Oppositional Human Factors in Cybersecurity: A Preliminary Analysis of Affective States

Ferguson-Walter, Kimberly; Gutzwiller, Robert S.; Scott, Dakota; Johnson, Craig J.

doi:10.1109/asew52652.2021.00040

Cited by 10 publications

(15 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For identifying and analyzing participant responses, we conducted a thematic analysis of the prior study dataset (Ferguson-Walter et al, 2019a; 2019b). Very early initial results for a portion of this data were reported in Ferguson-Walter et al (2021); and given that prior work, we want to clarify that all data here was originally collected in Ferguson-Walter et al (2019a) and only initially analyzed for counts and categories for Day 1 data (Ferguson-Walter et al, 2021). In the current work, we report the final Day 1 results including the use of Likert ratings which resulted in removing data with Likert ratings of '1' (which indicated none, rather than low), and the entirely new Day 2 results including the same information.…”

Section: Methodsmentioning

confidence: 99%

Frustration, Confusion, Surprise, Confidence, And Self-Doubt: Cyber Operators’ Affects During A Realistic Experiment

Gutzwiller,

Gilbert,

Drescher

et al. 2023

Proceedings of the Human Factors and Ergonomics Society Annual

Self Cite

View full text Add to dashboard Cite

In this paper we examine data from a complex two-day experiment with professional cyber red teamers to determine what creates, or contributes, to affective states that may further disrupt attackers. Participants rated their frustration, surprise, confidence, self-doubt, and confusion at the end of each day, and these responses were scored on a Likert scale and using Thematic analysis. We found several elements strongly contributed to the frequency and severity of these affective states, supporting our initial hypothesis, and further that (1) experiencing a Lack of Progress impacted four of the five states with moderate severity, and (2) interacting with elements in the environment that Deviated from what was expected was associated strongly with surprise. Implications for cyber defense and limitations of the method are discussed.

show abstract

Section: Methodsmentioning

confidence: 99%

Frustration, Confusion, Surprise, Confidence, And Self-Doubt: Cyber Operators’ Affects During A Realistic Experiment

Gutzwiller,

Gilbert,

Drescher

et al. 2023

Proceedings of the Human Factors and Ergonomics Society Annual

Self Cite

View full text Add to dashboard Cite

show abstract

“…One can easily imagine biasing selection, or other decisions, toward less-valuable elements in the network. There is also evidence these approaches can alter or influence affect and performance in attackers by making them feel frustration and confusion (Ferguson-Walter, 2020; Ferguson-Walter et al, 2021a). Secondly, a more thorough understanding of attacker cognition and decision-making enables new methods of network design, which could be specifically developed to produce that behavior.…”

Section: Introductionmentioning

confidence: 99%

“…Basic details of the study necessary to understand the bias methodology are described next. For rich detail on the experiment design, measures, and outcomes, the interested reader is referred to (Ferguson-Walter, 2020; Ferguson-Walter et al, 2019a, 2019b, 2021a, 2021b). The study team was covered under the IRB protocol for the original study.…”

Section: Introductionmentioning

confidence: 99%

Exploratory Analysis of Decision-Making Biases of Professional Red Teamers in a Cyber-Attack Dataset

Gutzwiller,

Rheem,

Ferguson-Walter

et al. 2023

Journal of Cognitive Engineering and Decision Making

Self Cite

View full text Add to dashboard Cite

Attacker psychology is currently under-examined in cybersecurity research. A prior, large-scale study sought to understand attackers’ behavior by testing both technological and psychological deception. Professional “red team” members participated over two days in various conditions. This data was examined for further evidence that cognitive biases, a potential disruption for attackers, may be present, and may be affecting the outcome. An applied, novel methodology for measuring confirmation bias and framing effects is presented using this realistic dataset. Both confirmation bias and the framing effect occurred in this interpretation. The framing effect appears to have reduced attacker interactions with systems in the network, which may benefit cyber defenders. These results provide additional, exploratory evidence that biases in the decision-making of cyber attackers could be used as part of a defensive cyber strategy. Limitations to the approach and directions for future study of attackers are discussed.

show abstract

“…OHF research has thus far focused on individuals (Ferguson-Walter, Gutzwiller, et al, 2021). However, malicious attackers (and red teamers) often work within teams.…”

Section: Introductionmentioning

confidence: 99%

“…Oppositional Human Factors (OHF;Gutzwiller et al, 2018), in contrast, proposes that cyber defense can also be improved by selectively reversing human factors advice and recommendations to create systems that disrupt the performance of attackers. Examples of OHF include implementing cyber and psychological deception (Ferguson-Walter, Major, et al, 2019;Ferguson-Walter, Major, et al, 2021) and inducing decision-making biases in cyber attackers (Cranford et al, 2021;Ferguson-Walter et al, 2017).OHF research has thus far focused on individuals (Ferguson-Walter, Gutzwiller, et al, 2021). However, malicious attackers (and red teamers) often work within teams.…”

mentioning

confidence: 99%

Investigating Cyber Attacker Team Cognition

Johnson

Ferguson-Walter²,

Gutzwiller

et al. 2022

Proceedings of the Human Factors and Ergonomics Society Annual

Self Cite

View full text Add to dashboard Cite

Cyber attackers commonly operate in teams, which may process information collectively and thus, may be best understood when the team is treated as the unit of analysis. Future research in Oppositional Human Factors (OHF) should consider the impact of team-influencing and team-level biases and the impact that defensive interventions have on team cognition in general. Existing measurement approaches using team interactions may be well suited for studying red teams, and how OHF interventions impact cyber attackers.

show abstract

Oppositional Human Factors in Cybersecurity: A Preliminary Analysis of Affective States

Cited by 10 publications

References 11 publications

Frustration, Confusion, Surprise, Confidence, And Self-Doubt: Cyber Operators’ Affects During A Realistic Experiment

Frustration, Confusion, Surprise, Confidence, And Self-Doubt: Cyber Operators’ Affects During A Realistic Experiment

Exploratory Analysis of Decision-Making Biases of Professional Red Teamers in a Cyber-Attack Dataset

Investigating Cyber Attacker Team Cognition

Contact Info

Product

Resources

About