Supporting the human in cyber defence

Abstract

Incident detection is not merely the result of a technological process, but the output of a socio-technical system where the human has an important part to play. In this paper we focus on the human role within a socio-technically defined incident detection context by discussing the case of the Norwegian Cyber Defence approach. We show that the human has an important part in the process, not only by owning technical skills but also high-level cognitive skills that help critical thinking, decision-making and communication. We further summarize the results of our previous research and discuss how it can be applied, in order to improve educational content of an incident detection team. We strongly believe that the topics discussed in this paper, when implemented and applied, will help transforming the weakest link - the human - to the strongest defence.