Achieving cyber defense situational awareness: A cognitive task analysis of information assurance analysts

D’Amico, Anita; Whitley, Kirsten; Tesone, Daniel; O'Brien, Brianne; Roth, Emilie M.

doi:10.1037/e577392012-004

Cited by 48 publications

(69 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The few published studies of work domain analyses and cognitive analyses of network defenders [3,8,13], and unpublished work we have had the opportunity to review or in which we participated, have relied on multi-page Visio-type drawings and extensive tables to capture and communicate findings. Cognitive task analyses in different, but equally complex, domains [11] use similar tabular and charting techniques.…”

Section: Related Workmentioning

confidence: 99%

Visual analysis of goal-directed network defense decisions

Horn

D’Amico

2011

Proceedings of the 8th International Symposium on Visualization for Cyber Security

Self Cite

View full text Add to dashboard Cite

Security visualization has been focused largely on graphic representation of data and relationships between network activity, security sensor output, and attacker activity. Visual analysis tools have not been designed to facilitate the analysis of data related to defender activities and decisions. This paper reports on the initial effort of a research team to use visual analytics to support the modeling of the computer network defense (CND) decision process of an organization. We describe a tool to support the visual analysis of a hierarchical decision structure represented in a portable, file-based database. The tool visualizes and traces relationships between decision goals, sub-goals, decisions, information requirements, and data sources.

show abstract

Section: Related Workmentioning

confidence: 99%

Visual analysis of goal-directed network defense decisions

Horn

D’Amico

2011

Proceedings of the 8th International Symposium on Visualization for Cyber Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…This resulted in an initial series of questions such as the time frame we needed to consider for this level of analysis. Such questions were primarily answered from existing Cognitive Task Analysis (CTAs), especially Anita D'Amico's from Secure Decisions [2] and Stefano Foresti's from the University of Utah [12]. Second, was an initial set of individual interviews with network analysts and managers.…”

Section: Visualization Design For Decision Makersmentioning

confidence: 99%

Visualization design for immediate high-level situational assessment

Erbacher

2012

Proceedings of the Ninth International Symposium on Visualization for Cyber Security

View full text Add to dashboard Cite

We present the design of a visualization technique based on the results of a human in the loop process, which relied on network managers and network analysts. This visualization design was directly targeted at supporting tasks identified by the domain experts. This was the need for the ability to provide rapid and immediate assessment of the state of the network and associated hosts. This visualization technique, the Cyber Command Gauge Cluster (CCGC), allows analysts to review the state of the network and locate potentially problematic anomalies, drill down into those anomalies, and prioritize the anomalies for detailed analysis and remediation. By providing a summary representation combined with independent representations of critical parameters, the technique is unique in its ability to aid decision makers in making rapid assessments and prioritization of identified anomalies. While the prototype focuses on network analysis, the technique is devised to provide generalized support for situational awareness in any domain. The generalized parameter mapping allows the technique to be applicable to any level of decision making, from the front-line network analyst to the CIO.

show abstract

“…Network defense analysts work in a dynamic, always changing, complex environment, with intense time pressures and a need-to-act [3,5]. Ethnographic methods, such a field observation and interviews [1,2,4,5,7], have been favored as a way to understand this rich, complex environment.…”

Section: Introductionmentioning

confidence: 99%

“…Even once they are recruited, they are always very busy, overworked, and have limited time that they can dedicate away from their responsibilities to participate in research [1]. Perhaps one of the most limiting challenges is the sensitivity of the information environment of a large network and the hesitation of sharing that information with outsiders [1,4,7].…”

Section: Introductionmentioning

confidence: 99%

Human-Centered Study of a Network Operations Center

Paul

2014

Proceedings of the 2014 ACM Workshop on Security Information Workers

View full text Add to dashboard Cite

Network operations centers are notoriously difficult places to conduct human-centered research. The intense pace and sensitive information environment creates a number of hurdles for researchers. This paper shares the experiences from humancentered research of a government network operations center. The lessons learned from conducting interviews, field observations, and a card sorting study offer guidance to those who may study network operations centers in the future.

show abstract

Achieving cyber defense situational awareness: A cognitive task analysis of information assurance analysts

Cited by 48 publications

References 0 publications

Visual analysis of goal-directed network defense decisions

Visual analysis of goal-directed network defense decisions

Visualization design for immediate high-level situational assessment

Human-Centered Study of a Network Operations Center

Contact Info

Product

Resources

About