Successful Cybersecurity Teams Are Inherently Antisocial, Army Study Finds

In a study published in the latest issue of the Journal of Computers & Security, researchers found that the most efficient cybersecurity teams functioned antisocially with limited interactions amongst their teammates and leaders. The research conducted by the Army Research Laboratory, the National Cyberwatch Center and Carnegie Mellon University took place at the Mid-Atlantic Collegiate Cyber Defense Competition (MACCDC).

"Successful cyber teams don't need to discuss every detail when defending a network; they already know what to do," summarized in a release Dr. Norbou E. Buchler, team leader with the US Army Research Laboratory's Cyber and Networked Systems Branch.

Face-to-face interactions deterred success

To reach this conclusion, the researchers equipped the teams at MACCDC with Sociometric Badges (Humanyze Inc.) that collected a variety of data including face-to-face interactions between teammates. The team members were also asked to complete a questionnaire on leadership style, task distribution, team meetings, communication and collaboration.

“We collected data from wearable social sensors to assess face-to-face interactions and using a 16-point teamwork instrument called OAT (Observational Assessment of Teamwork) to assess teamwork and leadership behaviors in cyber defense. Importantly, this being a cyber defense competition, the success of these teams is evaluated along three independent scoring dimensions: (a) Maintaining Services, (b) Incidence Response, and (c) Scenario Injects,” stated the study.

The results showed that traits such as effective leadership and functional specialization lead to success whereas face-to-face interactions were deterrents. "In other words, the teams whose members interacted less during the exercise, were usually more successful," Buchler explained.

"These results are important because current training programs commonly emphasize cybersecurity knowledge and do not provide training on effective team management," he added.

Tuckman's model at work

To explain these findings, Buchler used Tuckman’s famed team-building model as a reference. Established in 1965, Tuckman’s model dictates that successful teams grow through clearly defined stages from a group of separate individuals to a task-focused cohesive unit.

"High-performing teams exhibit fewer team interactions because they function as purposive social systems, defined as people who are readily identifiable to each other by role and position and who work interdependently to accomplish one or more collective objectives," Buchler said.

[see-also]

The paper is entitled "Sociometrics and observational assessment of teaming and leadership in a cybersecurity defense competition.” The work was undertaken in order to advance the "understanding about the human dynamics of cybersecurity" in order to determine "what makes a cyber defense team more or less effective in responding to and mitigating cyber attacks."

MACCDC's website states the competition is "a unique experience for college and university students to test their knowledge and skills in a competitive environment." The research team is part of the Army Research Laboratory's Cybersecurity Collaborative Research Alliance.