Measuring Stress in a High-Risk Environment

What do an air traffic controller, an emergency responder, and a cybersecurity operator have in common? The answer: stress from a high-risk work environment.

Cybersecurity operators defend vital networks from all-day, every-day barrages of intrusion and attack attempts. The stakes are high – compromises of those networks can affect the lives and livelihoods of thousands, even millions of people. The talent that does this work has extensive, expensive training and employee turnover is costly. Stress in this environment therefore is an important risk factor, both for performance and employee burnout.

At NSA, technical experts Dr. Celeste Lyn Paul and Dr. Josiah Dykstra have studied the stress of this work environment. Their research on cognitive workload in tactical cyber operations led them to develop an assessment to measure stress – the Cyber Operations Stress Survey (COSS) – which can be used by any organization to improve employee well-being.

As cybersecurity operations have matured over the past decade, managing growth of the volume of security alerts has increased demands on cybersecurity operators.

“Tactical cyber operations require speed and precision,” Dr. Dykstra said. “And stress may negatively affect operational security, work performance, and employee satisfaction.”

Dr. Paul and Dr. Dykstra developed the COSS as a low-cost method for studying fatigue, frustration, and cognitive workload in real-time tactical cyber operations. However, the COSS may be useful in other environments for assessing stress or measuring the stress-lowering benefits of policy changes and technical mitigations. Dr. Paul and Dr. Dykstra offer a few recommendations for using the survey:

• Use the assessment as a baseline for your organization’s current environment or try measuring the benefits of increased machine automation and human augmentation.
• Review your policies on time demands and technical options for mitigating stress. Check in with employees doing long and complex tasks.
• Remember that transparency matters to employees, and sharing your study’s results shows that you’re taking action to reduce stress at work.

Dr. Paul is a senior researcher and technical advisor at NSA Research and Dr. Dykstra is the Deputy Technical Director of NSA Cybersecurity Operations. They conducted a study of NSA’s tactical cybersecurity operators and published their findings in the spring 2017 issue of the Journal of Information Warfare. They recently spoke about their work at Black Hat USA 2018, as well as the workshop on Cybersecurity Experimentation and Test at the USENIX Security Symposium.