Icon.svg

How to make (better) decisions in security teams

SESSION

How to make (better) decisions in security teams

9:00 am

/

10 May 2023

About this session

This is a workshop about how to think well under adversary circumstances. In this workshop, we’ll re-use some ideas deriving from philosophy of science and systems thinking to determine what is true in incident response, how the nature of what is true may change during an investigation in a process of revision, and how teams can best handle the constraints on their behavior and thinking under conditions of uncertainty.

This workshop will draw on a number of traditions, especially philosophy of science and systems thinking.

Philosophers of science have long considered the creation, operation and nature of epistemic structures – scientific theories – that need to be true to be valuable. They have done so by focusing on how we develop and test explanations and theories. Another focus is the features good explanations have in comparison to poor or erroneous explanations.

In addition, we’ll use some ideas from systems thinking that will allow us to map out our current situation and its likely evolution in times of uncertainty allowing us to act in the environment we find ourselves in. The focus of action entails that we act on information, which is true, operate within the boundaries set by constraints, and operate in a way that is most effective.

The approach focuses on the principles that govern incident response and how they can regulate our behavior even when the endpoint of our interventions isn’t clearly in scope.