Cyber situation awareness as distributed socio-cognitive work

Abstract

A key challenge for human cybersecurity operators is to develop an understanding of what is happening within, and to, their network. This understanding, or situation awareness, provides the cognitive basis for human operators to take action within their environments. Yet developing situation awareness of cyberspace (cyber-SA) is understood to be extremely difficult given the scope of the operating environment, the highly dynamic nature of the environment and the absence of physical constraints that serve to bound the cognitive task 23 . As a result, human cybersecurity operators are often "flying blind" regarding understanding the source, nature, and likely impact of malicious activity on their networked assets. In recent years, many scholars have dedicated their attention to finding ways to improve cyber-SA in human operators. In this paper we present our findings from our ongoing research of how cybersecurity analysts develop and maintain cyber-SA. Drawing from over twenty interviews of analysts working in the military, government, industrial, and educational domains, we find that cyber-SA to be distributed across human operators and technological artifacts operating in different functional areas.

Identifying Expertise Gaps in Cyber Incident Response: Cyber Defender Needs vs. Technological Development

“…Situation awareness (SA) literature specifically discusses how systems can support multiple levels of SA in relation to expertise, which can act as guidelines for system development and design [38]. Additional cyber SA literature and ongoing research [39][40][41][42] also may help guide application design specifically for cyber security.…”

Observing Cyber Security Incident Response: Qualitative Themes From Field Research

“…The study of CSIRTs is different than cognitive expertise studies of individual analysts because CSIR is a distributed, team-based activity. A team-focused perspective was pervasive in the literature, including the study of situation awareness (e.g., Tyworth, Giacobe, & Mancuso, 2012). Work has examined CSIRTs in terms of large-scale issues, such as workforce development, team effectiveness and the social maturity of teams (Hoffman, Burley, & Toregas, 2012;Steinke et al, 2015;Tetrick et al, 2016).…”

On the collaborative practices of cyber threat intelligence analysts to develop and utilize tacit Threat and Defence Knowledge

“…Botta et al [60], [76] conduct interviews to investigate the organizational practices of cyberdefenders and how they achieve distributed cognition [77] within the organization. Tyworth et al [78] interviewed security analysts and similarly find that cyber SA is distributed across human operators and technological artifacts operating in four different functional areas: intrusion detection, threat landscape analysis, operations and policy and management. Each operational domain is separated by physical and virtual boundaries with individual communities of practice, which have distinct knowledge, terminologies, foci, understandings and practices and may even lie distributed outside the organization.…”