Neurophysiological and Emotional Influences on Team Communication and Metacognitive Cyber Situational Awareness During a Cyber Engineering Exercise

Background: Cyber operations unfold at superhuman speeds where cyber defense decisions are based on human-to-human communication aiming to achieve a shared cyber situational awareness. The recently proposed Orient, Locate, Bridge (OLB) model suggests a three-phase metacognitive approach for successful communication of cyber situational awareness for good cyber defense decision-making. Successful OLB execution implies applying cognitive control to coordinate self-referential and externally directed cognitive processes. In the brain, this is dependent on the frontoparietal control network and its connectivity to the default mode network. Emotional reactions may increase default mode network activity and reduce attention allocation to analytical processes resulting in sub-optimal decision-making. Vagal tone is an indicator of activity in the dorsolateral prefrontal node of the frontoparietal control network and is associated with functional connectivity between the frontoparietal control network and the default mode network. Aim: The aim of the present study was to assess whether indicators of neural activity relevant to the processes outlined by the OLB model were related to outcomes hypothesized by the model. Methods: Cyber cadets (N = 36) enrolled in a 3-day cyber engineering exercise organized by the Norwegian Defense Cyber Academy participated in the study. Differences in prospective metacognitive judgments of cyber situational awareness, communication demands, and mood were compared between cyber cadets with high and low vagal tone. Vagal tone was measured at rest prior to the exercise. Affective states, communication demands, cyber situational awareness, and metacognitive accuracy were measured on each day of the exercise. Results: We found that cyber cadets with higher vagal tone had better metacognitive judgments of cyber situational awareness, imposed fewer communication demands on their teams, and had more neutral moods compared to cyber cadets with lower vagal tone. Conclusion: These findings provide neuroergonomic support for the OLB model and suggest that it may be useful in education and training. Future studies should assess the effect of OLB-ing as an intervention on communication and performance.publishedVersio

Neurophysiological and Emotional Influences on Team Communication and Metacognitive Cyber Situational Awareness During a Cyber Engineering Exercise

Background: Cyber operations unfold at superhuman speeds where cyber defense decisions are based on human-to-human communication aiming to achieve a shared cyber situational awareness. The recently proposed Orient, Locate, Bridge (OLB) model suggests a three-phase metacognitive approach for successful communication of cyber situational awareness for good cyber defense decision-making. Successful OLB execution implies applying cognitive control to coordinate self-referential and externally directed cognitive processes. In the brain, this is dependent on the frontoparietal control network and its connectivity to the default mode network. Emotional reactions may increase default mode network activity and reduce attention allocation to analytical processes resulting in sub-optimal decision-making. Vagal tone is an indicator of activity in the dorsolateral prefrontal node of the frontoparietal control network and is associated with functional connectivity between the frontoparietal control network and the default mode network. Aim: The aim of the present study was to assess whether indicators of neural activity relevant to the processes outlined by the OLB model were related to outcomes hypothesized by the model. Methods: Cyber cadets (N = 36) enrolled in a 3-day cyber engineering exercise organized by the Norwegian Defense Cyber Academy participated in the study. Differences in prospective metacognitive judgments of cyber situational awareness, communication demands, and mood were compared between cyber cadets with high and low vagal tone. Vagal tone was measured at rest prior to the exercise. Affective states, communication demands, cyber situational awareness, and metacognitive accuracy were measured on each day of the exercise. Results: We found that cyber cadets with higher vagal tone had better metacognitive judgments of cyber situational awareness, imposed fewer communication demands on their teams, and had more neutral moods compared to cyber cadets with lower vagal tone. Conclusion: These findings provide neuroergonomic support for the OLB model and suggest that it may be useful in education and training. Future studies should assess the effect of OLB-ing as an intervention on communication and performance.Neurophysiological and Emotional Influences on Team Communication and Metacognitive Cyber Situational Awareness During a Cyber Engineering ExercisepublishedVersio

“This is the way ‘I’ create my passwords ...":does the endowment effect deter people from changing the way they create their passwords?

The endowment effect is the term used to describe a phenomenon that manifests as a reluctance to relinquish owned artifacts, even when a viable or better substitute is offered. It has been confirmed by multiple studies when it comes to ownership of physical artifacts. If computer users also "own", and are attached to, their personal security routines, such feelings could conceivably activate the same endowment effect. This would, in turn, lead to their over-estimating the \value" of their existing routines, in terms of the protection they afford, and the risks they mitigate. They might well, as a consequence, not countenance any efforts to persuade them to adopt a more secure routine, because their comparison of pre-existing and proposed new routine is skewed by the activation of the endowment effect.In this paper, we report on an investigation into the possibility that the endowment effect activates when people adopt personal password creation routines. We did indeed find evidence that the endowment effect is likely to be triggered in this context. This constitutes one explanation for the failure of many security awareness drives to improve password strength. We conclude by suggesting directions for future research to confirm our findings, and to investigate the activation of the effect for other security routines

