Eric Ortiz

Developing an Insider Threat Training Environment

Many cyber security officers are more concerned with outside rather than insider threats because the enemy is generally perceived as being “out there” or beyond the organization. Therefore, defensive actions are readily available once an outside threat is identified (Colwill in Human factors in information security: the insider threat—who can you trust these days? pp. 186–196, 2009 [1]). Contradictory to the ideas of social identification as an “us” and “them,” the greatest enemy may be lurking within one’s own organization. Individuals are considered insiders if they presently have (or at one time had) permission to access an organization’s data or network structures (Greitzer et al. in Secur Priv IEEE 6(1):61–64, 2008 [2]). The concept of the insider threat is considered one of the most difficult situations to deal with in the cybersecurity domain (Hunker and Probst in J Wireless Mobile Netw Ubiquitous Comput Dependable Appl 2(1):4–27, 2011 [3]). The Association of Certified Fraud Examiners has reported two-thirds of fraud and identity thefts are executed by organizations’ employees or other known insiders. They also estimate U.S. companies have lost 5 % of revenue to fraudulent insider activities (Randazzo et al. in Insider threat study: illicit cyber activity in the banking and finance sector, 2005 [4]). Insiders have multiple advantages over an outsider. An insider threat is one of the most difficult situations to identify. Therefore, it is critical that training be developed. The first step to effective training is constructing an environment that lends itself to insider threat situations. The present paper describes the process in which one insider threat virtual environment was constructed. A discussion of the considerations and functional features is detailed.

Assessing Engagement in Simulation-Based Training Systems for Virtual Kinesic Cue Detection Training

Combat Profiling techniques strengthen a Warfighter’s ability to quickly react to situations within the operational environment based upon observable behavioral identifiers. One significant domain-specific skill researched is kinesics, or the study of body language. A Warfighter’s ability to distinguish kinesic cues can greatly aid in the detection of possible threatening activities or individuals with harmful intent. This paper describes a research effort assessing the effectiveness of kinesic cue depiction within Simulation-Based Training (SBT) systems and the impact of engagement levels upon trainee performance. For this experiment, live training content served as the foundation for scenarios generated using Bohemia Interactive’s Virtual Battlespace 2 (VBS2). Training content was presented on a standard desktop computer or within a physically immersive Virtual Environment (VE). Results suggest that the utilization of a highly immersive VE is not critical to achieve optimal performance during familiarization training of kinesic cue detection. While there was not a significant difference in engagement between conditions, the data showed evidence to suggest decreased levels of engagement by participants using the immersive VE. Further analysis revealed that temporal dissociation, which was significantly lower in the immersive VE condition, was a predictor of simulation engagement. In one respect, this indicates that standard desktop systems are suited for transitioning existing kinesic familiarization training content from the classroom to a personal computer. However, interpretation of the results requires operational context that suggests the capabilities of high-fidelity immersive VEs are not fully utilized by existing training methodologies. Thus, this research serves as an illustration of technology advancements compelling the SBT community to evolve training methods in order to fully benefit from emerging technologies.

The impact of unmanned weapon systems on individual and team performance

The U.S. military integrates unmanned systems within combat operations with greater regularity and scope each year. Warfighters currently conduct operations such as Improvised Explosive Device (IED) interrogation, and Unmanned Aerial System (UAS) surveillance and reconnaissance with various unmanned systems. Integration of unmanned weapon systems into human Fire Teams represents the next evolution in mixed-initiative teams. Such integration aims to improve individual and team performance; however, improved understanding and application of Human-Robot Interaction (HRI) principles within combat environments is required. The research presented investigates the impact upon individual and team performance when a non-autonomous unmanned weapon system is integrated into a human Fire Team. Studies were conducted at two U.S. Army installations involving 36, four-person Fire Teams. At the first location, participants included pre-deployed novice soldiers, and the second installment included experienced soldiers as participants. All soldiers had previous weapon experience using an M16 rifle and M240B machine gun. Two conditions were compared: Fire Teams fully manned by human Warfighters and Fire Teams where one human Warfighter was replaced by a remotely operated weapon. Each team consisted of four members: one M240B Gunner and three M16 Rifleman. The teams completed simulated missions utilizing the Engagement Skills Trainer 2000 (EST 2000), a virtual training simulator that executes various mission scenarios. The Fire Teams completed two different scenarios, each consisting of a manned and unmanned condition. In the unmanned condition, the Gunner operated a remotely operated weapon from a separate location. Performance was primarily measured by recording the total number of targets hit by each team member during scenario execution. Paired samples t-tests revealed significant differences in individual performance from the manned to unmanned conditions. Individual Riflemen improved performance from manned to unmanned scenarios. However, the Gunners significantly decreased in performance when operating the remote weapon system during the unmanned condition. Team performance did not reveal a significant difference in performance across conditions. This paper describes the experimental plan and methodology, followed by a discussion of experimental results and recommendations for future mixed-initiative team research.

