The opportunity cost in Learning

This post was inspired by my learning project: "Learning malware analysis".

What is opportunity cost?

Let start the post by defining what is "opportunity cost". For me, opportunity cost is cost & reward of one decision over another decision. If you choose option A, you can't have option B. However, there are certain cases where you can have little bit of A and little bit of B (Example 2)

There's are some important things to keep in mind when making an decision:

• Your goal
• Cost & reward compounds
• Priorities

Let's explore what opportunity cost means through these following examples.

Example 1: Playing Video games vs Sleeping Early at 10pm

Disclaimer: I'm not against video games. Video games is fun and addicting especially if you're playing with your friends. However, I do think that there is a balance that we need to strive for as to everything we do.

I do think that finding that balance can be hard.

For example, Decision A: play video games until 12am vs Decision B: sleeping early at 10pm.

Decision A: Play video games until 12am has it's cost and reward.

• Cost:
  • Sleep at 1am -> Wake up at 9am. (Quarter of the day is already gone)
    • Eat breakfast - Takes time
    • Go to doctor appointment - Takes time
    • Each commitment eats up your time that you can use to invest in yourself.
• Time invested: Hours spent on playing video games. The hours spend on playing games can be used to learning other skills that generates meaningful results in your life
  • Now scale that by weeks, months, years then the difference shows
• Reward:
  • Fun (Short run) -> Dopamine -> Reinforce the behavior to do it again.

Decision B: Sleeping early at 10pm

Cost:

• Emotionally: Boring, Dull, Hard. Doesn't really give you dopamine.

Reward:

• Energized in the morning
• Allows you to wake up really early
  • Guess what, that time you wake up early -> You can use it for you. That the time you can control. That your ME TIME. That time you can invest in your self.
• Next time you try sleeping early at 10pm, that gets easier.

Example 2: Readjusting a decision to fit your goal

1. The tension (the setup).
At this stage of my life, two things I care about compete for the same resource — my time. I want to stay healthy, and I want to invest in my career and knowledge. Work already claims a big share of my hours.

2. The real cost of the plan.
Say I decide to exercise one hour each day. The true cost isn't one hour — once I factor in traffic to and from the gym, each session is about 1 hour 20 minutes (80 minutes). Zoom out to a full week (7 days) and that's 560 minutes — roughly 9.3 hours.

3. Name the opportunity cost.
Those 9.3 hours aren't free. Every hour I spend exercising is an hour I'm not spending on the thing I say matters the most. That foregone skill-building is the opportunity cost of training every single day.

4. Check the decision against the goal.

Now I evaluate my decision

• Do I want to be healthy? Yes.
• Am I training to be an athlete? No.
• What's my actual priority right now? Growing my skills as a SOC Analyst which requires a lot of hours.

Health matters but the return of exercising everyday vs the return of growing my skills as an SOC analyst doesn't compare.

5. Readjust.
So I scale back — 4 days a week instead of 7. Same 80 minutes per session, but now: 320 minutes — roughly 5.3 hours. That reclaims 4 hours every week developing my skills.

6. The lesson.
I didn't abandon health, and I didn't pretend the trade-off didn't exist. I readjusted the decision to fit my goal, and I accepted the opportunity cost that came with it — a bit less exercise — because the competing cost, lack of growth, was the one I couldn't afford.

Opportunity Cost in learning?

When I learn, I have the obsession of trying to learn everything about the subject as much as I can. However, that requires a lot of time and dedication. The time spent learning the subject can be used to learn something else which is represented as opportunity cost.

So, how do we know if we should pursue this subject further? That depends on all sort of factors: your goal for learning the skill, your priorities and where you're at in your life, etc...

For example, for my malware analysis learning project, I thought I can learn everything about malware analysis - Advanced Static Analysis (Using the Disassembly) and Advanced Dynamic Analysis (Using the Debugger). However that changed once I reflected on my experience working as an SOC analyst.

For me, as an SOC analyst, I need to investigate the alert, determine whether it's an false positive or true positive. Once, there's indication that an compromise happen, the next thing is to determine the scope of the compromise which leads to identify the IOCs. These IOCs can be an IP address, infected files, malicious service or process, etc.. and use those IOCs to determine what devices are infected which leads to quarantined. After that, it's also making sure there no persistence installed.

After that, it's writing an report of what happen and calling the clients. Through that whole process, there no time to load up IDA to analyze the malware.

Therefore, if I'm going to approach malware analysis, I think the best thing for me to focus on basic static analysis and basic dynamic analysis to grab IOCs and accept that I'll be meh at malware analysis because being meh is what going give me the most bang for my bucks.