Dealing with complex information regarding cyber security risks is increasingly important as attacks rise in frequency. Visualisation techniques are used to support decision-making and insight. However, the use of visualisations across different stakeholders and cyber security risk data is not well explored. This work presents an exploratory study in which participants use sketching to represent cyber-risk data. We critically discuss the method and our results demonstrate the usefulness of the method to identify new, diverse visualisation approaches, as well as the richness of stakeholder visualisation conceptualisation.
Embedded devices are pivotal in many aspects to our everyday life, acting as key elements within our critical infrastructures, e-health sector, and the IoT ecosystem. These devices ship with custom software, dubbed firmware, whose development may not have followed strict security-by-design guidelines and for which no detailed documentation may be available. Given their critical role, testing their software before deploying them is crucial. Software fuzzing is a popular software testing technique that has shown to be quite effective in the last decade. However, the firmware may contain thousands of subcomponents with unexpected interplays. Moreover, operators may have a tight time budget to perform a security evaluation, requiring focused fuzzing on the most critical subcomponents. Also, considering the lack of accurate documentation for a device, it is quite hard for a security operator to understand what to fuzz and how to fuzz a specific device firmware. In this paper, we present Fuzzplanner, a visual analytics solution that enables security operators during the design of a fuzzing campaign over a device firmware. Fuzzplanner helps the operator identify the best candidates for fuzzing using several innovative visual aids. Our contributions include introducing Fuzzplanner, exploring diverse analytical tools to pinpoint critical binaries, and showing its efficacy with two real-world firmware image scenarios.
We describe supporting near real-time situational awareness of the electric distribution system by visualizing novel data from voltage sensors deployed on existing broadband cable television network equipment. Our scalable web-based visual analytics platform supports interactive geospatial exploration, time-series analysis, and summarization of grid behavior during potentially anomalous events. The broadband cable television sensor network provides observability of the electrical distribution system at a higher local spatial resolution than is typically available to most utilities, revealing the operational state of the network and aiding in the detection of ab-normal behaviors or deviations from expected patterns, particularly across electric utility service areas. We outline the design and development of interactive geospatial and time-series visualization components and the scalable data services that supply metadata, historical, and real-time streams of sensor data across the network. We present our platform during periods of extreme weather, demon-strating its ability to assist in detecting patterns of operation that affect power availability, quality, resiliency, and service restoration.
Passwords remain the most widely used form of user authentication, despite advancements in other methods. However, their limitations, such as susceptibility to attacks, especially weak passwords defined by human users, are well-documented. The existence of weak human-defined passwords has led to repeated password leaks from websites, many of which are of large scale. While such password leaks are unfortunate security incidents, they provide security researchers and practitioners with good opportunities to learn valuable insights from such leaked passwords, in order to identify ways to improve password policies and other security controls on passwords. Researchers have proposed different data visualisation techniques to help analyse leaked passwords. However, many approaches rely solely on frequency analysis, with limited exploration of distance-based graphs. This paper reports PassViz, a novel method that combines the edit distance with the t-SNE (t-distributed stochastic neighbour embedding) dimensionality reduction algorithm [19] for visualising and analysing leaked passwords in a 2-D space. We implemented PassViz as an easy-to-use command-line tool for visualising large-scale password databases, and also as a graphical user interface (GUI) to support interactive visual analytics of small password databases. Using the “000webhost” leaked database as an example, we show how PassViz can be used to visually analyse different aspects of leaked passwords and to facilitate the discovery of previously unknown password patterns. Overall, our approach empowers researchers and practitioners to gain valuable insights and improve password security through effective data visualisation and analysis.
The complexity of distributed manufacturing and software development coupled with the increasing prevalence of cyber and supply chain attacks necessitates a greater understanding of the hardware and software components that comprise equipment in critical infrastructure. When a vulnerability in a single software library can have disastrous consequences, being able to identify where that library may exist in equipment or software becomes a prerequisite for protecting the overall infrastructure. This need has sparked a large effort around the development and incorporation of bill-of-materials (BOM) into security, asset management, and procurement practices to aid in mitigating, and responding to future attacks. While much of the current research is devoted to creating BOMs, it is equally important to develop methods for comparing them to answer questions, such as: How has my software changed? Are two pieces of equipment equivalent? Does this piece of equipment that just arrived match my historical information? In this work, we demonstrate how BOMs can be represented by graph structures. We then describe how these structures can be fed into a graph comparison algorithm to produce a novel interactive visualization that allows us to not only identify differences in BOMs but show exactly where they are in the product.
