Enhanced Training for Cyber Situational Awareness

A study was conducted in which participants received either tool-based or narrative-based training and then completed challenges associated with network security threats. Three teams were formed: (1) Tool-Based, for which each participant received tool-based training; (2) Narrative-Based, for which each participant received narrative-based training and (3) Combined, for which three participants received tool-based training and two received narrative-based training. Results showed that the Narrative-Based team recognized the spatial-temporal relationship between events and constructed a timeline that was a reasonable approximation of ground truth. In contrast, the Combined team produced a linear sequence of events that did not encompass the relationships between different adversaries. Finally, the Tool-Based team demonstrated little appreciation of either the spatial or temporal relationships between events. These findings suggest that participants receiving Narrative-Based training were able to use the software tools in a way that allowed them to gain a greater level of situation awareness.

Authors and Affiliations

1. Sandia National Laboratories, Albuquerque, NM, USA

   Susan Stevens-Adams, Armida Carbajal, Austin Silva, Kevin Nauer, Benjamin Anderson, Theodore Reed & Chris Forsythe

Editors and Affiliations

1. Office of the Assistant Secretary of Defense (Research and Engineerig), 4800 Mark Center Drive, Suite 17E08, 22314, Alexandria, VA, USA

   Dylan D. Schmorrow

2. University of Alabama at Birmingham, 336 SHPB, 1530 3rd Avenue South, 35294, Birmingham,, Alabama, USA

   Cali M. Fidopiastis

Reprints and permissions

© 2013 Springer-Verlag Berlin Heidelberg

Policies and ethics