The distributed nature of cyber situation awareness

Tyworth, Michael; Giacobe, Nicklaus A.; Mancuso, Vincent; Dancy, Christopher L.

doi:10.1109/cogsima.2012.6188375

Cited by 22 publications

(16 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Due to the complexity of the cyber security sector as well as lack of information sharing between functional domains, no individual is thought to have the full picture. Instead cyber SA is distributed across individuals and technological agents operating in different functional domains (Tyworth, Giacobe, Mancuso, & Dancy 2012). Little experimental research has been conducted on cyber SA, which is why there is only little data, and few validated assessment methods, available on the actual impact of cyber SA on performance (Franke & Brynielsson 2014).…”

Section: Assessing Team Effectiveness In the Cyber Defense Domainmentioning

confidence: 99%

Measuring team effectiveness in cyber-defense exercises: a cross-disciplinary case study

Granåsen

Andersson

2015

Cogn Tech Work

View full text Add to dashboard Cite

In 2010, IT-security experts from northern European governments and organizations gathered to conduct the first of a series of NATO-led cyber-defense exercises in a pilot attempt of training cyber defense. To gain knowledge on how to assess team effectiveness in cyber-defense exercises, this case study investigates the role of behavioral assessment techniques as a complement to task-based performance measurement. The collected data resulted in a massive data set including system logs, observer reports, and surveys. Six different methods were compared for feasibility in assessing the teams' performance, including automated availability check, exploratory sequential data analysis, and network intrusion detection system attack analysis. In addition, observer reports and surveys were used to collect aspects relating to team structures and processes, aiming to discover whether these aspects can explain differences in effectiveness. The cross-disciplinary approach and multiple metrics create possibilities to study not only the performance-related outcome of the exercise, but also why this result is obtained. The main conclusions found are (1) a combination of technical performance measurements and behavioral assessment techniques are needed to assess team effectiveness, and (2) cyber situation awareness is required not only for the defending teams, but also for the observers and the game control.

show abstract

Section: Assessing Team Effectiveness In the Cyber Defense Domainmentioning

confidence: 99%

Measuring team effectiveness in cyber-defense exercises: a cross-disciplinary case study

Granåsen

Andersson

2015

Cogn Tech Work

View full text Add to dashboard Cite

show abstract

“…The NETS platform is the successor to the NeoCITIES simulation (Hamilton, et al, 2010;Hellar & McNeese, 2010;McNeese, et al, 2005), and was designed based on interviews and observations of cyber security experts (Tyworth, Giacobe, Mancuso, & Dancy, 2012). The NETS platform was previously used to study intrusion detection analyst's situation awareness and decision-making processes (idsNETS, (Mancuso, Minotra, Giacobe, McNeese, & Tyworth, 2012)).…”

Section: Teamnets Simulationmentioning

confidence: 99%

Effects of Integrated and Differentiated Team Knowledge Structures on Distributed Team Cognition

Mancuso

McNeese

2012

Proceedings of the Human Factors and Ergonomics Society Annual

View full text Add to dashboard Cite

This paper describes an experiment to study the effects of varying knowledge structures on distributed team cognition. Using the teamNETS simulation, integrated and differentiated knowledge structures were manipulated by varying the reference materials the participants received during training. While the two knowledge structures had no direct effects on team performance, other results were found for their collaborative processes and team perceptions. Specifically the results showed that teams with differentiated structures worked more independently of each other, simply coordinated their actions and minimal communication, while teams with integrated structures worked more interdependently with a much tighter collaboration and frequent communication.

show abstract

“…Situation awareness research in the cyber domain is dominated by research aimed at automating defensive and/or tactical awareness of a network's attackers [28] e.g., [17]. Only recently has the issue of human cognition and how to improve the situation awareness of the people in the cyber security domain gained attention, e.g., [29], [5], [19].…”

Section: Introductionmentioning

confidence: 99%

Work Domain Analysis for network management revisited: Infrastructure, teams and situation awareness

Paterson

2014

2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support (CogSIMA

View full text Add to dashboard Cite

In this paper preliminary findings are presented from applying Work Domain Analysis (WDA) [33], [23], the first phase of the Cognitive Work Analysis (CWA) framework [33], [23] to the network management domain for the purpose of investigating situation awareness in a network administration team. Our findings suggest that several different strategies are needed to model the problem in different ways.

show abstract

The distributed nature of cyber situation awareness

Cited by 22 publications

References 18 publications

Measuring team effectiveness in cyber-defense exercises: a cross-disciplinary case study

Measuring team effectiveness in cyber-defense exercises: a cross-disciplinary case study

Effects of Integrated and Differentiated Team Knowledge Structures on Distributed Team Cognition

Work Domain Analysis for network management revisited: Infrastructure, teams and situation awareness

Contact Info

Product

Resources

About