The document discusses current trends in data visualization. It notes that data collection is important but often lacking. The cloud enables open standards and tools for visualization. However, security visualization remains an afterthought, with few examples and small individual projects, as most organizations do not collect enough security data to visualize. Standards and general purpose visualization tools are still needed to help users understand security data.

1. Visualization Trends
And Where We Are Today
Data Cloud Tools Security
12 3 4 Raffael Marty - @zrlram
SANS 2010, Washington, D.C.

2. 1
Log Maturity Model
Where are you?
Logging as a Service © by Raffael Marty

3. 1
Data
• No data - no visualization
• We don’t even have / collect the data
• It is too hard to collect data
• We don’t understand our data!
• Log management is expensive
• Big data movement enables large data crunching
• We need data interoperability standards - we will get one
Logging as a Service © by Raffael Marty

4. 2
Cloud
• A chance to build visibility / logging in
• Encourages open standards (REST, JSON, etc.)
• Helps advance Web based technologies
• Tools are available to everyone
• Advancement of Big Data tools
• Build your own
Logging as a Service © by Raffael Marty

5. 3
Tools
• We are nowhere!
• Same old - all over
- Does your SIEM support real visualization?
• Missing: Brushing, Interactivity Overview first
• Help the user understand the data!
Zoom Details on demand
• The move to the Web (HTML5)
• General purpose tools
Logging as a Service © by Raffael Marty

6. 4
Security
• We don’t have the data
• Hence, we don’t know how to visualize it
• Hence, we don’t understand anything
• We will see more bad examples
• Visualization is and will stay an afterthought
• More individual, small projects
secviz.org
Logging as a Service © by Raffael Marty

7. about.me/raffy
@zrlram
secviz.org - @secviz