# Social Engineering Attacks: A Survey
## 6 Challenges and Future Directions  
Companies are investing large amounts of money and resources to establish effective strategies against social engineering attacks [67; 68]. However, existing detection methods have fundamental limitations and countermeasures are inefficient in coping with the ever-growing number of social engineering attacks. Human-based techniques are limited by humans' subjective decisions. Technology-based techniques can be also limited as the technological vulnerabilities may be exploited. These attacks are evolving day after day and attackers are becoming smarter and stronger. Thus, there is a great need for more effective detection and countermeasure techniques to detect and minimize the impact of these attacks.  
Because humans are a challenge for the security of any network, it important to develop training programs for employees and most importantly for K-12 students. Training students at early age can minimize the number of victims in the future. Moreover, countries have to invest in cyber security education [69; 70]. Currently, there is a handful of universities in the United States of America that provide quality programs in cybersecurity. Thus, there are numerous jobs in this cyber-security field that are not filled because of the lack of graduates.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Techniques** & **Description** & **Advantages** & **Limitations** \\ \hline \multirow{6}{*}{Filtering tools} & Anti-phishing tools (McAfee & - Can block phishing emails & internally emails - Limited by human unawareness - Expensive tools \\  & filter, Microsoft Web sense) & - Can be implemented & - Attackers can send internally emails - Limited by human unawareness - Expensive tools \\ \hline \multirow{6}{*}{Alerting and scanning software} & Anti-virus, anti-spams, anti-scams & - Efficient in alerting - Strong products with security measures & - Expensive products - Alerts ignored by Humans \\ \hline \multirow{6}{*}{Biometric solutions} & \multirow{3}{*}{Based on biological traits} & - Distinguish real profiles from fake profiles through their biological traits - Efficient & - Can be mimicked \\  & & - Efficient & \\ \hline Artificial intelligence-based & Based on adaptive learning systems & - Efficient - Adaptive & - Complex \\ \hline Machine learning-based & Learning-based & - Achieve very good results - Effective - Complex \\  & & -Online learning & \\ \hline Anti-social engineering framework & Social Engineering Centered Risk Assessment (SERA) & - Efficient - High probability of attacks’ detection & - Very expensive \\ \hline \multirow{2}{*}{Threshold-based} & Use threshold to detect attacks & - Easy & - Not efficient - Limited by the threshold value \\ \hline \multirow{2}{*}{Phone-based} & \multirow{2}{*}{Use phones} & \multirow{2}{*}{- Easy} & - Phone companies are still not able to stop \\  & & & & \\ \hline \multirow{6}{*}{Flow whitelisting} & Identifying legitimate traffic & - Efficient - Learning-based & - Limited by the human \\  & from malicious traffic & - Able to distinguish between legitimate traffic from malicious traffic & - Ignoring alarms \\ \hline \multirow{2}{*}{IDS-based} & \multirow{2}{*}{Intrusion detection system} & - Able to detect suspicious activities & \multirow{2}{*}{High false alarm rates} \\  & & & \\ \end{tabular}
\end{table}
Table 2: Computer-based countermeasures and mitigation techniques comparison.