Cyber Operator Competencies: The Role of Cognitive Competencies in Cyber Operator Practice and Education

PhD Dissertations in Child and Youth Participation and Competence Development (BUK): 17. Articles 2, 3 and 4 have been removed from the digital thesis due to lack of permission from the publishers. These can be viewed in the relevant journals/books, and in the printed thesis.The theme of this thesis is the role of cognitive competencies in cyber operator practice and education. Cyber operator practice is a new field of research where the importance and attention is growing rapidly. Research has accumulated a solid amount of knowledge about the technical skills required by a cyber operator. However, less is known about the cognitive competencies that support cyber operator proficiency. In order to gain insight into the cognitive demands of cyber operators, the cognitions of young cyber officers(1) attending the Norwegian Defence Cyber Academy have been studied. Findings contributes to the development of theory and evidence-based knowledge needed to develop educational guidelines for the cyber operator workforce. This dissertation proposes and take steps towards validation of a conceptual framework, The Hybrid Space, that describes the cognitive work environment of military cyber operators. The Hybrid Space conceptual framework is introduced in the first article of this thesis and is used in all parts of the study. Methodological contributions include a method and a software to collect quantitative data on cyber operators’ cognitive focus and assess cognitive agility. Cognitive agility is proposed as a competence and a measure of cyber operator performance. Empirical data collected during a cyber defence exercise support our theoretical assumption and helps to further develop The Hybrid Space conceptual framework. Findings indicate that knowledge and understanding of cyberspace as a domain of operations and the cognitive competencies supporting cyber operator proficiency are limited. Cognitive agility is proposed as a cognitive competency and is associated with higher levels of selfregulation. These findings suggest that cognitive competencies can indeed support cyber operator performance. This thesis therefore contributes to cyber operator practice and education by suggesting that education and training would benefit from including the development of cognitive competencies alongside the technical education and training needed to become a cyber operator. In this way, this thesis adds new insight and perspective into the novel area of cyber operator practice. The results provide the first indications that cyber operator performance can be supported by the development of cognitive competencies during education. 1 Cyber officer and cyber operator are used interchangeably throughout the articles and this extended abstract. The reason is that the students undergo the same education, but the position they later get determine their career path and the accompanying title. The use of the terms is maturing in both military and civilian sectors. As of now neither finite guidelines nor agreed upon norms exist that guide the use of the titlesSammendrag Temaet for denne doktoravhandlingen er rollen til kognitive kompetanser i cyber operator praksis og utdanning. Cyber operator praksis er et nytt forskningsfelt som har fatt stor oppmerksomhet de siste arene. Forskning pa omradet har produsert kunnskap om hvilke tekniske kunnskaper og ferdigheter en cyber operator ma ha. Mindre kunnskap finnes om de kognitive kompetansene som en cyber operator trenger for a kunne utove sin praksis effektivt. For a fa bedre innsikt i de kognitive kravene som cyber operatorer stilles ovenfor har jeg studert unge cyber offiserer under utdanning pa Forsvarets Ingeniorhogskole (2) (FIH). Denne avhandlingen bidrar med kunnskap og empirisk grunnlag for a utvikle forskningsbasert utdanning for fremtidens cyber operatorer. Avhandlingen fremholder og starter validering et konseptuelt rammeverk, The Hybrid Space, som beskriver de kognitive kravene militare cyber operatorer ma forholde seg til i utovelsen av sitt virke. Rammeverket blir introdusert i forste artikkel av denne avhandlingen og blir brukt som konseptuelt fundament i resten av avhandlingen. Avhandlingen fremlegger ogsa en metode og et dataverktoy som kan brukes til a samle inn kvantitative data om cyber operatorers kognitive fokus. Dette dataverktoyet kan ogsa benyttes til a undersoke hvordan cyber operatorer utviser kognitiv fleksibilitet over tid nar de gjennomforer en cyber operasjon. Kognitiv fleksibilitet foreslas som et prestasjonsmal for cyber operatorer. Empiriske data innhentet under en cyberforsvars ovelse bekrefter vare teoretiske hypoteser og bidrar til videre utvikling av det konseptuelle rammeverket. Hovedfunnene indikerer at kunnskap om og forstaelse for cyberspace som operasjonsdomene og rollen til kognitive kompetanser i cyber operatorens utforelse av cyber operasjoner er begrenset. Denne avhandlingen argumenter for at evne til fleksibel kognitiv manover i operasjonsmiljoet, definert som ‘cognitive agility’, er en viktig kognitiv kompetanse for cyber operatorer som kan predikeres ved a undersoke evne til selvregulering. Disse funnene indikerer at kognitive kompetanser kan bidra til a understotte cyber operatorers prestasjon. Avhandlingen bidrar til cyber operator praksis og utdanning ved a vise til at utvikling av cyber operator kompetanse bor inkludere utvikling av kognitive kompetanser i tillegg til utvikling av tekniske kunnskaper og ferdigheter. Med disse funnene bidrar denne avhandlingen bidrar til ny innsikt og perspektiv pa cyber operator praksis og utdanning. 2 Forsvarets Ingeniørhøgskole (FIH) endret i 2018 navn til Cyberingeniørskolen (CIS) og ble samtidig underlagt Forsvarets Høgskole (FHS)

