Be critical of your thinking

I have been thinking a lot lately.  (applause).  Yes, I know this will shock people who know me, but whatever.  Some of that thinking has to do with being in a zombie movie, knowing it, and not being able to sleep because I feel like I am going to be bit next by surprise.  But mostly, I think about how to explain how important critical thinking is to the security process. 

The topic came back to me a couple years ago when I was teaching a forensics classes.  I found a great section in the Open Source Security Testing Methodology Manual (OSSTMM) regarding how to logically make conclusions based on the facts before you.  I feel this is a lost art in the Infosec field and that it needs to come back badly.  We as Infosec professionals make far too many decisions based on conjecture and not on the evidence in front of us.  If we document our arguments well and completely, then we have a much better chance of getting what we are asking for.

So let me ask a question:  you are presented with a phishing email that someone sent to you and asked "Hey!  Is this a phishing email?"

Now what?

To use the method that I like best (OSSTMM), we use a six step analysis technique:

1) Build your knowledge of the target- Google is my friend!  But use other known, reliable resources as well.
2) Determine what is already known about this email in the community at large.
3) Determine any bias or ulterior motives in the information sources.  This is incredibly important.  I wish I could count how many times I tell my students: Wikipedia is NOT an acceptable source to quote.
4) Translate jargon from your sources (aka don't use slang or other annoying 'out-of-the-box' terms, and please don't use marketing terms).
5) Be sure that any equipment that is used is properly calibrated (in this case, my test equipment is my PC.  So make sure it's free of viruses and keystroke loggers and such).
6) Assure that the translation state of tools or tests processes has been removed.  In this case, you could look at the state of your DNSserver or other filters (or even your search engine) to ensure that they aren't corrupted.

After doing all this, you should be able to answer the phishing question pretty authoritatively.  I know I wouldn't argue with the conclusion (nor would I send the process I went through.  Just say "Yes, please delete it.")

I have been extremely appreciative of this testing manual for a long time (it has a lot more to it besides this section), but I use this process the most.  I will be writing more on other support processes for critical thinking, but thought this was a good place to start.  Please join in the conversation if you have steps to insert into this process that you have found useful!

Asking the right questions

I read a really good article in CSO Magazine not long ago (December 2013/January 2014).  The topic was: "To Solve Problems, Start by Asking Questions" and the gist of it was trying to resolve a conflict with a co-worker and how the person in the article resolved it by quizzing their office adversary.  The article is excellent (if you can find it- I had trouble online), but it made me think about taking it one step further.

I would argue that asking the right questions is critical to succeeding in your clarification quest.  There is nothing more annoying than someone asking a bunch of questions randomly, trying to ascertain answers that don't mean anything to the topic at hand.  Not only will you fail in your quest, but you just end up irritating your inquisitee.  Instead, think a bit about what you want to ask.  Look at the topic, understand that it means something to the person and then focus your questions on asking the right things. 

Putting some effort into your questions makes a huge difference to the person you are essentially interrogating (in a professional manner, of course).  It shows that you did your homework, have some respect for what they are clearly passionate about and perhaps actually want to understand why its important to them.  OK, call it social engineering, but it's a much more productive way to accomplish your goal rather than asking "What were you thinking?"

Other thoughts on how to ask the right questions:

1) Use your new active listening skills (see this) to truly hear what someone is saying

2) Do some research and check with other co-workers

3) Put some critical thinking into the problem before you start your line of questions.  Look at the evidence before you, put together your conclusions, and then focus your questions on solving the gaps.

One final thought on this: the questions can (and should) go both ways.  Be open when someone approaches you with queries. Be forthcoming and calm, and don't feel like they are intruding on your territory or trying to steal your job.  After all, maybe they read the same article and would like to try the same mutually beneficial tactic!