Human-Human Communication in Cyber Threat Situations: A Systematic Review

Abstract

In cyber threat situations, decision-making within organizations and between the affected organization and external entities are high-stake situations. They require human communication entailing technical complexity, time pressure, interdisciplinary, and often insufficient information basis. Communication in cyber threat situations within socio-technical systems can thus be challenging and has a variety of implications for decision-making. The cyberphysical system is a rapidly changing socio-technical system that is understudied in terms of how cyber events are communicated and acted upon to secure and maintain cyber resilience. The present study is the first to review human-tohuman communication in cyber threat situations. Our aims are to (1) outline how human-human communication performance in cybersecurity settings have been studied; (2) to uncover areas where there is potential for developing common standards for information exchange in collaborative settings, and; (3) to provide guidance for future research efforts. The review was carried out according to the PRISMA guidelines and articles were searched for on Google Scholar, ScienceDirect, Taylor & Francis, and IEEE. Primary research articles and reviews focusing on human-human communication in cyber threat situations published in peer reviewed journals or as conference papers were included. A total of 17 studies were included in the final review. Most of the studies were correlational and exploratory in nature. Very few studies characterize communication in useful goal-related terms.

A Gamification Approach to Improving Interpersonal Situational Awareness in Cyber Defense

“…During a cyber threat situation, cyber defense decisions must be grounded in an accurate situational understanding to achieve defensive goals. Cyber defense decision-making is often based on human-to-human communication, which requires communication partners to generate a common and overlapping situational understanding of the cyber threat (Ask et al, 2021a;Knox et al, 2018). Achieving a shared situational understanding can be subject to many challenges that span the cyber-physical domains (Jøsok et al, 2016(Jøsok et al, , 2017, and will often require communication partners to apply a range of cognitive skills that will vary in effort and deliberation depending on how much their individual backgrounds differ from each other (Knox et al, 2018).…”

“…Communication problems have been identified as one of the major challenges facing personnel working within cyber defense (Agyepong et al, 2020;ENISA, 2018). There are, however, currently no common best practices for how these communication problems should be addressed in neither cyber defense training nor education (Ask et al, 2021a).…”

“…Thus, educational approaches that engage humans at both the individual and group/organizational level, to actively pursue good cyber defense cognitions and behaviors, will arguably make for a resilient organization in the face of emerging cyber threats. Currently, there is a general lack of studies and interventions that simultaneously target cybersecurity performance at both the individual and group level (Ask et al, 2021a).…”

“…The intervention design proposed in this paper is motivated to help CyOs involved in defensive cyberspace operations to improve knowledge transfer when communicating cyber threat information. Developing a training environment founded in gamification has the potential to fill this performance gap in socio-technical communication (Ask et al, 2021a;Knox et al, 2018) in cyber-hybrid contexts through a process that is neuroergonomically designed to improve engagement and change behavior. In the following sections, we will detail how gamification approaches can be utilized in training and education for cyber defense.…”

“…Organizations source their cyber security operations to internal or external Security Operation Centers (SOCs) which are organizational units and teams working around the clock to defend against cyber threats. SOCs typically form a hierarchical organizational structure with CyOs at the bottom and decision-makers further up in the hierarchical structure, where cyber threat information is 'pushed up' and decisions are 'pushed down' in the decision-making hierarchy (Ask et al, 2021a;Staheli et al, 2016). In this context, RCPs need to be shared and communicated across platforms and in differing modes.…”