When I write about analyst skills I often want to add a section about metacognitive skills. However, it's sometimes redundant because those skills appear alongside all the other skills analysts leverage.
For example, good analysts often know their limitations. They know what evidence sources they are weak in (knowledge regulation) and seek alternative investigative pathways to reach conclusions (knowledge regulation). That's essential metacognitive stuff.
Sometimes that's easy to deal with. There are a lot of ways to prove program execution (OS logs, prefetch, registry, and so on) and most mid-level analysts are comfortable with at least one of them. Not knowing one isn't a massive burden because you can use others.
Sometimes that's hard to deal with. Some analysts don't understand network traffic well, and sometimes there aren't great substitutes for that. Likewise, analysts who are well versed in network traffic but not host analysis limit their investigative pathways too.
You also have evidence sources like memory. In many cases, you can answer questions faster or better with other evidence sources. But sometimes, only memory will do.
Like I said, sometimes analysts may choose alternate pathways based on their limits. Other times, they may research the things they don't know. It often depends on where they are in relation to their goals and external factors like time sensitivity.
Monitoring those sorts of things are metacognitive skills too. Understanding your goals and weighting ways to pursue them against your realistic capabilities.
Knowing what you don't know is a marker of expertise. We're not good at helping folks grasp their own skill level in this field for a lot of reasons, so that's a hard fought skill over time. I and other people are working on that, though.
So this idea of knowing your own knowledge limits and reacting accordingly is a metacognitive skill, but one way it manifests is in how you form investigative questions and pursue specific evidence sources.
All of this requires some degree of intellectual humility. A lot less early on in your career when people expect less of you, but a lot more later on when people depend on you. So, there are social and intrapersonal things that can get in the way of metacognitive skill building.
All told, I think infosec provides lots of great opportunities to build metacognitive skills in a domain relevant way. Most experts I talk to show some evidence of that, but they don't realize that's what they are doing and its embedded in lots of decisions they make.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
