The Art of CISA KEV: How We Turned Vulnerabilities into an Art Piece
In the fast-paced world of cybersecurity, vulnerability management is of paramount importance. As vulnerabilities continue to emerge, organizations need to stay vigilant in their efforts to protect their systems and data, and the Cybersecurity Infrastructure and Security Agency (CISA) plays a crucial role in this domain, maintaining the Known Exploited Vulnerabilities (KEV) catalog.
Because this CISA KEV catalog has played such a significant role in world of vulnerability exploitation in vulnerability management programs, our team wanted to put an artistic spin on this analytical tool by creating a unique piece of artwork that paid homage to all the valuable work and research that the CISA KEV team has provided through the CISA KEV catalog.
The Inspiration Behind the Artwork
The idea to create a piece of artwork out of CISA KEV data first came to Nucleus Security’s VP and Vulnerability Researcher, Patrick Garrity, during countless hours of researching with Ryan Cribelar, security researcher, vulnerability exploitation and a deep fascination with the CISA KEV catalog. As the KEV approaches a milestone of 1,000 vulnerabilities, Patrick saw an opportunity to create something visual out of the numbers that would not only raise awareness of its importance in cybersecurity but put a special artistic spin on an otherwise numeric data set.
Pulling inspiration from both the renowned Dutch artist Mondrian, who is known for his abstract geometric paintings. It also happens that the original inspiration for Patrick’s vulnerability data visualizations came from Ingmar Vis, a dutch security researcher who created this Sankey Matic vulnerability chart posted on LinkedIn .
Bringing Visualizations to the Data
Treemap Visualization:
To kick off the process of visualizing the CISA KEV in art, Patrick started by creating a treemap out of the CISA KEV data that would create a visualization that mimics Mondrian’s abstract style. A treemap is a visualization technique that displays hierarchical data using nested rectangles, which allowed for a visually engaging representation of the KEV catalog. Each rectangle in the treemap represents the specific number of vulnerabilities for each vendor on the CISA KEV.
The Shape of National Cybersecurity:
To add a touch of historical significance, Rilee Smith, Director of Content Marketing at Nucleus, organized the data from the treemap with more of an artistic layout, and it happened to turn out in a shape similar to the American flag, symbolizing the roots of the KEV in the U.S. Federal Government. This transformation connects the artwork to its origin and serves as a reminder of the critical role played by the CISA KEV in safeguarding national cybersecurity.
The Colors of the KEV:
To further add a layer of artistic inspiration to the visualization, we channeled Mondrian’s famous tile paintings as the color inspiration for the artwork. By subtly blending the treemap with both the colors and shape of the United States flag, with the addition of yellow squares and bold dark lines inspired by Mondrian, this clever integration not only enhances the visual appeal of the artwork but also reinforces the idea of cybersecurity as a national concern.
Paying Homage to CISA:
To further pay tribute to the agency that curates the KEV catalog, we incorporated the CISA logo into the background of the overall art piece. This not only gives due credit to the organization, but also adds depth and layers of meaning to the chart.
Naming our Art for Its Black Hat 2023 Exhibition
Once the artwork was completed, Patrick aptly named the piece “A Picture is Worth 1,000 Vulns,” signifying the profound impact that visual representations can have in conveying complex ideas and messages, and nodding to the milestone that CISA is soon to hit with a total number of KEVs added to the catalog soon hitting 1,000 in total.
In alignment with the upcoming Blackhat 2023 conference, Nucleus plans to unveil the masterpiece to a wider audience. The event will feature the distribution of stickers, shirts, and beach towels adorned with this artwork, further spreading awareness about the significance of vulnerability management and the crucial role played by the CISA KEV.
The “A Picture is Worth 1,000 Vulns” artwork created by our Nucleus team stands as a testament to the importance of vulnerability management and cybersecurity in our digital age. Through the creative amalgamation of art and technology, we were able to successfully capture the essenceof the CISA KEV catalog and its relevance in safeguarding critical infrastructure. By showcasing this masterpiece at Blackhat 2023, we aim to inspire further discussions and actions towards building a more secure future.