The National Security Agency asks: What do an air traffic controller, an emergency responder, and a cybersecurity operator have in common?
The answer: stress from a high-risk work environment.
Cybersecurity operators defend vital networks from bombardments of intrusion and attack attempts around the clock each day. The stakes are crucial – compromises of those networks can affect the lives and livelihoods of thousands, even millions of people. The talented workforce that performs this work has extensive, expensive training and employee turnover is costly in terms of lost expertise, time and money. Stress in this environment is an important risk factor, both for effective performance and employee burnout, NSA said in a release.
At NSA, technical experts Dr. Celeste Lyn Paul and Dr. Josiah Dykstra have studied the stress of the cybersecurity work environment. Their research on cognitive workload in tactical cyber operations led them to develop an assessment to measure stress in the – Cyber Operations Stress Survey (COSS) – which can be used by any organization to improve employee well-being.
As cybersecurity operations have matured over the past decade and cyber-threats have increased, managing the unprecedented growth of security alerts has placed unremitting demands on cybersecurity operators.
“Tactical cyber operations require speed and precision,” Dr. Dykstra said. “And stress may negatively affect operational security, work performance, and employee satisfaction.”
Dr. Paul and Dr. Dykstra developed the COSS as a low-cost method for studying fatigue, frustration and cognitive workload in real-time tactical cyber operations. However, the COSS may be useful in other environments for assessing stress or measuring the stress-lowering benefits of policy changes and technical mitigations.
Dr. Paul and Dr. Dykstra offer a few recommendations for using the survey:
- Use the assessment as a baseline for your organization’s current environment or try measuring the benefits of increased machine automation and human augmentation.
- Review your policies on time demands and technical options for mitigating stress. Check in with employees doing long and complex tasks.
- Remember that transparency matters to employees, and sharing your study’s results shows that you’re taking action to reduce stress at work and promoting a healthy work environment.
Dr. Paul is a senior researcher and technical advisor at NSA Research and Dr. Dykstra is the Deputy Technical Director of NSA Cybersecurity Operations. They conducted a study of NSA’s tactical cybersecurity operators and published their findings in the spring 2017 issue of the Journal of Information Warfare. They recently spoke about their work at Black Hat USA 2018, as well as the workshop on Cybersecurity Experimentation and Test at the USENIX Security Symposium, according to the National Security Agency.