Cyber Teaming and Role Specialization in a Cyber Security Defense Competition

Abstract

A critical requirement for developing a cyber capable workforce is to understand how to challenge, assess, and rapidly develop human cyber skill-sets in realistic cyber operational environments. Fortunately, cyber team competitions make use of simulated operational environments with scoring criteria of task performance that objectively define overall team effectiveness, thus providing the means and context for observation and analysis of cyber teaming. Such competitions allow researchers to address the key determinants that make a cyber defense team more or less effective in responding to and mitigating cyber attacks. For this purpose, we analyzed data collected at the 12th annual Mid-Atlantic Collegiate Cyber Defense Competition (MACCDC, http://www.maccdc.org), where eight teams were evaluated along four independent scoring dimensions: maintaining services, incident response, scenario injects, and thwarting adversarial activities. Data collected from the 13-point OAT (Observational Assessment of Teamwork) instrument by embedded observers and a cyber teamwork survey completed by all participants were used to assess teamwork and leadership behaviors and team composition and work processes, respectively. The scores from the competition were used as an outcome measure in our analysis to extract key features of team process, structure, leadership, and skill-sets in relation to effective cyber defense. We used Bayesian regression to relate scored performance during the competition to team skill composition, team experience level, and an observational construct of team collaboration. Our results indicate that effective collaboration, experience, and functional role-specialization within the teams are important factors that determine the success of these teams in the competition and are important observational predictors of the timely detection and effective mitigation of ongoing cyber attacks. These results support theories of team maturation and the development of functional team cognition applied to mastering cybersecurity.

Self-Regulation and Cognitive Agility in Cyber Operations

“…The tasks in which cyber operators engage have been described as varied, often non-routine, and involve perception and comprehending large amounts of information (Erbacher et al, 2010). Cyber operator tasks include both human and technical aspects and: “…is heavily reliant upon the decision-making capabilities and skill-sets of defenders to overcome attackers” (Buchler et al, 2018). Ben-Asher and Gonzalez (2015) propose that cyber operators need updated theoretical knowledge, practical experience and training in how to: “…quickly learn and adapt to novel and dynamic environments” (p. 60).…”

“…While technical cyber competence is paramount to operate in the cyber domain, the soft skills and cognitive competencies have started to receive more attention. The high cognitive demands of cyber operators have been widely acknowledged (Tapscott, 2014; Røislien, 2015; D’Amico et al, 2016; Buchler et al, 2018); however, the soft skills 1 and cognitive competencies 2 contribution to cyber operator performance is yet to be empirically validated (Forsythe et al, 2013; Lathrop et al, 2016; Helkala et al, 2017; Knox B. et al, 2018).…”

“…Lathrop et al (2016) propose that cyber operators are reliant on competencies like sensemaking, creative thinking, mental projection, and other high-level cognitive functions to perform. Further, cyber operators’ ability to collaborate, organize, and analyze problems has been described as: “… just as important as their technical acumen on the keyboard” (Buchler et al, 2018). However, it is unclear how these competencies relate to cyber operator performance.…”

Cyber Security Beyond the Industry 4.0 Era. A Short Review on a Few Technological Promises

“…As time goes by, the number of connected devices and their usage will be rising, and as a result of this, the convolution of cyberinfrastructure will exponentially increase. However, as these numbers increase, another major problem associated with the issue is that more vulnerable devices will emerge from this phenomenon hence the need to have a cyber security workforce which will underpin the developing cyberinfrastructure hence protecting the networks [36]. Consequently, with the inception of cyber security and how this issue is pivotal in maintaining the integrity of the cyberspace for many industries, there has been a growing need and demand for the development of various cyber security workforces and the pertinent framework which can offer some of the crucial roles of the cyber workforce.…”

Exploring C2 Capability and Effectiveness in Challenging Situations : Interorganizational Crisis Management, Military Operations and Cyber Defence

“…A perspective that is discussed to a smaller extent is competence. All domains consist of people with specialized skills, however, the cyber domain is extreme in this sense (Buchler, 2018). The cyber-teams in the exercise could not have solved their tasks without sufficient technical skills, no matter how well-coordinated or agile they had been.…”