Security is both a feeling and a reality
—Bruce Schneier

Daniel Gardner starts his book The Science of Fear with the shocking history of US September 11 attacks:

And so in the months following the September 11 attacks, as politicians and journalists worried endlessly about terrorism, anthrax, and dirty bombs, people who fled the airports to be safe from terrorism crashed and bled to death on America’s roads. And nobody noticed. […] It turned out that the shift from planes to cars in America lasted one year. Then traffic patterns went back to normal. Gigerenzer also found that, exactly as expected, fatalities on American roads soared after September 2001 and settled back to normal levels in September 2002. With these data, Gigerenzer was able to calculate the number of Americans killed in car crashes as a direct result of the switch from planes to cars. It was 1,595.

What killed all those victims? The fear

We all know that flying is safer than driving a car. In fact, the most dangerous part of flying is the car journey to the airport, as statistics have showed. So, why are we more afraid of flying than driving? Because risk acceptance is not only based on technical estimates of risk and benefit, but also on subjective factors, such as the feelings.

Our beliefs on the world are determined by our emotional preferences
The Affect Heuristic allows someone to make a decision based on an affect ꟷthis is, a feelingꟷ instead of on a rational consideration. This heuristic works according to the following substitution:

If your feelings towards a situation are positive, then you are more likely to judge its risks as low; on the other hand, if your feelings towards a situation are negative, this would lead to a higher risk perception.

You are using your affective response to a risk (for instance, how do I feel about genetically modified food, nuclear power, breast cancer or firearms?) in order to infer how serious a given risk is for you (for example, how many people die of breast cancer or by firearms per year?). Often, you will find that there is an important gap between actual and perceived risk.

On our brains, risk is associated with a number of psychological factors that determine if we are more or less afraid. And how can these factors be measured?

One of the most well-known researchers on risk analysis, Paul Slovic, suggested a psychometric paradigm to measure perceived levels of risk according to the affective response to different threats. In his first research, Slovic suggested 18 characteristics to quantitatively measure risk perception. In order to make it simpler, the following table only includes those risk perception factors most directly related to cybersecurity:

People overreact against those risks that:	People play down those risks that:
Strike fear	Do not strike fear
Are uncontrollable	Are under their control
Are globally catastrophic	Impact on a few people
Impact on others, not the activity agent (inequitable)	Impact on the activity agent (equitable)
Are externally imposed	Are voluntary
Are unknown	Are known
Are difficult to understand	Are well-understood
Are new, infrequent	Are old or common
Have immediate consequences	Have long-term effects

Let’s see again the example of flying or travelling by car from this new perspective. If you evaluate each one of the previous factors for both activities, you will reach a similar result to the one represented by the following graphic:

Maybe now it seems clearer for you why we are more afraid of flying than travelling by car in spite of what statistics and studies on accidents and mortality show: We are emotional beings!

Check out the previous articles on availability and representativeness heuristics to see how most of the behaviors listed in the table are explained.

You risk perception against threats is conditioned by fear and familiarity
Later, when going further into the study of these factors, Slovic discerned that there are two main dimensions among all of them: fear and familiarity. Both dimensions may be graphically represented in order to make risk classification simpler.

If we focus on these two factors, the Affect Heuristic may be redefined as the following substitution:

When evaluating two threats A and B, the more fear one of them strikes into you and the less familiar it is to you, the higher you will perceive its risk regarding the remaining one.

Unconsciously, you are making a judgement: flying is more frightening and less familiar than travelling by car, so it must be riskier. This way, you place the flight into the bottom right side (High Risk) and the car into the top left side (Low Risk). And not even all the existing statistics will change this affect. You can try it out on your brother-in-law.

This heuristic is specially applied when you must take quick decisions. When you are under pressure and out of time, you cannot avoid feeling affective or emotional reactions towards most of the options. Of course, in addition to affect, psychological shortcuts also leap into action, helping you to determine if a risk seems to be high or low: they are the cognitive biases and heuristics that we have been examining over previous articles.

