Cognitive Biases in Digital Forensics

Cognitive biases are systematic patterns of deviation from the norm or rationality in judgment, whereby inferences about other people and situations may be drawn in an illogical fashion. These biases are a result of the brain's attempt to simplify information processing. Cognitive biases can lead to perceptual distortion, inaccurate judgment, illogical interpretation, or what is broadly called irrationality.

Cognitive biases can affect the decision-making process of individuals, as well as groups and organizations. They can also have a significant impact on the field of cybersecurity, as they can lead to missed or misinterpreted evidence, false assumptions, and a false sense of security. Understanding and recognizing these biases is important for making accurate and logical decisions, especially in high-stakes fields such as cybersecurity.

Common Cognitive Biases in DFIR

Biases can greatly affect the work of a digital forensic analyst, leading to inaccurate or incomplete analysis. Some of the most common mental biases that can affect digital forensic analysis include:

Confirmation bias

This bias occurs when an analyst only looks for evidence that confirms their existing beliefs or hypotheses, while ignoring any evidence that contradicts them. This can lead to a false sense of certainty and ultimately result in missed or misinterpreted evidence.

An example of confirmation bias would be an analyst who is investigating a suspected intrusion into a company's network. The analyst believes that the intrusion is the result of a specific threat actor that has been active recently in the same geographical region. The analyst focuses only on the available threat intelligence evidence that supports this belief and ignores any evidence that contradicts it. As a result, the analyst may overlook important clues or overlook a different type of intrusion entirely.

Anchoring bias

This bias occurs when an analyst relies too heavily on the first piece of evidence they find, and subsequently interprets all other evidence in relation to it. This can lead to a skewed understanding of the case and result in inaccurate conclusions.

An example of anchoring bias would be an analyst who is investigating a cyber intrusion incident. The analyst receives the first piece of evidence, which suggests that the attacker may have used a specific vulnerability to gain access. The analyst becomes anchored to this initial piece of information and subsequently interprets all other evidence in relation to it, without considering alternative explanations or suspects. As a result, the analyst may overlook important clues or overlook other types of intrusion entirely, such as a social engineering attack, or a weak password that allowed the attacker to gain access to the systems.

Availability bias

This bias occurs when an analyst makes assumptions based on the information that is more readily available to them, rather than considering all possible evidence. This can lead to incomplete or inaccurate analysis.

An example of availability bias would be an analyst who is investigating an intrusion and receives a report of a cyber attack on the company's network and because of that they only focus on the most recent attack and the evidence that's readily available to them. The analyst assumes that the attack was carried out by a specific threat actor group because that is the most recent and available information. However, they don't take into account that the attack could have been carried out by a different group or using different methods.

Hindsight bias

This bias, also known as the "I-knew-it-all-along" effect, occurs when an analyst retrospectively views an event as if it was predictable or obvious, even though it was not obvious at the time. This can lead to an overestimation of the analyst's own abilities and ultimately result in missed or misinterpreted evidence.

An example of hindsight bias would be an analyst who is investigating a case and after the investigation is over, the analyst looks back at the evidence and concludes that the attack was obvious and could have been predicted based on the information available at the time. However, during the investigation, the analyst did not consider or identify the potential attack because of lack of information or knowledge. For example, an analyst investigates a data breach and finds out that the attacker used a known exploit to gain access to the system, but during the investigation the analyst didn't consider that possibility. After the investigation is over, the analyst looks back and says "It was obvious the attacker used that exploit, I should have thought about that from the start."

Sunk cost fallacy

This bias occurs when an analyst continues to invest resources into a specific hypothesis or technique, even though it is no longer effective, because they have already invested a significant amount of time or resources into it.

An example of the sunk cost fallacy in the field of digital forensics would be an analyst that has spent a significant amount of time investigating an alternate scenario of an attack supported by data provided by a third party during an incident. The new scenario may not be relevant to the main incident, but the analyst continues to focus on it because of all the effort that was already spent.

Managing the impact of cognitive biases

To mitigate these biases, digital forensic analysts should take a step back and objectively evaluate the evidence, testing and re-testing hypotheses and seeking out and considering evidence that contradicts existing beliefs. Additionally, analysts should be aware of their own personal biases and try to avoid them as much as possible. It is also helpful to establish a diverse and inclusive team where different perspectives and expertise can challenge existing biases and lead to more accurate and efficient analysis.

Another way to mitigate cognitive biases in cybersecurity analysis is to establish a diverse and inclusive team. A diverse team can bring different perspectives and challenge existing biases, leading to more accurate and efficient analysis. An effective strategy is to implement a regular review process that allows for fresh eyes to evaluate the analysis and findings. This can be done by having another team member, or an outside expert, review and validate the analysis. This can help to identify any missed vulnerabilities or false assumptions that may have been overlooked due to cognitive biases.