In this paper we examine data from a complex two-day experiment with professional cyber red teamers to determine what creates, or contributes, to affective states that may further disrupt attackers. Participants rated their frustration, surprise, confidence, self-doubt, and confusion at the end of each day, and these responses were scored on a Likert scale and using Thematic analysis. We found several elements strongly contributed to the frequency and severity of these affective states, supporting our initial hypothesis, and further that (1) experiencing a Lack of Progress impacted four of the five states with moderate severity, and (2) interacting with elements in the environment that Deviated from what was expected was associated strongly with surprise. Implications for cyber defense and limitations of the method are discussed.
BosN.PaulC. L.GershJ. R.GreenbergA.PiatkoC.SperlingS.SpitalettaJ.ArendtD. L.BurtnerR. (2016). Effects of gain/loss framing in cyber defense decision-making. Proceedings of the Human Factors and Ergonomics Society, 60, 168–172.
2.
BraunV.ClarkeV. (2006). Using thematic analysis in psychology. Qualitative Research in Psychology, 3(2),77–101.
3.
D'MelloS. K.GraesserA. C. (2014). Confusion. In PekrunR.Linnenbrink-GarciaL. (Eds.), International Handbook of Emotions in Education (pp. 289–310). Routledge/Taylor & Francis Group.
4.
DykstraJ.ShortridgeK.MetJ.HoughD. (2022a). Opportunity cost of action bias in cybersecurity incident response. Proceedings of the Human Factors and Ergonomics Society, 66, 1116-1120.
5.
DykstraJ.ShortridgeK.MetJ.HoughD. (2022b). Sludge for good: Slowing and imposing costs on cyber attackers. arXiv preprint arXiv:2211.16626.
6.
Ferguson-WalterK. J.GutzwillerR. S.ScottD. D.JohnsonC. J. (2021). Oppositional human factors in cybersecurity: A preliminary analysis of affective states. Proceedings of the 36th IEEE/ACM International Conference on Automated Software Engineering, 153–158.
7.
Ferguson-WalterK. J.LaFonD. S.ShadeT. B. (2017). Friend or faux: Deception for cyber defense. Jrnal of Information Warfare, 16(2), 28–42.
8.
Ferguson-WalterK. J.ShadeT. B.RogersA. V.NiedbalaE.TrumboM.NauerK.DivisK.JonesA.CombsA.AbbottR. (2019a). Appendix to The Tularosa Study: An Experimental Design and Implementation to Quantify the Effectiveness of Cyber Deception. Retrieved from [https://pdfs.semanticscholar.org/522d/d2d413f160a1182edd35c9f6ac1cde294a0f.pdf].
9.
Ferguson-WalterK. J.ShadeT. B.RogersA. V.NiedbalaE.TrumboM.NauerK.DivisK.JonesA.CombsA.AbbottR. (2019b). The Tularosa Study: An experimental design and implementation to quantify the effectiveness of cyber deception. 52nd IEEE Hawaii International Conference on Systems Science (HICSS).
GutzwillerR. S.Ferguson-WalterK. J.FugateS. J. (2019). Are cyber attackers thinking fast and slow? Exploratory analysis reveals evidence of decision-making biases in red teamers. Proceedings of the Human Factors and Ergonomics Society, 63, 427–431.
12.
GutzwillerR. S.Ferguson-WalterK. J.FugateS.RogersA. (2018). “Oh, look, a butterfly!" A framework for distracting attackers to improve cyber defense. Proceedings of the Human Factors and Ergonomics Society, 62, 272–276.
13.
GutzwillerR. S.FugateS.SawyerB. D.HancockP. A. (2015). The human factors of cyber network defense. Proceedings of the Human Factors and Ergonomics Society, 59, 322–326.
14.
JohnsonC. J.Ferguson-WalterK. J.GutzwillerR. S.ScottD. D.CookeN. J. (2022). Investigating cyber attacker team cognition. Proceedings of the Human Factors and Ergonomics Society, 66, 105-109.
15.
JohnsonC. K.GutzwillerR. S.GervaisJ.Ferguson-WalterK. J. (2021). Decision-making biases and cyber attackers. Proceedings of the 36th IEEE/ACM International Conference on Automated Software Engineering Workshops, 140–144. doi:10.1109/ASEW52652.2021.00038
16.
LodererK.PekrunR.LesterJ. C. (2020). Beyond cold technology: A systematic review and meta-analysis on emotions in technology-based learning environments. Learning & Instruction, 70, 101162.
17.
PaulC. L.DykstraJ. (2017). Understanding operator fatigue, frustration, and cognitive workload in tactical cybersecurity operations. Journal of Information Warfare, 16(2), 1–11.
18.
RossG.TomkoL. (2016, September). Confusion in the cockpit: Typology, antecedents, and sources. Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 60, 1299-1303.
19.
ShortridgeK.PetrichR. (2021). Lamboozling attackers: a new generation of deception: Software engineering teams can exploit attackers' human nature by building deception environments. Queue, 19(5), 26-59.
20.
ThomasD. R. (2006). A general inductive approach for analyzing qualitative evaluation data. American Journal of Evaluation, 27(2), 237–246.
