SOT

SOT

SOAR
Security Orchestration, Automation and Response

Automation of response to information security incidents using dynamic playbooks and information security tools, building an attack chain and with an object-oriented approach

NG SOAR
Next Generation SOAR

Automation of response to information security incidents with built-in basic correlation (SIEM), vulnerability Scanner (VS), collection of raw events directly from information security tools, dynamic playbooks, building an attack chain and an object-oriented approach. AM and VM are included

AM
Asset Management

Description of the IT landscape, detection of new objects on the network, categorization of assets, inventory, life cycle management of equipment and software on automated workstations and servers of organizations

VS
Vulnerability Scanner

Scanning information assets with enrichment from any external services (additional scanners, The Data Security Threats Database and other analytical databases) to analyze the security of the infrastructure.

VM
Vulnerability Management

Building a process for detecting and eliminating technical vulnerabilities, collecting information from existing security scanners, update management platforms, expert external services and other solutions

FinCERT
Financial Computer Emergency Response Team

Bilateral interaction with the Central Bank, namely the transfer of information about incidents and receipt of prompt notifications/bulletins from the regulator

GovCERT
Government Computer Emergency Response Team

Bilateral interaction with the state coordination center for computer incidents, namely the transfer of information about incidents and receipt of prompt notifications/bulletins from the regulator

Mail us to sales@securityvision.ru or get demo presentation

Anatomy of visualisation. Part One: From Task to Execution

Anatomy of visualisation. Part One: From Task to Execution
09.05.2024


  |  Listen on Google Podcasts  |   Listen on Mave  |   Listen on Yandex Music  |  


Security Vision

‘Complicating is easy, simplifying is hard.’

Meyer's Law



Introduction



Do you often think about how you absorb information? Why do some articles or books come easier and others harder? Have you ever found yourself glancing over a paragraph of text time after time and not being able to understand what you have just read?


Visual representation of data is a very big part of our lives, and it affects different areas of our lives: learning, work, entertainment.


What if we told you that almost any question can be answered in such a way that the speed of perception of the information you receive will increase and comprehension will be guaranteed?


For example, to hell with all this text, here's a picture:


image001.png

An exaggerated version of perception of complex information


Sometimes, of course, visualisation is powerless or simply useless, and text is not the same as text. We will consider this too.


Let's highlight three tasks for which we can resort to displaying information in the form of a set of graphical objects rather than text:


● Analytics - in order to find evidence of a certain judgement in the data, it is often more effective to display the data from an appropriate ‘perspective’ in the form of graphs, rather than verifying complex formulae of calculations.

● Communication - communicating the result of analytics to colleagues or management is best done in a visual and colourful format because it engages subconscious mechanisms of information perception.

● Illustration - this is infographics, and unlike communication, the greatest emphasis is placed on the accessibility of the presentation, as anyone should be able to read it.

image003.png


Dependence of complexity, completeness and context on the format of data presentation


Further on in this article we look at the communicative use of visualisations. Whether you are justifying your position or trying to find out what employees are doing in a department, there is a widget or a full-fledged dashboard for everything.


How does the question-and-answer format interact in a visual format?


Information transmission channel


Visualisation, like text, is a way to convey a certain idea from the one who created it to the one who uses it. We can say that any graphic is a kind of signal (which the user has to consider), packaged in the most varied and rich form - graphic.


image005.png

The source of the signal is the author/developer of the visualisation.


Signal medium - a variety of graphical images, including colours, shapes, directions, locations and so on.


The receiver of the visualisation is the user, who can be a colleague of the author, his boss, a completely uninitiated person or even himself.


For example, you are introducing a new work schedule for your employees, whose daily tasks are to answer users' questions. You're wondering - how exactly has your innovation affected productivity? In that case, the easiest solution is to build a graph of closing requests with questions by time. From it, you can immediately see where this metric has changed. And if there is no change, the result will prompt you to think about what else could be improved.


You could present the same information as dry numbers in a table or describe it in words, but:

- A table with data plotted over several months or years is hard to read;

- The phrase or even the paragraph ‘things got better/worse/same’ is not supported by real data.


What does visualisation provide and who uses it


Every process should have a purpose and meaning, and visualisation is no exception.


● Questions

The most common scenario is to get an answer to a question. Whether it's a desire to demonstrate the results of your work or to extract the main idea from a text quickly, without reading hundreds of pages of text. What was your favourite actor's screen time in the film? How good was the decision to switch to a new cloud provider? The idea is to present a fact-supported mini-annotation once through the data work and provide a clear answer on the basis of which the recipient can choose a strategy for their future behaviour.


