Untying the Anchor: Countering Unconscious Bias in Threat Intel Analysis - SANS CTI Summit 2019

Подробнее о видео

Bias is an unavoidable facet of an analyst’s life, but it is something that good analysis techniques can help to remedy. Anchoring is just one of the many forms of bias that with which an analyst must grapple. Anchoring involves focusing on a piece of information to the exclusion of others, and it can cause analysts to stop looking further or to disregard otherwise relevant information. To avoid this common dilemma, the PricewaterhouseCoopers LLP team has looked at ways that to untie this anchor in everyday analysis and view the vast sea of data from a fresh perspective.

This talk will cover how the team has applied traditional intelligence techniques into its ways of working, including introducing “surges” and how these have helped challenge the team’s assessments. A case study will be presented that shows how a variety of different analysis techniques have been applied to avoid bias, as well as the lessons learned from their application. This talk will not only provide attendees with practical examples of analytical techniques in action and how they can refocus threat actor attribution, but will also explore how recognizing bias can support threat intelligence being used effectively by security teams.

Rachel Mullan (@jadedmuse), Strategic Threat Intelligence Lead, PricewaterhouseCoopers LLP
Jason Smart, Technical Threat Intelligence Lead, PricewaterhouseCoopers LLP