Data visualization short v1.1

Data Visualization and the
Security Professional
A study of data visualization knowledge
and practices
By Adam Winkler
January 26, 2012

© Copyright 2011 EMC Corporation. All rights reserved. 1

Survey Objective
• To poll general data visualization knowledge of security
professionals within the network security industry
• To understand which visualization types security
professionals find most and least familiar, interpretable
and useful
• To use these findings as we evaluate third party data
visualization packages for our Security Management
suite of products and as we consider development and
adoption of new data visualization techniques


Participants
• Total participants: 65 (51 Security Professionals)
(Participants were allowed to check off multiple roles)
ROLE COUNT PERCENT
Security Analyst 23 35%
Security Engineer 17 26%
Security Architect 13 20%
Network Analyst 4 7%
SOC Manager 1 1%
DBA/Device owner 1 1%
Product Administrator 4 6%
Other (Security Related) 11 17%
Non-Security (gen public) 14 21%


Experience as a Security Professional
Yrs at current position
50.00%

45.00%

40.00%

35.00%

30.00%

25.00%
Yrs at current position
20.00%

15.00%

10.00%

5.00%

0.00%
< 1 year 1-3 years > 3 years
< 11year
< year 1-3 years > 3 years


Industry
30.00%

25.00%

20.00%

15.00%
Percent (Security)
Percent (Public)

10.00%

5.00%

0.00%
Government Financial Health Care High Tech Educational Manufacturing Retail Other (please
specify)


Company Size
Percent

> 10,000 employees

2001-10,000 employees

Percent

500-2000 employees

<500 employees

0.00% 5.00% 10.00% 15.00% 20.00% 25.00% 30.00% 35.00% 40.00% 45.00%


When interacting with data during your daily
activities, what is most important to you?
80% of security professionals prefer to view summary information
first, then drill into the details
Lots of detail. Show me all the information right
away and let me filter it down

Summary information. Show me high level
information right away, then let me get to the Public (Percent)
details Security (Percent)

Other

0 20 40 60 80 100

Comments
“Let me insert the information I need, then let me get details what did you find (logs, video, files, users and etc)...”
“Show me *selected* information, then let me get to the details”
“ Post processed visualization of data using filters that artificially exaggerate or minimize based on anomalous patterns”


How do you prefer data to be presented?
75% of security professionals prefer to see a combination of charts
and graphs in their data display

I prefer a combination of tables, charts and
I prefer a combination of tables, charts and graphs
graphs

I preferprefer charts graphs over tables
I charts and and graphs over tables
Security (Percent)

I prefer tablestables charts and graphs
I prefer over over charts and graphs Public (Percent)

Other
Other
0% 10% 20% 30% 40% 50% 60% 70% 80%

Comments
“I like any visualization that filters large volumes of unimportant information and makes interesting anomalies
or patterns obvious “


Visualizations used in this survey
• Pie chart • Parallel coordinates
• Bar chart • Link graph
• Stacked bar chart • Radar chart
• Histogram • Sparkline
• Line chart • Network map
• Area chart • Tree map
• Scatter plot • Heat map
• Bubble chart • Geo map
Note: See Appendix for visualization illustrations and survey data


80% +
60%-79%
Our Findings (Security Profs only) < 60%
Viz Type Familiarity (%) Interpretation (%) Usefulness (%)
Pie chart 100 96 85
Bar chart 100 92 94
Stacked bar 96 90 82
Histogram 96 92 87
Line chart 100 96 98
Area chart 98 92 75
Scatter plot 81 72 79
Bubble chart 73 80 65
Parallel coordinate 51 72 64
Link graph 83 94 91
Radar chart 81 76 53
Sparkline 62 88 72
Network map 83 86 83
Tree map 51 56 60
Heat map 68 77 80
Geo map 98 93 84


