Exploring the Effects of “Low and Slow” Cyber Attacks on Team Decision Making

Abstract

This paper describes an experiment on the effects of low and slow cyber attacks on team decision making. Specifically, the study focuses on how targeted communications, disguised as originating from reliable sources, can be used to disseminate false information and instantiate biases in a team to disrupt normal decision-making processes. Using a team consensus task (the Life Event Stress Test), we manipulated the presence of a shared anchor (the disguised communication), and the presence of individual anchors. Our results indicated that, while teams were able to utilize their collaborative processes to reject the shared anchors, they were still susceptible to individual anchors. While only an introductory study with a limited sample size, the results contribute to both the cyber security and team decision-making literature. Implications for future research are also discussed.

Human Factors of Cyber Attacks

“…To date, most of this research has been focused on social engineering tactics (e.g. Kelly et al, 2012;Hong et al, 2013), and information operations (Finomore et al, 2013;Mancuso et al, 2013), but these represent a small sample of possible vectors that could affect humans.…”

“…Previous research considering the outcome of cyber attacks has been limited and mainly focused on decision making outcomes, rather than on more sensitive effects that may be longitudinal (e.g. Finomore et al, 2013;Hong et al, 2013;Kelly et al, 2012;Mancuso et al, 2013). As new types of attacks emerge, and with the constant threat of traditional cyber attacks looming, future research must aim to understand the full scope of operational outcomes across technological, human-centered, and socio-organizational variables.…”

Behavioral responses to a cyber attack in a hospital environment

“…Regarding IT-Security incidents in a hospital environment, there are few published studies. Behavioral research on victims of cyberattacks and the consequences of such attacks have applied different approaches to investigate the stress levels 26 , socio-psychological impacts 27 , and effects on team performance in general 28 . These works have highlighted a strong interaction between psychological and technical factors in a subject area of public interest.…”

When actions speak louder than words: Using changes in operator behavior and system efficiency measures to detect the presence of a cyber attack

“…The aim of such attacks is to evade detection for long durations, allowing them to cause as much harm as possible. As a result, such attacks are sometimes referred to as "low and slow" (e.g., Mancuso et al, 2013).It is unknown how effective operators are likely to be at detecting and correctly diagnosing the symptoms of low and slow cyber attacks. Recent research by Hirshfield and colleagues (2015) suggests that the symptoms of the attack may need to be extreme in order to gain operator recognition.…”

“…The aim of such attacks is to evade detection for long durations, allowing them to cause as much harm as possible. As a result, such attacks are sometimes referred to as "low and slow" (e.g., Mancuso et al, 2013).…”