Skip to main content

The WiKID Blog

Viewing posts from January, 2009


I would think that this kind of research would be applicable to Information Security:


I really enjoyed a recent 'manifesto' from the ChangeThis site recently by Phil Rosenzweig called Forget Formulas . In it he points out the flaws in many management books that purport to find a formula for success based on a large quantity of mainly anecdotal evidence. The data is suspect because of the 'halo effect' (also the title of Rosenzweig's book):

The key weakness is the halo effect, a concept that was first identified by psychologist Edward Thorndike in 1920. It refers to the basic human tendency to make specific inferences on the basis of an overall impression. People tend to have an overall evaluation about someone or something, and let that evaluation shape specific features. the halo effect is found in many walks of life, including the way we evaluate job candidates—the graduate from a well-respected school tends to look good across the boards, while a graduate from an unheralded local school tends to look less attractive. Brand building, too, is based on the halo effect—companies know that consumers will attribute favorable qualities to a product from a respected company, and therefore go to great lengths to create positive associations with their brand.


Perhaps there is a lesson for infosec professionals in this post on the Affect heuristic on Overcoming Bias:

Suppose an airport must decide whether to spend money to purchase some new equipment, while critics argue that the money should be spent on other aspects of airport safety. Slovic et. al. (2002) presented two groups of subjects with the arguments for and against purchasing the equipment, with a response scale ranging from 0 (would not support at all) to 20 (very strong support). One group saw the measure described as saving 150 lives. The other group saw the measure described as saving 98% of 150 lives. The hypothesis motivating the experiment was that saving 150 lives sounds vaguely good - is that a lot? a little? - while saving 98% of something is clearly very good because 98% is so close to the upper bound of the percentage scale. Lo and behold, saving 150 lives had mean support of 10.4, while saving 98% of 150 lives had mean support of 13.6.
The post also shows that people tend to over-estimate the value of going with known brands, even though they might not add any extra value:
Ganzach (2001) found the same effect in the realm of finance. According to ordinary economic theory, return and risk should correlate positively - or to put it another way, people pay a premium price for safe investments, which lowers the return; stocks deliver higher returns than bonds, but have correspondingly greater risk. When judging familiar stocks, analysts' judgments of risks and returns were positively correlated, as conventionally predicted. But when judging unfamiliar stocks, analysts tended to judge the stocks as if they were generally good or generally bad - low risk and high returns, or high risk and low returns.
But perhaps you don't have time to consider all this, because you've got a deadline!
Finucane et. al. also found that time pressure greatly increased the inverse relationship between perceived risk and perceived benefit, consistent with the general finding that time pressure, poor information, or distraction all increase the dominance of perceptual heuristics over analytic deliberation.


I was wandering around aimlessly at a store with 10 bags of spring fertlizer for my yard talking on one of my 5 cellular devices trying to explain to expain to a clerk that I go by my middle name, not my first name, thinking about how suspicious it was that my credit card was actually accepted when it occurred to me that if I lived in Manchester, I would surely have been reported to the Anti-Terrorist Hotline whose motto is "“You don’t have to be sure. If you suspect it, report it.”


It will probably be a little quiet around here for the rest of the week as it's the Thanksgiving holiday here in the US. I'll still be checking my e-mail via the blackberry, of course :). Thanks to all who have made this a great year for WiKID.

Recent Posts







RSS / Atom