Enhanced Training for Cyber Situational Awareness

摘要: A study was conducted in which participants received either tool-based or narrative-based training and then completed challenges associated with network security threats. Three teams were formed: (1) Tool-Based, for each participant training; (2) Narrative-Based, (3) Combined, three two training. Results showed that the Narrative-Based team recognized spatial-temporal relationship between events constructed a timeline reasonable approximation of ground truth. In contrast, Combined produced linear sequence did not encompass relationships different adversaries. Finally, Tool-Based demonstrated little appreciation spatial temporal events. These findings suggest receiving able to use software tools way allowed them gain greater level situation awareness.