Familiarity is a key factor to risk assessment. The more familiar you are to an activity or event, the less attention you pay to it. Your brain is bombed by millions of input data and need to filter them, extracting the relevant information. In general, relevant means new, anything that involves a change. Over time, when our brain responds to the same stimulus time and again, it gets used to and ends up ignoring it.

Habituation is a wonderful phenomenon that allows you to get along in your everyday life without having to pay attention to everything. The downside is that you become desensitized to frequent stimuli. The more familiar an activity is, the less risky it ends up seeming to you. For this reason, you may smoke, eat ultra-processed food, whatsapp while driving and cross the road while reading Facebook on your mobile device EVERYDAY! You are so used to these activities (they are familiar to you) that they don’t seem risky to you anymore.

The surprising relationship between our judgements of risk and benefit
But the story does not end there. Paul Slovic did not only reach the conclusions previously described in his risk psychometric paradigm. He discovered surprising relationships between our judgements of risk and benefit as well:

In the world, risk and benefit are positively correlated, while in people’s minds (and judgements), risk and benefit are negatively correlated. […] People base their judgments of an activity or a technology not only on what they think about it but also on what they feel about it. If they like an activity, they are moved to judge the risks as low and the benefits as high; if they dislike it, they tend to judge the opposite-high risk and low benefit.

The paradigmatic example here is nuclear power. As everybody knows, nuclear power is a Bad Thing, so it must involve a high risk. How beneficial is nuclear power? Considering that it is a Bad Thing, it must involve a low benefit. However, X-rays of radiographies are a Good Thing, since doctors use them to save lives, so they must involve a Low Risk and a High Benefit. This is how our brain works. What about data? We do not need them; the decision is already made. They would only be useful for confirming the initial position. The result is that we overestimate the risks of nuclear power and underestimate the risks of X-rays.

Under this model, affect is the first reaction and guides our judgements of risk and benefit. If a general affective view guides perceptions of risk and benefit, providing information about benefit should change perception of risk and vice versa.

Make risk take its rightful place in your empleyee’s affect
All the studies on risk perception confirm that experts in the assessed field succumb to the Affect Heuristic to a lesser extent. After all, they have a greater awareness of the field, gained through experience and study. This is, they know more accurately the probabilities and nature of the threats, as well as the impact of incidents. In conclusion, they are better equipped to assess the actual risk: their gap between actual and perceived risk is smaller than among laypersons in the field.

The conclusion is clear: if you want to help your employees make better security decisions, you must raise their Information Security Awareness (ISA). This conclusion is so obvious that jotting it down is shameful. However, whether this is made or not is another story. And among the major challenges of this awareness, re-educate users on technologies that are quite familiar and helpful for them is one of the greatest ones, since they end up losing sight of their actual risk.

Therefore, one of the key points of any program must be dishabituation. The more familiar employees are to a technology and the more helpful they perceive it; the less risky such technology will be for them. Cybercriminals exploit precisely these high familiarity, low fear and high benefit of a number of technologies in order to turned them into attack input vectors. Some examples of this type of familiar, nice and helpful technologies are:

• E-mail, a technology we use every single day at any time.
• USB drives, those small and innocent-looking devices that store so many useful information.
• Office files from Word, Excel, PowerPoint, PDF, on which we spend our time every day and which we happily share.
• Ads on legitimate websites, that we view everywhere and are really annoying, even if sometimes they advertise interesting things.
• Games and apps downloaded on the smartphone, so funny, useful and cute.
• Photos and videos shared on social networks.
• The company’s employees themselves, with whom we drink coffee every morning and whose children we know.

There is no harm in carrying out from time to time security campaigns intended to remind employees that e-mail, USBs, office files, browsing, games, multimedia, the colleagues themselves, etc. are the main cyberattack input doors, however familiar and friendly they seem.

Finally, your security perception is not merely a rational issue, but emotional as well. You cannot fight against the affect heuristic directly, because this is how our brain works. Instead, you can guide your employee’s affect towards the various technologies, raising their awareness level.

Gonzalo Álvarez de Marañón
Innovation and Labs (ElevenPaths)
[email protected]

Anyone who causes harm by forecasting should be treated as either a fool or a liar. Some forecasters cause more damage to society than criminals.

