Human factors related to the performance of intrusion detection operators

Intrusion detection systems are common in contemporary enterprises. These systems are sometimes operated by a single individual as a part time activity; they are sometimes operated by cyber security operation centres in which a group of technology experts with the sole task of monitoring, detecting, analysing and responding to threatening events in the computer network. In either case, human factors and ergonomics should be expected to influence the intrusion detection capability. In this paper, Wickens’ model of information processing and human factors concepts and tests are related to the tasks of intrusion detection operators. This model is used to identify both environmental conditions and human capabilities that are relevant for operators’ performance as well as experimental setups that can test hypotheses related to these factors. Based on this analysis, it is proposed that the most important factors are attention, vigilance, automation, multitasking and mental workload and tests and measures such as NASA-TLX and eye-movements, should be useful.