Elicitation by Critiquing: Applications to Computer Network Defense

With an increasing frequency of data breaches suffered by organizations, computer network defense (CND) is becoming an increasingly important concern. With understanding of how cybersecurity professionals engage in the cognitive aspects of their work, human factors researchers and practitioners can improve tools and training. By optimizing the tools and training network defenders rely on to detect and respond to novel network threats, the cybersecurity workforce will be strengthened. While cognitive task analysis (CTA) is well-positioned to represent the cognitive work of CND, we identify challenges practitioners are likely to encounter in the field. Through a review of published CTAs in CND and other domains, we provide guidance for future CTA efforts in CND. Finally, we present an argument for the use of Elicitation by Critiquing (EBC) and demonstrate its efficacy in mitigating the challenges of applying CTA in CND.