Security Vision
Introduction
Some of the oldest reports discovered by anthropologists belonged to the Incas and were complex rope weaves and knots made of alpaca or llama wool. Humanity has come a long way in just under five thousand years. Gadgets have rushed into our lives, and now no one will be surprised by the picture of a man studying diagrams and tables on a tablet, sitting in a chaise longue on the seashore. Let's take a look at what they are - modern digital reports, what new opportunities they open up, as well as dive into the specifics of reporting in the field of information security and consider several real situations with customers.
Advantages of ‘digital’
Electronic versions of reports appeared before printing was no longer necessary, and the first significant advantage of a digital report was the ability to preview. Data could be studied and, if necessary, tweaked before it was put on the boss's desk. But appetite, as you know, comes with the meal, and electronic media began to suggest new possibilities.
For example, do you remember from historical films the long scrolls on which heralds read out the tsar's will to the people? This kind of document was completely devoid of navigation: to find a particular place in the document, you had to run through it with your eyes, relying only on your own memory and the meaning of what was written. When people learnt to cut scrolls into equal pieces (A4 size) and number them, a table of contents and the possibility to refer to certain text fragments appeared. This is how navigation in documents was born. Electronic documents became even more convenient, because clicking on a hyperlink instantly took you to the right part of the text.
Digital reports went even further, abandoning two-dimensionality and gaining a third dimension - depth. From any pie chart, you can now, with just a couple of clicks, ‘fall through’ to the list of values, and from it - to the object card and back again. This has made the reports much more concise, highlighting the most important information in the easiest-to-understand format.
Personal experience
There are many different reports. For example, let's take the reports of the systems we know best - systems related to information protection tools such as IRP/SOAR, DLP, CMDB, VM. Let's first introduce a conventional classification of reports by purpose and belonging to one or another type of information protection equipment (IPE) and then consider each individual type of report.
Types of reports depending on the purpose and type of information protection systems:
- Per period - generated in asset management systems (CMDB) or vulnerability management systems (VM). Reflects the result of the software or team's work for a certain period.
- Monitoring - generated in DLP systems. Reflect time slices to highlight critical performance issues.
- Problem - generated in TIP or SOC class systems. Reflects an existing problem and, as a result, a request for action from decision makers. The report acts as a kind of ToR.
Reports for the period should provide answers to three questions as simply and quickly as possible: what to do, where to do it and how to do it quickly. Old-format reports, although they answer these questions, make the executor first flip through several pages, then, having waded through the maze of compound sentences, reread the task several times and only then proceed to its execution. Such verbal noise should be minimised in the new format reports, so that in the end it can be read in one approach, and a clear scheme ‘condition-action-result’ can be built in a person's mind, without the need to spend time on the independent development of such a scheme.
Reports with a monitoring function (using the example of reports provided by DLP systems) should be evidence-based and speak the language of facts. It is the evidence applications that play the main role in such reports, which are included in the report as they are, but it is also important to get the fact-based conclusions right, which is the job of the operator/analyst. In such reports, the structure of the report is already at the forefront, allowing for a logical and concise narrative of the incident.
Reports that report on a problem requiring a response are very diverse. The results can be either time slices or individual sets of information about resources (and the ‘resources’ can be both equipment and people). For example, it is necessary to prove and defend the choice of a protection system depending on the performance results or to form in business language the needs for new tools or resources based on performance indicators. In such cases, evidence alone is not enough; it must also be properly framed and presented in order to form a coherent chain of arguments for the manager reading the report that does not allow him or her to doubt the validity of the data. Usually, it is the inability of many high performers to ‘translate’ their well-founded concerns into the language of financial feasibility that becomes a problem. Based on the reports, serious decisions are made about budget levels, staff expansion, and other staffing challenges. Contractors report to the management and the customer, employees interact with each other using a universal language of reports, and the efficiency of many processes and people depends on how smoothly and qualitatively, without unnecessary ‘water’, it will be built.
Questions and solutions
Everything sounds great in theory, but real projects sometimes threw up problems and situations that would have been very difficult to foresee in advance. Of course, this raised questions, and the questions prompted solutions. Here's how it happened.
Do you really need a cover page?
In fact, that is exactly what the question to the customer sounded like. The problem was that in a large analytical report, the entire first page was taken up by information about which city, in which year and by whom the report was prepared, as well as the title of the report and the company name and logo. The second page was the table of contents, followed by the glossary, and the content of the report started on page five. People worked with the report all the time, but each time they started with the ritual flipping to page five.
We removed the company name altogether: the report was internal and people mostly remembered where they worked. The name of the report was placed in the centre of the top edge of the first page. The information about the period of the report and the author was reduced and placed in the upper left corner, and the logo was also reduced and placed in the upper right corner. The glossary and table of contents were moved to the last pages of the report. In this way, the useful information in the report started on the first page, and people found it easier and more enjoyable to work with it. This brought us to the next question.
Where do you look first?
When we asked for a demonstration of exactly how the report is handled, it turned out that the customer first looks at incident statistics, then at current assets with changes over the last year, and only then moves on to the recommendations of the information protection department and their justification. We simply rearranged the sections of the report, placing them in order of review, added cross-references and a few charts on key indicators. As a result, the ergonomics of the report improved significantly. Next, we started not just arranging and grouping information, but translating a set of concepts into the language of business - so we created an additional level of abstraction called ‘Conclusion’. The ‘Conclusion’ was different: it could be a big number, or beautiful intersecting graphs (where sometimes ‘the boa constrictor ate the elephant’), but one thing our conclusions had in common - a quick glance at an icon, word, paragraph or picture gave an unambiguous understanding of whether what we were seeing was good or bad. However, there is always room for improvement, so we asked the following question.
Surely the report should be black and white?
It turned out that monochrome reports were a relic of the past: previously, the company used laser printers without colour printing capabilities. However, over time they were replaced by MFPs, and the reports were no longer printed at all. The reports were prepared in the appropriate software, presented to the management on a projector and additionally sent to the meeting participants by mail. The customer did not understand why the report should be in colour: ‘You can see everything, all the information is there. It's not a comic book!’. Nevertheless, we added coloured bullets to each section of the report - after that it became much easier to navigate in the printed version, even without referring to the table of contents. We made the comparison charts in colour and highlighted the most important indicators. The report was perceived in a completely different way, and a week later the customer could not imagine how he had lived without it until now.
Conclusion
To summarise, the most important thing in preparing report layouts is to always take an analytical approach and start with the needs of the business. At the same time, the deeper you dive into the essence of the issue, the better the result will be. And you should always keep up with the times to use all the latest achievements of mankind, adapting the customer's work to new gadgets, technologies and current trends in design and styling.