● Training

It is not uncommon to see on shop shelves, in addition to the usual textbooks and other materials, cheat sheets or full-fledged posters for a particular discipline, which systematise and organise learning material. Also, when it comes to taking notes, people most often try to keep their notes according to one or another scheme (sometimes it comes to studycore - a full-fledged culture of taking lecture notes) in order to better understand the information in the process, and later in the preparation to find the answer to their question as quickly as possible.


● Presentations

When pitching, teaching, or speaking in front of an audience, presentations come into play. Even in this material, most of the images are ready-made slides to show our thoughts. The specificity of this format is that half of the information, if not more, is spoken in words by the speaker, leaving so-called ‘reference points’ on the picture for his memory. Visually, it is very similar to a drop-down list; on the picture are the headings, and in a person's head are paragraphs of text for each item.


Who needs visualisation?


In the general mass of people, you can try to distinguish those to whom this approach will actually be relevant. After all, there are those who by virtue of their preferences and experience do not perceive the format ‘with pictures’ in any way.


We decided to pay attention to the very layer of people who need visualisation directly in their work.


Corporate recipients


Different categories of company employees perceive information differently. In an IS-company, security analysts and response centre operators are more interested in technical peculiarities, details of patterns of data changes; they are focused on extracting information from data about the current situation in the systems within their area of responsibility. Managers, on the other hand, are more interested in a generalised range of information; as their responsibility increases, their focus on the economic performance of their subordinates grows stronger, and they use visualisation to draw conclusions about the company's future strategy. Because of the increased viewpoint they also need easy presentation of the material, so here too visualisation with its intuitive comprehensibility fits perfectly.


Let's assume that employees can be divided into three categories: operational, tactical and strategic. In the context of information security, their tasks include:


● The operational ones - let's call them implementers - have incident management, improving incident detection and response. These are engineers and analysts who are constantly producing some amount of data, working directly with the entities themselves that need to be translated into visuals.

● Tactical - teamleaders and line managers - assessing the effectiveness of accountable resources, approving activities, managing operational staff and making development decisions.

● Strategic - evaluating the effectiveness of investments in safety or anything else that operational staff work with. This category is most often referred to by the single word ‘business’ by those in production.


image007.png

In fact, this categorisation is relevant not only in terms of information security. What is important is the approach itself, which can be extended to all areas of activity, from medicine to gaming.


There are several scenarios of communication with the help of visualisation between such employees:


image009.png

When designing a particular report, graph or picture, the direction of the information and the person who will work with it should be taken into account. The higher the level of the person in the hierarchy we have introduced, the easier and faster the result should be read and vice versa. Let's talk about this in more detail.


Peculiarities of perception


A bit about the laws of visual attention/perception

image011.png


In the palette of available charts, possibilities of customisation together with your own representation of the picture, you are tempted to make the brightest and most beautiful chart. In an attempt to achieve the image that originally appeared in your head, you can also go into very unusual and exotic forms, demonstrating information emphasis in your own way.


In the end, it may turn out that the visual logic of the graph is so complex that it requires separate explanations. In order to avoid such inconveniences, it is possible to follow certain rules, according to which our subconscious mind perceives visual stimuli. This type of human attention is called subsensory, or subliminal.


There is nothing complicated about these rules. For example, for people who are used to reading in Western languages, it is characteristic to perceive structured information from left to right, and then from top to bottom. What should be taken into account when arranging the elements of your ‘graphic history’ in this order.


● Growth of any indicators is intuitively expected from bottom to top.

● When displaying the time dependence on the chart, the time marks should increase from left to right. In other words, future on the right, past on the left.

● To indicate similar and different entities, their mutual location in some understandable coordinate system is best.

● The size of individual graphical primitives (circles, squares, etc.) work very well for emphasising important entities from the general mass. The larger, the more important.

● It is important not to forget about colour. Humans tend to pay attention to dark coloured objects first and pale/light coloured objects last. It also helps to emphasise accents.


Colours themselves also have a certain psychological impact. Red is bad, green is good, yellow can act as a warning colour. This type of indication is good for conveying the meaning of an accent.


Colour intensity can also be an indicator of the significance of an accent, but compared to all of the above, the difference in shades is the worst for humans to process, so you should not rely on it too much.


It is also important to realise that the above visual indicators can reinforce each other's effects by displaying the same parameter. For example, if on a bar graph showing the number of incidents on different devices, some bars are not only higher but also clearer, and some are not only lower but also more transparent (although, of course, not completely transparent), it will help to orientate in their large number (as there may be many devices).


However, just as the format of data presentation is important, the presentation of the finished graphs and ‘pies’ itself is also important. The result can be customised in different ways to suit the individual.


