{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,14]],"date-time":"2026-10-14T10:09:06Z","timestamp":1791972546323,"version":"4.3.4"},"publisher-location":"New York, NY, USA","reference-count":69,"publisher":"ACM","license":[{"start":{"date-parts":[[2022,4,29]],"date-time":"2022-04-29T00:00:00Z","timestamp":1651190400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,4,29]]},"DOI":"10.1145\/3491102.3517559","type":"proceedings-article","created":{"date-parts":[[2022,4,28]],"date-time":"2022-04-28T16:33:27Z","timestamp":1651163607000},"page":"1-18","source":"Crossref","is-referenced-by-count":34,"title":["How Ready is Your Ready? Assessing the Usability of Incident Response Playbook Frameworks"],"prefix":"10.1145","author":[{"given":"Rock","family":"Stevens","sequence":"first","affiliation":[{"name":"University of Maryland, United States"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Daniel","family":"Votipka","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Tufts University, United States"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Josiah","family":"Dykstra","sequence":"additional","affiliation":[{"name":"Cybersecurity Collaboration Center, National Security Agency, United States"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fernando","family":"Tomlinson","sequence":"additional","affiliation":[{"name":"Mandiant, United States"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Erin","family":"Quartararo","sequence":"additional","affiliation":[{"name":"University of Maryland, United States"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Colin","family":"Ahern","sequence":"additional","affiliation":[{"name":"New York City Cyber Command, United States"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Michelle L.","family":"Mazurek","sequence":"additional","affiliation":[{"name":"University of Maryland, United States"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,4,29]]},"reference":[{"key":"e_1_3_2_2_1_1","doi-asserted-by":"crossref","unstructured":"Andy Applebaum Shawn Johnson Michael Limiero and Michael Smith. 2018. Playbook oriented cyber response. In 2018 National Cyber Summit (NCS). Andy Applebaum Shawn Johnson Michael Limiero and Michael Smith. 2018. Playbook oriented cyber response. In 2018 National Cyber Summit (NCS).","DOI":"10.1109\/NCS.2018.00007"},{"key":"e_1_3_2_2_2_1","volume-title":"Fourteenth Symposium on Usable Privacy and Security (SOUPS).","author":"Assal Hala","year":"2018","unstructured":"Hala Assal and Sonia Chiasson . 2018 . Security in the software development lifecycle . In Fourteenth Symposium on Usable Privacy and Security (SOUPS). Hala Assal and Sonia Chiasson. 2018. Security in the software development lifecycle. In Fourteenth Symposium on Usable Privacy and Security (SOUPS)."},{"key":"e_1_3_2_2_3_1","first-page":"359","article-title":"Motivational determinants of risk-taking behavior.Psychological review 64, 6","volume":"1","author":"Atkinson W","year":"1957","unstructured":"John\u00a0 W Atkinson . 1957 . Motivational determinants of risk-taking behavior.Psychological review 64, 6 , Pt. 1 (1957), 359 . John\u00a0W Atkinson. 1957. Motivational determinants of risk-taking behavior.Psychological review 64, 6, Pt.1 (1957), 359.","journal-title":"Pt."},{"key":"e_1_3_2_2_4_1","unstructured":"Amazon AWS. 2020. AWS incident response runbook samples. https:\/\/github.com\/aws-samples\/aws-incident-response-playbooks\/tree\/0d9a1c0f7ad68fb2c1b2d86be8914f2069492e21 (Accessed 01-08-2022). Amazon AWS. 2020. AWS incident response runbook samples. https:\/\/github.com\/aws-samples\/aws-incident-response-playbooks\/tree\/0d9a1c0f7ad68fb2c1b2d86be8914f2069492e21 (Accessed 01-08-2022)."