The second lesson from the module,
attribution is going to be about
cognitive biases in
this lesson, we will start by
introducing biases.
Then we are going to understand
what are the cognitive biases
and we will see some of the common
types of cognitive biases
in threat intelligence.
Dr. Margaret Cunneen, principal
research scientist, at first
point defines biases as
the tendency for people to
favor one group person or
thing over another, while
unfairly discriminating
against the remainder of the
process.
For better or worse,
bias is an inescapable
feature of the human experience.
We are shaped by a combination
of our environment, our
genetics and our
cognitive ability to process
and make sense of our world.
This means that our decisions,
behavior and experiences
are influenced by the experiences
of the past and the present.
Basically, cognitive bias
isn't specific to cybersecurity.
It's universal.
Many factors that influence the
human behavior fly under
our radar, especially in
stressful situations that
security pros often face.
When the psychological biases of
analysts are taken into
consideration, it is important
to stress that we are all
subject to cognitive biases,
which could impact decisions and
business outcomes and cybersecurity.
It is also possible to classify
biases as the types of
cognitive limitations.
Psychological biases
which are related to intelligence
analysis could be classified
as entering bias,
availability, bias, confirmation
bias, illusionary
correlation and the framing
effect.
Let's start with the first type
of biases.
The availability, bias or
availability. Heuristic is a mental
shortcut that relies on
immediate examples that come
to a given person's mind when
evaluating a specific topic,
concept, method or
decision in cybersecurity
news cycles that focus
on ransomware or specific types of
threats of influence and
perception of what's risky
and can't influence their approaches
toward security.
The hot topics that continuously
arise to the top of analyst's
mind can be distracting
and bias of the diagnosis
of system issues that
are less likely
simply because they are less
available or less active in
the analyst's memory.
At an organizational level,
availability bias can influence
the allocation of resources and
can lead to a misinterpretation
of the risk.
The second example is confirmation
bias.
Basically, the confirmation bias
is when someone seeks
to confirm their beliefs
by exclusively searching for
information that supports their
Hansch or excluding open
data.
This is especially common in
cybersecurity.
It is typical among analysts
who enter any investigation
digging for an answer
that they really want.
The third type of biases is
correlation is not causation.
The correlation is not causation.
Bias is the logically
valid idea that the events
which coincide with each other
are not necessarily caused by
each other.
The assumption of causation is false
when the only evidence available
is simple correlation.
However, keep in mind
that it's not true, that
correlation cannot imply
causation, if there is
still a correlation, then
causation is very likely.
You just need to prove it
with evidence.
Another common type of basis
is the enduring effect.
And sharing occurs when a person
locks onto the specific salient
feature or a set of features
of information early in the
decision making process.
This frequently occurs with numbers
such as in sales.
When one party in the negotiation
proposes a price point
was a price point is set.
The number serves as an insurer for
additional negotiations, which
may be too high, maybe
too low or even accurate.
The fifth type of bias's
is illusory correlation,
and it is the phenomenon of
perceiving a relationship between
variables.
Typically people, events or
behaviors, even when no
such relationship exists,
illusory correlations occur
because the brain is constructed
to search out meaningful patterns
and make sense of experience.
The less common type of biases
is the framing effect.
The framing effect, which affects
how choices are worded, often
manipulates those who buy security
tools. For example, a vendor
might say one in five
companies never got their data
back after ransomware attack, for
example, a vendor may say
one in five companies never
got their data back after ransomware
attack place and focus on the
one organization that lost data
instead of the four
that didn't.
This strategy causes security admins
to buy pricey tools
for low probability risk.
Basically, this is all for this
lesson.
After watching this video, you will
be able to understand what our
cognitive biases
and now you are ready to identify
any of the common cognitive biases
if you encounter any of them during
your day to day situation
or during your investigations
and analyzes.
I hope you enjoy this lesson.
It's time to move to another problem
encountered by analysts during
their analysis phase, which is
logical fallacies or errors.