Active Response Console (ARC)

Active Response is the capability for a computer network system to respond to cyber-attack defensively. When an attack is detected, the system takes appropriate steps to mitigate its effects. The proposed Active Response Console (ARC) will provide such a capability. The ARC will enhance Sentar's current computer network defense (CND) capability by integrating active response into its Work-Centered Interface (WCI-CND). The ARC will enable the security manager to manage and deploy resources for active response against cyber attack, including the ability to formulate and modify active response directives. The ARC will be developed using off-the-shelf cyber-sensor products, Sentar's WCI-CND and KnoWebr technology, and the AKA-CND, now in SBIR Phase II development. The WCI-CND will be enhanced to permit utilization of manageable routers and firewalls, giving the system the ability to implement active response. The ARC will operate as a fully integrated part of the WCI-CND. Cyber event information will feed into the system from the sensors, and the correlation engine will perform knowledge synthesis to generate situation awareness. Decision support and active response agents will use this information to make recommendations and issue active response directives. The system manager will have full access and control over the active response capability.