Eye Tracking Metrics for Insider Threat Detection in a Simulated Work Environment

Insider Threats (ITs) are hard to identify because of their knowledge of the organization and motivation to avoid detection. One approach to detecting ITs utilizes Active Indicators (AI), stimuli that elicit a characteristic response from the insider. The present research implemented this approach within a simulation of financial investigative work. A sequence of AIs associated with accessing a locked file was introduced into an ongoing workflow. Participants allocated to an insider role accessed the file illicitly. Eye tracking metrics were used to differentiate insiders and control participants performing legitimate role. Data suggested that ITs may show responses suggestive of strategic concealment of interest and emotional stress. Such findings may provide the basis for a cognitive engineering approach to IT detection.

Scenarios using situation awareness in a simulation environment for eliciting insider threat behavior

An important topic in cybersecurity is validating Active Indicators (AI), which are stimuli that can be implemented in systems to trigger responses from individuals who might or might not be Insider Threats (ITs). The way in which a person responds to the AI is being validated for identifying a potential threat and a non-threat. In order to execute this validation process, it is important to create a paradigm that allows manipulation of AIs for measuring response. The scenarios are posed in a manner that require participants to be situationally aware that they are being monitored and have to act deceptively. In particular, manipulations in the environment should no differences between conditions relative to immersion and ease of use, but the narrative should be the driving force behind non-deceptive and IT responses. The success of the narrative and the simulation environment to induce such behaviors is determined by immersion, usability, and stress response questionnaires, and performance. Initial results of the feasibility to use a narrative reliant upon situation awareness of monitoring and evasion are discussed.

Effects of Visual Fidelity on Biometric Cue Detection in Virtual Combat Profiling Training

Combat Profiling involves observation of humans and the environment to identify behavioral anomalies signifying the presence of a potential threat. Desires to expand accessibility to Combat Profiling training motivate the training community to investigate Virtual Environments (VEs). VE design recommendations will benefit efforts to translate Combat Profiling training methods to virtual platforms. Visual aspects of virtual environments may significantly impact observational and perceptual training objectives. This experiment compared the effects of high and low fidelity virtual characters for biometric cue detection training on participant performance and perceptions. Results suggest that high fidelity virtual characters promote positive training perceptions and self-efficacy, but do not significantly impact overall performance.

Effects of Autonomous vs. Remotely-Operated Unmanned Weapon Systems on Human-Robot Teamwork and Trust

In the United States Military, 2011 marks the third year of a 25 year plan to increase the number of unmanned systems across the air, ground, and maritime domains. These systems perform as members of human-robot teams either autonomously or by remote-operation. The success of employing unmanned systems in coordination with human team members depends on system capabilities which support teamwork and trust. Weaponization of these systems introduces new concerns in teamwork and trust research. This paper presents research comparing the effects of autonomous and remotely-operated unmanned weapon systems on human-robot teamwork and trust. The results will contribute to the development of recommended roles and automation levels for future weaponized robotic systems.

Theoretical Foundations for Developing Cybersecurity Training

Cybersecurity is a computer term regarding the detection, anticipation, and prevention of computer technologies and peripherals from damage, attack, or unauthorized access. These technologies include the monitoring of networks, programs, applications, and personnel. Cybersecurity can be viewed from both an offensive or defensive posture involving maintaining and proactively assessing security vulnerabilities. In 2013, Edward Snowden used his position as an infrastructure analyst to leak thousands of top-secret classified documents detailing the U.S. Government’s global covert surveillance and eavesdropping undertakings to the public. This incident identified the human threat as a contributing factor that highlighted several weaknesses in the present state of U.S. cybersecurity affairs. In efforts to strengthen cyber defenses, a solid theoretical research foundation regarding cyber vulnerabilities is warranted. Building upon that foundation, training and experimentation can provide insight into current cybersecurity training methods and how they can be transitioned and implemented into future training regimens.