Achieving Cyber Defense Situational Awareness: A Cognitive Task Analysis of Information Assurance Analysts

Abstract

A Cognitive Task Analysis (CTA) was performed to investigate the workflow, decision processes, and cognitive demands of information assurance (IA) analysts responsible for defending against attacks on critical computer networks. We interviewed and observed 41 IA analysts responsible for various aspects of cyber defense in seven organizations within the US Department of Defense (DOD) and industry. Results are presented as workflows of the analytical process and as attribute tables including analyst goals, decisions, required knowledge, and obstacles to successful performance. We discuss how IA analysts progress through three stages of situational awareness and how visual representations are likely to facilitate cyber defense situational awareness.

EEVi - framework for evaluating the effectiveness of visualization in cyber-security

“…The papers that were used for the purpose of this research were: D'Amico et al [10], D'Amico et al [11], Erbacher et al [12], Fink et al [13] and Mckenna et al [16]. The reasons these papers were chosen was because of the data they presented.…”

“…These papers gave precise details about analyst roles, the type of data they used, how the analysis were conducted, what the analysts thought about visualization approaches and their experiences, if any, with visualizations. D'Amico et al [10] and D'Amico et al [11] gave insight into roles of analysts and the tasks they perform in organizations. Erbacher et al [12] presents interviews with analysts for the specific purpose of cyber-security visualization.…”

“…It is the "...first look at the raw data and interesting activity" [10] and hence uses Raw Data and Interesting Activities as types of Data. Visualization for Triage Analysis requires abilities to Filter for "...initial filtering" [10] and for "...weeding out false positives..." [11]. It also requires Speed of data access as "...triage period should be on the order of minutes" [12] and a "...relatively fast decision..." [10] A visual representation of this relationship is displayed in Fig.…”

System design considerations for risk perception

“…In terms of the system, this is the need to provide the multiple pieces of information required for understanding. A security analyst rarely relies on one piece of information to fully understand a situation [12]. For example, the results from a vulnerability scan indicating that vulnerabilities exist on a system may require additional checks for false positives.…”

Large scale network situational awareness via 3D gaming technology

“…According to Amico [2], achieving SA requires the analyst to proceed through three stages: perception, comprehension, and projection. The challenges traversing through these stages are: ingesting large volumes of data, sustaining real time response, and presentation in a comprehensible format.…”