  Social engineering cyberattacks are a major threat because they often prelude
sophisticated and devastating cyberattacks. Social engineering cyberattacks are
a kind of psychological attack that exploits weaknesses in human cognitive
functions. Adequate defense against social engineering cyberattacks requires a
deeper understanding of what aspects of human cognition are exploited by these
cyberattacks, why humans are susceptible to these cyberattacks, and how we can
minimize or at least mitigate their damage. These questions have received some
amount of attention but the state-of-the-art understanding is superficial and
scattered in the literature. In this paper, we review human cognition through
the lens of social engineering cyberattacks. Then, we propose an extended
framework of human cognitive functions to accommodate social engineering
cyberattacks. We cast existing studies on various aspects of social engineering
cyberattacks into the extended framework, while drawing a number of insights
that represent the current understanding and shed light on future research
directions. The extended framework might inspire future research endeavors
towards a new sub-field that can be called Cybersecurity Cognitive Psychology,
which tailors or adapts principles of Cognitive Psychology to the cybersecurity
domain while embracing new notions and concepts that are unique to the
cybersecurity domain.
