Lessons learned while supporting Cyber Situational Awareness

The increasing number of cyberattacks against critical infrastructures has pushed researchers to develop many Visual Analytics solutions to provide valid defensive approaches and improve the situational awareness of the security operators. Applying such solutions to complex infrastructures is often challenging, and existing tools can present limitations and exhibit various issues. In this paper, supported by cybersecurity experts of a world leader company in the military domain, we apply an existing Visual Analytics solution, MAD, to a complex network of a critical infrastructure, highlighting its limitations in this scenario and proposing further solutions to improve the cyber situational awareness in both proactive and reactive risk analyses. The results of this research contribute to characterize the activities performed by domain experts in this domain and their implications for the design of Visual Analytics solutions that aim at supporting them