A Human Factors Psychology Approach to Immersive Cyber Incident Response

上下文。网络安全事件应对是应急响应的一种形式。这些事件可能涉及单个行为者对单独的攻击做出反应，也可能涉及一个由多个机构组成的行为者群体对针对国家基础设施的多管齐下的攻击做出反应。该项目涉及在行动者利用(I)来自基于规则的系统的对网络攻击的自动警报和(Ii)越来越多的人工智能驱动的响应的机会的背景下理解网络安全事件的响应。跨学科的问题空间是理解：(I)导致网络事件响应无效/有效的个人和群体动态；(Ii)自动攻击检测方法所起的作用，以及“上下拨打自动警报”如何影响压力下决策的准确性/有效性；以及(Iii)人类如何发展对算法方法的信任(例如，人工智能驱动的网络事件响应)，使混合方法能够处理小规模和大规模的攻击。接近。实验工作将使用我们的沉浸式网络攻击实验室对复制的企业IT网络发动攻击，并将研究专家(来自行业合作伙伴和更广泛的应急人员)如何在我们的沉浸式穹顶和安全运营中心(取决于哪种攻击最适合执行任务)对这些攻击做出反应。实验场景的复杂程度各不相同，其中包括提供和集成自动警报。在每一种情况下，我们都将研究演员和团体的反应，并量身定做决策剧本，以改善反应。对于自动网络事件响应，我们将使用完善的问卷和相关的实时信任行为指数进行实验，以帮助提高人们对算法决策的接受度和信任度。就我们所知，这都是该领域的新奇研究价值。心理学的价值将是在与英国消防和救援服务以及更广泛的紧急服务(例如战略协调小组)获奖工作的基础上，对网络安全事件响应压力下的决策做出新的见解。它将导致有关这一主题的期刊文章。在计算机科学方面，这项研究将带来新的见解，即人工智能如何以一种人类满足于使用算法方法的方式驱动自动网络响应，并将努力将其作为日常实践的一部分。

Context. Cybersecurity incident response is a form of emergency response. The incidents might involve an individual actor responding to an isolated attack, or a multi-agency group of actors responding to a multi-pronged attack on national infrastructure. This project concerns understanding cybersecurity incident response in the context of opportunities for actors to make use of (i) automated alerts to cyber attacks, from rule-based systems, and (ii) increasingly AI-driven responses. The interdisciplinary problem space is to understand: (i) the individual and group dynamics that lead to an in/effective cyber incident response; (ii) the role played by automated methods for attack detection and how "dialling automated alerts up and down" have an impact of accuracy/effectiveness of decision making under pressure; and (iii) how humans develop trust with algorithmic approaches (e.g. AI-driven cyber incident responses) that enable hybrid approaches that can handle small and large-scale attacks. Approach. The experimental work will use our immersive cyber attack labs to launch attacks on a replica enterprise IT network, and will study how experts (drawn from industry partners and broader emergency responders) respond to these attacks in our immersive dome and Security Operations Centre (depending on which is best suited to task). Experimental scenarios will vary in complexity, and include the provision and integration of automated alerts. In each case, we will study the responses of actors and groups, and tailor decision-making playbooks to improve the response. For the automated cyber incident response, we will conduct experiments to help improve human acceptability of and trust in algorithmic decision making, using well-established questionnaires and correlated real-time behavioural indices of trust. To the best of our knowledge this is all novel research Value to the field. The value to Psychology will be new insights into decision making under pressure for cybersecurity incident response, building on the award winning work with the UK Fire and Rescue Service and broader emergency services (e.g., Strategic Coordinating Groups). It will lead to journal articles on this topic. In Computer Science, the research will lead to new insights into how AI can drive automated cyber responses in such a way that humans are content to work with the algorithmic approaches, and will work towards adopting them as part of everyday practice.