},{"key":"e_1_3_2_2_5_1","volume-title":"How good is your cyberincident-response plan?McKinsey on Business Technology31","author":"Bailey Tucker","year":"2013","unstructured":"Tucker Bailey , Josh Brandley , and James Kaplan . 2013. How good is your cyberincident-response plan?McKinsey on Business Technology31 ( 2013 ), 16\u201323. Tucker Bailey, Josh Brandley, and James Kaplan. 2013. How good is your cyberincident-response plan?McKinsey on Business Technology31 (2013), 16\u201323."},{"key":"e_1_3_2_2_6_1","volume-title":"Social learning theory","author":"Bandura Albert","unstructured":"Albert Bandura and Richard\u00a0 H Walters . 1977. Social learning theory . Prentice-Hall . Albert Bandura and Richard\u00a0H Walters. 1977. Social learning theory. Prentice-Hall."},{"key":"e_1_3_2_2_7_1","volume-title":"Business continuity management: Building an effective incident management plan","author":"Blyth Michael","unstructured":"Michael Blyth . 2009. Business continuity management: Building an effective incident management plan . John Wiley & Sons . Michael Blyth. 2009. Business continuity management: Building an effective incident management plan. John Wiley & Sons."},{"key":"e_1_3_2_2_8_1","volume-title":"Crafting the InfoSec playbook: Security monitoring and incident response master plan. O\u2019Reilly Media","author":"Bollinger Jeff","unstructured":"Jeff Bollinger , Brandon Enright , and Matthew Valites . 2015. Crafting the InfoSec playbook: Security monitoring and incident response master plan. O\u2019Reilly Media , Inc . Jeff Bollinger, Brandon Enright, and Matthew Valites. 2015. Crafting the InfoSec playbook: Security monitoring and incident response master plan. O\u2019Reilly Media, Inc."},{"key":"e_1_3_2_2_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/1280680.1280693"},{"key":"e_1_3_2_2_10_1","volume-title":"Tenth Symposium On Usable Privacy and Security (SOUPS).","author":"Bravo-Lillo Cristian","year":"2014","unstructured":"Cristian Bravo-Lillo , Lorrie Cranor , Saranga Komanduri , Stuart Schechter , and Manya Sleeper . 2014 . Harder to ignore? Revisiting pop-up fatigue and approaches to prevent it . In Tenth Symposium On Usable Privacy and Security (SOUPS). Cristian Bravo-Lillo, Lorrie Cranor, Saranga Komanduri, Stuart Schechter, and Manya Sleeper. 2014. Harder to ignore? Revisiting pop-up fatigue and approaches to prevent it. In Tenth Symposium On Usable Privacy and Security (SOUPS)."},{"key":"e_1_3_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/2858036.2858498"},{"key":"e_1_3_2_2_12_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1742-6723.2011.01495.x"},{"key":"e_1_3_2_2_13_1","volume-title":"Constructing grounded theory: A practical guide through qualitative analysis","author":"Charmaz Kathy","unstructured":"Kathy Charmaz . 2006. Constructing grounded theory: A practical guide through qualitative analysis . Sage . Kathy Charmaz. 2006. Constructing grounded theory: A practical guide through qualitative analysis. Sage."},{"key":"e_1_3_2_2_14_1","first-page":"1","article-title":"Computer security incident handling guide","volume":"800","author":"Cichonski Paul","year":"2012","unstructured":"Paul Cichonski , Tom Millar , Tim Grance , and Karen Scarfone . 2012 . Computer security incident handling guide . NIST Special Publication 800 , 61 (2012), 1 \u2013 147 . Paul Cichonski, Tom Millar, Tim Grance, and Karen Scarfone. 2012. Computer security incident handling guide. NIST Special Publication 800, 61 (2012), 1\u2013147.","journal-title":"NIST Special Publication"},{"key":"e_1_3_2_2_15_1","volume-title":"Enigma","author":"Clark Robert","year":"2018","unstructured":"Robert Clark . 