Protection Analysis Work Stations (PAWS)

A problem associated with complex network defense systems is the constant change occurring in the system. This is due to wireless devices, upgrades in operating system and application software, and user configuration changes. These changes result in a natural evolution of the network system that leads to new vulnerabilities for attackers to exploit. Such changes may not expose the new vulnerabilities for months afterward, and then only after an attack succeeds. The best situation awareness simply does not address the evolving nature of threats; situation awareness addresses response to attacks. The Sentar Team developed a concept for the Protection Analysis Work Stations (PAWS) under a Phase I SBIR project. The PAWS concept supports off-line analysis of computer network defense (CND) systems for the purpose of recommending improvements to their implementation. The PAWS analyzes a CND system in order to improve its ability to protect both the network system and its critical applications from malicious or accidental damage. The purpose of PAWS is to complement situation awareness system by providing off-line analysis and recommending improvements to it. The opportunity is to begin implementation of PAWS, alongside the situational awareness (WCI-CND), to yield a proactive network defense system to guard against sophisticated cyber attacks.