Challenging Investigative Bias in Incident Response

Keynote: Drea London-Petter – Global Sr. Director, Vigilance DFIR, SentinelOne
Room: Ballroom, EMU 244, Level 2
Time: 03:30p – 04:15p

Response teams world-wide are facing a highly diverse and evolving community of threat actors. Without an equally diverse and evolving group of responders we will remain several paces behind them. Building diversity in the war-room is critical to equalizing that imbalance so that we may challenge the gap that keeps threat actors one-step ahead.

Investigative bias is defined as “The inclination or tendency to present or hold a partial perspective that is preconceived or unreasoned”. As human beings our contribution to investigations is often a reflection of our perspective and of our past experiences. We create assumptions of how a threat actor will behave, what evidence they will leave behind, and even who they may be. A lack of diversity in that perspective opens the door to bias, and as a result, key parts of an investigation may go over-looked.