—Nassim Taleb, The Black Swan, 2007

In 1957, the Sydney Opera House was expected to cost $7 million and to take 4 years to be carried out. Finally, it took 14 years to be completed for around $102 million, resulting in a cost overrun of 1,400%! Probably the highest in the whole History.

Cost overruns and delays constitute a constant in engineering works: the Panama Canal, the new headquarters for the European Central Bank, the M-30 tunnels, the Madrid-Barcelona high-speed train, the Pajares turn-off (variante de Pajares), the Barajas Airport T4, the L9 of the Barcelona metro… It is an endless list. After having studied hundreds of works in 20 countries over the last 70 years, Bent Flyvbjerg −Infrastructure Policy Expert and Professor at Oxford University−, concluded that 90% of the projects were not able to meet the budget.

And this does not happen only with big civil works, but also with major engineering projects: the A400M Airbus, the Australian F-100, or the Galileo project intended to replace the GPS, that has accrued 10.000 EUR million in terms of cost overruns and a 15-year delay. Imagine!

What about your projects? Are they more resource-intensive than it was originally budgeted? Do they take longer than expected to be completed?

Why we are so bad estimating costs and deadlines: the tension between inside and outside views
Throw the first stone if you have never been over-optimistic when estimating the time and resource costs needed to complete something!

The psychologists Daniel Kahneman and Amos Tversky coined the term planning fallacy to refer to this paradoxical phenomenon: although all of us have miserably failed time and again when estimating the completion time and execution budget of all type of personal and professional projects where we have been involved, the next time our planning remains absurdly optimistic!

In his book Thinking, Fast and Slow, Daniel Kahneman explains how you can address a problem by using an inside view or an outside view:

• When you use the inside view, you focus on your specific circumstances and search for evidence in your similar experiences, including anecdotal evidences and fallacious perceptions. You imagine idyllic scenarios where everything goes according to plan. Nevertheless, in addition to all the variables that you consider on your mind, there is an incalculable volume of unknown and undeterminable variables: diseases, accidents, security incidents, breakdowns, disagreements within a team, other projects that are more relevant, firings, unforeseen exhausted funds, strikes… so many unexpected things may happen! Unfortunately, it is impossible to anticipate all of them. What is clear is that the likelihood that something goes wrong increases as the project is more ambitious. In summary, we underestimate what we don’t know.
• Conversely, when you use the outside view you are looking beyond yourself —beyond your own experience, beyond the details of a particular case— and paying attention to additional objective information, such as the base rate. Instead of thinking that your project is unique, you look for similar projects and check their data on average budget and duration.

Unfortunately, you tend to discard, even to scorn, the outside vision. When statistical information of similar cases comes into conflict with your personal feelings, you will reject the data. After all, those projects were so long and had such a high cost because other people executed them, but you are different and the same thing might not happen to you, right?

Let’s see it from a different angle, thanks to this piece of dialogue from a real conversation between two parents:

“I’m going to enroll my son at the TAI School.”

“Are you sure? It’s really elitist. The probability to be admitted is quite low, only 8%.”

“Well, the probability of my children will be close to 100%, his grades are excellent.”

This father thinks that his son has a very great probability to be admitted because, indeed, the child is quite intelligent and his grades are excellent… as the hundreds of children that apply for this school every year, of whom only 8 out of 100 are admitted. This father is only using its inside view to evaluate the situation. Sadly, the best probability estimation that his son will be admitted to that school remains 8%, that is, the base rate.

To sum up, the outside view looks for similar situations that may provide a statistical basis to make a decision: Have other people faced similar problems in the past? What did it happen? Since we consider the outside view is an unnatural way of think, we prefer to believe that our situation is unique.

According to Kahneman in Thinking, Fast and Slow:

In the competition with the inside view, the outside view doesn’t stand a chance

Welcome to Lake Wobegon, where all the children are above the average
Acknowledge that your perception of events is asymmetrical. According to a high number of psychology experiments:

• You attribute your successes to your skills and your failures to your bad luck, exactly the opposite of how you apprehend successes and failures of others.
• You consider yourself more intelligent than others.
• You think you are a better driver than others.
• You think your marriage will last longer than others.