2018. Compliance != security (Except when it might be). In Enigma 2018 . https:\/\/www.usenix.org\/node\/208142 Robert Clark. 2018. Compliance != security (Except when it might be). In Enigma 2018. https:\/\/www.usenix.org\/node\/208142"},{"key":"e_1_3_2_2_16_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.07.009"},{"key":"e_1_3_2_2_17_1","unstructured":"Lorrie\u00a0F Cranor. 2008. A framework for reasoning about the human in the loop. In Usability Psychology and Security Workshop (UPSEC). Lorrie\u00a0F Cranor. 2008. A framework for reasoning about the human in the loop. In Usability Psychology and Security Workshop (UPSEC)."},{"key":"e_1_3_2_2_18_1","unstructured":"CrowdStrike. 2019. 2019 CrowdStrike global threat report: Adversary tradecraft and the importance of speed. https:\/\/go.crowdstrike.com\/rs\/281-OBQ-266\/images\/Report2019GlobalThreatReport.pdf CrowdStrike. 2019. 2019 CrowdStrike global threat report: Adversary tradecraft and the importance of speed. https:\/\/go.crowdstrike.com\/rs\/281-OBQ-266\/images\/Report2019GlobalThreatReport.pdf"},{"key":"e_1_3_2_2_21_1","unstructured":"Cybersecurity and Infrastructure\u00a0Security Agency. 2021. Cybersecurity Incident & Vulnerability Response Playbooks. Technical Report. US Department of Homeland Security. Cybersecurity and Infrastructure\u00a0Security Agency. 2021. Cybersecurity Incident & Vulnerability Response Playbooks. Technical Report. US Department of Homeland Security."},{"key":"e_1_3_2_2_22_1","first-page":"58","article-title":"Commander\u2019s intent and concept of operations","volume":"93","author":"Dempsey Richard","year":"2013","unstructured":"Richard Dempsey and Jonathan\u00a0 M Chavous . 2013 . Commander\u2019s intent and concept of operations . Military Review 93 , 6 (2013), 58 \u2013 66 . Richard Dempsey and Jonathan\u00a0M Chavous. 2013. Commander\u2019s intent and concept of operations. Military Review 93, 6 (2013), 58\u201366.","journal-title":"Military Review"},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243794"},{"key":"e_1_3_2_2_24_1","doi-asserted-by":"crossref","first-page":"103","DOI":"10.69554\/WSIN1093","article-title":"The European air traffic management response to volcanic ash crises: Towards institutionalised aviation crisis management","volume":"5","author":"Dopagne Jacques","year":"2011","unstructured":"Jacques Dopagne . 2011 . The European air traffic management response to volcanic ash crises: Towards institutionalised aviation crisis management . Journal of Business Continuity & Emergency Planning 5 , 2 (2011), 103 \u2013 117 . Jacques Dopagne. 2011. The European air traffic management response to volcanic ash crises: Towards institutionalised aviation crisis management. Journal of Business Continuity & Emergency Planning 5, 2 (2011), 103\u2013117.","journal-title":"Journal of Business Continuity & Emergency Planning"},{"key":"e_1_3_2_2_25_1","volume-title":"11th USENIX Workshop on Cyber Security Experimentation and Test (CSET).","author":"Dykstra Josiah","year":"2018","unstructured":"Josiah Dykstra and Celeste\u00a0Lyn Paul . 2018 . Cyber Operations Stress Survey (COSS): Studying fatigue, frustration, and cognitive workload in cybersecurity operations . In 11th USENIX Workshop on Cyber Security Experimentation and Test (CSET). Josiah Dykstra and Celeste\u00a0Lyn Paul. 2018. Cyber Operations Stress Survey (COSS): Studying fatigue, frustration, and cognitive workload in cybersecurity operations. In 11th USENIX Workshop on Cyber Security Experimentation and Test (CSET)."},{"key":"e_1_3_2_2_26_1","volume-title":"The social desirability variable in personality assessment and research","author":"Edwards L","unstructured":"Allen\u00a0 L Edwards . 