Root cause

Abstract: Many secure systems rely on a "human in the loop" to perform security-critical functions. However, humans often fail in their security roles. Whenever possible, secure system designers should find ways of keeping humans out of the loop. However, there are some tasks for which feasible or cost effective alternatives to humans are not available. In these cases secure system designers should engineer their systems to support the humans in the loop and maximize their chances of performing their security-critical functions successfully. We propose a framework for reasoning about the human in the loop that provides a systematic approach to identifying potential causes for human failure. This framework can be used by system designers to identify problem areas before a system is built and proactively address deficiencies. System operators can also use this framework to analyze the root cause of security failures that have been attributed to "human error." We provide examples to illustrate the applicability of this framework to a variety of secure systems design problems, including anti-phishing warnings and password policies.

Abstract: This paper uses case studies of shop-floor problem-solving at three automotive assembly plants to examine organizational influences on process quality improvement. Three complex quality problems-water leaks, paint defects, and electrical defects-were chosen because they are universally found in assembly plants, have multiple sources, and can only be resolved with high levels of interaction and coordination among individuals in multiple departments or functional groups. The case studies focus particularly on the early stages of the problem-solving process-problem definition, problem analysis, and the generation of solutions-emphasizing how each plant tries to identify the "root cause" of defects. The paper then explores consistencies and contrasts within and across the three cases to analyze the factors underlying effective shop-floor problem-solving. Central to this analysis is the idea that successful process quality improvement depends heavily on how the organization influences the cognitive processes of its members. Problem-solving processes benefit from rich data that capture multiple perspectives on a problem, problem categories that are "fuzzy", and organizational structures that facilitate the development of a common language for discussing problems. Also, when problems are framed as opportunities for learning, the combination of positive attributions that boost motivation and the suppression of threat effects can improve the effectiveness of improvement activities. Finally, when process standardization is understood as marking the beginning and not the end of further improvement efforts, the normal inertial tendencies of organizations with respect to adaptive learning can be partially overcome.

Abstract: Meehl argued in 1978 that theories in psychology come and go, with little cumulative progress. We believe that this assessment still holds, as also evidenced by increasingly common claims that psychology is facing a "theory crisis" and that psychologists should invest more in theory building. In this article, we argue that the root cause of the theory crisis is that developing good psychological theories is extremely difficult and that understanding the reasons why it is so difficult is crucial for moving forward in the theory crisis. We discuss three key reasons based on philosophy of science for why developing good psychological theories is so hard: the relative lack of robust phenomena that impose constraints on possible theories, problems of validity of psychological constructs, and obstacles to discovering causal relationships between psychological variables. We conclude with recommendations on how to move past the theory crisis.

Abstract: Troubleshooting the performance of production software is challenging. Most existing tools, such as profiling, tracing, and logging systems, reveal what events occurred during performance anomalies. However, users of such toolsmust infer why these events occurred; e.g., that their execution was due to a root cause such as a specific input request or configuration setting. Such inference often requires source code and detailed application knowledge that is beyond system administrators and end users.This paper introduces performance summarization, a technique for automatically diagnosing the root causes of performance problems. Performance summarization instruments binaries as applications execute. It first attributes performance costs to each basic block. It then uses dynamic information flow tracking to estimate the likelihood that a block was executed due to each potential root cause. Finally, it summarizes the overall cost of each potential root cause by summing the per-block cost multiplied by the cause-specific likelihood over all basic blocks. Performance summarization can also be performed differentially to explain performance differences between two similar activities. X-ray is a tool that implements performance summarization. Our results show that X-ray accurately diagnoses 17 performance issues in Apache, lighttpd, Postfix, and PostgreSQL, while adding 2.3% average runtime overhead.