Cited by 107Information and Cyber SecuritySpam and Phishing DetectionUser Authentication and Security Systems

Human Cognition Through the Lens of Social Engineering Cyberattacks

Open access
Montañez, Rosana, Golob, Edward, Xu, Shouhuai·2020·Frontiers in Psychology

Abstract

Social engineering cyberattacks are a major threat because they often prelude sophisticated and devastating cyberattacks. Social engineering cyberattacks are a kind of psychological attack that exploits weaknesses in human cognitive functions. Adequate defense against social engineering cyberattacks requires a deeper understanding of what aspects of human cognition are exploited by these cyberattacks, why humans are susceptible to these cyberattacks, and how we can minimize or at least mitigate their damage. These questions have received some amount of attention but the state-of-the-art understanding is superficial and scattered in the literature. In this paper, we review human cognition through the lens of social engineering cyberattacks. Then, we propose an extended framework of human cognitive functions to accommodate social engineering cyberattacks. We cast existing studies on various aspects of social engineering cyberattacks into the extended framework, while drawing a number of insights that represent the current understanding and shed light on future research directions. The extended framework might inspire future research endeavor towards a new sub-field that can be called {\em Cybersecurity Cognitive Psychology}, which tailors or adapts principles of Cognitive Psychology to the cybersecurity domain while embracing new notions and concepts that are unique to the cybersecurity domain.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.3389/fpsyg.2020.01755

Cites

119 of 123 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • A fundamentally important mitigation strategy against social engineering attacks is to strengthen human users through education.

    “A fundamentally important mitigation strategy against social engineering attacks is to strengthen human users through education (Montañez et al., 2020).”

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 3

  1. Anderson R. J. (2008). Security Engineering: A Guide to Building Dependable Distributed Systems, 2nd Edn. New York, NY: Wiley Publishing.
  2. Damon W. Lerner R. M. Kuhn D. Siegler R. S. (2006). Handbook of Child Psychology, Cognition, Perception, and Language, Vol. 2 Hoboken, NJ: John Wiley & Sons.
  3. Stajano F. Wilson P. (2009). Understanding Scam Victims: Seven Principles for Systems Security. Technical report, University of Cambridge, Computer Laboratory.

Cited by

Sorted by citations

Authors
Montañez, R., Golob, E., & Xu, S.
Affiliations
The University of Texas at San Antonio (US)
Corresponding author
Xu, Shouhuai
Venue
Frontiers in Psychology
Published
2020-09-30
Volume
11
Pages
1755-1755
ISSN
1664-1078 (ISSN-L)
OpenAlex
W3091679231
Cited by
106
References
119
Citations by year
2026: 21 · 2025: 26 · 2024: 23 · 2023: 17 · 2022: 9 · 2021: 8 · 2020: 2
FWCI
1.31
Type
journal article
Language
en
Open access
Locations
  • Frontiers in Psychology (publishedVersion, cc-by)
  • PubMed Central (publishedVersion, cc-by)
  • PubMed (publishedVersion)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Funders
  • National Science Foundation (1736209, 1814825)
  • Army Research Office (W911NF-17, W911NF-17-1-0566, W911NF)
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
Keywords
human cognition, cognitive psychology, cybersecurity, human factors in cybersecurity

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review