1957. The social desirability variable in personality assessment and research . Dryden Press . Allen\u00a0L Edwards. 1957. The social desirability variable in personality assessment and research. Dryden Press."},{"key":"e_1_3_2_2_27_1","unstructured":"Federal Emergency Management Agency. 2020. FEMA Playbooks. Federal Emergency Management Agency. 2020. FEMA Playbooks."},{"key":"e_1_3_2_2_29_1","unstructured":"Charles Frick. 2020. New cyber defense feed protects government systems in live trial across four states. https:\/\/www.jhuapl.edu\/PressRelease\/201203-APL-leads-cyber-defense-feed-protecting-live-active-government-systems Charles Frick. 2020. New cyber defense feed protects government systems in live trial across four states. https:\/\/www.jhuapl.edu\/PressRelease\/201203-APL-leads-cyber-defense-feed-protecting-live-active-government-systems"},{"key":"e_1_3_2_2_30_1","volume-title":"A risk management approach to business continuity: Aligning business continuity and corporate governance","author":"Graham Julia","unstructured":"Julia Graham and David Kaye . 2015. A risk management approach to business continuity: Aligning business continuity and corporate governance . Rothstein Publishing . Julia Graham and David Kaye. 2015. A risk management approach to business continuity: Aligning business continuity and corporate governance. Rothstein Publishing."},{"key":"e_1_3_2_2_32_1","volume-title":"27th USENIX Security Symposium.","author":"Harkous Hamza","year":"2018","unstructured":"Hamza Harkous , Kassem Fawaz , R\u00e9mi Lebret , Florian Schaub , Kang\u00a0 G Shin , and Karl Aberer . 2018 . Polisis: Automated analysis and presentation of privacy policies using deep learning . In 27th USENIX Security Symposium. Hamza Harkous, Kassem Fawaz, R\u00e9mi Lebret, Florian Schaub, Kang\u00a0G Shin, and Karl Aberer. 2018. Polisis: Automated analysis and presentation of privacy policies using deep learning. In 27th USENIX Security Symposium."},{"key":"e_1_3_2_2_33_1","volume-title":"Business continuity: Playbook","author":"Hayes Bob","unstructured":"Bob Hayes and Kathleen Kotwica . 2013. Business continuity: Playbook . Elsevier . Bob Hayes and Kathleen Kotwica. 2013. Business continuity: Playbook. Elsevier."},{"key":"e_1_3_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.1057\/thr.2008.12"},{"key":"e_1_3_2_2_35_1","volume-title":"The definitive handbook of business continuity management","author":"Hiles Andrew","unstructured":"Andrew Hiles . 2010. The definitive handbook of business continuity management . John Wiley & Sons . Andrew Hiles. 2010. The definitive handbook of business continuity management. John Wiley & Sons."},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"crossref","unstructured":"Allyson\u00a0L Holbrook Melanie\u00a0C Green and Jon\u00a0A Krosnick. 2003. Telephone versus face-to-face interviewing of national probability samples with long questionnaires: Comparisons of respondent satisficing and social desirability response bias. Public opinion quarterly 67 1 (2003) 79\u2013125. Allyson\u00a0L Holbrook Melanie\u00a0C Green and Jon\u00a0A Krosnick. 2003. Telephone versus face-to-face interviewing of national probability samples with long questionnaires: Comparisons of respondent satisficing and social desirability response bias. Public opinion quarterly 67 1 (2003) 79\u2013125.","DOI":"10.1086\/346010"},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"publisher","DOI":"10.1111\/psyp.12339"},{"key":"e_1_3_2_2_38_1","unstructured":"IACD. 2019. About IACD. https:\/\/www.iacdautomate.org\/aboutiacd IACD. 2019. About IACD. https:\/\/www.iacdautomate.org\/aboutiacd"},{"key":"e_1_3_2_2_39_1","volume-title":"https:\/\/www.incidentresponse.com\/playbooks\/ (Accessed","author":"Incident Response Consortium","year":"2021","unstructured":"Incident Response Consortium . 