Busting Biases in Infosec

The talk opens with a demonstration of how the brain fills in gaps without conscious choice, using an optical illusion with empty glasses frames and a song-recall prompt. The speaker separates explicit bias, which a person would openly admit to holding, from implicit bias, which operates below awareness. A résumé study in which identical applications drew different callbacks depending on the applicant's name illustrates the implicit kind.

The middle section walks through biases and fallacies relevant to security work. The World War II bomber study shows survivorship bias: armor was first placed where returning planes had holes, while the planes that never came back were missing from the data. The same reasoning applies to hiring criteria such as years of experience or college names, and to articles about the habits of successful people. Other examples include confirmation bias during investigations, the curse of knowledge when explaining multi-factor authentication to users, status quo and system justification bias, the prevention bias that favors spending on prevention over detection, the risk compensation effect after new controls are added, and the Dunning-Kruger effect.

For mitigation, the speaker recommends starting with awareness and removing identifying details such as names from candidate intake. Other suggestions include widening candidate pools, seeking feedback from people outside one's own social group, avoiding defensiveness when a bias is pointed out, and watching for contradictory beliefs. Practitioners are encouraged to actively look for evidence against their own conclusions and to be comfortable saying "I don't know." The takeaway is that biases cannot be fully removed, but they can be noticed and worked around in everyday security decisions.