Dottorato in INGEGNERIA INFORMATICA

Titolo della tesi: Managing Human Factors in Cybersecurity through Visual Analytics

Information technologies are increasingly present in our personal and working lives. The wide variety of available systems ranges from the backbone infrastructures to smart home and wearable devices. These systems are constantly under attack. The attackers responsible for security breaches have evolved in both motivations and capabilities. Social engineering techniques exploiting human vulnerabilities are increasingly popular attack vectors that exploit victims' cognitive biases to grant the attacker unauthorized access to data or systems. The increasing importance of cybersecurity has contributed to the continuous refinement of defense techniques, most of them relying on a human in the loop to perform critical security functions. Applying many of these activities, defenders are prone to errors mainly due to a large amount of relevant data and the time constraints of the decision-making process, highlighting the need for powerful analysis tools to mitigate these issues. The combination of automatic analysis tools and human reasoning capabilities is required to face these problems. Visual Analytics (VA) has proven its effectiveness in this area, facilitating analytical reasoning with interactive visual interfaces. An advantage provided by VA is that decision-makers may focus their full cognitive and perceptual capabilities on the analytical process while applying advanced computational capabilities to enlarge the analysis process. The thesis aims to model the humans' role in cybersecurity, connecting them to standard and repeatable methods, and design Visual Analytics solutions to support them. We focus on modeling the threats posed by the end-users of IT systems and cybersecurity professionals' information needs. We present guidelines for Visual Analytics contributions in cybersecurity according to the operators' needs and frame our contributions according to them. Furthermore, we propose a threat model comprising vulnerabilities of the end-users.