2019. Playbooks. https:\/\/www.incidentresponse.com\/playbooks\/ (Accessed 2021 .). Incident Response Consortium. 2019. Playbooks. https:\/\/www.incidentresponse.com\/playbooks\/ (Accessed 2021.)."},{"key":"e_1_3_2_2_40_1","unstructured":"Joseph R.\u00a0Biden Jr.2021. Executive order on improving the nation\u2019s cybersecurity. https:\/\/www.whitehouse.gov\/briefing-room\/presidential-actions\/2021\/05\/12\/executive-order-on-improving-the-nations-cybersecurity\/ Joseph R.\u00a0Biden Jr.2021. Executive order on improving the nation\u2019s cybersecurity. https:\/\/www.whitehouse.gov\/briefing-room\/presidential-actions\/2021\/05\/12\/executive-order-on-improving-the-nations-cybersecurity\/"},{"key":"e_1_3_2_2_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516671"},{"key":"e_1_3_2_2_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354239"},{"key":"e_1_3_2_2_44_1","doi-asserted-by":"publisher","DOI":"10.5465\/amle.2005.17268566"},{"key":"e_1_3_2_2_45_1","unstructured":"J. Lazar J.H. Feng and H. Hochheiser. 2017. Research Methods in Human-Computer Interaction. Elsevier Science. J. Lazar J.H. Feng and H. Hochheiser. 2017. Research Methods in Human-Computer Interaction. Elsevier Science."},{"key":"e_1_3_2_2_46_1","doi-asserted-by":"publisher","DOI":"10.1080\/02678370500065275"},{"key":"e_1_3_2_2_47_1","unstructured":"Microsoft. 2021. Incident response playbooks. https:\/\/docs.microsoft.com\/en-us\/security\/compass\/incident-response-playbooks Microsoft. 2021. Incident response playbooks. https:\/\/docs.microsoft.com\/en-us\/security\/compass\/incident-response-playbooks"},{"key":"e_1_3_2_2_48_1","doi-asserted-by":"crossref","unstructured":"Devesh Mishra. 2018. Cybersecurity playbook \u2013 An executive response. Available at SSRN 3240285(2018). https:\/\/ssrn.com\/abstract=3240285 Devesh Mishra. 2018. Cybersecurity playbook \u2013 An executive response. Available at SSRN 3240285(2018). https:\/\/ssrn.com\/abstract=3240285","DOI":"10.2139\/ssrn.3240285"},{"key":"e_1_3_2_2_49_1","unstructured":"MITRE. 2019. ATT&ACK. https:\/\/attack.mitre.org MITRE. 2019. ATT&ACK. https:\/\/attack.mitre.org"},{"key":"e_1_3_2_2_50_1","unstructured":"MITRE. 2019. Brute Force. https:\/\/attack.mitre.org\/techniques\/T1110\/ MITRE. 2019. Brute Force. https:\/\/attack.mitre.org\/techniques\/T1110\/"},{"key":"e_1_3_2_2_51_1","volume-title":"Phishing: Spearphishing Link. https:\/\/attack.mitre.org\/techniques\/T1192\/","author":"MITRE.","year":"2019","unstructured":"MITRE. 2019 . Phishing: Spearphishing Link. https:\/\/attack.mitre.org\/techniques\/T1192\/ MITRE. 2019. Phishing: Spearphishing Link. https:\/\/attack.mitre.org\/techniques\/T1192\/"},{"key":"e_1_3_2_2_52_1","unstructured":"MITRE. 2019. Valid Accounts. https:\/\/attack.mitre.org\/techniques\/T1078\/ MITRE. 2019. Valid Accounts. https:\/\/attack.mitre.org\/techniques\/T1078\/"},{"key":"e_1_3_2_2_53_1","doi-asserted-by":"publisher","DOI":"10.1001\/dmp.2011.13"},{"key":"e_1_3_2_2_54_1","volume-title":"The coding manual for qualitative researchers (2 ed.)","author":"Johnny\u00a0Salda","unstructured":"Johnny\u00a0Salda na. 2014. The coding manual for qualitative researchers (2 ed.) . Sage . Johnny\u00a0Salda na. 2014. The coding manual for qualitative researchers (2 ed.). Sage."},{"key":"e_1_3_2_2_55_1","unstructured":"National Institute of Standards and Technology. 2014. NIST Cybersecurity Framework. https:\/\/www.us-cert.gov\/ccubedvp\/cybersecurity-framework National Institute of Standards and Technology. 