Understanding decision making in security operations centres: building the case for cyber deception technology

Area of Science:

• Cybersecurity
• Human-Computer Interaction

Background:

• Security Operations Centres (SOCs) are critical for detecting and responding to cyber threats under intense time pressure.
• Cyber deception technology offers a way to extend response times by consuming attacker resources, but is currently underutilized.

Purpose of the Study:

• To identify barriers to the effective implementation of cyber deception technology in SOCs.
• To explore how understanding analyst decision-making can improve cyber deception efficacy.

Main Methods:

• Expert interviews were conducted to gather insights.
• Thematic analysis was applied to interview data.

Main Results:

• Key barriers include a lack of use cases, limited empirical evidence of efficacy, reluctance towards active defense, vendor overpromising, and concerns about disrupting analyst decision-making.
• Cyber deception technology is promising but faces significant implementation hurdles.

Conclusions:

• Naturalistic Decision Making (NDM) offers a framework to better understand SOC analyst decision processes.
• Leveraging NDM can optimize the integration and effectiveness of cyber deception technologies within SOC environments.