Personal characteristics


People perceive visual information in different ways. Some are mainly visual, and are more inclined to visual representation. There are those for whom sound perception is preferred, for whom it is more effective to explain information by voice - audials. There is a type in which perception occurs through logical comprehension, with the help of figures, signs, logical arguments - in a word, not illustrated text.


image013.png


Reasons for adapting the visual part


Some people have physical limitations in the perception of information - colours and sizes of graphic objects, text. To make graphics readable for the widest possible audience, you should avoid using combinations of red and green, accompany colour fills with texture patterns (parallel slanting lines, dots, etc.), increase the contrast of figures in the image if possible.


image015.png

Previous picture, but adjusted to the peculiarities of perception


Personal experience associated with certain colours, symbols or figures can also significantly affect the interpretation and perception of data. For example, a certain colour can cause negative or positive associations, which in turn affects the perception of graphic objects. For example, a person may subconsciously dislike the colour blue because as a child, all textbooks for the most disliked subjects at school were blue.


It is important to consider that perception also changes with age. As life progresses, the general condition of the body increasingly affects the ability to perceive large amounts of information and complex concepts, making simpler and clearer visualisations preferable.


In addition, job title and professional background also influence thinking style. For example, executives managing large numbers of employees often prefer simplified and visual representations of data in order to quickly assimilate key information. At the same time, data analysts may prefer more detailed and complex visualisations.


These differences in perception highlight the need for flexibility in data visualisation approaches. When creating visual representations, the diversity of audiences and their unique needs and preferences should be taken into account. This approach enables better interaction and understanding of information, increasing its value to different user groups.


The magic of transformation


When transitioning from text to image, the key is not to lose the core meaning by chasing beauty. Here we need a balance between the amount of information we put in the picture and what we leave to accompany it.


For example, if we designed the whole article in the format of ‘presentation without a narrator’, the footnotes, clarifications and other definitions would already be a third of the way through the picture. On the other hand, if we took all the images from here and left no context, no one would understand what we meant but ourselves (but that is not certain).


The task of the speaker is most often to produce a result in which the person to whom the information is being presented could at the same time:

- Understand everything

- Do it quickly


Balance between completeness and accessibility of information


image017.png


Textual form - maximum completeness and minimum accessibility (i.e. very high user attention span).


Visual - reduced completeness and increased accessibility (i.e. reduced user attention cost).


What is not worth visualising?


When it comes to technical literature and training, the opposite question arises: is it worth converting this into a graphical form? Sometimes the meaning of the message is lost if, for example, complex formulas are redrawn into a ‘mush’ of triangles and circles.


For some people, a picture instead of text is pointless and will only take time to understand the image, either out of habit or lack of context.


Here are more anti-categories for visualisation:


1. Complex concepts. Over-simplification or information noise leads to inaccurate conveyance of meaning. This is generally what we talked about in The Magic of Transformation a bit earlier.

2. Too much detail. Cluttering charts with a bunch of data leads to complexity of understanding, which is the opposite of our original goal. For example, this numbered list is better left that way, without translating it into a picture.

3. Narrowly specialised text, for example, interpretation of laws in jurisprudence. Although they can be translated into an algorithm understandable to the average person, there is a great risk of twisting the information, which is fraught with consequences.

4. very long and lengthy instructions. Even though IKEA was able to explain to us in comic book format how to assemble a cabinet, some actions (working with a database, writing code, starting a nuclear reactor) may still require a full text explanation.

5. Sensitive or confidential data. This information should not be converted into anything at all without obfuscation or anonymisation. Even if you really want to put the statistics of your employees' insecure passwords out into the world, never put it in a graph for public view.


The effect of creation time on visualisation


image019.png


The longer it takes us to draw a widget, the more good ideas visit us in the process. We optimise certain elements of the picture, reformat the legend and measurement scales - all to make it easier for the person looking at it to understand the issue.


The progress of the widget over time can be decomposed into different branches of evolution, eventually the author of the graphic may realise himself as the author of an infographic (divine pun intended) and a full-fledged analytics that grew out of a simple table.


What we get as a result


Ready-made visualisation formats from a set of forms


There are quite a few implementations of visual data presentation. For each sphere of activity, task or person there is its own world of charts, buttons and pictures. Here are the most famous of them:


image021.png


Output


It's amazing how such a seemingly odd move - simplifying presentation - is both dependent on many factors and affects the effectiveness of communicating key information to others. How one simple graphic can replace a full meeting, and a serious issue can be resolved after showing coloured circles with signatures.