2014. NIST Cybersecurity Framework. https:\/\/www.us-cert.gov\/ccubedvp\/cybersecurity-framework"},{"key":"e_1_3_2_2_56_1","unstructured":"Jakob Nielsen. 2012. Usability 101: Introduction to Usability. https:\/\/www.nngroup.com\/articles\/usability-101-introduction-to-usability\/ Accessed: 2022-01-08. Jakob Nielsen. 2012. Usability 101: Introduction to Usability. https:\/\/www.nngroup.com\/articles\/usability-101-introduction-to-usability\/ Accessed: 2022-01-08."},{"key":"e_1_3_2_2_57_1","volume-title":"SOTER: A playbook for cybersecurity incident management","author":"Onwubiko Cyril","year":"2020","unstructured":"Cyril Onwubiko and Karim Ouazzane . 2020 . SOTER: A playbook for cybersecurity incident management . IEEE Transactions on Engineering Management( 2020). Cyril Onwubiko and Karim Ouazzane. 2020. SOTER: A playbook for cybersecurity incident management. IEEE Transactions on Engineering Management(2020)."},{"key":"e_1_3_2_2_58_1","volume-title":"On the social psychology of the psychological experiment: With particular reference to demand characteristics and their implications.American psychologist 17, 11","author":"Orne T","year":"1962","unstructured":"Martin\u00a0 T Orne . 1962. On the social psychology of the psychological experiment: With particular reference to demand characteristics and their implications.American psychologist 17, 11 ( 1962 ), 776. Martin\u00a0T Orne. 1962. On the social psychology of the psychological experiment: With particular reference to demand characteristics and their implications.American psychologist 17, 11 (1962), 776."},{"key":"e_1_3_2_2_59_1","doi-asserted-by":"publisher","DOI":"10.1197\/aemj.10.4.386"},{"key":"e_1_3_2_2_61_1","volume-title":"Ways of Knowing in HCI, Judith\u00a0S Olson and Wendy\u00a0A Kellogg (Eds.)","author":"Siek A","unstructured":"Katie\u00a0 A Siek , Gillian\u00a0 R Hayes , Mark\u00a0 W Newman , and John\u00a0 C Tang . 2014. Field deployments: Knowing from using in context . In Ways of Knowing in HCI, Judith\u00a0S Olson and Wendy\u00a0A Kellogg (Eds.) . Springer , 119\u2013142. Katie\u00a0A Siek, Gillian\u00a0R Hayes, Mark\u00a0W Newman, and John\u00a0C Tang. 2014. Field deployments: Knowing from using in context. In Ways of Knowing in HCI, Judith\u00a0S Olson and Wendy\u00a0A Kellogg (Eds.). Springer, 119\u2013142."},{"key":"e_1_3_2_2_62_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.23022"},{"key":"e_1_3_2_2_63_1","volume-title":"31st USENIX Large Installation System Administration Conference (LISA).","author":"Stevens Rock","year":"2017","unstructured":"Rock Stevens . 2017 . Calcifying crisis readiness . In 31st USENIX Large Installation System Administration Conference (LISA). Rock Stevens. 2017. Calcifying crisis readiness. In 31st USENIX Large Installation System Administration Conference (LISA)."},{"key":"e_1_3_2_2_64_1","volume-title":"27th USENIX Security Symposium.","author":"Stevens Rock","year":"2018","unstructured":"Rock Stevens , Colin Ahern , Daniel Votipka , Elissa Redmiles , Patrick Sweeney , and Michelle\u00a0 L Mazurek . 2018 . The battle for New York: A case study of applied digital threat modeling at the enterprise level . In 27th USENIX Security Symposium. Rock Stevens, Colin Ahern, Daniel Votipka, Elissa Redmiles, Patrick Sweeney, and Michelle\u00a0L Mazurek. 2018. The battle for New York: A case study of applied digital threat modeling at the enterprise level. In 27th USENIX Security Symposium."},{"key":"e_1_3_2_2_65_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24003"},{"key":"e_1_3_2_2_67_1","volume-title":"Eleventh Symposium On Usable Privacy and Security (SOUPS).","author":"Sundaramurthy Sathya\u00a0Chandran","year":"2015","unstructured":"Sathya\u00a0Chandran Sundaramurthy , Alexandru\u00a0 G Bardas , Jacob Case , Xinming Ou , Michael Wesch , John McHugh , and S\u00a0Raj Rajagopalan . 