A Human Factors Psychology Approach to Immersive Cyber Incident Response

上下文。网络安全事件响应是应急响应的一种形式。这些事件可能涉及单个行为者对孤立攻击的响应，或涉及多机构行为者对针对国家基础设施的多管齐下攻击的响应。该项目涉及在行动者有机会利用(i)基于规则的系统对网络攻击发出自动警报的背景下理解网络安全事件响应，以及（ii）越来越多的人工智能驱动响应。跨学科的问题空间是要理解：(i)导致有效的网络事件响应的个人和群体动态；（ii）侦测攻击的自动化方法所扮演的角色，以及“上下调拨自动警报”如何影响在压力下决策的准确性/有效性；（iii）人类如何通过算法方法（例如人工智能驱动的网络事件响应）建立信任，从而实现可以处理小型和大规模攻击的混合方法。的方法。实验工作将使用我们的沉浸式网络攻击实验室对复制的企业IT网络发起攻击，并将研究专家（从行业合作伙伴和更广泛的应急响应人员中抽取）如何在我们的沉浸式穹顶和安全运营中心（取决于哪个最适合任务）应对这些攻击。实验场景的复杂性各不相同，并且包括自动警报的提供和集成。在每种情况下，我们将研究参与者和群体的反应，并定制决策剧本以改进反应。对于自动网络事件响应，我们将进行实验，以帮助提高人类对算法决策的接受度和信任，使用完善的问卷调查和相关的实时信任行为指数。据我们所知，这些都是本领域新颖的研究价值。心理学的价值将是对网络安全事件响应压力下决策的新见解，建立在与英国消防和救援服务以及更广泛的紧急服务（例如，战略协调小组）的获奖工作的基础上。这将导致关于这个主题的期刊文章。在计算机科学领域，这项研究将为人工智能如何驱动自动网络反应提供新的见解，使人类满足于使用算法方法，并将努力将其作为日常实践的一部分。

Context. Cybersecurity incident response is a form of emergency response. The incidents might involve an individual actor responding to an isolated attack, or a multi-agency group of actors responding to a multi-pronged attack on national infrastructure. This project concerns understanding cybersecurity incident response in the context of opportunities for actors to make use of (i) automated alerts to cyber attacks, from rule-based systems, and (ii) increasingly AI-driven responses. The interdisciplinary problem space is to understand: (i) the individual and group dynamics that lead to an in/effective cyber incident response; (ii) the role played by automated methods for attack detection and how "dialling automated alerts up and down" have an impact of accuracy/effectiveness of decision making under pressure; and (iii) how humans develop trust with algorithmic approaches (e.g. AI-driven cyber incident responses) that enable hybrid approaches that can handle small and large-scale attacks. Approach. The experimental work will use our immersive cyber attack labs to launch attacks on a replica enterprise IT network, and will study how experts (drawn from industry partners and broader emergency responders) respond to these attacks in our immersive dome and Security Operations Centre (depending on which is best suited to task). Experimental scenarios will vary in complexity, and include the provision and integration of automated alerts. In each case, we will study the responses of actors and groups, and tailor decision-making playbooks to improve the response. For the automated cyber incident response, we will conduct experiments to help improve human acceptability of and trust in algorithmic decision making, using well-established questionnaires and correlated real-time behavioural indices of trust. To the best of our knowledge this is all novel research Value to the field. The value to Psychology will be new insights into decision making under pressure for cybersecurity incident response, building on the award winning work with the UK Fire and Rescue Service and broader emergency services (e.g., Strategic Coordinating Groups). It will lead to journal articles on this topic. In Computer Science, the research will lead to new insights into how AI can drive automated cyber responses in such a way that humans are content to work with the algorithmic approaches, and will work towards adopting them as part of everyday practice.