This topic is much broader than just pictures - it's important to know how our brains work and what our capabilities and tools are.


In this article we touched on the basic principles and prerequisites of working with visuals for a large number of formats. We left a lot of things out - like palette selection, complex data structures, and more. In order to cover them in more detail, we will have to take up a full series of articles. Stay tuned!


Recommended

Practical protection of personal data. How should a company handle and protect personal data? Part 2
Practical protection of personal data. How should a company handle and protect personal data? Part 2
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #3 ‘Align your SOC structure to your company's needs’. Part 2
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #3 ‘Align your SOC structure to your company's needs’. Part 2
Threat analysis and cyber intelligence: what problems the updated Security Vision TIP solves
Threat analysis and cyber intelligence: what problems the updated Security Vision TIP solves
Network forensics using ZUI
Network forensics using ZUI
A summary of NIST's special publications on information security. Part 2
A summary of NIST's special publications on information security. Part 2
New generation of reports
New generation of reports
More alive than ever: business continuity
More alive than ever: business continuity
Benefits of Pentest for the post-incident patient
Benefits of Pentest for the post-incident patient
The IT/IS interface: defence tools
The IT/IS interface: defence tools
New features of the Security Vision Risk Management (RM) product
New features of the Security Vision Risk Management (RM) product
Biometric personal data, changes in regulation of its processing and market impact
Biometric personal data, changes in regulation of its processing and market impact
Extension of protection in NGFW and UTM
Extension of protection in NGFW and UTM

Recommended

Practical protection of personal data. How should a company handle and protect personal data? Part 2
Practical protection of personal data. How should a company handle and protect personal data? Part 2
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #3 ‘Align your SOC structure to your company's needs’. Part 2
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #3 ‘Align your SOC structure to your company's needs’. Part 2
Threat analysis and cyber intelligence: what problems the updated Security Vision TIP solves
Threat analysis and cyber intelligence: what problems the updated Security Vision TIP solves
Network forensics using ZUI
Network forensics using ZUI
A summary of NIST's special publications on information security. Part 2
A summary of NIST's special publications on information security. Part 2
New generation of reports
New generation of reports
More alive than ever: business continuity
More alive than ever: business continuity
Benefits of Pentest for the post-incident patient
Benefits of Pentest for the post-incident patient
The IT/IS interface: defence tools
The IT/IS interface: defence tools
New features of the Security Vision Risk Management (RM) product
New features of the Security Vision Risk Management (RM) product
Biometric personal data, changes in regulation of its processing and market impact
Biometric personal data, changes in regulation of its processing and market impact
Extension of protection in NGFW and UTM
Extension of protection in NGFW and UTM

Other articles

How the data leakage protection system understands what to protect
How the data leakage protection system understands what to protect
Review of NIST Publication SP 800-61 "Computer Security Incident Handling Guide". Part 2
Review of NIST Publication SP 800-61 "Computer Security Incident Handling Guide". Part 2
What social engineering is and how to protect yourself from it
What social engineering is and how to protect yourself from it
Principles of information security
Principles of information security
Review of NIST publication SP 1800-5, ‘IT Asset Management’
Review of NIST publication SP 1800-5, ‘IT Asset Management’
IPS / IDS systems. Intrusion detection and prevention
IPS / IDS systems. Intrusion detection and prevention
Security Vision Compliance Management capabilities
Security Vision Compliance Management capabilities
Security Vision's ‘Chips’: working together
Security Vision's ‘Chips’: working together
Review of the publication NIST SP 800-210 "General Access Control Guidance for Cloud Systems"
Review of the publication NIST SP 800-210 "General Access Control Guidance for Cloud Systems"

Other articles

How the data leakage protection system understands what to protect
How the data leakage protection system understands what to protect
Review of NIST Publication SP 800-61 "Computer Security Incident Handling Guide". Part 2
Review of NIST Publication SP 800-61 "Computer Security Incident Handling Guide". Part 2
What social engineering is and how to protect yourself from it
What social engineering is and how to protect yourself from it
Principles of information security
Principles of information security
Review of NIST publication SP 1800-5, ‘IT Asset Management’
Review of NIST publication SP 1800-5, ‘IT Asset Management’
IPS / IDS systems. Intrusion detection and prevention
IPS / IDS systems. Intrusion detection and prevention
Security Vision Compliance Management capabilities
Security Vision Compliance Management capabilities
Security Vision's ‘Chips’: working together
Security Vision's ‘Chips’: working together
Review of the publication NIST SP 800-210 "General Access Control Guidance for Cloud Systems"
Review of the publication NIST SP 800-210 "General Access Control Guidance for Cloud Systems"