Latest / CYBR.Signal / A Grave Case of Confirmation Bias

Transcript

A Grave Case of Confirmation Bias · CYBR.Signal

• 0:00
  SPEAKER_00: And hello everybody, Michael Farnum, CEO of Cyberset Community here, coming at you on the Cyber Signal podcast.
• 0:08
  SPEAKER_00: So I am at a site in a little town called Tomball, Texas.
• 0:13
  SPEAKER_00: So what's interesting about this site here, I'll turn around so you can see it for those of you who are able to watch this.
• 0:22
  SPEAKER_00: This is the site of some construction that's going on in Tomball, Texas.
• 0:28
  SPEAKER_00: And if you'll notice, you got these gates or these fences around here, which is no big deal, right?
• 0:33
  SPEAKER_00: That's pretty typical for safety.
• 0:35
  SPEAKER_00: But what you'll also notice potentially is there are police line tape around it.
• 0:42
  SPEAKER_00: So the reason that's interesting is because as they were tearing down an old building here in Tomball, and I, if you don't know about Tomball, it's an older town, been around for a long time.
• 0:57
  SPEAKER_00: They were tearing this old building down to do some new construction.
• 1:01
  SPEAKER_00: And what they found was possibly an old grave site.
• 1:07
  SPEAKER_00: So what they did was immediately stop construction for good reasons, right?
• 1:12
  SPEAKER_00: They thought this was an old cemetery potentially, and so they stopped everything, pulled permits from the construction company, said we have to do some investigation.
• 1:21
  SPEAKER_00: So they're still doing some investigation.
• 1:23
  SPEAKER_00: So when that initially came out, that story came out, it was immediately assumed that this was a cemetery.
• 1:30
  SPEAKER_00: In a lot of ways, nobody, you know, all the news sites and everything said, oh, it could be a cemetery.
• 1:36
  SPEAKER_00: It might not be, but there's a possibility, so we have to shut everything down.
• 1:40
  SPEAKER_00: And again, that makes sense, right?
• 1:42
  SPEAKER_00: There's reasons for that.
• 1:43
  SPEAKER_00: We know why they did that.
• 1:45
  SPEAKER_00: The cybersecurity corollary here is that you can't make assumptions in cybersecurity that make you shut everything down if it looks like you have an incident.
• 1:58
  SPEAKER_00: So, what do I mean by that?
• 1:59
  SPEAKER_00: You see a PowerShell command on your environment, looks like it could be sketched, but we all know that PowerShell commands also have legitimate uses.
• 2:09
  SPEAKER_00: You see something on your network you weren't aware of before, maybe a server or something like that that popped up.
• 2:16
  SPEAKER_00: You can't always assume those things are an incident.
• 2:22
  SPEAKER_00: You have to assume that they possibly could be.
• 2:26
  SPEAKER_00: But if you make that assumption and then you do what these guys did, which again, they there was a reason for it.
• 2:33
  SPEAKER_00: But if you shut everything down, from a business perspective, that doesn't make any sense.
• 2:37
  SPEAKER_00: So you've really got to start thinking about what is the business use case on top of the cybersecurity use case here.
• 2:47
  SPEAKER_00: Like what could potentially happen if I do make an assumption here and shut these things down.
• 2:54
  SPEAKER_00: You can't go into this with a confirmation bias.
• 2:57
  SPEAKER_00: You have to do investigation.
• 2:59
  SPEAKER_00: Now, the other corollary here is, and I think it's a response issue, is they shut this site down again for good reason, and they're doing an investigation.
• 3:12
  SPEAKER_00: So they're bringing the experts in.
• 3:14
  SPEAKER_00: They're literally bringing somebody from a historical society, like an archaeologist, all of this stuff.
• 3:20
  SPEAKER_00: They're bringing them in to look at this before they make a final decision.
• 3:24
  SPEAKER_00: And that's a good thing.
• 3:26
  SPEAKER_00: You need to bring the experts in, you need to be able to show that you're doing the right thing and do all of the right response.
• 3:34
  SPEAKER_00: From a governmental perspective, going back to the business case, business is a secondary issue.
• 3:41
  SPEAKER_00: This is not something that they're going to prioritize the business case.
• 3:48
  SPEAKER_00: They're going to prioritize getting the historical significance of this site figured out.
• 3:54
  SPEAKER_00: They're going to prioritize if there are, sorry, human remains here.
• 3:59
  SPEAKER_00: And those are things that have to be prioritized.
• 4:02
  SPEAKER_00: So the governmental regulation and the issues around preserving history and preserving human remains, all of that takes precedence over the business use case.
• 4:15
  SPEAKER_00: But us in cybersecurity, or we in cybersecurity cannot make that assumption.
• 4:21
  SPEAKER_00: We cannot say all the time that a regulation takes precedence, but it might.
• 4:28
  SPEAKER_00: So we have to balance those things out.
• 4:31
  SPEAKER_00: If there's a you're in critical infrastructure or something to that effect, then a regulation and safety and those kind of things might absolutely take precedence.
• 4:41
  SPEAKER_00: And you might just have to forget the business use case and preserve safety.
• 4:47
  SPEAKER_00: But in other cases, when you don't have some kind of critical infrastructure where you don't have something that's that from a national security or safety perspective, that's that important, then you have to prioritize in different ways.
• 5:01
  SPEAKER_00: Doesn't mean you don't shut things down.
• 5:03
  SPEAKER_00: If you have a clear and present issue and you know there's a problem, then you may want to shut down completely.
• 5:09
  SPEAKER_00: In other cases, you may not.
• 5:12
  SPEAKER_00: So again, it all comes down to the context.
• 5:15
  SPEAKER_00: You can't let confirmation bias and where it, oh, this is absolutely an incident.
• 5:21
  SPEAKER_00: You can't let that take precedence.
• 5:22
  SPEAKER_00: You've got to really start thinking about what the business case is.
• 5:26
  SPEAKER_00: And those are things you should have ready to go.
• 5:28
  SPEAKER_00: You should have those policies and procedures in place.
• 5:31
  SPEAKER_00: But in this case, as you can see, this construction has been stuck here for probably, I don't know, about three or four weeks, if I remember correctly.
• 5:40
  SPEAKER_00: I think it was in June when this started.
• 5:42
  SPEAKER_00: And they are going to wait and prioritize that investigation and make sure this was not a cemetery before they begin.
• 5:50
  SPEAKER_00: So anyway, hope that makes sense.
• 5:53
  SPEAKER_00: I appreciate you listening to Cyber Signal and hopefully watching.
• 5:56
  SPEAKER_00: If you don't listen to it, or if you only listen to it and you want to see this site, then go out on YouTube and watch this video.
• 6:04
  SPEAKER_00: And as usual, Cyber Signal here is to reduce the noise and amplify the signal.
• 6:10
  SPEAKER_00: Talk to you next time.