# Phishing Attacks Survey: Types, Vectors, and Technical Approaches
## 7 Discussion of Current Challenges and Trends in Phishing Attacks
It was noted that when the effectiveness of information sharing among the firms increased, firms tended to utilize information sharing rather than investing in defense. It also showed that increased interdependence between firms will lead to increased information sharing among the attackers, which in turn leads to attackers launching combined attacks. For the attackers, information sharing is a priority when attacks are costly and the company's defenses are cheap. The second hacker may be disadvantaged and given less information and could be deterred by the reputation gain of the first hacker. Since phishing is a method of infiltration and is sometimes used for the delivery of malware, the information about information sharing within this study is relevant. As stated above, one attacker may gain access to one company using phishing and acquire knowledge of the company's network, policies, and the managerial structure; and share it with the second attacker. The first attacker may also be suitably placed within one organization to assist with an attack on a firm that the company is sharing information with by moving within, and between, the companies by phishing internally using a legitimate company email address. Using a legitimate company email address would be extremely beneficial in this example as there is already trust between the two companies due to their history of information sharing. This leads to the main challenge of phishing prevention, education, and awareness. Though this is an issue throughout the cyber security field, educating the public and employees should be a priority on this particular issue since, as shown above, there are not many automated systems to compensate for the users lack of knowledge or simple mistakes. The fact that cyber security is an issue that some users do not take seriously until it is too late is cause for major concern, with those willing to pay for general cyber threat protection coming in at around 50% of those surveyed [83]. It is worth considering that the only real way to combat phishing and other cybercrime would be to establish societal change, educating people more thoroughly--and from a younger age, especially since access to technology and the internet becomes easier for younger generations. It has been shown that the use of role-play scenarios (like in a game) can increase the effectiveness of phishing detection training by up to 36%, using a technique like this in educational institutions could help younger generations to be better prepared against phishing attacks [88]. To some extent, businesses could take steps to help reduce phishing attacks. This would include things like purchasing web and email domain names that could be easily mistaken for their company and redirecting to the legitimate site; this technique is already used by some large businesses, but having to pay extra could be a problem for smaller or non-profit organizations. In the long run, this would help companies by maintaining their reputation. Whilst researching for this paper, it became clear that the majority of current and past research regarding phishing primarily focuses on the technical approaches used by phishers and the technical prevention techniques that are being developed. However, very few of the papers analyzed aspects of the targets or tried to identify demographics or behaviors of the subjects who are most susceptible to phishing beyond standard categorization of age and gender. There is also little analysis of the effectiveness of each type of medium, vector, and technical approach against the demographics of the targets. Furthermore, there is little research into the motivations behind phishing attacks besides the most common reason of financial gain, either directly or by selling the victims credentials on the online black market (where depending on the account, the credentials can go for between $1 and $100, with even greater returns for online banking accounts depending on their contents [5]).