Security visualisation

By Marco Krebs and William Rothwell

This article is guideline of how to generate a visual representation of a given dataset and use in the evaluation of known security vulnerabilities. Although this example is based on the output of an automated vulnerability scanner (Nessus), the suggested information visualisation process can be applied to generate any kind of visualisation.

Click on the button below to download this article.

Have you ever been stuck looking at a list of security vulnerabilities that seems endless? – You are not alone... Even worse: All issues appear to be of high priority and of equal importance at first sight. However, given the limited amount of time and resources in practice, it is key that each of them is carefully evaluated and prioritised to take adequate steps towards mitigation. If not done properly, the lack of prioritisation many times leads to the fact that known vulnerabilities do not get fixed within an appropriate time frame – if they get fixed at all.

This is a perfect example where information visualisation can help with the process of prioritisation. What if you had a visual representation of the findings that not only shows the underlying network architecture but makes the most critical issues sticking out immediately? What if you could see from this visual the attack path and identify potential security enforcement points along that path to cut-off the attacker?

If done properly, information visualisation takes advantages of human perception. As human beings we are literally wired to see: The human visual system is often described as a flexible pattern finder that can quickly detect changes in size, color, shape, movement or texture.

Contents:

Basic graph design principles
The information visualization process
Problem definition and message
Data analysis
Process information
Visual transformation
Interpret and decide

Royal Holloway Information Security Thesis Series

Vendor:: TechTarget ComputerWeekly.com
Posted:: Feb 8, 2021
Published:: Jan 18, 2013
Format:: HTML
Type:: Essential Guide

Already a Bitpipe member? Log in here

Download this Essential Guide!

Corporate Email Address:
You forgot to provide an Email Address.

This email address doesn’t appear to be valid.

Please provide a Corporate Email Address.

This email address is already registered. Please log in.
First Name:
You forgot to provide your first name.
Last Name:
You forgot to provide your last name.
Company Name:
You forgot to provide a company name.
Job Title:
You forgot to provide a job title.
Seniority:
You forgot to select your seniority.
Job Function:
You forgot to select your job function.
# of employees:
You did not select the number of employees at your company.
Industry:
You did not select which industry you are in.
Sub-Industry:
You did not select which industry you are in.
Address 1:
You did not provide a full local address.
Address 2:
City/Town:
You did not provide a full local address.
Country:
You did not select the country you are from.
State/Province:

You did not provide a full local address.
Zip/Postal Code:
You did not provide a full local address.
Phone:
You forgot to provide a phone number.

This phone number format is not recognized. Please check the country and number.
- I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.
Please check the box if you want to proceed.
- I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.
Please check the box if you want to proceed.