Stress and Hacking: Understanding Cognitive Stress in Tactical Cyber Ops

The presentation discusses the impact of stress on operators in tactical cyber operations and the need to address it for the health and safety of the workforce.

• Tactical cyber operations involve hands-on keyboard work to protect DoD networks from adversaries through red teaming and hunting missions.
• Performance in this work is closely tied to speed and precision, requiring a highly trained workforce.
• Chronic stress from repetitive and prolonged exposure to high-pressure situations can have adverse effects on the health and well-being of operators.
• The survey conducted by the NSA found that longer operations increased stress, fatigue, frustration, and cognitive workload.
• Employers can use the survey as a baseline to measure stress levels and make policy changes to address the well-being of their workforce.
• Having some control over their environment can lower stress levels for operators.

The presenter shared a humorous anecdote about an operator who reported a high stress level before an operation, but it decreased significantly after the operation. However, the presenter emphasized the importance of ensuring the health and safety of operators, as chronic stress can have long-term effects.

Hacking is a high-risk, high-reward, with a high-cost to human capital. In this session, we will talk about the effects of human factors in cyber operations and why you should care about them. Specifically, we will focus on results of research at the National Security Agency that studied the effects of cognitive stress on tactical cyber operators. A key motivation for this work was the intuition that cognitive stress may negatively affect operational security, work performance, and employee satisfaction. Operator fatigue, frustration, and cognitive workload increases significantly over the course of a tactical cyber operation. Fatigue and frustration are correlated, and as one increases so does the other. The longer the operation, the greater the mental demand, physical demand, time pressure, frustration, and overall effort needed to complete the operation. Operations longer than 5 hours have 10% greater increases in fatigue and frustration compared to shorter operations. We found no link of performance to operation length; that is, from the operator's perspective longer operations did not result in higher success. Knowing how these factors affect cyber operations has helped us make more informed decisions about mission policy and workforce health. We hope that by sharing this with the greater Black Hat community, they will also be able to learn from our study and improve their own cybersecurity operations.