Information-Pooling Bias in Collaborative Security Incident Correlation Analysis

Area of Science:

• Cybersecurity
• Human-Computer Interaction
• Cognitive Psychology

Background:

• Information-pooling bias hinders teams from sharing unique data.
• This bias's impact on cybersecurity team collaboration is understudied.

Purpose of the Study:

• To investigate the effect of group-level information-pooling bias on collaborative incident correlation.
• To evaluate the efficacy of different collaboration aids in mitigating this bias.

Main Methods:

• Thirty 3-person teams performed threat detection and incident correlation tasks.
• Teams used varying collaboration aids under a hidden profile paradigm.
• Communication patterns were analyzed to assess information sharing.

Main Results:

• Teams predominantly discussed commonly known information, neglecting unique data.
• Unaided collaboration proved inefficient for correlating unique security incidents.
• Visualizations effectively mitigated information-pooling bias by enhancing perception and memory.

Conclusions:

• Security analyst teams may be inefficient at pooling unique information.
• Standard collaboration tools are insufficient for cybersecurity defense.
• Developing collaborative security visualization tools tailored to cognitive limitations is crucial.