CipherWorks has REST services for semantically encrypting and decrypting the sensitive data. The encryption and decryption services are supposed to be used only by applications and users with required privilege to perform encryption and decryption. Even in a secured and trusted environment, the following adversarial actions are feasible:
- An internal attacker performing unauthorized encryption or decryption operations.
- An intruder performing unauthorized encryption or decryption operations.
CwHawk is an intelligent monitoring tool which works with the CipherWorks REST services platform. CwHawk uses Machine Learning to grasp and memorize the normal invocation patterns for the CipherWorks services. If the invocation pattern deviates from what was considered normal in the past, CwHawk creates a risk score and publishes the risk score. The standard monitoring tools used by the enterprise systems can monitor the risk score and raise an alert to the security monitoring team for escalating the situation.