Effects of Gain/Loss Framing in Cyber Defense Decision-Making

Abstract

Cyber defense requires decision making under uncertainty, yet this critical area has not been a focus of research in judgment and decision-making. Future defense systems, which will rely on software-defined networks and may employ “moving target” defenses, will increasingly automate lower level detection and analysis, but will still require humans in the loop for higher level judgment. We studied the decision making process and outcomes of 17 experienced network defense professionals who worked through a set of realistic network defense scenarios. We manipulated gain versus loss framing in a cyber defense scenario, and found significant effects in one of two focal problems. Defenders that began with a network already in quarantine (gain framing) used a quarantine system more, as measured by cost, than those that did not (loss framing). We also found some difference in perceived workload and efficacy. Alternate explanations of these findings and implications for network defense are discussed.

Opportunities and Challenges for Human-Machine Teaming in Cybersecurity Operations

“…This arrangement is rapidly being re-negotiated, however, as new systems automate risk assessment, and make decisions according to rules both learned and inferred. Our own work has examined, among other things, the context of applying network "'quarantines" under simulated attacks (Bos, et al, 2016;Arendt, et al 2015). We are also examining human mental models of these AI systems, including the ability to assess weaknesses and bias.…”

Exploratory Analysis of Decision-Making Biases of Professional Red Teamers in a Cyber-Attack Dataset

“…In a particularly compelling and applied experimental example, biases were tested as part of investigating the management of a business network under attack (Bos et al, 2016) as part of a test of prospect theory (Tversky & Kahneman, 1991). Prospect theory predicts that people are generally loss averse meaning they are more likely to work to avoid loss, rather than pursuing perceived gains.…”

“…Prospect theory predicts that people are generally loss averse meaning they are more likely to work to avoid loss, rather than pursuing perceived gains. Bos et al (2016) provided evidence that such gain/loss framing effects were operating for cyber defense decision-making. In their experiment, participants were provided with a network that was compromised by a cyber-attack.…”

Frustration, Confusion, Surprise, Confidence, And Self-Doubt: Cyber Operators’ Affects During A Realistic Experiment

“…The goal here is similar: to understand what may influence defenders to make poor decisions in mitigating the attackers or in other areas of their operations by understanding their psychological behaviors. A good example is Bos, Paul, Gersh, et. al (2016) who gave defenders with a network potentially under attack in one of two different states; one that was already in quarantine (a gain framing, based on the idea that machines removed from the quarantine would be available to enable the business to return to normal), or a network that was not quarantined being presented as a loss frame (every machine taken off would degrade the business).…”