Enhancing cybersecurity situation awareness through visualization: A USB data exfiltration case study.

Employees who have legitimate access to an organization's data may occasionally put sensitive corporate data at risk, either carelessly or maliciously. Ideally, potential breaches should be detected as soon as they occur, but in practice there may be delays, because human analysts are not able to recognize data exfiltration behaviors quickly enough with the tools available to them. Visualization may improve cybersecurity situation awareness. In this paper, we present a dashboard application for investigating file activity, as a way to improve situation awareness. We developed this dashboard for a wide range of stakeholders within a large financial services company. Cybersecurity experts/analysts, data owners, team leaders/managers, high level administrators, and other investigators all provided input to its design. The use of a co-design approach helped to create trust between users and the new visualization tools, which were built to be compatible with existing work processes. We discuss the user-centered design process that informed the development of the dashboard, and the functionality of its three inter-operable monitoring dashboards. In this case three dashboards were developed covering high-level overview, file volume/type comparison, and individual activity, but the appropriate number and type of dashboards to use will likely vary according to the nature of the detection task). We also present two use cases with usability results and preliminary usage data. The results presented examined the amount of use that the dashboards received as well as measures obtained using the Technology Acceptance Model (TAM). We also report user comments about the dashboards and how to improve them.

Challenges to Human Drivers in Increasingly Automated Vehicles.

OBJECTIVE: We examine the relationships between contemporary progress in on-road vehicle automation and its coherence with an envisioned "autopia" (automobile utopia) whereby the vehicle operation task is removed from all direct human control. BACKGROUND: The progressive automation of on-road vehicles toward a completely driverless state is determined by the integration of technological advances into the private automobile market; improvements in transportation infrastructure and systems efficiencies; and the vision of future driving as a crash-free enterprise. While there are many challenges to address with respect to automated vehicles concerning the remaining driver role, a considerable amount of technology is already present in vehicles and is advancing rapidly. METHODS: A multidisciplinary team of experts met to discuss the most critical challenges in the changing role of the driver, and associated safety issues, during the transitional phase of vehicle automation where human drivers continue to have an important but truncated role in monitoring and supervising vehicle operations. RESULTS: The group endorsed that vehicle automation is an important application of information technology, not only because of its impact on transportation efficiency, but also because road transport is a life critical system in which failures result in deaths and injuries. Five critical challenges were identified: driver independence and mobility, driver acceptance and trust, failure management, third-party testing, and political support. CONCLUSION: Vehicle automation is not technical innovation alone, but is a social as much as a technological revolution consisting of both attendant costs and concomitant benefits.

WikiBuild: a new online collaboration process for multistakeholder tool development and consensus building.

BACKGROUND: Production of media such as patient education tools requires methods that can integrate multiple stakeholder perspectives. Existing consensus techniques are poorly suited to design of visual media, can be expensive and logistically demanding, and are subject to caveats arising from group dynamics such as participant hierarchies. OBJECTIVE: Our objective was to develop a method that enables multistakeholder tool building while averting these difficulties. METHODS: We developed a wiki-inspired method and tested this through the collaborative design of an asthma action plan (AAP). In the development stage, we developed the Web-based tool by (1) establishing AAP content and format options, (2) building a Web-based application capable of representing each content and format permutation, (3) testing this tool among stakeholders, and (4) revising this tool based on stakeholder feedback. In the wiki stage, groups of participants used the revised tool in three separate 1-week "wiki" periods during which each group collaboratively authored an AAP by making multiple online selections. RESULTS: In the development stage, we recruited 16 participants (9/16 male) (4 pulmonologists, 4 primary care physicians, 3 certified asthma educators, and 5 patients) for system testing. The mean System Usability Scale (SUS) score for the tool used in testing was 72.2 (SD 10.2). In the wiki stage, we recruited 41 participants (15/41 male) (9 pulmonologists, 6 primary care physicians, 5 certified asthma educators, and 21 patients) from diverse locations. The mean SUS score for the revised tool was 75.9 (SD 19.6). Users made 872, 466, and 599 successful changes to the AAP in weeks 1, 2, and 3, respectively. The site was used actively for a mean of 32.0 hours per week, of which 3.1 hours per week (9.7%) constituted synchronous multiuser use (2-4 users at the same time). Participants averaged 23 (SD 33) minutes of login time and made 7.7 (SD 15) changes to the AAP per day. Among participants, 28/35 (80%) were satisfied with the final AAP, and only 3/34 (9%) perceived interstakeholder group hierarchies. CONCLUSION: Use of a wiki-inspired method allowed for effective collaborative design of content and format aspects of an AAP while minimizing logistical requirements, maximizing geographical representation, and mitigating hierarchical group dynamics. Our method faced unique software and hardware challenges, and raises certain questions regarding its effect on group functioning. Potential uses of our method are broad, and further studies are required.

Reference frame congruency in search-and-rescue tasks.

OBJECTIVE: Our aim was to investigate how the congruency between visual displays and auditory cues affects performance on various spatial tasks. BACKGROUND: Previous studies have demonstrated that spatial auditory cues, when combined with visual displays, can enhance performance and decrease workload. However, this facilitation was achieved only when auditory cues shared a common reference frame (RF) with the visual display. In complex and dynamic environments, such as airborne search and rescue (SAR), it is often difficult to ensure such congruency. METHOD: In a simulated SAR operation, participants performed three spatial tasks: target search, target localization, and target recall. The interface consisted of the camera view of the terrain from the aircraft-mounted sensor, a map of the area flown over, a joystick that controlled the sensor, and a mouse. Auditory cues were used to indicate target location. While flying in the scenario, participants searched for targets, identified their locations in one of two coordinate systems, and memorized their location relative to the terrain layout. RESULTS: Congruent cues produced the fastest and most accurate performance. Performance advantages were observed even with incongruent cues relative to neutral cues, and egocentric cues were more effective than exocentric cues. CONCLUSION: Although the congruent cues are most effective, in cases in which the same cue is used across spatial tasks, egocentric cues are a better choice than exocentric cues. APPLICATION: Egocentric auditory cues should be used in display design for tasks that involve RF transformations, such as SAR, air traffic control, and unmanned aerial vehicle operations.