Fuzzy to Clear: Elucidating the Threat Hunter Cognitive Process and Cognitive Support Needs
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2024
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866912569759891456 |
|---|---|
| author | Milani, Alessandra Maciel Paz Starr, Arty Hill, Samantha Curtis, Callum Anderson, Norman Moreno-Lumbreras, David Storey, Margaret-Anne |
| author_facet | Milani, Alessandra Maciel Paz Starr, Arty Hill, Samantha Curtis, Callum Anderson, Norman Moreno-Lumbreras, David Storey, Margaret-Anne |
| contents | With security threats increasing in frequency and severity, it is critical that we consider the important role of threat hunters. These highly-trained security professionals learn to see, identify, and intercept security threats. Many recent works and existing tools in cybersecurity are focused on automating the threat hunting process, often overlooking the critical human element. Our study shifts this paradigm by emphasizing a human-centered approach to understanding the lived experiences of threat hunters. By observing threat hunters during hunting sessions and analyzing the rich insights they provide, we seek to advance the understanding of their cognitive processes and the tool support they need. Through an in-depth observational study of threat hunters, we introduce a model of how they build and refine their mental models during threat hunting sessions. We also present 23 themes that provide a foundation to better understand threat hunter needs and suggest five actionable design propositions to enhance the tools that support them. Through these contributions, our work enriches the theoretical understanding of threat hunting and provides practical insights for designing more effective, human-centered cybersecurity tools. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2408_04348 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Fuzzy to Clear: Elucidating the Threat Hunter Cognitive Process and Cognitive Support Needs Milani, Alessandra Maciel Paz Starr, Arty Hill, Samantha Curtis, Callum Anderson, Norman Moreno-Lumbreras, David Storey, Margaret-Anne Cryptography and Security Human-Computer Interaction With security threats increasing in frequency and severity, it is critical that we consider the important role of threat hunters. These highly-trained security professionals learn to see, identify, and intercept security threats. Many recent works and existing tools in cybersecurity are focused on automating the threat hunting process, often overlooking the critical human element. Our study shifts this paradigm by emphasizing a human-centered approach to understanding the lived experiences of threat hunters. By observing threat hunters during hunting sessions and analyzing the rich insights they provide, we seek to advance the understanding of their cognitive processes and the tool support they need. Through an in-depth observational study of threat hunters, we introduce a model of how they build and refine their mental models during threat hunting sessions. We also present 23 themes that provide a foundation to better understand threat hunter needs and suggest five actionable design propositions to enhance the tools that support them. Through these contributions, our work enriches the theoretical understanding of threat hunting and provides practical insights for designing more effective, human-centered cybersecurity tools. |
| title | Fuzzy to Clear: Elucidating the Threat Hunter Cognitive Process and Cognitive Support Needs |
| topic | Cryptography and Security Human-Computer Interaction |
| url | https://arxiv.org/abs/2408.04348 |