Security visualisation is a very difficult problem due to its inherent need to represent complexity and to be flexible for a wide range of applications. As a result, many current approaches are not particularly effective. This paper presents several novel approaches for visualising information security threats which aim to create a flexible and effective basis for creating semantically rich threat visualisation diagrams. By presenting generalised approaches, these ideas can be applied to a wide variety of situations, as demonstrated in two specific visualisations: one for visualising attack trees, the other for visualising attack graphs. It concludes by discussing future work and introducing a novel exploration of attack models.
Security models and security economics have been separate developments for a long time. Models represent the organisation under scrutiny with possible attack paths, and security economics covers the effect and cost of attacks and counter-measures. This inhibits progress in decision support for security investment. The navigation metaphor merges these two concepts: navigation on security models can identify optimal attacker and defender decisions for multistep attacks, based on "maps" of the system being studied. Routes on the map represent attacks on the system. Economic optimisation analyses can identify the most efficient routes for gaining access to certain targets from the point of view of an attacker; this insight is used to optimise the defences on these routes from the point of view of the defender. In this article, we discuss the achievements and the challenges of the navigation metaphor in cyber security.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.
hi@scite.ai
10624 S. Eastern Ave., Ste. A-614
Henderson, NV 89052, USA
Copyright © 2024 scite LLC. All rights reserved.
Made with 💙 for researchers
Part of the Research Solutions Family.