Visualization type by Rank
Rank Familiarity Rank Interpretation Rank Usefulness
1 Pie chart 1 Pie chart 1 Line chart
1 Bar chart 1 Line chart 2 Bar chart
1 Line chart 3 Link graph 3 Link graph
4 Geo Map 4 Geo map 4 Histogram
4 Area Map 5 Bar chart 5 Pie chart
6 Stacked Bar 5 Histogram 6 Geo map
6 Histogram 5 Area map 7 Network map
8 Link Graph 8 Stacked bar 8 Stacked bar
8 Network Map 9 Sparkline 9 Heat map
10 Scatter plot 10 Network map 10 Scatter plot
10 Radar chart 11 Bubble chart 11 Area chart
12 Bubble chart 12 Heat map 12 Sparkline
13 Heat map 13 Radar chart 13 Bubble chart
14 Sparkline 13 Scatter plot 14 Parallel Coord’s
15 Parallel Coord’s 15 Parallel Coord’s 15 Tree map
15 Tree map 16 Tree map 16 Radar chart


Summary
Among security professionals familiar with these visualizations:
• Pie charts, bar charts, line charts are most familiar types of
visualizations
• Parallel coordinates, tree maps and sparklines are the least familiar
types of visualizations
• Line charts are most useful, followed by bar charts, link graphs and
histograms
• Bubble charts, parallel coordinates, tree maps and radar charts are least
useful
• Radar charts are the most over-rated, followed by area charts, and pie
charts*
• Parallel coordinates are the most under-rated, followed by heat maps
and link graph*
* Based upon disparity between familiarity and usefulness


Appendix


Visualizations: Pie Chart (1 of 2)
How familiar are you with a pie chart? How useful is a pie chart?
I've never seen or used it
I’ve never seen or used it before
before

I’ve seen it but I don’t use it Not useful

I use/have used it on occasion in my
day to day operations Somewhat useful

I use/have used it all the time in my day
to day operations Very useful

0% 10% 20% 30% 40% 50% 60% 0% 10% 20% 30% 40% 50% 60%

How comfortable are you interpreting a pie
chart? seen or used it before
I've never

Not comfortable. I don’t understand
the data.

Somewhat comfortable. I need to
spend some time understanding …

Very comfortable. I easily
understand the data.

0% 50% 100%


Visualizations: Pie Chart (2 of 2)
For what purposes do you currently use a pie
chart?
Other (please specify)
I don't use it
Real-time event monitoring
Network monitoring
Incident investigation
Security (%)
Incoming alerts
Device monitoring
Daily/weekly reports that I…

0% 10% 20% 30% 40%

“Likes” “Dislikes”
• I can share this with my team for better understanding • Less details then other charts
• Good for a general overview • I prefer count or sum to percents (usually used in pie
• Display relative proportions of multiple classes of data charts)
• Visually simpler than other types of graphs • Rapid overall view
• Easy to present high level overview of data providing • Not enough detailed
there are not too many areas • The more data points you have, the less effective a pie
chart is
• Little context usually, too high level, inability to drill into
more meaningful information


Visualizations: Bar Chart (1 of 2)
How familiar are you with a bar chart? How useful is a bar chart?
I've never seen or used it
before
I’ve seen it but I don’t use it
Not useful
day to day operations
Somewhat useful
I use/have used it all the time in my

Very useful
0% 10% 20% 30% 40% 50% 60% 70% 80%

How comfortable are you interpreting a bar 0% 20% 40% 60% 80%

chart? seen or used it before
I've never

Not comfortable. I don’t understand the
data.

Somewhat comfortable. I need to spend
some time understanding the data.

Very comfortable. I easily understand
the data.

0% 10%20%30%40%50%60%70%80%90%


Visualizations: Bar Chart (2 of 2)
For what purposes do you currently use a bar
chart? Security (%)
I don't use it
Network monitoring
Incoming alerts Security (%)
Device monitoring

0% 10% 20% 30% 40% 50% 60%

• Good for high-level data overview • Not usable for huge amounts of data
• Can quickly identify where problems lie • If one value is much bigger then the others the chart
• it gives the details so easy .. becomes uninformative
• Can display more info than pie chart while still being • . They only show data 'as a total', you can't know the
clear behavior of such data like an histogram.
• Once there are two things being shown per bar with
different colors, it starts to get confusing though


Visualizations: Stacked Bar Chart
How familiar are you with a stacked bar How useful is a x?
chart?
I’ve never seen or used it before I've never seen or used it
before

I’ve seen it but I don’t use it Not useful

I use/have used it on occasion in
my day to day operations Somewhat useful

Very useful

0% 10% 20% 30% 40% 50% 0% 10% 20% 30% 40% 50% 60%

How comfortable are you interpreting a stacked bar
chart?
I've never seen or used it before
the data.
spend some time understanding the…
Very comfortable. I easily understand
the data.

