Influence of Mental Models on the Design of Cyber Security Dashboards

Abstract

Governments make cyber security related policies to protect citizens’ interests and national infrastructures against cyber attacks. Cyber security related data can enable evidence based policymaking. Data visualisation via dashboards can help understanding of these cyber security data. Designing such dashboards, however, is not straightforward due to difficulty for potential dashboard users to correctly interpret the displayed information. In this contribution we investigate the use of mental models for correct interpretation of displayed information. Our research question is: How useful are mental models for designing cyber security dashboards? We qualitatively investigate the mental models of seven cyber security experts from a typical governmental organisation. This research shows how operators, analysts and managers have different cyber security mental models. Based on the insight gained on these mental models, we develop a cyber security dashboard to assess the impact of mental models on dashboard design. An experience evaluation shows that the realised dashboard is easy to understand and does not obstruct users. We, however, do not see any meaningful difference in how the experts perceive the dashboard, despite their different cyber security mental models. We propose some directions for future research on using mental models for cyber security dashboard design.