Cyber-attack maps can be fun to look at, but are they useful? As usual, when it comes to security context is key, so CSO looked at eight of the web's most popular cyber-attack maps. While the maps themselves are mostly eye candy with limited context, there are some creative ways they can be used.
Entrenched security professionals view cyber-attack maps with a somewhat jaded eye. They call them "pew pew" maps, mimicking a child-like sound to represent gunfire when playing with toys. In fact, one map actually uses these sounds to an amusing effect.
Some of the professionals CSO spoke with said they'll pop one of the maps up on a screen in the SOC (Security Operations Center) if they know a client is coming in, but only because of the eye candy factor. In fact, most of the professionals said they've used them, but other than "performance art," there isn't any real value in them.
"If I found one that'd add value, we'd use it," one security executive said on Twitter.
The common misconception with cyber-attack maps is that the data is live, or real-time. It isn't. Most are just a subset of recorded attacks or a playback of sanitized packet captures.
But don't discount how useful the eye candy factor can be: one security professional said he uses them to get high schoolers interested in the security industry. The concept is smart, as the visuals and datatypes on display can create discussion points on attack types, methods and threat actors.
Some SOC operators do the same thing for clients, using the maps to visualize attack types and try to answer customer questions. Again, the value of these cyber-attack maps isn't the data they're showing, it's how they can be used as a conversation starter. This is something the vendors that produce the maps know well, as the maps themselves are sales tools.