Gamification as a neuroergonomic approach to improving interpersonal situational awareness in cyber defense

In cyber threat situations, the establishment of a shared situational awareness as a basis for cyber defense decision-making results from adequate communication of a Recognized Cyber Picture (RCP). RCPs consist of actively selected information and have the goal of accurately presenting the severity and potential consequences of the situation. RCPs must be communicated between individuals, but also between organizations, and often from technical to non-/less technical personnel. The communication of RCPs is subject to many challenges that may affect the transfer of critical information between individuals. There are currently no common best practices for training communication for shared situational awareness among cyber defense personnel. The Orient, Locate, Bridge (OLB) model is a pedagogic tool to improve communication between individuals during a cyber threat situation. According to the model, an individual must apply meta-cognitive awareness (O), perspective taking (L), and communication skills (B) to successfully communicate the RCP. Gamification (applying game elements to non-game contexts) has shown promise as an approach to learning. We propose a novel OLB-based Gamification design to improve dyadic communication for shared situational awareness among (technical and non-technical) individuals during a cyber threat situation. The design includes the Gamification elements of narrative, scoring, feedback, and judgment of self. The proposed concept contributes to the educational development of cyber operators from both military and civilian organizations responsible for defending and securing digital infrastructure. This is achieved by combining the elements of a novel communication model with Gamification in a context in urgent need for educational input.publishedVersio

Reports of the AAAI 2019 spring symposium series

Applications of machine learning combined with AI algorithms have propelled unprecedented economic disruptions across diverse fields in industry, military, medicine, finance, and others. With the forecast for even larger impacts, the present economic impact of machine learning is estimated in the trillions of dollars. But as autonomous machines become ubiquitous, recent problems have surfaced. Early on, and again in 2018, Judea Pearl warned AI scientists they must "build machines that make sense of what goes on in their environment," a warning still unheeded that may impede future development. For example, self-driving vehicles often rely on sparse data; self-driving cars have already been involved in fatalities, including a pedestrian; and yet machine learning is unable to explain the contexts within which it operates

DEFINING A CYBER OPERATIONS PERFORMANCE FRAMEWORK VIA COMPUTATIONAL MODELING

Cyber operations are influenced by a wide range of environmental characteristics, strategic policies, organizational procedures, complex networks, and the individuals who attack and defend these cyber battlegrounds. While no two cyber operations are identical, leveraging the power of computational modeling will enable decision-makers to understand and evaluate the effect of these influences prior to their impact on mission success. Given the complexity of these influences, this research proposes an agent-based modeling framework that will result in an operational performance dashboard for user analysis. To account for cyber team behavioral characteristics, this research includes the development and validation of the Cyber Operations Self-Efficacy Scales (COSES). The underlying statistics, algorithms, research instruments, and equations to support the overall framework are provided. This research represents the most comprehensive cyber operations agent-based performance analysis tools published to date

Big data academic and learning analytics: connecting the dots for academic excellence in higher education

Purpose Although big data analytics have great benefits for higher education institutions, due to lack of sufficient evidence on how big data analytics investment can pay off, it is tough for HEIs practitioners to realize value from such adoption. The current study proposes a big data academic and learning analytics enabled business value model to explain big data analytics potential benefits and business value which can be obtained by developing such analytics capabilities in HEIs. Design/methodology/approach The study examined 47 case descriptions from 26 HEIs to investigate the causal association between the big data analytics current and potential benefits and business value creation path for big data academic and learning analytics success in higher education institutions. Findings The pressure of compliance with all legal & regulatory requirements and competition had pushed higher education institutions hard to adopt BDA tools. However, the study found out that application of risk & security and predictive analytics to higher education fields is still in its infancy. Using this theoretical model, our results provide new insights to higher education administrators on ways to create big data analytics capabilities for higher education institutions transformation and suggest an empirical foundation that can lead to more thorough analysis of big data analytics implementation. Originality/value A distinctive theoretical contribution of this study is its conceptualization of understanding business value from big data analytics in the typical setting of higher education. The study provides HEIs with an all-inclusive understanding of big data analytics and gives insights on how it helps to transform HEIs. The new perspectives associated with the big data academic and learning analytics enabled business value model will contribute to future research in this area