Understanding how a potential threat will be handled by enterprise security technologies is a challenge that NSS Labs’ Cyber Advanced Warning System (CAWS) platform aims to help solve. The CAWS 2.2 platform debuted on Jan. 24, providing new capabilities to help improve enterprise security.
NSS Labs defines CAWS as a cyber threat protection platform and cyber threat impact product. CAWS makes use of NSS Labs’ BaitNET technology backend which crawls the internet looking for malicious web addresses and files. NSS Labs will then re-visit the malicious addresses and files in a virtual environment to discover how various security technologies will react to the threats.
CAWS provides a user-interface into BaitNET, giving organizations with insight into potential indicators of compromise.
“CAWS is where all the analytics are crunched,”Brian Soldato, senior director product management at NSS Labs, told eWEEK.
With CAWS an organization can determine what the active threats are in a specific environment. Soldato added that CAWS will also detail where deployed security technologies, including endpoint and firewall systems are vulnerable.
CAWS also provides risk modelling capabilities, such that an organization can see how different security technologies stack up against specific threats. Soldato added that the CAWS risk modelling capability can help an organization when making a buying decision for a security technology to better understand how it will run in a specific environment.
A core element of CAWS is the platform’s API component, that can be integrated with an enterprise’s existing threat intelligence or Security Information and Event Management (SIEM) tools. Soldata said that the CAWS API is being used by organizations for threat research to help find targeted attacks.
The new CAWS 2.2 release improves on its predecessors with an improved ability to collect and understand malicious files. Soldato said that NSS Labs looks at Microsoft Office, PDF and media files for potential malware activities. The API interface has also been improved in the CAWS 2.2 release making it easier for users to both submit files and query the system.
Additionally malware classification has been improved in the new CAWS release.
“Prior to CAWS 2.2 we did not classify malware, we only told users that something was bad and provided lots of context,” Soldato said. “Now we will classify the malware and provide full static analysis.”
The full static analysis will give organizations insight into how a given piece of malware propagates, what operating system registry changes have been made and where it might have command and control servers.
Looking forward, NSS Labs is planning further enhancements in the CAWS 2.3 update that will be released in March. Among the future enhancement is support for STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Indicator Information). STIX and TAXII are commonly used in the security industry today to help organizations share information about Indicators of Compromise (IOCs).
Soldato added that later in 2017, there is a plan to deliver a completely refreshed user interface for CAWS.
“The new interface will be more user-friendly,” Soldato said. “It will be more flexible in general.”
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.