In essence, you think you are special. Well, this is another thought error known as optimism bias. This bias is closely related to the illusory superiority. In other words, we believe within ourselves that we are different, when actually we are all quite similar.

The optimism bias plays a critical role in the planning fallacy. As explained by the expert Bent Flyvbjerg in his study mentioned above:

“In the grip of the planning fallacy, managers make decisions based on delusional optimism rather than on a rational weighting of gains, losses, and probabilities. They overestimate benefits and underestimate costs. They involuntarily spin scenarios of success and overlook the potential for mistakes and miscalculations. As a result, managers pursue initiatives that are unlikely to come in on budget or on time, or to deliver the expected returns.”

Not everything is our imperfect thought’s fault
The optimism of planners and those who make decisions is not the only cause of these increases. In Thinking, Fast and Slow Kahneman points out other factors:

“Errors in the initial budget are not always innocent. The authors of unrealistic plans are often driven by the desire to get the plan approved—whether by their superiors or by a client—supported by the knowledge that projects are rarely abandoned unfinished merely because of overruns in costs or completion times.”

In order to obtain funding at all costs, overstating the returns of the coming project and easing the risks and costs is frequent. In such a way, Bent Flyvbjerg provides a formula that stresses this pernicious spiral where the projects that are best presented are the most funded ones:

Underestimated costs + Overestimated benefits = Funding

At the end, people don’t fund real projects, but idealized versions of them with oversized returns, while costs and problems are swept under the rug.

What you can do to better plan your next project
Statistical information on similar projects may save us from the planning fallacy. However optimistic you are, you may expect to find, on average, similar bottlenecks to those faced by similar projects’ teams. Bent Flyvbjerg suggested the method known as Reference class forecasting to set the optimism bias aside when forecasting projects’ completion time and cost.

Reference class forecasting requires the following three steps for your particular project:

1. Identify a relevant reference class of past projects. The class must be wide enough to be statistically significant, but also restricted enough to be truly compared with your project. Naturally, the rarer the problem you are dealing with, the more difficult this step will be. In case of common decisions (at least for others, although not for you), reference class identification is immediate.  
2. Establish a probability distribution for the selected reference class. This requires access to credible empirical data for a sufficient number of projects within the reference class in order to obtain statistically significant conclusions.
3. Compare your project with the reference class distribution, in order to establish the most likely outcome for your project.

When evaluating plans and forecasting, we tend to focus on what is different, leaving behind that the best decisions often focus on identical factors. Even if the situation you are dealing with seems to be a little different, at the moment of truth it is almost always the same. However painful it may be, let’s assume we are not as special as we think.

Learn from ancient stoic philosophers to think about what may go wrong: project premortem analysis
It is attributed to Seneca the meditation exercise that Stoics called premeditatio malorum: something like a reflection on what may go wrong before undertaking an enterprise. For instance, before undertaking a sea journey, what may go wrong? A storm may break, the captain may get sick, the ship may be attacked by pirates, etc. In this way, you may get yourself ready for these eventualities. And in case nothing can be done, if the worst happens, at least it will not catch you by surprise.

The American psychologist Gary Klein takes this old idea up and recommends performing a premortem analysis of the project under study:

“A premortem in a business setting comes at the beginning of a project rather than the end, so that the project can be improved rather than autopsied. Unlike a typical critiquing session, in which project team members are asked what might go wrong, the premortem operates on the assumption that the “patient” has died, and so asks what did go wrong. The team members’ task is to generate plausible reasons for the project’s failure.”

If you wish to apply this analysis, try to give the following speech to your team:

 “Imagine that a year has passed. We have followed the project to the letter. The project has failed spectacularly. Over the next few minutes those in the room independently write down every reason they can think of for the failure—especially the kinds of things they ordinarily wouldn’t mention as potential problems.”

The reasons that have been pointed out will show you how things might happen. After all, a premortem may be the best way to avoid a painful postmortem.

Gonzalo Álvarez Marañón
@gonalvmar
Innovation and Labs (ElevenPaths)
www.elevenpaths.com