Humans in Cyber Incident Response Teams: Improving Effectiveness using Person-focused Research

Cyber incident response teams (or CIRTs) are responsible for detecting, analysing, containing, mitigating and recovering from occurrences that may threaten the confidentiality, integrity, or availability of information or an information system. This role can be demanding, as it requires many technical skills, but also many non-technical competencies in order to maximise performance both as an individual and as part of a team. As such, research into how to maximise performance in CIRTs is crucial in order to keep up with evolving threats. However, current research tends to focus on technical issues and frameworks often neglect to cover factors affecting the human element of the team. As such, I aim to delve into various elements of the working process of these CIRTs and whether they are designed with the human responder in mind. These may include elements involving individual factors, such as decision-making, situational awareness and general stressors; and those involving team factors, such as communication and collaboration.