Security Visualization

RSS Link

by Raffael Marty

Raffael Marty most recently co-founded Loggly, a cloud-based log management company. As an entrepreneur, he is interested in enterprise and infrastructure startups, business models, and technologies. He has been a long term data analysis and visualization enthusiast and has spent a lot of time building and defining the security visualization space through open source tools, writing books, a number of papers, and speaking at conferences around the world. He is frequently consulting as an industry expert in all aspects of log analysis, computer security, and data visualization. Raffy has held various positions in the log management space at companies like Splunk, ArcSight, and IBM research where he also earned his masters in computer science. In addition to visualization, big data analysis, and computer security, Raffy is all over cloud-based business models.

Maturity Scale for IT Data Management

Posted Jan 05, 2009 - 09:28 pm

How does the IT data management -- the market that is an umbrella for log management, security information management, and security event management -- look? What are some of the implications based on the maturity scale? Why do some SIM/SEM projects fail and others don't? Are you ripe for advanced analytics and visualization?
- Like
- Tweet
- Security, corrrelation, log management
How do you encode hundreds of data points into one single graph? Use Sparklines.

Posted Nov 30, 2008 - 06:13 pm

Have you tried to visualize your traffic flows? Did you have the problem that your graphs got really cluttered? Did you find a way around that problem? Did you filter data? Did you aggregate multiple nodes into one?
- Like
- Tweet
- Security, network, sparklines
How do you visualize your traffic flow (NetFlow) logs?

Posted Nov 18, 2008 - 10:05 am

What are you doing with your traffic flow logs, such as NetFlow? How long does it normally take you to understand what exactly the log entries represent? What if you could generate a visual representation of the machines communicating on your network? Would that make your analysis work easier?
How do you prepare your security data for visualization?

Posted Nov 17, 2008 - 01:46 pm

Do you know how much traffic is transmitted on your networks? Do you know what protocols are in use and what machines are using them? Are there spyware infected machines on your network that leak information?
- 5 comments
- Like
- Tweet
- Security, netflow, parser
What is the right graph to use in what situation?

Posted Nov 06, 2008 - 09:39 pm

Do you like pie charts? Have you ever thought about replacing them with a bar chart? Or a line chart? Do you know when to use what chart?
- 2 comments
- Like
  
  1
- Tweet
- Security, charts, parallell coordinates
How do you create good visualizations?

Posted Nov 04, 2008 - 05:32 pm

I am sure you have seen graphs that were just horrible to look at. Even worse, it was almost impossible to determine what the graph was trying to communicate. One of the first things you should learn - before you even go ahead and generate a graph - are some simple visualization principles.
- Like
- Tweet
- Security, security visualization, tufte
How Do You Get Started With Security Visualization?

Posted Nov 03, 2008 - 01:27 am

Are you in charge of analyzing large amounts of security data? Have you ever wondered whether there is a better way than reading your logs line by line? Here are some starting points on how to visualize your security data.
- Like
- Tweet
- Security, analytics, applied

May is...
Storage Month

BY THE NUMBERS: Spotlight on storage
FEATURE: Can storage be sexy?
FREE DOWNLOAD: 4 things every storage admin should know
REVIEW: NAS shoot-out: 5 storage servers battle for business
BLOG: Ceph extends storage with open scalability

The enemy of SMS is my ... ?

2 comments
Facebook likes the application marketplace

1 comment
Will Facebook’s App Center finally kill off all those spammy Facebook apps?

1 comment
Where did 'cloud' come from?

1 comment
Fedora Project is naming names

1 comment

White Papers & Webcasts

Webcast On Demand

Today's NAS: A Solution Beyond Old Limits

Date: Tuesday, July 17, 2012 2:00 PM EDT Traditional NAS systems don't scale beyond fixed limits. Proliferation of NAS systems leads to management challenges. Many organizations also use traditional block-based SAN solutions for transactional systems like databases and email. Having separate block and file storage also adds to management challenges.

White Paper

Cloud Computing Owner's Manual

One of the significant benefits of cloud computing and one of its greatest drawbacks is the astonishing variety of configurations available. To name a few, there's SaaS, IaaS, and PaaS, not to mention the cloud CIOs fear most - IT as a service (ITaaS). Not bad for a technology that's been around a relatively short while, but has already upended every major product segment in the computer industry, and cut corporate IT departments loose from a 50-year tradition of responsibility for, and control over information, and the technology that manipulates it.

White Paper

Gartner: Magic Quadrant for Midrange and High-End Modular Disk Arrays

This Magic Quadrant represents vendors that sell into the end-user market with branded midrange and high-end modular disk array storage systems that support block-access protocols. Despite rather gloomy macroeconomic conditions worldwide and ongoing geopolitical unrest in the Middle East, the midrange and high-end modular disk array storage market grew 8.2% from 3Q10 through 2Q11, compared with the same period the year before. Propelled by technological innovation and enhanced scalability, this continued growth in vendor revenue supports the observation that IT executives are willing to invest in modern midrange and high-end modular disk storage systems to improve operational efficiency, to support deployments of virtualized IT infrastructures, and to address the impact of unabated terabyte growth.Intel and the Intel logo are trademarks of Intel Corporation in the U.S. and/or other countries.

White Paper

IDG Tech Dossier: Converged Storage ~ A Next Gen Virtualized Architecture

Organizations need a strategy for rearchitecting storage so that it enables, rather than constricts, the delivery of IT services. According to HP, it's all about Converged Storage, which breaks through the barriers, reducing complexity so that IT can expand storage on a "pay as you grow" basis. It involves the creation a pool of storage based on modular building blocks that can be moved and reconfigured on the fly to support a range of needs. In fact, HP's approach to Converged Storage incorporates several core capabilities - read this tech dossier to learn more.Intel and the Intel logo are trademarks of Intel Corporation in the U.S. and/or other countries.

White Paper

ESG Lab Review: HP 3PAR Peer Motion Software

This ESG Lab review documents hands-on testing of HP 3PAR Peer Motion Software's distributed volume management with a focus on federated workload balancing, asset management, and thin provisioning.Intel and the Intel logo are trademarks of Intel Corporation in the U.S. and/or other countries.

See more White Papers | Webcasts