All 100 indicators / Category 7.x: Stress response
Indicator 7.7
Measures vulnerability to attentional narrowing under stress that causes security teams to miss critical peripheral security indicators while focusing exclusively on immediate obvious threats
Stress-induced tunnel vision represents a fundamental neurobiological response where acute or chronic stress narrows cognitive processing to focus exclusively on immediate perceived threats while filtering out peripheral information crucial for comprehensive security assessment. This phenomenon occurs through activation of the sympathetic nervous system and HPA axis, which floods the system with stress hormones creating a cognitive 'spotlight' that illuminates only a fraction of the total information environment. The mechanism operates through attentional narrowing, working memory degradation, and increased reliance on heuristic shortcuts that may be inappropriate for novel or complex security threats.
Yerkes-Dodson Law demonstrates performance follows an inverted-U curve relative to arousal levels - beyond optimal arousal, increased stress leads to performance degradation, with complex cognitive tasks showing earlier degradation than simple tasks. Easterbrook's cue utilization theory explains how stress narrows attention span exponentially.
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Documented procedures ensure comprehensive threat assessment during stress. Parallel investigation teams maintain routine monitoring during incidents. Mandatory scope assessment protocols with multi-vector checks. Decision validation requires external perspective for extended incidents. Cross-functional consultation occurs in 80%+ of complex events.
Procedures exist but inconsistently applied during high-stress periods. Routine monitoring reduced but not eliminated during incidents. Informal scope assessment with occasional documented checks. Cross-functional consultation occurs in 50-80% of complex events.
No documented procedures or procedures consistently abandoned under pressure. Routine monitoring completely stops during active incident response. No formal scope assessment or single-threat assumption standard. Cross-team consultation occurs in less than 50% of complex security events.
Implement mandatory decision trees for all security incidents that force consideration of multiple attack vectors before proceeding
Create detailed decision trees with specific checkpoints: 'Have you checked for lateral movement?', 'Have you verified this isn't a distraction attack?', 'What systems weren't affected?', 'Have you consulted with network/app/compliance teams?'. Require documented completion of all checkpoints before incident closure. Integrate into incident management system with automatic reminders.
Establish minimum staffing requirements ensuring routine security monitoring continues during incident response
Create formal 'business as usual' teams that cannot be reassigned to incident response without executive approval. Implement rotating incident response assignments to prevent team exhaustion. Define clear boundaries: IR team handles active incident, BAU team maintains routine monitoring and investigates new alerts. Minimum 30% of security staff must remain on BAU during any incident.
Implement mandatory pause protocols when incident response exceeds defined stress thresholds
Define stress triggers: multiple critical alerts, response time >4 hours, executive escalation, team fatigue indicators. Automatic activation of circuit breakers requiring 15-minute team huddles every 2 hours during extended incidents to reassess scope and approach. External perspective requirement for incidents lasting >8 hours (consultant, different team, or senior review). Documented pause and reassessment in incident timeline.
Establish mandatory consultation requirements with network, application, and compliance teams for all critical/high severity incidents
Create standardized consultation templates with specific questions each team must answer: Network team verifies lateral movement checks, App team confirms application-layer attack vectors assessed, Compliance validates regulatory implications considered. Implement escalation triggers when consultation reveals conflicting information or missed vectors. Include cross-functional review in incident closure criteria.
Deploy security orchestration tools that automatically correlate incidents across time windows, attack vectors, and affected systems
Configure SOAR platform to automatically analyze: (1) temporal correlation - similar incidents in past 72 hours, (2) systemic correlation - same attack patterns across different systems, (3) user correlation - targeting patterns, (4) TTP correlation - matching tactics/techniques/procedures. Generate automated scope assessment reports requiring analyst review before declaring incidents 'contained'. Alert for potential multi-vector attacks based on statistical patterns.
Conduct structured red team reviews within 48 hours of incident resolution specifically looking for missed indicators and alternative attack vectors
Establish dedicated red team (internal or external) that reviews all critical incidents within 48 hours of resolution. Review focuses on: indicators present but not detected, attack vectors not investigated, scope limitations that may have missed activity. Include external security consultants in reviews for critical incidents. Maintain database of 'missed indicators' to identify tunnel vision patterns and training needs. Feed findings back into detection rules and training programs.