Understanding security practitioners’ experiences of investigating compromised email accounts

Neeranjan Chitare; Lynne Coventry; James Nicholson

doi:10.14236/ewic/BCSHCI2024.13

Understanding security practitioners’ experiences of investigating compromised email accounts

Neeranjan Chitare, Lynne Coventry, James Nicholson

Department of Cybersecurity and Computing

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

23 Downloads (Pure)

Abstract

Cybersecurity breaches are a serious threat to economies and organisations across the globe in the digital landscape of today. Phishing attacks are one of the most common ways that these threats infiltrate businesses as they have developed into sophisticated strategies that make use of compromised accounts and exploit legitimate credentials for advanced attacks like lateral phishing. This paper investigates the processes employed by security practitioners in verifying the identity of account owners when suspecting a compromised account. Through semi-structured interviews with 13 cybersecurity professionals, we report on how practitioners are using diverse strategies for contacting suspected employees, including direct and indirect contact through line managers. We discuss the complexities in communication strategies during security incidents.

Original language	English
Title of host publication	Proceedings of BCS HCI 2024
Editors	Dan Fitton, Matt Horton
Publisher	BCS Learning & Development Ltd.
Pages	136-145
Number of pages	10
DOIs	https://doi.org/10.14236/ewic/BCSHCI2024.13
Publication status	Published - 13 Mar 2025
Event	37th International BCS Human-Computer Interaction Conference - University of Central Lancashire, Preston, United Kingdom Duration: 15 Jul 2024 → 17 Jul 2024 Conference number: 37th https://bcshci.org/

Publication series

Name	Electronic Workshops in Computing (eWiC)
Publisher	BCS Learning & Development Ltd.
ISSN (Electronic)	1477-9358

Conference

Conference	37th International BCS Human-Computer Interaction Conference
Abbreviated title	BCS HCI 2024
Country/Territory	United Kingdom
City	Preston
Period	15/07/24 → 17/07/24
Internet address	https://bcshci.org/

Keywords

Incident response
Cybersecurity practitioners
Account compromise

Access to Document

10.14236/ewic/BCSHCI2024.13Licence: CC BY

Coventry_UnderstandingSecurityPractitioners_Published_2025Final published version, 302 KBLicence: CC BY

Cite this

@inproceedings{4515eca301e043429b735c9baf7bb55d,

title = "Understanding security practitioners{\textquoteright} experiences of investigating compromised email accounts",

abstract = "Cybersecurity breaches are a serious threat to economies and organisations across the globe in the digital landscape of today. Phishing attacks are one of the most common ways that these threats infiltrate businesses as they have developed into sophisticated strategies that make use of compromised accounts and exploit legitimate credentials for advanced attacks like lateral phishing. This paper investigates the processes employed by security practitioners in verifying the identity of account owners when suspecting a compromised account. Through semi-structured interviews with 13 cybersecurity professionals, we report on how practitioners are using diverse strategies for contacting suspected employees, including direct and indirect contact through line managers. We discuss the complexities in communication strategies during security incidents.",

author = "Neeranjan Chitare and Lynne Coventry and James Nicholson",

note = "{\textcopyright} Chitare et al. Published by BCS Learning and Development Ltd. Proceedings of BCS HCI 2024, UK License: This work is licensed under a Creative Commons Attribution 4.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/ Data availability statement: Not present.; 37th International BCS Human-Computer Interaction Conference, BCS HCI 2024 ; Conference date: 15-07-2024 Through 17-07-2024",

year = "2025",

month = mar,

day = "13",

doi = "10.14236/ewic/BCSHCI2024.13",

language = "English",

series = "Electronic Workshops in Computing (eWiC)",

publisher = "BCS Learning \& Development Ltd.",

pages = "136--145",

editor = "Dan Fitton and Matt Horton",

booktitle = "Proceedings of BCS HCI 2024",

url = "https://bcshci.org/",

}

Chitare, N, Coventry, L & Nicholson, J 2025, Understanding security practitioners’ experiences of investigating compromised email accounts. in D Fitton & M Horton (eds), Proceedings of BCS HCI 2024. Electronic Workshops in Computing (eWiC), BCS Learning & Development Ltd., pp. 136-145, 37th International BCS Human-Computer Interaction Conference, Preston, United Kingdom, 15/07/24. https://doi.org/10.14236/ewic/BCSHCI2024.13

Understanding security practitioners’ experiences of investigating compromised email accounts. / Chitare, Neeranjan; Coventry, Lynne; Nicholson, James.
Proceedings of BCS HCI 2024. ed. / Dan Fitton; Matt Horton. BCS Learning & Development Ltd., 2025. p. 136-145 (Electronic Workshops in Computing (eWiC)).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Understanding security practitioners’ experiences of investigating compromised email accounts

AU - Chitare, Neeranjan

AU - Coventry, Lynne

AU - Nicholson, James

N1 - Conference code: 37th

PY - 2025/3/13

Y1 - 2025/3/13

N2 - Cybersecurity breaches are a serious threat to economies and organisations across the globe in the digital landscape of today. Phishing attacks are one of the most common ways that these threats infiltrate businesses as they have developed into sophisticated strategies that make use of compromised accounts and exploit legitimate credentials for advanced attacks like lateral phishing. This paper investigates the processes employed by security practitioners in verifying the identity of account owners when suspecting a compromised account. Through semi-structured interviews with 13 cybersecurity professionals, we report on how practitioners are using diverse strategies for contacting suspected employees, including direct and indirect contact through line managers. We discuss the complexities in communication strategies during security incidents.

AB - Cybersecurity breaches are a serious threat to economies and organisations across the globe in the digital landscape of today. Phishing attacks are one of the most common ways that these threats infiltrate businesses as they have developed into sophisticated strategies that make use of compromised accounts and exploit legitimate credentials for advanced attacks like lateral phishing. This paper investigates the processes employed by security practitioners in verifying the identity of account owners when suspecting a compromised account. Through semi-structured interviews with 13 cybersecurity professionals, we report on how practitioners are using diverse strategies for contacting suspected employees, including direct and indirect contact through line managers. We discuss the complexities in communication strategies during security incidents.

U2 - 10.14236/ewic/BCSHCI2024.13

DO - 10.14236/ewic/BCSHCI2024.13

M3 - Conference contribution

T3 - Electronic Workshops in Computing (eWiC)

SP - 136

EP - 145

BT - Proceedings of BCS HCI 2024

A2 - Fitton, Dan

A2 - Horton, Matt

PB - BCS Learning & Development Ltd.

T2 - 37th International BCS Human-Computer Interaction Conference

Y2 - 15 July 2024 through 17 July 2024

ER -

Understanding security practitioners’ experiences of investigating compromised email accounts

Abstract

Publication series

Conference

Keywords

Access to Document

Fingerprint

Cite this