Explore cognitive biases and develop analytic techniques in this 49-minute conference talk from BSides Augusta 2014. Delve into the complexities of human perception and decision-making, examining various cognitive biases such as anchoring, clustering illusion, and confirmation bias. Learn how these biases affect network security monitoring and incident analysis. Discover practical analytic techniques, including relational investigation, differential diagnosis, and alternative analysis, to improve your critical thinking skills. Gain insights into best practices for incident management and analysis, enhancing your ability to make informed decisions in the field of cybersecurity.
Overview
Syllabus
Intro
Chris Sanders
Outline
Disclaimer
The Pain Begins
Ultrasounds == Magic?
"Let's Cut it Out!" - Surgeon
Missing Parts
Cause and Effect
Analysis is Everywhere
Network Security Monitoring
Evolution of NSM Emphasis
The Need for Analytic Technique
Analysis: Thinking About Thinking
Perception vs. Reality
What is Bias?
First Image Results
Second Image Results
Let's Hit Closer to Home...
A Recent Example
Anchoring
Clustering Illusion
Availability Cascade
Belief Bias
Confirmation Bias
Impact Bias
Irrational Escalation
Framing Effect
Overconfidence Effect
Pro-Innovation Bias
What Can We Do?
Analytic Techniques
Relational Investigation
Differential Diagnosis
Alternative Analysis
Incident M&M Best Practices
Conclusion
