An interdiscplinary study of phishing and spear-phishing attacks

In a world where spear-phishing is one of the most common attacks used to steal confidential data, it is necessary to instruct technical and non-technical users about new mechanisms attackers can use to generate these attacks. We want to focus on phishing attacks, where a social engineer communicates a deceitful message to their victims in order to obtain some confidential information, because of recent advancements in the field. Nowadays, with all the information most users provide online along with the advancements of fields such as data mining, it is more difficult for users to distinguish between malicious and benign communication. If the attack is designed to target a specific user with the knowledge of his or her information it is called spearphishing. Spear-phishing attacks tend to be more successful than other attacks due to their targeted nature. Recent studies by Intel suggest that 97% of people cannot identify phishing emails. Therefore, as educators we find the need to instruct users about the structure, purpose, and power of these attacks. In this investigation we propose the construction of a body of knowledge for phishing and spear-phishing attacks. Our motivation is the increasement of accuracy, success, and scale of these attacks in the last decade. The body of knowledge we propose provide a corpus of what we think are the main components of phishing attacks: psychology, computation, and sociology. Studying these aspects of phishing attacks can help future generations of computer science students to better understand how to defend against them. As a community, we need to provide a better definition for the set of vulnerabilities social engineers use to exploit their victims. We propose to expand the curriculum for these types of attacks and to include interdisciplinary areas such as psychology and sociology in future courses that relate to social engineering. More precisely, we aim to educate students on the aspects we argue are involved in the eval-