"Applying Behavioral Psychology to Strengthen Your Incident Response Team"

A team of researchers from George Mason University (GMU), Dartmouth College, and HP did a study on the inner workings of cybersecurity incident response teams (CSIRTs), which led to the development of a framework that applies behavioral psychology principles to strengthen such teams. From 2012 to 2017, the team interviewed over 200 people and led 80 focus groups across 17 international organizations, identifying the drivers of teamwork within and between teams. They spent more than 56,000 hours on interviewing, data gathering, and analysis to gain greater insight into what an individual does on a team, the team they represent, or the multiteam system they represent. Collaboration issues emerge when security professionals are trained individually as they learn how to hack, investigate, and conduct testing. When they are put into a situation in which they face complex problems and challenges that require collaboration, they will most likely not have the background and habits that stem from collaborative work in a multiteam system. The prominent focus on technical tools and skills adds to CSIRTs' collaboration issues, with incident response teams often becoming overwhelmed by tools when trying to address technical problems in security and incident response. There is a lack of tools to address some of the social and collaboration challenges faced by CSIRTs when operating in a multigroup, multiteam system. This article continues to discuss the challenges faced by CSIRTs when operating within the context of a multiteam system and the framework developed to address this challenge by applying behavioral psychology principles. 

Dark Reading reports "Applying Behavioral Psychology to Strengthen Your Incident Response Team"