Researchers studying human behavior describe a trait, referred to as the availability heuristic, that significantly skews our estimation of the likelihood of certain events based on how easy or hard it is for us to recall an event, rather than how likely the event really is.
It isn’t hard to identify the availability heuristic at work out in the world: shark attacks, terror attacks, plane crashes, kidnappings and mass shootings. All of them are vivid. All of them occupy, to a greater or lesser extend, the news media. The recollection of these events, usually seen through the media, will often cause people to irrationally overestimated certain risks. For instance, the overwhelming majority, approximately 88%, of child kidnappings is perpetrated by a relative or caregiver. However, the raw statistics regarding kidnappings, constant Amber alerts and media stories about horrible kidnapping cases is the source of much consternation for parents. Consternation to the point that police in some jurisdictions are accusing parents who allow kids to play outside unsupervised of child neglect. The gun debate rages on in the U.S., with mass shooting tragedies leading news reports, even though the number of people who kill themselves with a gun significantly outnumbers those murdered with a gun.
The availability heuristic causes us to worry about shark attacks, plane crashes, stranger kidnappings and mass shootings, while we are far more likely to die in car crashes, or from diabetes, or heart disease, or cancer or even of suicide, however the risks from those are generally not prominent in our minds when we think about the most important risks we, and our friends and families, face. Maybe if, at the end of the TV news, the commentators recapped the number of car crash fatalities and heart disease fatalities, we would put better context around these risks, but probably not. As Stalin said: “a single death is a tragedy; a million deaths is a statistic.”
How does this related to information security?
Information security programs are, at their core, intended to mitigate risks to an organization’s systems and data. Most organizations need to be thoughtful in the allocation of their information security budgets and staff: addressing risks in some sort of prioritized order. What, specifically, is different between the ability to assess the likelihood of information security risks as opposed to the “every day” risks described above?
Increasingly, we are bombarded by news of mega breaches and “highly sophisticated” attacks in the media. The availability of these attacks in recollection is certainly going up as a result. However, just like fretting about a shark attack as we cautiously lounge in a beach chair safely away from the water while eating a bag of Doritos, are we focusing on the unlikely Sony-style attack, while our data continues to bleed out through lost or stolen unencrypted drives on a daily basis? In many cases, we do not actually know the specific mechanisms that lead to the major beaches. Regardless, security vendors step in and tailor their “solutions” to help organizations mitigate these attacks.
Given that the use of quantitative risk analyses are still pretty uncommon, the assessment of likelihood of information risks is, tautologically, subjective in most cases. Subjective assessment of risks are almost certainly vulnerable to the same kinds of biases described by the availability heuristic.
The availability heuristic works in both directions, too. Available risks are over-assessed, while other risks that may actually be far more likely but not prominently recalled, are never even considered. Often, the designers of complex IT environments appear to be ignorant of many common attacks and do not account for them in the system design or implementation. They confidently address the risks, as budget permits, that they can easily recall.
Similarly, larger scale organizational risk assessments that do not enumerate the more likely threats will most certainly lead to suboptimal prioritization of investment.
At this point, the above linkage of the availability heuristic to information security is hypothetical- it hasn’t been demonstrated objectively, though I would argue that we see the impacts of it with each new breach announcement.
I can envision some interesting experiments to test this hypothesis: tracking how well an organization’s risk assessments forecast the actual occurrence of incidents; identifying discrepancies between the likelihood of certain threats relative to the occurrence of those threats out in the world and assessing the sources of the discontinuities; determining if risk assessment outcomes are different if participants are primed with different information regarding threats, or if the framing of assessment questions result in different risk assessment outcomes.
A possible mitigation against the availability heuristic in risk assessments, if one is really needed, might be to review sources of objective threat information as part of the risk assessment process. This information may come from threat intelligence feeds, internal incident data and reports such as the Verizon DBIR. We have to be cognizant, though, that many sources of such data are going to be skewed according to the specific objectives of the organization that produced the information. Reading an industry report on security breaches written by the producer of identity management applications will very likely skew toward analyzing incidents that resulted from identity management failures, or at least play up the significance of identity management failures in incidents where multiple failures were in play.