A Cognitive Task Analysis for Cyber Situational Awareness

Abstract

Cyber Network degradation and exploitation can covertly turn an organization's technological strength into an operational weakness. It has become increasingly imperative, therefore, for an organization's personnel to have an awareness of the state of the Cyber Network that they use to carry out their mission. Recent high-level government initiatives along with hacking and exploitation in the commercial realm highlight this need for general Cyber Situational Awareness (SA). While much of the attention in both the military and commercial cyber security communities is on abrupt and blunt attacks on the network, the most insidious cyber threat to organizations are subtle and persistent attacks leading to compromised databases, processing algorithms, and displays. We recently began an effort developing software tools to support the Cyber SA of users at varying levels of responsibility and expertise (i.e., not just the network administrators). This paper presents our approach and preliminary findings from a CTA we conducted with an operational Subject Matter Expert to uncover the situational awareness requirements of such a tool. Results from our analysis indicate a list of preliminary categories of these requirements, as well as specific questions that will drive the design and development of our SA tool.

Cyber situation awareness as distributed socio-cognitive work

“…Most cybersecurity research on SA directly adopts the Endsley model; defining SA as perception, comprehension, and projection. Some have extended this definition to incorporate specific features of the cyber environment / cybersecurity task 22,32 ; but from at the cognitive level, SA is still limited to perception, comprehension and projection. There are two likely reasons for the popularity of the 3-Level model of SA in cybersecurity research.…”

“…For example, Barford et al 3 describe SA as consisting of awareness of "the current situation, impact of the attack, evolution of the situation, adversary behavior, basis for situation, the quality of the available information, and any plausible future situations." Others define cyber-SA in terms of categories of awareness such as 'health of the network,' 'potential risks,' and 'sources of data 22 . '…”

The Human Factors of Cyber Network Defense

“…Theory and frameworks for considering cyber-attacks are emerging. Some theory and frameworks are developed from the top-down , while others are created from the bottom up, building upon cognitive task analyses (CTAs) of cyber analyst roles and demands on cognition (D'Amico et al, 2005;Mahoney et al, 2010). The role of cyber-teams and team cognition has also been captured (Champion et al, 2012;Rajivan et al, 2013), and helps clarify the collaborations among different analysts and organizations.…”

“…It requires derivation of operators' goal-driven behaviors. Existing cognitive task analyses provide starting points (e.g., Mahoney et al, 2010). However, these analyses often lack granular measures of CCSA, or validation in actual cyber-defense performance (but see Champion et al 2012).…”

Framework for Developing a Brief Interview to Understand Cyber Defense Work: An Experience Report

“…The human factors field recognizes the need for a better understanding of cybersecurity work (Dodge, Toregas, & Hoffman, 2012;Knott et al, 2013;Lathrop, Trent, & Hoffman, 2016;Madhavan, Cooke, Bass, Meyer, & Roth, 2015;Mancuso et al, 2014;Oltramari, Henshel, Cains, & Hoffman, 2015), and there have been efforts to study aspects of cyber defense work (e.g., D'Amico & Whitley, 2008;Mahoney et al, 2010;Stanard et al, 2004).…”