In Security Operations Centres (SOCs) security practitioners work using a range of tools to detect and mitigate malicious computer-network activity. Sonification, in which data is represented as sound, is said to have potential as an approach to addressing some of the unique challenges faced by SOCs. For example, sonification has been shown to enable peripheral monitoring of processes, which could aid practitioners multitasking in busy SOCs. The perspectives of security practitioners on incorporating sonification into their actual working environments have not yet been examined, however. The aim of this paper therefore is to address this gap by exploring attitudes to using sonification in SOCs. We report on the results of a study consisting of an online survey (N=20) and interviews (N=21) with security practitioners working in a range of different SOCs. Our contribution is a refined appreciation of the contexts in which sonification could aid in SOC working practice, and an understanding of the areas in which sonification may not be beneficial or may even be problematic.We also analyse the critical requirements for the design of sonification systems and their integration into the SOC setting. Our findings clarify insights into the potential benefits and challenges of introducing sonification to support work in this vital security-monitoring environment.
found that non-expert participants' failure rates in carrying out security-critical tasks were lower when auditory cues were played @cite_34 . Less complex stimuli improved performance, while more complex stimuli worsened it @cite_22 . These results are consistent with the Brain Arousal model: moderate noise can improve cognitive performance, while excessive or insufficient noise are detrimental @cite_33 . The findings support the potential for the improvement of network-security monitoring task performance through audio cues designed with appropriate levels of complexity.
@cite_34 @cite_22 @cite_33
1830858207 2769512728 2194198555 2086210198
Author(s): Kaczmarek, T; Kobsa, A; Sy, R; Tsudik, G | Abstract: User errors while performing security-critical tasks can lead to undesirable or even disastrous consequences. One major factor influencing mistakes and failures is complexity of such tasks, which has been studied extensively in prior research. Another important issue which hardly received any attention is the impact of both accidental and intended distractions on users performing security-critical tasks. In particular, it is unclear whether, and to what extent, unexpected sensory cues (e.g., auditory or visual) can influence user behavior and or trigger mistakes. Better understanding of the effects of intended distractions will help clarify their role in adversarial models. As part of the research effort described in this paper, we administered a range of naturally occurring -- yet unexpected -- sounds while study participants attempted to perform a security-critical task. We found that, although these auditory cues lowered participants' failure rates, they had no discernible effect on their task completion times. To this end, we overview some relevant literature that explains these somewhat counter-intuitive findings. Conducting a thorough and meaningful study on user errors requires a large number of participants, since errors are typically infrequent and should not be instigated more than once per subject. To reduce the effort of running numerous subjects, we developed a novel experimental setup that was fully automated and unattended. We discuss our experience with this setup and highlight the pros and cons of generalizing its usage. Ambient sensory distractions play a role in security-critical tasks that require human involvement. Adversarial control over human sensory input could broaden the attack surface. To shed light on this issue, a team conducted large-scale experiments that exposed subjects to unexpected audio and visual stimuli while they performed a security-critical task. The literature on the effects of noise on monitoring performance shows a disappointing lack of consistency in results. The hypothesis of the present study was that task classification in terms of demands made on the observer should reconcile conflicting findings so that generalizations could be made. Therefore, a study was made of the effects of intermittent or variable noise on vigilance experiments with similar task demands. Twenty-one sensory vigilance studies, selected from 98 visual performance experiments, were analyzed in detail. It appeared that, even when studies possess similar task characteristics, they are hard to compare due to the many types and varieties of the noise variables involved and the measures of performance used. Contradictory results remain. It was concluded that we know nothing about the effects of variable noise on sustained attention, despite the importance of this kind of noise for everyday life. Using this detailed analysis as an illustration, it was suggested that disparate... The vigilance decrement has been described as a slowing in reaction times or an increase in error rates as an effect of time-on-task during tedious monitoring tasks. This decrement has been alternatively ascribed to either withdrawal of the supervisory attentional system, due to underarousal caused by the insufficient workload, or to a decreased attentional capacity and thus the impossibility to sustain mental effort. Furthermore, it has previously been reported that controlled processing is the locus of the vigilance decrement. This study aimed at answering three questions, to better define sustained attention. First, is endogenous attention more vulnerable to time-on-task than exogenous attention? Second, do measures of autonomic arousal provide evidence to support the underload vs overload hypothesis? And third, do these measures show a different effect for endogenous and exogenous attention? We applied a cued (valid vs invalid) conjunction search task, and ECG and respiration recordings were used to compute sympathetic (normalized low frequency power) and parasympathetic tone (respiratory sinus arrhythmia, RSA). Behavioural results showed a dual effect of time-on-task: the usually described vigilance decrement, expressed as increased reaction times (RTs) after 30 min for both conditions; and a higher cost in RTs after invalid cues for the endogenous condition only, appearing after 60 min. Physiological results clearly support the underload hypothesis to subtend the vigilance decrement, since heart period and RSA increased over time-on-task. There was no physiological difference between the endogenous and exogenous conditions. Subjective experience of participants was more compatible with boredom than with high mental effort.