Publication:
An Empirical Assessment of the Effectiveness of Deception for Cyber Defense

Simple item page
dc.contributor.advisorBrian Levine
dc.contributor.advisorDavid Jensen
dc.contributor.advisorPhillipa Gill
dc.contributor.advisorShannon Roberts
dc.contributor.authorFerguson-Walter, Kimberly J
dc.contributor.departmentUniversity of Massachusetts Amherst
dc.date2024-03-27T17:49:52.000
dc.date.accessioned2024-04-26T15:36:13Z
dc.date.available2024-04-26T15:36:13Z
dc.date.submittedFebruary
dc.date.submitted2020
dc.description.abstractThe threat of cyber attacks is a growing concern across the world, leading to an increasing need for sophisticated cyber defense techniques. The Tularosa Study, was designed and conducted to understand how defensive deception, both cyber and psychological, affects cyber attackers Ferguson-Walter et al. [2019c]. More specifically, for this empirical study, cyber deception refers to a decoy system and psychological deception refers to false information of the presence of defensive deception techniques on the network. Over 130 red teamers participated in a network penetration test over two days in which we controlled both the presence of and explicit mention of deceptive defensive techniques. To our knowledge, this represents the largest study of its kind ever conducted on a skilled red team population. In addition to the abundant host and network data collected, we conducted a battery of questionnaires, e.g., experience, personality; and cognitive tasks, e.g., fluid intelligence, working memory; as well as physiological measures, e.g., galvanic skin response (GSR), heart rate, to be correlated with the cyber events at a later date. The design and execution of this study and the lessons learned are a major contribution of this thesis. I investigate the effectiveness of decoy systems for cyber defense by comparing performance across all experimental conditions. Results support a new finding that the combination of the presence of deception and the true information that deception is present has the greatest effect on cyber attackers, when compared to a control condition in which no deception was used. Evidence of cognitive biases in the red teamers’ behavior is then detailed and explained, to further support our theory of oppositional human factors (OHF). The final chapter discusses how elements of the experimental design contribute to the validity of assessing the effectiveness of cyber deception and reviews trade-offs and lessons learned.
dc.description.degreeDoctor of Philosophy (PhD)
dc.description.departmentComputer Science
dc.identifier.doihttps://doi.org/10.7275/z0rb-ek46
dc.identifier.orcidhttps://orcid.org/0000-0001-5108-4599
dc.identifier.urihttps://hdl.handle.net/20.500.14394/18084
dc.relation.urlhttps://scholarworks.umass.edu/cgi/viewcontent.cgi?article=2890&context=dissertations_2&unstamped=1
dc.source.statuspublished
dc.subjectcybersecurity
dc.subjecthuman subject
dc.subjectcognitive bias
dc.subjectdecoy system
dc.subjectnetwork penetration
dc.subjecthackers
dc.subjectInformation Security
dc.titleAn Empirical Assessment of the Effectiveness of Deception for Cyber Defense
dc.typedissertation
digcom.contributor.authorisAuthorOfPublication|email:k.fergusonwalter@gmail.com|institution:University of Massachusetts Amherst|Ferguson-Walter, Kimberly J
digcom.identifierdissertations_2/1823
digcom.identifier.contextkey15924271
digcom.identifier.submissionpathdissertations_2/1823
dspace.entity.typePublication
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
FergusonWalterDiss2020.pdf
Size:
5.88 MB
Format:
Adobe Portable Document Format
Thumbnail Image
Name: FergusonWalterDiss2020.pdf
Size: 5.88 MB
Kind: Adobe PDF
Collections
Dissertations