CISOs who lead global teams must be especially cautious about judging situations based on their personal beliefs and values. Quite often, they hold cognitive biases that obstruct their ability to make sound risk management and incident response judgments.
The decisions taken by security leaders are frequently influenced by a range of cognitive biases. It’s vital to avoid these biases if cyber threats are to be properly interpreted and acted upon, especially when big disruptions occur, like the recent move to a more remote work environment due to the COVID-19 pandemic.
Because many breaches are caused by human error, knowing how people think, feel, and behave is critical to good cybersecurity. Understanding behavioral biases is even more critical in the age of remote work, when personal security hygiene has a stronger impact on overall network health and the implications of a single bad decision might have far-reaching consequences.
Here are some common biases that security leaders should be aware of and avoid.
Confirmation bias
CISOs sometimes make the mistake of assuming that the threat narrative they choose is always correct. Attack attribution, or threat attribution, is one area where security officials can easily fall into the trap of laying responsibility on a certain nation-state or threat actor just because they assume that’s what happened. Instead, CISOs should look for objective data points to reduce confirmation bias, consider alternative possibilities, and actively challenge their beliefs.
Bandwagon bias
In a business where sharing knowledge and comparing security practices with peers is encouraged, security leaders sometimes take the safe road and embrace certain measures just because everyone else has.
The impact of groupthink must be minimized by CISOs. Such thinking can eliminate other options, resulting in erroneous analysis and conclusions. Building diverse teams, supporting critical thinking, and encouraging the devil’s advocate perspective are all ways CISOs can avoid groupthink.
Anchoring bias
Anchoring bias affects security leaders who are prone to being swayed by the first piece of fresh information they receive. Anchoring bias must be avoided at all costs, especially during incident response activities. Furthermore, CISOs should not become fixated on early evaluations during an incident and instead remain open to various options as the response unfolds.
When a company lacks formal procedures for identifying inherent or residual risk, security leaders may rely too much on other sources of information, such as the news media, to make conclusions about their own risk posture. Even low-probability or low-impact risks are perceived as more likely to occur in these circumstances. This type of bias is most common at the highest levels, such as the board of directors. Some of these biases may have been more prevalent in the past year due to teams being distant during the pandemic and not being able to have in-person meetings with the CISO.
Business language bias
In recent years, there’s been a lot of emphasis on CISOs and other security professionals being able to communicate their organization’s cyber risk posture in terms that the C-suite and board of directors can comprehend. Security executives have been urged to consider company goals, business alignment, and positioning security as a business enabler rather than a cost center. While this type of thinking is necessary, security leaders must be careful not to overdo it.
One prejudice that executives must avoid is going overboard with “business jargon” rather than putting it out in security terms. Although CISOs are frequently pushed to speak like CFOs, this does not mean they should always frame everything cybersecurity-related in terms of risk management. As a result of this, the leadership could end up making the wrong decision based on the erroneous belief that cyber risk is manageable
For more such updates follow us on Google News ITsecuritywire News.
