# Social Engineering Attacks: A Survey
## 4 Mitigation Techniques  
Human-based attacks are sophisticated and hard to detect, making their mitigation necessary. Mitigating techniques for social engineering attacks aim at decreasing the attacks' impact on the individuals or the companies [52]. They aim at saving what can be saved after a human is already attacked or a company's system is already hacked. The cyber security entity needs to minimize the loss as much as possible by defining security actions in case of emergency. For instance, building a corporate security culture among the company's employees is a mitigation technique against the attacks targeting companies or groups of individuals [53]. This positive culture helps the attack's victim not feel ashamed of being manipulated as the social engineer exploits the misplaced trust and not because the victim is unintelligent or foolish. Being aware of this culture enhances the security responsibilities by reporting all the attacks to the technical staff as soon as possible in order to prevent more damage. This mitigation technique saves valuable time in responding to an attack and stopping the spread of the attack into the company's network. Another mitigation technique for attacks related to calls or emails informing someone of a lottery win is spreading awareness about the psychological triggers of social engineering attacks. If individuals receive this kind of information, they should be aware that they cannot win a lottery or prize they did never entered, and no one gives away a fortune to them by an email or as a donation. Recognizing that can stop people from replying to the attacker with the requested data. For attacks related to emails or link clicks, software vendors become more aware of the social engineering treats by building strong products with security measures [54]. These software products are very challenging for cyber criminals to penetrate them. Due to these implemented security measures, the attacker cannot get enough data even if a victim is fooled by the attack [55]. The human-based mitigation techniques are based on human judgments in determining if an activity is legitimate or malicious. They involve two approaches: (1) auditing and policy; (2) education, training, and awareness (ETA). The auditing and policy approach refers to a number of security rules and procedures implemented in companies to help employees detect social engineering attacks [56]. These security rules are controlled by policies in order to guide employees to decide about the state of a suspected activity. The policy approach can be considered as a defense strategy to control the employee's reaction while under social engineering attack. The education, training, and awareness approaches refer to the effective application of the auditing and policy approach. They aim at ensuring the deployment of the defined security policies and procedures by the organization. In [57], the authors proposed to introduce these ETA techniques to new employees as a security orientation in order to provide them with the organization prerequisites toward a secure company. Human-based mitigation techniques are a must for companies to mitigate the social engineering attacks and minimize their impacts in exploiting employees' weaknesses and vulnerabilities. They are mainly related to the effective in decision making and acting to classify an activity as malicious and act as necessary. However, human decisions are relative and thus not efficient as the human judgment is subjective even with strong awareness of social engineering attacks [58]. Technology-based mitigation techniques are required to enhance the accuracy of the human-based mitigation techniques. There are four technology-based mitigation techniques: biometrics, sensors, artificial intelligence, and social honeypot. Biometrics-based techniques aim at counteracting physical impersonation attacks, which refer to impersonating a company's employee by creating a fake profile with his/her identity [59].