0% 10% 20% 30% 40% 50% 60% 70%


Visualizations: Stacked Bar Chart
For what purposes do you currently use a stacked bar
chart?
Security (%)
I don't use it
Network monitoring
Device monitoring

0% 10% 20% 30% 40% 50%

• The stacked bar chart is the lowest level of useful
visualization in any security context
• I don't love these.
• They can be confusing for those unfamiliar with their
use. They also make comparing some mid-column
values difficult.
• Only values next to axis can be compared easily


Visualizations: Histogram (1 of 2)
How familiar are you with a histogram? How useful is a histogram?


Not useful
my day to day operations
Somewhat useful
Very useful
0% 10% 20% 30% 40% 50%

0% 20% 40% 60% 80%
How comfortable are you interpreting a
histogram?

the data.
spend some time understanding…

0% 10%20%30%40%50%60%70%80%


Visualizations: Histogram(2 of 2)
For what purposes do you currently use a x?
Security (%)
I don't use it
Network monitoring
Device monitoring

0% 10% 20% 30% 40% 50%

• Useful to see the picture for a period of time • Does not allow comparisons very easily
• Useful for showing trends when dealing with a large • Useful for one variable only
amount of data
• It's very useful in determining what data has reached a
peak in a given time
• best diagram ever, all the information available in one
graph.


Visualizations: Line Chart (1 of 2)
How familiar are you with a line chart? How useful is a line chart?

before

Not useful
Somewhat useful
I use/have used it all the time in
Very useful
0% 20% 40% 60% 80% 100%

How comfortable are you interpreting a line 0% 20% 40% 60% 80% 100%

chart?

Not comfortable. I don’t

0% 20% 40% 60% 80% 100%


Visualizations: Line Chart (2 of 2)
For what purposes do you currently use a line
chart?
Security (%)
I don't use it
Network monitoring
Device monitoring

0% 10% 20% 30% 40% 50%

• Useful to see the picture for a period of time • If there are too many lines, you have to keep looking
• Ideal to show trends at the key
• I use them when projecting future data • Limited number of variables.
• It's similar to the histogram. Very useful.


Visualizations: Area Chart (1 of 2)
How familiar are you with an area How useful is an area chart?
chart?
before
Not useful
Somewhat useful
Very useful
0% 10% 20% 30% 40% 50% 60%

How comfortable are you interpreting an area 0% 10% 20% 30% 40% 50% 60%

chart?

the data.

0% 20% 40% 60% 80%


Visualizations: Area Chart (2 of 2)
For what purposes do you currently use an area
chart?
Security (%)
I don't use it
Network monitoring
Device monitoring

0% 10% 20% 30% 40% 50% 60%

• Creates easy reference of relational change over time • Not as useful as the line char
• Better than stacked bar for seeing trends in each • Very limited usage
variable • Often confusing and more difficult to interpret
• They are often ambiguous to read and not well labeled
• Meh...


Visualizations: Scatter Plot (1 of 2)
How familiar are you with a scatter How useful is a scatter plot?
plot?
before
Not useful
Somewhat useful
Very useful
0% 10% 20% 30% 40% 50% 60%

0% 20% 40% 60% 80% 100%
How comfortable are you interpreting a scatter
plot?

the data.

