Be critical of your thinking

I have been thinking a lot lately.  (applause).  Yes, I know this will shock people who know me, but whatever.  Some of that thinking has to do with being in a zombie movie, knowing it, and not being able to sleep because I feel like I am going to be bit next by surprise.  But mostly, I think about how to explain how important critical thinking is to the security process. 

The topic came back to me a couple years ago when I was teaching a forensics classes.  I found a great section in the Open Source Security Testing Methodology Manual (OSSTMM) regarding how to logically make conclusions based on the facts before you.  I feel this is a lost art in the Infosec field and that it needs to come back badly.  We as Infosec professionals make far too many decisions based on conjecture and not on the evidence in front of us.  If we document our arguments well and completely, then we have a much better chance of getting what we are asking for.

So let me ask a question:  you are presented with a phishing email that someone sent to you and asked "Hey!  Is this a phishing email?"

Now what?

To use the method that I like best (OSSTMM), we use a six step analysis technique:

1) Build your knowledge of the target- Google is my friend!  But use other known, reliable resources as well.
2) Determine what is already known about this email in the community at large.
3) Determine any bias or ulterior motives in the information sources.  This is incredibly important.  I wish I could count how many times I tell my students: Wikipedia is NOT an acceptable source to quote.
4) Translate jargon from your sources (aka don't use slang or other annoying 'out-of-the-box' terms, and please don't use marketing terms).
5) Be sure that any equipment that is used is properly calibrated (in this case, my test equipment is my PC.  So make sure it's free of viruses and keystroke loggers and such).
6) Assure that the translation state of tools or tests processes has been removed.  In this case, you could look at the state of your DNSserver or other filters (or even your search engine) to ensure that they aren't corrupted.

After doing all this, you should be able to answer the phishing question pretty authoritatively.  I know I wouldn't argue with the conclusion (nor would I send the process I went through.  Just say "Yes, please delete it.")

I have been extremely appreciative of this testing manual for a long time (it has a lot more to it besides this section), but I use this process the most.  I will be writing more on other support processes for critical thinking, but thought this was a good place to start.  Please join in the conversation if you have steps to insert into this process that you have found useful!