Time
3 hours 1 minute
Difficulty
Advanced
CEU/CPE
3

Video Transcription

00:04
Okay, so let's think about cognitive bias and logical errors. As I was stating in the introduction, one of the biggest challenges with
00:12
with these kinds of concerns is trying to identify when
00:17
a bias or other kind of logical thinking error has occurred. Or is a current maybe you notice
00:24
in the middle of your brain trying to send you down a path which
00:29
may not be the right one.
00:32
This is certainly something that, as I was saying before, is a cover feature of humanity.
00:39
We're thinking creatures. So
00:43
in a general sense, what were often trying to do is find patterns that we recognize trying to find a shortcut
00:50
to get to a desirable result.
00:53
And from an evolutionary standpoint, that's certainly a positive thing.
00:57
But when doing some kind of hard analysis,
01:00
looking at lots of different types of evidence, trying to fit together timelines,
01:04
trying to correctly a sign attribution, and so on. There's so many different ways that we can get tripped up by our thinking.
01:11
So it is worthwhile to date a little bit deeper into this topic
01:15
and think about how we can better monitor are thinking, knowing some basic definitions of how these things can go wrong
01:26
when the first ones to consider is what is a bias to begin with.
01:30
And generally the definition is accepted to be some kind of deviation.
01:37
I might have a favorite tool that I like to use for for analyzing
01:42
log files, for instance.
01:45
It's my favorite because I started using it,
01:47
and I think it's better than other tools that are available.
01:51
And I may continue to use that tool knowing that there are other ones available that could actually be better. Maybe the tool app I have biased towards is out of date
02:00
and doesn't have some of the advanced capabilities. Other tools might have
02:07
that same type of favoritism thinking could also extend towards other conclusions, like preferring
02:14
a certain conclusion over others because it's comfortable and because it's
02:19
something that is consistent with other work that's been done.
02:23
So that's a very basic definition of what a bias might be. But we can dig a little bit deeper than that as well
02:30
to think about
02:31
other aspects of this overall process,
02:36
for instance, sometimes our judgment is just incorrect.
02:39
You might look at a
02:42
Siri's of pieces of evidence of evidence
02:45
and make some drops and conclusion,
02:47
and that turns out to just be plain wrong.
02:51
You could think of lots of different ways why that might happen. It could be that the the analyst was distracted while they're doing their work. Maybe they're trying Thio tackle too many tasks at one time
03:04
multitasking, even though that's something people often brag about.
03:07
A lot of
03:09
research that has been published over the last several years
03:13
indicates that multi taskers
03:15
don't necessarily get more done.
03:17
They might feel like they're getting more done, but in reality, that may not actually be the case.
03:23
So there is something to be said for
03:25
putting on the blinders and focusing in on the task at hand,
03:30
especially since that helps to prevent. Some of these problems were creeping into your
03:36
to your work. As it is.
03:38
There's the concept also of perceptual distortion.
03:43
This means that the your response to some action or some kind of stimulus is different than what would be expected.
03:51
Your perceptual distortion can can occur for lots of different reasons. For instance, if you are not feeling well when you come to work,
04:00
you might have in a hard time focusing.
04:04
You might be thinking about wanting to be home, getting better instead of doing your job. Simple example.
04:12
And that could alter your ability to make logical decisions and logical conclusions
04:16
that would otherwise be more or less easy. For Yu Thio. D'oh!
04:21
People who are under the influence of alcohol and drugs have perceptual distortion distortion.
04:27
In many cases, they do this on purpose, right? They want to perceive
04:31
what their senses tell them
04:33
differently than what they would normally expect to have.
04:39
So any time that there's a chance that your surroundings or distraction level your current health status,
04:47
having too much on your plate, whatever you wanna call it that could certainly have it have an impact on your ability to
04:54
clearly see through the evidence in front of you
04:57
and reach the correct or the most correct conclusion that's available.
05:04
Then we have to consider irrational conclusions.
05:09
Someone who's irrational is perhaps overreacting, or even under reacting to a situation or in this case, some evidence that they're analyzing.
05:19
It might be that there, again, because of other combinations of different factors
05:26
a conclusion has reached that doesn't seem to make sense when someone else looks at it, they might look at the evidence and say, Well, I see this, this and this
05:34
and you You reach this conclusion, but that doesn't add up. There's something missing here.
05:40
And this hopefully would be something that would happen very infrequently
05:45
because as a c t I analyst, you're certainly going to be
05:49
expected. Heavy, finally trained mind and
05:53
being irrational should be something that's very, very, uh,
05:58
uncommon.
06:00
But yeah, it happens,
06:00
maybe for some of the reasons that I've already cited having a bad day
06:04
being stressed out about family life, home life,
06:08
having too many different conflicting pieces of information
06:14
that concluded the issue that's being studied. All these are possibilities that that should be considered to make sure that there's no
06:21
major flaw and thinking.
06:27
Now, if we move on to cognitive bias errors,
06:30
one of the biggest ones is trying to avoid taking shortcuts.
06:35
As I stated earlier, this is a feature of human evolution that certainly has helped hasn't served us very well.
06:43
If you're faced with doing some kind of task, especially if it's repetitive
06:47
and tedious,
06:49
our minds are generally designed to look for a shortcut to try to get to the same result
06:55
with less effort,
06:57
and that's a good thing in most cases. But
07:00
in this line of work, taking shortcuts can
07:04
caused a ripple effect of other kinds of errors.
07:09
If something early on and analysis wasn't done correctly, there was a little shortcut taken then that may ripple out to other pieces of the work because you're basing
07:20
subsequent decisions on conclusions. Reached that, or perhaps and correct.
07:27
That's a dangerous thing to
07:29
to engage in. And it has to be identified and rooted out wherever possible. Gods have confirmation bias.
07:39
This is a tendency for people in general, too.
07:43
Try to find information that supports the conclusion that they already have.
07:47
I might think. OK, I've got enough data here to say that
07:51
this this incident was caused by this threat actor.
07:55
I already believe that,
07:57
but maybe I haven't finished my analysis. So as I do more analysis, I might continue to pay more attention to
08:03
details and evidence that seems to support the conclusion I've already reached already know who the bad guy is, and so I
08:13
keep myself on that path,
08:15
perhaps paying less attention to things that would allow me to deviate from that path.
08:20
It's also a
08:22
you know, anyone who's doing any kind of any kind of investigation,
08:26
Whether it's in a cyber threat scenario or criminal investigation and legal investigation, for instance,
08:35
they all have these same things to worry about.

Up Next

Advanced Cyber Threat Intelligence

The Cyber Threat Intelligence (CTI) course is taught by Cybrary SME, Dean Pompilio. It consists of 12 modules and provides a comprehensive introduction to CTI. The subject is an important one, and in addition to discussing tactics and methods, quite a bit of focus is placed on operational matters including the various CTI analyst roles.

Instructed By

Instructor Profile Image
Dean Pompilio
CEO of SteppingStone Solutions
Instructor