0% 10% 20% 30% 40% 50% 60% 70%


Visualizations: Scatter Plot (2 of 2)
For what purposes do you currently use a scatter
plot?
Security (%) “Finally we get into truly useful
Other (please specify) visualization, were we can see
I don't use it patterns emerging from the data. This
Real-time event monitoring is where security visualization
Network monitoring
lies, being able to easily perceive and
Incoming alerts Security (%) explore patterns in the data.”
Device monitoring

0% 20% 40% 60% 80%

• Can see the distribution of events here • can be difficult for people to interpret
• A lot of information - mostly overview can be displayed • Results may not be clear
• Does show a lot of information, but users generally like • Very limited usage
it less. Great to show trends. • Almost always a bad idea
• Great to spot outliers • At first glance it looks confusing, maybe easier to
understand with less clusters


Visualizations: Bubble Chart (1 of 2)
How familiar are you with a bubble How useful is a bubble chart?
chart?
before
Not useful
Somewhat useful
Very useful
0% 10% 20% 30% 40% 50% 60%

How comfortable are you interpreting a bubble 0% 20% 40% 60% 80%

chart?

the data.

0% 10% 20% 30% 40% 50% 60%


Visualizations: Bubble Chart (2 of 2)
For what purposes do you currently use a bubble
chart?
Security (%)
I don't use it
Network monitoring
Device monitoring

0% 20% 40% 60% 80%

• Great for spotting outliers • Not much better than a scatter chart
• I like the very high density of information • can get cluttered
• Fantastic graph type, if done well.


Visualization: Parallel Coordinates
How familiar are you with a parallel How useful are parallel coord’s?
coord’s?

Not useful
Somewhat useful
Very useful
0% 10% 20% 30% 40% 50% 60%

How comfortable are you interpreting parallel 0% 10% 20% 30% 40% 50%

coord’s?
the data.

0% 10% 20% 30% 40% 50% 60%


Visualization: Parallel Coordinates
For what purposes do you currently use parallel coord’s?
Security (%)
“…the relationships between
I don't use it
disparate pieces of data become
Real-time event monitoring clear, new information is
Network monitoring contexted out of the data, and the
Incident investigation visualization serves an actual
Device monitoring
purpose, instead of being a
Daily/weekly reports that I… hindrance.”

0% 20% 40% 60% 80%

• Can see a high level overview on loads of different data • Can be somewhat complicated
• Useful to demonstrate ranking on different elements. • A bit more complex for users that are less familiar with
• Looks like an interesting way to display data. could be it.
good for showing access to sensitive data • Looks confusing, I would need someone to explain it
• This one seems like it would be a lot of work. Like it's
showing something complicated
• That would take some detailed explanation to grasp the
meaning


Visualizations: Link Graph (1 of 2)
How familiar are you with a link graph? How useful is a link graph?

before
Not useful
Somewhat useful
Very useful
0% 10% 20% 30% 40% 50% 60%

How comfortable are you interpreting a link 0% 20% 40% 60% 80%

graph?seen or used it before
I've never

the data.

0% 10%20%30%40%50%60%70%80%


Visualizations: Link Graph (2 of 2)
For what purposes do you currently use a link
graph?
Security (%)
Other
I don't use it
Network monitoring
Device monitoring

0% 10% 20% 30% 40% 50% 60%

• Great for workflows and network mapping • the Parallel Coordinates are much better
• good for showing relationships between entities • can get very cluttered


Visualizations: Radar Chart (1 of 2)
How familiar are you with a radar How useful is a radar chart?
chart?

Not useful
Somewhat useful
I use/have used it all the time in
Very useful
0% 10% 20% 30% 40% 50% 60%

How comfortable are you interpreting a radar 0% 10% 20% 30% 40% 50%

chart?

the data.

0% 10% 20% 30% 40% 50% 60%


Visualizations: Radar Chart (2 of 2)
For what purposes do you currently use a radar
chart?
Security (%)
Other
I don't use it
Network monitoring
Device monitoring

0% 20% 40% 60% 80% 100%

• I like these. Good for showing the weight of certain • Would need someone to explain it
aspects in comparison to each other. • limited by the number of axes that can be realistically
displayed at one. Essentially just a different way of
doing a stacked bar chart
• They are only useful for very specific data types.
• Not very intuitive


Visualizations: Spark Line (1 of 2)
How familiar are you with a spark line? How useful is a spark line?


