To help overcome these biases and assist the architect and others in making better decisions, three de-biasing techniques are proposed as extensions to the SABSA Framework:
1. Bias Training and Awareness
2. Risk Calibration. The calibration technique improves estimates-making by providing a more realistic assessment of our uncertainty, removing personal estimating biases. The goal of calibration is to state our estimates with 90% confidence. 3 Steps:
2.1. Start with the absurd
2.2. Focus on what you know & what you can reference
2.3. Play the betting game
3. Factor Analysis of Information Risk. One method to improve risk forecasting judgements is to use Factor Analysis of Information Risk, or FAIR. The FAIR methodology is a quantitative approach to risk analysis that can aid security architects in better risk judgement and more accurate risk forecasts. FAIR leverages a taxonomy of factors. One of the primary goals of FAIR is to improve the accuracy of probability and loss forecasting for cyber loss events. This is done using a combination of techniques including calibration (previously discussed) and computer-aided Monte Carlo simulation.
The influence of biases is often unconscious and can lead to poor decisions. Raising awareness and teaching biases in SABSA classes is one approach to elevating architects’ awareness of biases. By teaching architects about biases, a learning frame can be created to help identify and prevent them in the future.