Bias Thursday – Déformation professionnelle
While I am not a psychologist, a good understanding of psychological issues is an important part of a full security practice. These themed posts are likely to be incomplete, as I am just exploring some ideas and how they might apply to security.
Déformation professionnelle (which Google translates as "professional distortion") is the tendency to consider situations from the perspective of your profession. The classic example is the joke "when all you have is a hammer, every problem looks like a nail". What I've noticed, though, is that "profession" seems to apply to business divisions now. We're all getting extremely specialized, and that seems to create what we can call "a failure to communicate".
Take, for example, the concept of risk. In the security field, risk is bad and the steps that can be taken to avoid risk seem reasonable. However, in the business field, risk is viewed in terms of the potential gains that the risk can provide whereas the steps to avoid risk seem likely to cause problems and will therefore impact the bottom line. Similarly, admins and developers are likely to resist the perceived difficulties in implementing the mitigation strategies.
Again, there are both offensive and defensive capabilities to this bias. Offensively, simply knowing a target's profession can give you a good chance at predicting their responses. If you have a planned proposal, you can practice it against others in the same profession and tweak it before you present it to the people that matter. You can be aware of the context in which they will likely view your ideas and work on expanding their context before you get to the hard stuff.
Defensively, like most biases, you just have to be aware that you will likely view things within the context of your profession. Thus, if you are having conversations with those outside of your profession, there is a higher likelihood of misunderstanding. If you find yourself reacting negatively to something someone else says, you should check and see if maybe that reaction is because you are coming at things from different contexts.
As an note to this particular bias, I have occasionally been asked why I blog the way I do. Other than the fact that the Internet doesn't need yet another voice in the Security echo chamber, I find that forcing myself to consider issues from different contexts (mythological, natural, psychological, etc) allows me to understand the issues at a deeper level. I don't know if it gives me any advantage over the usual advantages that one gains by taking time to think things through and write them up... but it doesn't seem to be hurting.