2015 . A human capital model for mitigating security analyst burnout . In Eleventh Symposium On Usable Privacy and Security (SOUPS). Sathya\u00a0Chandran Sundaramurthy, Alexandru\u00a0G Bardas, Jacob Case, Xinming Ou, Michael Wesch, John McHugh, and S\u00a0Raj Rajagopalan. 2015. A human capital model for mitigating security analyst burnout. In Eleventh Symposium On Usable Privacy and Security (SOUPS)."},{"key":"e_1_3_2_2_68_1","doi-asserted-by":"publisher","DOI":"10.1109\/MIC.2017.52"},{"key":"e_1_3_2_2_69_1","volume-title":"Cybersecurity Incident Response: How to Contain, Eradicate, and Recover from Incidents","author":"Thompson C","unstructured":"Eric\u00a0 C Thompson . 2018. Cybersecurity Incident Response: How to Contain, Eradicate, and Recover from Incidents . Apress . Eric\u00a0C Thompson. 2018. Cybersecurity Incident Response: How to Contain, Eradicate, and Recover from Incidents. Apress."},{"key":"e_1_3_2_2_70_1","doi-asserted-by":"publisher","DOI":"10.1037\/0033-2909.133.5.859"},{"key":"e_1_3_2_2_71_1","unstructured":"U.S. Department of Homeland Security. 2019. DHS bomb threat checklist. https:\/\/www.cisa.gov\/sites\/default\/files\/publications\/dhs-bomb-threat-checklist-2014-508.pdf U.S. Department of Homeland Security. 2019. DHS bomb threat checklist. https:\/\/www.cisa.gov\/sites\/default\/files\/publications\/dhs-bomb-threat-checklist-2014-508.pdf"},{"key":"e_1_3_2_2_72_1","volume-title":"The state of incident response","author":"Virtual Intelligence","year":"2017","unstructured":"Virtual Intelligence Briefing (VIB). 2017. The state of incident response 2017 . https:\/\/a51.nl\/sites\/default\/files\/pdf\/The%20State%20of%20Incident%20Response%202017.pdf Virtual Intelligence Briefing (VIB). 2017. The state of incident response 2017. https:\/\/a51.nl\/sites\/default\/files\/pdf\/The%20State%20of%20Incident%20Response%202017.pdf"},{"key":"e_1_3_2_2_73_1","unstructured":"Andy Wapling and Chloe Sellwood. 2016. Health Emergency Preparedness and Response. CABI. Andy Wapling and Chloe Sellwood. 2016. Health Emergency Preparedness and Response. CABI."},{"key":"e_1_3_2_2_74_1","unstructured":"Shaun Waterman. 2017. Looking to fit it all together banks adopt standards for cyber automation and integration. https:\/\/www.cyberscoop.com\/banks-fs-isac-jhu-apl-ais-iacd\/ (Accessed 01-08-2022). Shaun Waterman. 2017. Looking to fit it all together banks adopt standards for cyber automation and integration. https:\/\/www.cyberscoop.com\/banks-fs-isac-jhu-apl-ais-iacd\/ (Accessed 01-08-2022)."},{"key":"e_1_3_2_2_75_1","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2004.1265411"},{"key":"e_1_3_2_2_77_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-22915-7_40"}],"event":{"name":"CHI '22: CHI Conference on Human Factors in Computing Systems","location":"New Orleans LA USA","acronym":"CHI '22","sponsor":["SIGCHI ACM Special Interest Group on Computer-Human Interaction"]},"container-title":["CHI Conference on Human Factors in Computing Systems"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3491102.3517559","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3491102.3517559","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T19:31:13Z","timestamp":1750188673000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3491102.3517559"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,4,29]]},"references-count":69,"alternative-id":["10.1145\/3491102.3517559","10.1145\/3491102"],"URL":"https:\/\/doi.org\/10.1145\/3491102.3517559","relation":{},"subject":[],"published":{"date-parts":[[2022,4,29]]}}}