Question

An organization reviews recent audit results of monitoring solutions used to protect the companies infrastructure and learn that detection tools are reporting a high volume of false positive positives which alert tuning techniques can reduce the volume of false positives

Answer 1

To reduce false positives in detection systems, organizations can use accuracy nudges for crowdsourced feedback, provide researchers with more data using differential privacy, and refine decision-making processes to decrease cognitive overload, as well as ensuring accurate interpretation of alerts.

Step-by-step explanation:

To reduce the volume of false positives in detection tools, an organization could employ several alert tuning techniques. One effective technique is the use of accuracy nudges to crowdsource falsity labels, which allows for the improvement of algorithm accuracy in detecting true threats versus false alerts.

However, to refine these algorithms, researchers may need access to more data. Implementing technologies such as differential privacy can help in providing the necessary data while maintaining confidentiality. Furthermore, team cognition and decision-making processes play an integral role, as shown by studies like that of Bruno & Abrahão (2012), which indicated a correlation between the volume of decisions and the rate of false alarms. Refining the decision process by reducing cognitive overload could help reduce false positives.

Additionally, awareness and correct interpretation of alerts are crucial, as demonstrated by the case of the 2013 Target data breach, where signals of a breach were overlooked by security personnel.