COGNITIVE BIASES in INFORMATION SECURITY CAUSES, EXAMPLES and MITIGATION by Veselin Monev, Information Security and Compliance Practitioner
Total Page:16
File Type:pdf, Size:1020Kb
COGNITIVE BIASES IN INFORMATION SECURITY COGNITIVE BIASES IN INFORMATION SECURITY CAUSES, EXAMPLES AND MITIGATION By Veselin Monev, information security and compliance practitioner Abstract This article makes a contribution to the theory of the human factor in the information security by exploring how errors in thinking distort the perceptions of InfoSec issues. Besides examples from the practice, the author proposes several ideas for mitigating the negative effects of the cognitive biases through training. Keywords Information, security, bias, psychology, determinant, causes, mitigation, cognitive, training NTRODUCTION IOne of the components of a mature information information security issues in their organisations. security program is the human factor. Typically, the The key word here is “actionable”. Their experience emphasis is on maintaining a security awareness shows that professional analysis, argumentation program and mitigating risks caused by human techniques and even supporting evidence combined mistakes and lack of knowledge of security. may be insufficient for properly addressing some Security awareness is necessary but also only one of the identified problems. Although a number of aspect of the human factor. Another challenge for difficulties can be noted as causes for insufficient or security professionals is finding actionable arguments inadequate actions on information security matters, to support their analysis and recommendations on like deficiency of budget, time or human resources, cybersecurity-review.com 1 COGNITIVE BIASES IN INFORMATION SECURITY management ignorance and so forth, the picture wisdom2. This complex processing chain may be would be incomplete if the psychological phenomenon impacted by the misperception or misinterpretation of cognitive biases are of random data or events. As excluded. an example, a data leakage The cognitive biases are prevention (DLP) analyst, inherent characteristics of the tasked to inspect the DLP human nature and this way reports for irregularities, may part of everyone’s thinking. suspect random events as A bias is an error in thinking real attacks on a network. In when people are processing this instance, the “random” and interpreting information data could be misinterpreted. and thus influencing the way One should understand that they see and think about the world. Unfortunately, human’s nature is inclined to look for patterns where these biases lead to poor decisions and incorrect such do not always exist3. judgments. This article correlates researches on In a second example, a typical computer user could the biased thinking with examples from the InfoSec erroneously conclude that his computer troubles are industry. caused by malware. However, an experienced IT The first part of the article explains several support specialist could identify a different cause for important (and non-exhaustive) determinants for the symptoms of the issue and quickly rule out the cognitive biases and then exemplifies them with malware scenario as a cause. realistic sample situations that an InfoSec specialist might encounter. The second part proposes several Judgment by Representativeness4 ideas on how organisations can deal with the biases Representativeness can be thought to have the so that their occurrences and impact are reduced. reflexive tendency to assess the similarity of outcomes, The author wants to emphasize the need for further instances, and categories on relatively salient and even exploration of the potency of these ideas in the real superficial features, and then use these assessments world and their role for a possible mitigation strategy. of similarity as a basis of judgment. In addition, the reader is encouraged to learn about Judgment by representativeness is often valid and the types of cognitive biases - a topic not directly helpful because objects, instances, and categories that discussed here. go together usually do in fact share a resemblance. However, the overapplication of representativeness DETERMINANTS1 FOR is what leads to biased COGNITIVE BIASES AND conclusions. Many would likely EXAMPLES recall personal experiences when a person, who belongs to The Misperception and a particular group, is attributed Misinterpretation of Data or qualities, considered typical Events for that group. For instance, People deal with data on an some IT experts perceive the everyday basis. The common members of their information approach is to analyse the security team as very strict data by converting it into security and compliance something more useful – information - and from there enforcers, but in reality not all of them may have to continue the conversion into knowledge and then this profile. The stereotypical over-generalisations 2 Cyber Security Review online - August 2018 COGNITIVE BIASES IN INFORMATION SECURITY like “All the IT experts…”, “All the auditors…”, “All Misunderstanding instances of the consultants from that company…” often follow statistical regression imprecise and even incorrect qualifications (negative or The statistics teach that when two variables are related, positive). The simplification can and in some instances but imperfectly so, then extreme values on one of the will be misleading. variables tend to be matched by less extreme values on the other. For instance, a company’s financially Misperceptions of Random Dispersions disastrous years tend to be followed by more profitable If the information security professional analyses ones; Student’s high scores on an exam (over 97%) statistical data from a certain security tool, he tend to develop less regressive scores in the next may notice patterns, which could lead him to the exam. conclusion that specific events occur more frequently If people are asked to predict the next result after at specific time frames5. For instance, if a particular an extreme value, they often tend not to consider type of security incident occurred for four consecutive the statistical regression and make non-regressive months, each time in the last seven days of the or only minimally regressive predictions (they predict month, this could indicate a similar value).8 A that there is a pattern. second problem is the These incidents could tendency of people to fail be correlated with other to recognise statistical known events and regression when it occurs assumptions can be made and instead “explain” the about the underlying observed phenomenon cause, but a definite with complicated and even conclusion should not be superfluous theories. This drawn without additional is called the regression investigation. fallacy. For example, a lesser performance that Solidifying the Misperceptions follows an exceptional one is attributed to slacking with Causal Theories6 off; A slight improvement of the security incident rate Once a person has (mis)identified a random pattern as is attributed to the latest policy update; Company’s a “real” phenomenon, it is likely going to be integrated management may hold their IT Security Officer into his pre-existing beliefs7. These beliefs, furthermore, accountable for the decrease of the server compliance serve to bias the person’s evaluation of new information level after an excellent patching and hardening activity in such a way that the initial belief becomes solidly three months ago. entrenched. For example, if a person participated as the auditee during an audit several years ago where he Misinterpretation of Incomplete and was supposed to provide to the auditor some of the IT Unrepresentative Data (Assuming security procedures, the same person could afterward Too Much from Too Little) develop false expectations about the requirements in other standards or for another type of organisations. The Excessive Impact of Confirmatory Information This person could be convinced that he is well aware The beliefs people hold are primarily supported by of all the auditing practices, but in reality, he could be positive types of evidence. In addition, a lot of the lacking essential knowledge on the specifics of other evidence is necessary for the beliefs to be true but they security standards and types of audits (e.g., see the are not always sufficient to warrant the same. If one fails difference between SOC 2, type I and type II audits). to recognize that a particular belief rests on deficient cybersecurity-review.com 3 COGNITIVE BIASES IN INFORMATION SECURITY evidence, the belief becomes an “illusion of validity9” period for the accounts of a particular business critical and is seen not as a matter of opinion or values but application is an accepted good security practice. as a logical conclusion from the objective evidence However, if only this general best practice is taken that any rational person would take. The most likely into account, the expectations of the change could be reason for the excessive influence of confirmatory overly optimistic. The reason for this is that a lot of information is that it is easier to deal with it cognitively, missing information cannot be considered: it is nearly compared to non-confirmatory information. impossible to anticipate all the indirect consequences Information systems audits are good examples of of such a change, like users starting to write down searching for confirmatory evidence10. In an audit, their passwords. If they do this, the risk for password unless a statistical methodology11 is utilised for compromise will most likely increase and the change controls testing, the evidence for the effectiveness of will have the opposite effect. the controls