Not useful
Somewhat useful
Very useful
0% 10% 20% 30% 40% 50%

How comfortable are you interpreting a spark 0% 10% 20% 30% 40% 50%

line?

the data.

0% 10% 20% 30% 40% 50%


Visualizations: Spark line (2 of 2)
For what purposes do you currently use a spark line?
Security (%)
I don't use it
Network monitoring
Device monitoring

0% 20% 40% 60% 80% 100%

• Trend data reduced to its simplest form • Looks like 4 bar charts to me
• Great for overviews when not much detail is required.


Visualizations: Network Map (1 of 2)
How familiar are you with a network How useful is a network map?
map?

Not useful
Somewhat useful
Very useful
0% 10% 20% 30% 40% 50%

How comfortable are you interpreting a network 0% 10% 20% 30% 40% 50% 60% 70%

map?

the data.

0% 10% 20% 30% 40% 50% 60% 70%


Visualizations: Network Map (2 of 2)
For what purposes do you currently use a network
map?
Security (%)
Other
I don't use it
Network monitoring
Device monitoring

0% 10% 20% 30% 40% 50%

• Very clear representation of network • Not used by many vendors
• Great for showing relationships between entities - much • Can become very cluttered. Lists are sometimes more
like the link graph. useful.
• Can quickly get very messy and confusing until filtered


Visualizations: Tree Map (1 of 2)
How familiar are you with a tree map? How useful is a tree map?


Not useful
Somewhat useful
Very useful
0% 10% 20% 30% 40% 50% 60%

How comfortable are you interpreting a tree 0% 10% 20% 30% 40% 50%

map?

the data.

0% 10% 20% 30% 40% 50%


Visualizations: Tree Map (2 of 2)
For what purposes do you currently use a tree map?
Security (%)
Other
I don't use it
Network monitoring
Device monitoring

0% 20% 40% 60% 80% 100%

• Easily observe hierarchical groupings as the viewer • Very limited usage
needs to perceive them, in the same visualization, is • Details not visible
where tree graphs rule • Not usable in small space
• Can show hierarchies nicely • looks confusing
• I have a hard time making sense of it. Too much info at
once.


Visualizations: Heat Map (1 of 2)
How familiar are you with a heat map? How useful is a heat map?


Not useful
Somewhat useful
Very useful
0% 10% 20% 30% 40% 50%

How comfortable are you interpreting a heat 0% 10% 20% 30% 40%

map?

the data.

0% 10% 20% 30% 40% 50%


Visualizations: Heat Map (2 of 2)
For what purposes do you currently use a heat map?
Security (%)
Other
I don't use it
Network monitoring
Device monitoring

0% 200% 400% 600% 800%

• One of the best 'at a glance' visualizations, for • Needs a lot of space
demonstrating relations between individual quantities • Would need someone to explain it
and allow perception of patterns over time • Looks too complicated.
• Simple and easy visualization


Visualizations: Geo Map(1 of 2)
How familiar are you with a geo map? How useful is a geo map?


Not useful
Somewhat useful
Very useful
0% 10% 20% 30% 40% 50%

How comfortable are you interpreting a geo 0% 20% 40% 60% 80% 100%

map?

the data.

0% 20% 40% 60% 80% 100%


Visualizations: Geo Map (2 of 2)
For what purposes do you currently use a geo?
Security (%)
Other
I don't use it
Network monitoring
Device monitoring

0% 10% 20% 30% 40% 50% 60% 70%

• A clear location of certain data can be visualized • 1) Not useful if 1 data center is used
• great for showing to non IT people - i.e. Management • Useful for large deployed systems. Less useful for
systems that are localized even if they are complex.
• There can be challenges getting enough of the useful
information into the hover-bubble


THANK YOU


Data visualization short v1.1

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (20)

Similar to Data visualization short v1.1

Similar to Data visualization short v1.1 (20)

Recently uploaded

Recently uploaded (20)

Data visualization short v1.1