The Role of Human Operators' Suspicion in the Detection of Cyber Attacks

Abstract

Despite the importance that human error in the cyber domain has had in recent reports, cyber warfare research to date has largely focused on the effects of cyber attacks on the target computer system. In contrast, there is little empirical work on the role of human operators during cyber breaches. More specifically, there is a need to understand the human-level factors at play when attacks occur. This paper views cyber attacks through the lens of suspicion, a construct that has been used in other contexts, but inadequately defined, in prior research. After defining the construct of suspicion, the authors demonstrate the role that suspicion plays as the conduit between computer operators' normal working behaviors and their ability to alter that behavior to detect and react to cyber attacks. With a focus on the user, rather than the target computer, the authors empirically develop a latent structure for a variety of types of cyber attacks, link that structure to levels of operator suspicion, link suspicion to users' cognitive and emotional states, and develop initial implications for cyber training.

Are pilots prepared for a cyber-attack? A human factors approach to the experimental evaluation of pilots' behavior

“…This leads to the conclusion that the attack evokes cognitive activation as described in the deception detection model (Grazioli, 2004), which increases the workload. This result is consistent with previous research by Hirshfield et al (2015), who also reported increased workload when users are under cyber-attack.…”

“…Different models and views all suggest that such an analytic procedure places severe demands on cognitive resources (Bobko et al, 2014;Boyce et al, 2011;Dutt et al, 2013;Grazioli, 2004;Hirshfield et al, 2015;Rasmussen, 1983). Further, Orasanu et al (1993) argue that ambiguous cues such as those, we argue, present during a cyber-attack also increase workload.…”

“…Further, Orasanu et al (1993) argue that ambiguous cues such as those, we argue, present during a cyber-attack also increase workload. Results of empirical research indicate a positive relation between the occurrence of a cyber-attack and operators' workload (Hirshfield et al, 2015). We thus formulate the following research questions:…”

“…As cyber-attacks are not currently a topic in airline training, individual pilots will have to rely on their own knowledge and personal experience with ordinary malfunctions to generate response options for detecting a cyber-attack or making sense of available information (Dutt et al, 2013;Grazioli, 2004;Hirshfield et al, 2015). Doing so could become dangerous as pilots' assumption might not hold true during a cyber-attack.…”

“…Human factors analysis showed pilots' explicit wish for technical support during a cyber-attack as well as their concern about making ill-informed decisions. The major issue is that a successful attack exposes pilots to great uncertainty (Dutt et al, 2013;Hirshfield et al, 2015). Although individual cues might be ambiguous during the very infrequent occasions when technical malfunctions occur, pilots can normally apply procedures to solve the associated technical problems.…”