A Human Factors Psychology Approach to Immersive Cyber Incident Response

点击翻译按钮获取中文摘要

Context. Cybersecurity incident response is a form of emergency response. The incidents might involve an individual actor responding to an isolated attack, or a multi-agency group of actors responding to a multi-pronged attack on national infrastructure. This project concerns understanding cybersecurity incident response in the context of opportunities for actors to make use of (i) automated alerts to cyber attacks, from rule-based systems, and (ii) increasingly AI-driven responses. The interdisciplinary problem space is to understand: (i) the individual and group dynamics that lead to an in/effective cyber incident response; (ii) the role played by automated methods for attack detection and how "dialling automated alerts up and down" have an impact of accuracy/effectiveness of decision making under pressure; and (iii) how humans develop trust with algorithmic approaches (e.g. AI-driven cyber incident responses) that enable hybrid approaches that can handle small and large-scale attacks. Approach. The experimental work will use our immersive cyber attack labs to launch attacks on a replica enterprise IT network, and will study how experts (drawn from industry partners and broader emergency responders) respond to these attacks in our immersive dome and Security Operations Centre (depending on which is best suited to task). Experimental scenarios will vary in complexity, and include the provision and integration of automated alerts. In each case, we will study the responses of actors and groups, and tailor decision-making playbooks to improve the response. For the automated cyber incident response, we will conduct experiments to help improve human acceptability of and trust in algorithmic decision making, using well-established questionnaires and correlated real-time behavioural indices of trust. To the best of our knowledge this is all novel research Value to the field. The value to Psychology will be new insights into decision making under pressure for cybersecurity incident response, building on the award winning work with the UK Fire and Rescue Service and broader emergency services (e.g., Strategic Coordinating Groups). It will lead to journal articles on this topic. In Computer Science, the research will lead to new insights into how AI can drive automated cyber responses in such a way that humans are content to work with the algorithmic approaches, and will work towards adopting them as part of everyday practice.