one of the biggest problems in our health care system,” said Mafi, who conducted the research as a fellow in general internal medicine at Boston’s Beth Israel Deaconess Medical Center and Harvard Medical School.

“OpenNotes offers patients a way to remember their doctors’ instructions, rationale for their care plan and any other critical information about their health. OpenNotes has the potential to empower patients to take charge of their health.”

Another recent study about OpenNotes found that patients who read their notes are more likely to take the medicine they need to lower their cholesterol.

The team led by Mafi studied 14,000 patients at Beth Israel Deaconess and at Geisinger Health System in Danville, Pennsylvania, for two years. Doctors at Beth Israel Deaconess sent reminders throughout the study; those at Geisinger stopped after one year.

During the first 12 months, 53.7 percent of the patients at Beth Israel Deaconess and 60.9 percent of the patients at Geisinger checked their doctors’ notes within 30 days of their becoming available to them. Those percentages stayed consistent throughout the year.

During the second year, patients at Beth Israel Deaconess viewed their notes with the same frequency until a slight decline during the final three months.

At Geisinger, however, just 13.2 percent of patients continued viewing their notes once the email reminders ceased.

The study also found that compared to 55.1 percent of white patients viewed their notes, compared with 36.3 percent of black patients; these differences remained relatively consistent even after the researchers accounted for differences in demographics, the patients’ illnesses and other factors.

“While we predicted that reminders would influence patients’ viewing their doctors’ notes, we did not anticipate the large role that reminders seem to play in patients continuing to access viewing their notes,” Mafi said.

“The key lessons of our study are that sending reminders to patients to view their medical notes may be essential to promoting patient engagement and improving patient-doctor communication, and that new health technology implementation requires additional efforts to reduce potential disparities in health.”

Mafi said future studies should evaluate how to better engage non-white patients in order to help mitigate racial and ethnic health disparities.

Researchers should also evaluate the best way to invite patients to view their doctors’ notes and then gauge the impact on patient engagement, management of chronic diseases and health outcomes.

He also added that many patients already have access to their notes but might not realize it.

“We encourage people to ask their doctors or other healthcare professionals about whether they have access to their notes, and to make it a habit to view them,” he said.

The study’s co-authors are Roanne Mejilla, Henry Feldman, Long Ngo, Tom Delbanco, Christina Wee and Jan Walker of Beth Israel Deaconess Medical Center, and Jonathan Darer of Geisinger Health System.

The work was supported by a National Research Service Award training grant (T32HP12706) from the U.S. Health Services and Research Administration and the Ryoichi Sasakawa Fellowship Fund, the National Institutes of Health (K24DK087932); the Robert Wood Johnson Foundation (65921), the Drane Family Fund and the Richard and Florence Koplow Charitable Foundation

New Online Tool Allows Patients to Make Informed Cardiac Care Decisions

MedStar Heart & Vascular Institute Participates in Find Your Heart a Home in Partnership with American College of Cardiology

Newswise February 5, 2016– MedStar Heart & Vascular Institute at MedStar Washington Hospital Center is one of only two hospitals in the nation selected to partner with the American College of Cardiology (ACC) on the Find Your Heart a Home™ pilot program, a campaign aimed at empowering patients when making their heart care decisions. Through its participation,

MedStar Heart & Vascular Institute is further demonstrating its dedication to quality improvement, transparency, and patient and provider engagement.

In this era of health care transparency, patients and their families want access to credible information about quality of care to help them make informed decisions.

Consumers consult online search tools to make decisions on restaurants and hotels, and now they can do the same for their cardiovascular care.

Find Your Heart a Home is a first-of-its-kind hospital comparison database for cardiac care. It allows patients and caregivers, to search and compare hospitals based on the cardiac services they provide and important information on the quality of care they deliver.

“Transparency in health care is a growing expectation among patients and their caregivers,” said Allen J. Taylor, MD, FACC FAHA, chief of Cardiology at MedStar Heart & Vascular Institute.

“The Find Your Heart a Home tool can offer the transparency patients are seeking and help eliminate the information clutter by giving them reliable information they need to make informed choices. We are proud to be partnering with ACC on this important pilot project.”

Find Your Heart a Home is populated with data from the National Cardiovascular Data Registry, which tracks certain heart care procedures performed at hospitals nationwide.

 It rated MedStar Washington Hospital Center, the founding hospital of MedStar Heart & Vascular Institute, based on 1,810 cardiac catheterization and angioplasty procedures, and 520 implanted cardiac defibrillators. For each aspect of care evaluated, the Hospital Center’s performance earned the maximum four stars.

The tool is part of ACC’s CardioSmart initiative, a website full of educational information and tools to help guide patients on their heart health journey.

“MedStar Heart & Vascular Institute is a pioneer in this effort to give patients the tools they need to become an active participant when mapping out their cardiac care plan,” said ACC President Kim Allan Williams, MD, FACC. “They are showing a true commitment to transparency and quality and serving as an example to hospitals across the country.”

