1. Security administrators The experts need better tools too!

2. Agenda Projects? Projects? –Final conflicts? –Report and presentations Security admins Security admins General wrap-up General wrap-up

3. Report and presentation Intro and motivation Intro and motivation Describe the study - tasks, surveys, how many users, etc. Describe the study - tasks, surveys, how many users, etc. Describe the results – tables of data, issues observed, etc. Describe the results – tables of data, issues observed, etc. Describe the implications – what do the results mean? What would someone do with these results? Describe the implications – what do the results mean? What would someone do with these results? Future work – how would you modify study based on your pilot? What future studies does this suggest? Future work – how would you modify study based on your pilot? What future studies does this suggest?

4. Security Administrator Knowledge Growing more and more difficult Growing more and more difficult Decade ago: Decade ago: –possible for intimate knowledge of smaller computer systems, fewer applications and infrastructures to support –An intruder also likely needed intimate knowledge, less malicious code out there Now: Now: –large operating systems, 10s of thousands of files, large infrastructures –Widely distributed attack tools, very interconnected networks, infection occurs everywhere all the time Slides adapted from Matthew DeSantis, CMU

5. (Some) tools of the trade Intrusion Detection Systems (IDS) Intrusion Detection Systems (IDS) –Monitor network traffic and alert to suspicious patterns Scanning tools Scanning tools –Look for known vulnerabilities in networks and machines File/host integrity tools File/host integrity tools –Virus detection –Filesystem monitoring Home made scripts Home made scripts –Filter and process log files, run services, etc. Information sources Information sources –Descriptions of attacks, source code, etc.

6. Admin challenges Problems complex, still require human judgement to determine and solve Problems complex, still require human judgement to determine and solve Information overload Information overload –Large numbers of alerts and emails –Large log files –Many tools to help with different tasks Usability still not an aspect of these tools Usability still not an aspect of these tools –Command lines rule –No standards for tool output, difficult to synthesize

7. Solutions? Identify work practices and needs of these users Identify work practices and needs of these users –What is the implications of having security experts as users? –What usability properties do tools need to have? Visualization Visualization –Help users identify patterns in high volume data –Synthesize data from multiple sources to provide higher level views –Challenge: another thing to attack

8. Example - NVisionIP http://security.ncsa.uiuc.edu/distribution/NVisionIPDownLoad.html Visualize traffic flows to/from every machine on a large computer network Visualize traffic flows to/from every machine on a large computer network

9. Rumint Visualize network packets Visualize network packets http://www.rumint.org/

10. Rainstorm IDS Visualize IDS alarm events over an entire network space Visualize IDS alarm events over an entire network space

11. Wormhole detection Weichao Wang and Aidong Lu, UNCC Weichao Wang and Aidong Lu, UNCC

12. What else? Advantages, disadvantages of visualizations? Advantages, disadvantages of visualizations? Why don’t sysadmins use more of these visualization tools? Why don’t sysadmins use more of these visualization tools? What else could potentially make security administrator’s jobs easier? What else could potentially make security administrator’s jobs easier? What do end user’s need to know about security administrators? What do end user’s need to know about security administrators?

13. Course wrap-up Big lessons: Big lessons: –HCI can play a role in security and privacy solutions –Security and privacy are secondary tasks –Usability is not necessarily contrary to security –As with anything, tradeoffs in approaches –Good user-centered design can improve today’s tools

14. So what have you learned? What are the biggest lessons you take away from this course? What are the biggest lessons you take away from this course? How will you incorporate what you have learned into your job or life? How will you incorporate what you have learned into your job or life? What are important new themes to study in this area? What are important new themes to study in this area? –What needs additional focus? –anything we didn’t cover you think is really important?

15. Next week Give me 24 hours to give you feedback on a project draft Give me 24 hours to give you feedback on a project draft Presentations: 6:30pm in CHHS 285 Presentations: 6:30pm in CHHS 285