What do you do if logical reasoning fails to solve cybersecurity problems?

While logical reasoning is still crucial to cybersecurity analysis, it's essential to recognize its limitations, especially when dealing with increasingly sophisticated adversaries. By embracing a more flexible and multidisciplinary approach to problem-solving, we can adapt to the dynamic nature of cybersecurity threats and improve our overall resilience in defending against them. Instead of strictly following predefined patterns and rules, I adopted a mindset of exploration and experimentation. This meant utilizing data visualization tools, machine learning algorithms, and behavioral analytics to identify subtle patterns and anomalies that could indicate malicious behavior.

When logical reasoning doesn’t solve cybersecurity issues, it’s time to think outside the box. ??? Engage with diverse perspectives, encourage creative problem-solving, and foster a culture of innovation. ?? Sometimes, the key lies in unconventional approaches.

Assume by default no one in an organisation has time to listen to logical reasoning. It's not that they don't care, it's that they have their jobs to do and their jobs aren't security (like what you and I are doing). If you can't grab their attention in the first few seconds how the topic is relevant to their roles, you're already lost. Many executives are time poor, so make sure you've got your elevator pitch ready on why the problem on hand matters, e.g. patching a particularly vulnerability is critical is NOT about the CVSS score, it's this [vulnerability] exists in [x] machines in [these countries]. If it is exploited, these [systems] in [these countries] will be downing impacting [xxx] services. You can fill in the blanks.

If logical reasoning proves insufficient in solving cybersecurity problems: 1. Collaborate: Seek input from experts for diverse perspectives. 2. Research: Explore unconventional approaches and review relevant resources. 3. Experiment: Test hypotheses in a controlled environment to identify solutions. 4. Consult Documentation: Refer to technical resources and case studies for insights. 5. Seek Mentorship: Gain guidance from experienced professionals. 6. Consider External Support: Engage external consultants with specialized expertise. 7. Stay Persistent: Maintain adaptability and continue learning through iterative problem-solving. By utilizing these strategies, you can tackle cybersecurity challenges that defy conventional logic.

When logical reasoning falls short in cybersecurity, a comprehensive approach is crucial. Consulting experts provide alternative insights. The research delves into literature and past solutions. Experimentation tests new approaches. Collaboration fosters innovative ideas. Advanced tools aid analysis. Critical thinking uncovers hidden factors. Taking breaks refreshes the mind. Seeking professional help offers tailored solutions. By combining these strategies, cybersecurity challenges can be effectively addressed, ensuring the protection of critical assets.

Intuition is NOT useful for any cybersecurity tasks. What people meant when they said intuition, they meant 'based on their previous experience'. This is valuable in forming the hypothesis. (It is important for scientific study and it's also a must-do in consulting firms such as McKinsey). Anyway with this hypotheses, it is then broken down into more granular details & gather data to support/debunk it. E.g, we have more alerts this month, the hypothesis is that we have fine-tune the rulesets, and increase the trust positive. So you want the data: events - relatively the same, no. of rules - the same, TP % by ruleset, and perhaps TP% by analyst (no names required). Test if the data tells the same story. Ask a second opinion to avoid bias.

Trust yourself. You're where you are for a reason. Sometimes the usual approach may not be able to solve the program, as all problems aren't same. Your intuition could lead you to discover what isn't explicitly stated. If you haven't been able to solve the problem through the usually methods and your gut is leading you in a different direction, try it out, you might just learn something new.

Before doing any experimentation, lay out paths to one or more hypothesis. That way your experimentation can guide you towards your goals. If your experimentation lends itself towards it, use something like Jupyter Notebook or JupyterLab: your documentation, reasoning and above all *failed experiments* are even more valuable than just the results of an experiment.

I can't stress more than enough the importance of understanding cross-cultural difference in collaboration, e.g. - Some culture are less expressive but they might have a lot of knowledge and experience within them. It is important to invite their opinion. - Some people don't like to speak in front of others, so organise a 15-mins 1:1. It's collaboration, not TED talk. Not everyone wants to be in the spot light - Do not use security jargons, no one outside security needs to know the security acronyms. just like no one outside Finance needs to know how the financial reporting standards.

The tendency, for me, is to look immediately for an answer why the things I know to do - cannot solve a certain cybersecurity problem; and even through the series of trial and error that I have done. My books, manuals and notes would be useless at this time because it is beyond logic. Initially, we must refer to the OSI model and try to identify at what layer the problem is occurring. From here, it will now be easier to search in youtube how to solve the problem…at the same time post the problem in a cybersecurity forum (that you are a member) and hope that someone had a similar problem and was able to solve the particular problem.

As much as we'd like it to be, security isn't strictly a logic problem. Humans do illogical things and are a major part of any organization you're securing. Your plans need to account for this so ensure you're considering the realities of how humans act - They're looking for an easy path but generally want to do things correctly and be secure. Make this part of how you address risks and think about how you can leverage those two human tendencies to drive behavior you want to see - Is it easy to use the right authentication? Then they'll use it. Is it easier to build software using approved frameworks than to bring in their own? Then they'll use it. Look at how Netflix thinks about the paved road for more ideas along this line.