This year, I decided to hit up BSides with some friends, though I had never been before. It was smaller than some of the other conferences I have been to, like DefCon and SaintCon, but it was not at all lacking in quality.
From what I could tell, this first day was primarily workshops. I first attended a workshop on structured analytic techniques, which I really need to look into more. For me, a main point was to be conscious of what biases i may have. Beyond this, we learned about some specific techniques like prioritization and risk matrices, key assumptions analyses, and futures wheels. Might add more here later if I look into these deeper.
Circling back, here is a breakdown of the main biases mentioned:
- Perceptual Bias:
- Mirroring bias
- Halo effect
- Biases in evaluating evidence:
- Anchoring bias
- Bandwagon effect
- Ad hominem
- Biases estimating probability:
- Gamblers fallacy
- Survivorship bias
- Biases in perceiving causality:
- Red herring
- Slippery slope
From here, after the conference, I wanted to fully understand each of these biases, and try to see what I could learn from them. Definitions from different articles and examples from ChatGPT.
| Bias Name | Explanation | Cyber Example |
|---|---|---|
| Mirroring bias | refers to the reciprocal views individuals or groups hold about each other, often in the context of conflict or competition. This cognitive bias leads parties to project their own fears and negative attitudes onto the opposing side, while simultaneously perceiving themselves as acting defensively. | A company’s security team assumes that a hacker wouldn’t attack their outdated billing system because “it’s old, boring, and not worth anything.” They believe this because they themselves wouldn’t target such a system—it’s legacy, not flashy, and doesn’t seem to hold anything interesting. However, an attacker might see that exact system as a goldmine because it has weak or outdated defenses, it might store personal data or offer a path to more secure parts of the network, or it’s less monitored, making it an ideal backdoor. |
| Halo effect | The halo effect refers to the tendency to allow one specific trait or our overall impression of a person, company or product to positively influence our judgment of their other related traits. | A halo effect bias in cybersecurity might occur when a well-known tech company or employee with a strong reputation is assumed to follow all best security practices, so their actions or systems are not scrutinized as closely. For example, a senior developer with a history of clean code might be trusted implicitly, leading the security team to overlook a misconfigured server they set up quickly under pressure. This blind trust can result in vulnerabilities being missed simply because of the person’s positive reputation. |
| Anchoring bias | describes people’s tendency to rely too heavily on the first piece of information they receive on a topic. Regardless of the accuracy of that information, people use it as a reference point, or anchor, to make subsequent judgments. Because of this, anchoring bias can lead to poor decisions in various contexts, such as salary negotiations, medical diagnoses, and purchases. | An anchoring bias in cybersecurity can happen when analysts fixate on the first piece of information they receive during an incident. For example, if an alert initially suggests a phishing attack, the response team might focus all their efforts on email systems and overlook other entry points, like compromised credentials used through a VPN. This early assumption anchors their thinking and can delay the discovery of the real attack vector, allowing the breach to escalate. |
| Bandwagon effect | is simply an appeal to popularity. For example, “Everyone else is doing it, so why don’t you?” or “Most people believe X, so X must be true.” The bandwagon argument is often based on common belief statements (e.g. “Everyone knows that opposites attract” a common adage that is actually not the case), which are generally weak with respect to credibility. | The bandwagon effect in cybersecurity can occur when organizations adopt a specific security tool or framework simply because many others in the industry are doing so, without fully evaluating if it fits their unique needs. For example, a company might implement a popular threat detection platform because it’s widely praised, but fail to consider that it doesn’t integrate well with their existing infrastructure or lacks coverage for their specific threat landscape. This can lead to wasted resources and a false sense of security. |
| Ad hominem | (“to the man”) refers to an attack on the person; for example, regarding their past or personal traits, as a means of undermining/opposing their argument, without having to provide any evidence. Loaded questions evoke a similar effect. | An ad hominem in a cybersecurity setting might happen during a team discussion about a potential vulnerability, where someone dismisses a junior analyst’s concerns by saying, “You’ve only been here six months, what do you know?” instead of addressing the actual technical points raised. This shifts the focus from the validity of the argument to the person’s experience level, potentially causing the team to overlook a real issue because of bias against the individual presenting it. |
| Gamblers fallacy | refers to the belief that streaks affect statistically independent phenomena. Simply, there is a one in two chance of a coin landing tails up, so based on this assessment, some might say if heads comes up on the first flip, then it seems likely the coin will come up tails on the second flip. This would be an incorrect assessment of probability, as coins do not have a memory. The same goes for roulette wheels. Every flip and every spin is new and is not dictated by what happened previously. Thus, the probability of flipping a coin and getting tails eight times in a row is the very same as getting HTHTHTHT | A gambler’s fallacy in cybersecurity might occur when a team believes that because they’ve gone a long time without a major attack, they’re “due” for one soon. This can lead to overreacting to minor alerts or reallocating resources unnecessarily, based on the false assumption that past events influence the likelihood of future, unrelated incidents. In reality, threats remain constant or vary based on actual risk factors, not a streak of luck or calm. |
| Survivorship bias | is the logical error of concentrating on entities that passed a selection process while overlooking those that did not. This can lead to incorrect conclusions because of incomplete data. | Survivorship bias in cybersecurity can happen when an organization looks only at companies that have successfully fended off cyberattacks and tries to copy their strategies, assuming those methods are why they survived. They ignore the many other companies that used the same strategies but still got breached. This can lead to overconfidence in certain tools or practices without understanding the full picture, including the failures that aren’t as visible or talked about. |
| Red herring | This fallacy introduces an irrelevant topic to distract from the original argument. For instance, when asked about pollution levels, a politician says, “We have some of the best parks in the country, and our citizens love spending time in nature.” | A red herring in cybersecurity might occur during an incident investigation when the team becomes focused on a suspicious IP address that turns out to be unrelated, such as a misconfigured internal device. This distracts them from the real issue, like an active attacker using valid credentials to move laterally within the network. Chasing the unrelated lead wastes time and resources, delaying the proper response to the actual threat. |
| Slippery slope | is an argument that concludes that if an action is taken, other negative consequences will follow. For example, “If event X were to occur, then event Y would (eventually) follow; thus, we cannot allow event X to happen.” This is often difficult to refute because it is not possible for us to see into the future and guarantee that the subsequent event won’t occur. Often, after critically thinking about patterns in human history, it may be that the subsequent event is likely to happen, in which case, the slippery slope argument may not be illogical. However, such judgment depends on the context of the argument. Regardless, what makes the argument fallacious is that it avoids engaging the argument at hand. It adds a component that isn’t necessarily relevant to the initial argument. Furthermore, the added component is generally emotionally loaded (e.g. fear-evoking). | A slippery slope in cybersecurity might occur when someone argues that allowing one employee to use a personal device for work will inevitably lead to the entire company ignoring security protocols, resulting in a massive data breach. While using personal devices can introduce risks, assuming it will automatically lead to total security failure exaggerates the consequences without considering proper controls or policies that could prevent such an outcome. |
I also had the opportunity to participate in “The Keep”, a heavily gameified way to practice offensive cyber techniques. If I understood things correctly, this was put on by n1ghtbl00d from 801 labs. I’ll double check in the future. The main takeaway I had was how ffuf specifically works when fussing for Subdomains. I cannot remember exactly what, but we had to include specific header information in order to get it to work. I’ll try to add that here later. Another takeaway is to remember to work together. I was working on a particular challenge by myself, getting nowhere, when a colleague caught up to the same challenge. We were able to bounce ideas off of each other and eventually we both were able to solve the challenge.
Overall a very positive experience and I am happy I went.