Cybersecurity has large-scale versions of the challenges common to sociotechnical systems; in this high-risk, dynamic environment, attacks on organizations and governments are increasing in frequency, sophistication, and severity. In this paper, we summarize existing understanding of situation awareness in cybersecurity and propose additional factors that reflect emerging technology in the domain, incorporate the rising role of automation in cybersecurity, and are relevant to diverse organizations. To do this, we apply a distributed, sociotechnical systems approach to SA and consider the importance of multiteam cognition. Finally, we describe strategies for measurement to support future empirical research in cybersecurity.
References
1.
BarfordP.DacierM.DietterichT. G.FredriksonM.GiffinJ.JajodiaS.… YenJ. (2010). Cyber SA: Situational awareness for cyber defense. Advances in Information Security, 46. https://doi.org/10.1007/978-1-4419-0140-8
2.
BoyceM. W.DumaK. M.HettingerL. J.MaloneT. B.WilsonD. P.Lockett-ReynoldsJ. (2011). Human Performance in Cybersecurity: A Research Agenda. Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 55(1), 1115–1119. https://doi.org/10.1177/1071181311551233
ChenT. R.ShoreD. B.ZaccaroS. J.DalalR. S.TetrickL. E.GorabA. K. (2014). An organizational psychology perspective to examining computer security incident response teams. IEEE Security Privacy, 12(5), 61–67.
6.
Cisco Systems (2017). Cisco 2017 annual cybersecurity report.
7.
CooperR. B.WolfeR. A. (2005). Information processing model of information technology adaptation: an intra-organizational diffusion perspective. SIGMIS Database, 36(1), 30–48. https://doi.org/10.1145/1047070.1047074
8.
D’AmicoA. D.GoodallJ. R.TesoneD. R.KopylecJ. K. (2007). Visual discovery in computer network defense. IEEE Computer Graphics and Applications, 27(5), 20–27. https://doi.org/10.1109/MCG.2007.137
9.
EndsleyM. R. (1988). Situation awareness global assessment technique (SAGAT). IEEE 1988 National Aerospace and Electronics Conference, 3, 789–795. https://doi.org/10.1109/NAECON.1988.195097
10.
EndsleyM. R. (1995). Toward a theory of situation awareness in dynamic systems. Human Factors, 37(1), 32–64.
11.
EndsleyM. R. (2000). Direct measurement of situation awareness: Validity and use of SAGAT. In EndsleyM. R.GarlandD. J. (Eds.), Situation Awareness Analysis and Measurement (pp. 147–173). Mahwah, NJ: Lawrence Erlbaum Associates.
12.
EndsleyM. R.KirisE. O. (1995). The out-of-the-loop performance problem and level of control in automation. Human Factors, 37, 381–394. https://doi.org/10.1518/001872095779064555
FrankeU.BrynielssonJ. (2014). Cyber situational awareness – A systematic review of the literature. Computers & Security, 46, 18–31. https://doi.org/10.1016/j.cose.2014.06.008
15.
GutzwillerR. S.FugateS.SawyerB. D.HancockP. A. (2015). The Human Factors of Cyber Network Defense. Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 59(1), 322–326. https://doi.org/10.1177/1541931215591067
16.
GutzwillerR. S.HuntS. M.LangeD. S. (2016). A task analysis toward characterizing cyber-cognitive situation awareness (CCSA) in cyber defense analysts. IEEE International Multi-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA2016, 14–20.
HutchinsE. (1995b). Cognition in the wild. Cambridge, MA: MIT Press.
19.
LeeJ. D.WickensC. D.LiuY.BoyleL. N. (2017). Designing for people: an introduction to human factors engineering (3rd ed.). Charleston, SC: CreateSpace.
20.
LineM. B.ZandA.StringhiniG.KemmererR. (2014). Targeted attacks against industrial control systems: is the power industry prepared?SEGS Proceedings for the 2nd Workshop On Smart Energy Grid Security, 13-22. DOI: 10.1145/2667190.2667192
McNeeseM.CookeN. J.D’AmicoA.EndsleyM. R.GonzalezC.RothE.SalasE. (2012). Perspectives on the role of cognition in cyber security. Proceedings of the Human Factors and Ergonomics Society 56th Annual Meeting, 56(1), 268–271. https://doi.org/10.1177/1071181312561063
23.
NewhouseW.KeithS.ScribnerB.WitteG. (2017). National initiative for cybersecurity education (NICE) cybersecurity workforce framework (No. NIST SP 800-181). Gaithersburg, MD: National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-181
TosattoA.RuiuP.AttanasioA. (2015). Container-based orchestration in cloud: state of the art and challenges. In 2015 Ninth International Conference on Complex, Intelligent, and Software Intensive Systems, 70–75. https://doi.org/10.1109/CISIS.2015.35
StantonN. A.SalmonP. M.WalkerG. H. (2015). Let the reader decide: A paradigm shift for situation awareness in sociotechnical systems. Journal of Cognitive Engineering and Decision Making, 9(1), 44–50. https://doi.org/10.1177/1555343414552297
28.
StantonN. A.StewartR.HarrisD.HoughtonR. J.BaberC.McmasterR.… GreenD. (2006). Distributed situation awareness in dynamic systems: Theoretical development and application of an ergonomics methodology. Ergonomics, 49, 1288–1311.
29.
RoegeP. E.CollierZ. A.ChevardinV.ChouinardP.FlorinM. V.LambertJ. H.… TodorovicB. (2017). Bridging the gap from cyber security to resilience. In Resilience and Risk (pp. 383-414). Springer, Dordrecht.
VicenteK.J. (1999). Cognitive work analysis. Lawrence Erlbaum Associates, Publishers, Mahwah, NJ.
32.
YurcikW.BarlowJ.RosendaleJ. (2003). Maintaining perspective on who is the enemy in the security systems administration of computer networks. ACM CHI Workshop on System Administrators Are Users, 345. ACM Press.
33.
ZaccaroS. J.DalalR. S.TetrickL. E.SteinkeJ. A. (Eds.). (2016). Psychosocial dynamics of cyber security. New York, NY: Routledge.