MedStar Washington Hospital Center’s heart data can be found here, or visit FindYourHeartaHome.org

When Loved Ones Battle Cancer, Families Head to Web for Information More Than Support

Newswise, February 1, 2016 – Loved ones of cancer patients are likely to search for further information about the disease online but less inclined to seek emotional support from social media forums, according to a University of Georgia study published recently in the journal Computers, Informatics, Nursing.

Individuals frequently suffer negative psychological and emotional effects when the people they care about are diagnosed with cancer. It is fairly common for loved ones of cancer patients to develop depression or anxiety disorders as a result of the diagnosis, but there aren’t many studies focusing specifically on cancer patients’ caregivers and family members, said the study’s author, Carolyn Lauckner.

“I think sometimes the loved ones and caregivers get forgotten about,” she said. “And that’s why I wanted to research this population to see if there are ways that we can better support these individuals.”

Lauckner, an assistant professor in the College of Public Health’s department of health promotion and behavior, surveyed 191 people whose loved ones were diagnosed with cancer in the past year or who were currently acting as caregivers to someone with cancer.

The motivation behind the research was personal for Lauckner.

“I went through a period of time where I had three loved ones diagnosed within a short amount of time,” she said. “I had these experiences where I heard about the diagnosis and I would go online to look it up, and then I would immediately become terrified and freak out about all the stuff I read online.”

More than three-quarters of participants searched online for information on a loved one’s disease. Most looked for treatment options, prevention strategies and risk factors, and prognosis information.

“I was pleasantly surprised by the amount of people who said that they were looking for prevention information online and detection information because that shows that not only are they concerned for their loved one but they’re also concerned about how they themselves can avoid cancer, which from a public health perspective is great,” Lauckner said.

Respondents were less inclined to view blogs or go online to hear about others’ cancer experiences. These kinds of sites were linked to negative emotions for participants, such as fear, sadness and anger.

“A lot of people, especially in the cancer realm, they will use blogs or discussion posts to vent and to talk about the harsh realities of living with an illness,” she said.

“And while I think that that is beneficial for both the person who is writing it and potentially for some people who want an idea of what to expect, when someone is dealing with the prospect of their loved one having to go through that experience, it can be extremely distressing.

“You’re only getting a snapshot of what that person’s cancer experience was like, and you may be seeing the snapshot of the worst day that they had” on blogs and discussion boards.

The most commonly visited websites were those of charitable organizations like the American Cancer Society, which were associated with positive emotions. Lauckner said she found this information encouraging because it shows that the participants were consulting reliable sources of information and not being swayed by personal accounts as much.

Lauckner ultimately wants to build on the information gleaned in this study to determine the most effective use of social media and technology to distribute cancer prevention and risk reduction messages to the public.

The study, “The Effects of Viewing and Preferences for Online Cancer Information Among Patients’ Loved Ones,” is available online at http://www.ncbi.nlm.nih.gov/pubmed/26636409

.

The study received funding from an internal research grant from Michigan State University’s College of Communication Arts and Sciences.

Why Daring to Compare Online Prices Pays Off Offline

Price comparison websites impact in-store behaviour, a Concordia study shows

Newswise, January 6, 2016 — The constant barrage of post-holiday sales touted by web-based retailers may make it seem like online shopping is killing real-world stores. But shoppers are actually engaging in “web-to-store” shopping — buying offline after comparing prices online.

A study from Concordia University’s John Molson School of Business shows this consumer behaviour has important implications for retailers.

When setting in-store prices or offering price-matching guarantees, offline retailers should focus more on online retailer ratings than on offering the lowest prices.

In a study published in the Journal of Retailing, one of the top journals in the retailing field, marketing professor Onur Bodur investigates how offline consumer behaviour is influenced by online price comparison sites (PCSs).

His results from three studies show that consumers pay careful attention to things like retailer ratings, how often a product is offered at the same price, and differing price levels.

“Price comparison sites like Shopzilla and PriceGrabber are solid online information sources that display numerous retailer prices for a product type or given brand,” says Bodur, who co-authored the paper with colleagues Noreen Klein from Virginia Tech, and Neeraj Arora from the University of Wisconsin-Madison.

For the study, the research team focused on how information from PCSs often acted as reference pricing for in-store shoppers.

“We asked: How PCS retailer ratings would impact in-store price evaluations? Do consumers really believe super-low online prices are obtainable?” Bodur says.

“The good news for brick-and-mortar retailers is that low online prices may not be used by consumers as comparison prices. We found that offline retailers should actually focus on prices that are associated with highly rated online retailers. That’s because their prices are perceived as more valid and therefore have greater impact on subsequent price evaluations,” he says.

“When there is little variation in PCS retailer ratings, offline retailers should also focus on prices that occur frequently in PCS searches and not just the low price.”

Related links:
Centre for Multidisciplinary Behavioural Business Research
Journal of Retailing
John Molson School of Business
Department of Marketing