/

/

Incident response, inside Operations centre: incident response, coordinated vulnerability disclosure, CSIRT services, remote hands and field dispatch. Every item is traced to its specification, from NIST SP 800-61 Rev. 3 to ISO/IEC 27035-1:2023, and runs on the open Observatory Protocol.

Technologies

4

At the frontier

0

Protocol functions

3 of 12

Industries served

3

At a glance

Incident response

Preparing, detecting, containing, recovering and learning, tied to risk management. In incident response, part of Operations centre, the monitoring, incident response and governance layer holds incident response, drawn against NIST SP 800-61 Rev. We build it into every site for incident response against that standard, and keep its version and its test results on the site’s record.

O problema

From first alarm to root cause

Networks generate alarms day and night. Without a team that owns them, alarms are muted, incidents repeat and service levels are argued about instead of measured. Nobody can say how well the network is really performing, or what each outage cost the people relying on it.

Key facts

Specification

NIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023

Specification

ISO/IEC 29147 · ISO/IEC 30111

Specification

FIRST CSIRT Services Framework

Specification

ISO 45001:2018

Normas

NIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023 · ISO 45001:2018 · ISO/IEC 29147

Components

• Field-service crew vehicle
• Particulate monitoring station and sensor node
• Radar stream gauge on a road bridge
• Street small-cell pole with an air-quality node
• “AI tower in a box”
• Data hall row pair with cold-aisle containment
• Network operations centre with a curved video wall

Interfaces

Radio

LTE / 5G

Time and position

GNSS

Where it works

• CSIRT services

In the story below

1. The system, part by part
2. Assembly
3. Installation
4. Deployment
5. Connections
6. Operação
7. Failure and recovery
8. Scale and federation
9. What you get

Scenes · 13

Next steps

1. Operations centre · Incident response

   From first alarm to root cause

   Networks generate alarms day and night. Without a team that owns them, alarms are muted, incidents repeat and service levels are argued about instead of measured. Nobody can say how well the network is really performing, or what each outage cost the people relying on it.

2. O que faz

   Incident response

   Preparing, detecting, containing, recovering and learning, tied to risk management. In incident response, part of Operations centre, the monitoring, incident response and governance layer holds incident response, drawn against NIST SP 800-61 Rev. We build it into every site for incident response against that standard, and keep its version and its test results on the site’s record.

   Specification

   NIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023

3. Monitoramento

   Coordinated vulnerability disclosure

   Receiving, triaging and fixing reported vulnerabilities, with a published contact. In incident response, part of Operations centre, the monitoring, incident response and governance layer holds coordinated vulnerability disclosure, drawn against ISO/IEC 29147 and ISO/IEC 30111. We build it into every site for incident response against that standard, and keep its version and its test results on the site’s record.

   Specification

   ISO/IEC 29147 · ISO/IEC 30111

4. Monitoramento

   CSIRT services

   The services a security response team provides to its constituency. In incident response, part of Operations centre, the monitoring, incident response and governance layer holds CSIRT services, drawn against FIRST CSIRT Services Framework. We build it into every site for incident response against that standard, and keep its version and its test results on the site’s record.

   Specification

   FIRST CSIRT Services Framework

5. Time and place

   When and where, on every record

   Every record made for incident response carries its time, from a clock disciplined by satellite time or a PTP grandmaster, with the position and siting record of the station that made it. When time or position degrades, the record for incident response says so, and every user downstream sees the same warning.

6. Operations, NOC, support and training

   Remote hands and field dispatch

   Local technicians sent with parts, procedures and access arranged. In incident response, part of Operations centre, the operations, NOC, support and training layer holds remote hands and field dispatch, drawn against ISO 45001:2018. We build it into every site for incident response against that standard, and keep its version and its test results on the site’s record.

   Specification

   ISO 45001:2018

7. Confiança

   Proved before it is trusted

   A node joins a network for incident response only after its hardware root of trust answers an attestation challenge. Its keys stay in secure hardware, its software arrives signed and every record it makes for incident response carries a signature, so anyone downstream can check where a value came from.

8. Evidências

   Traced to its specifications

   We trace each part of incident response to its specification: NIST SP 800-61 Rev. 3, ISO/IEC 27035-1:2023 and ISO 45001:2018. We keep the versions, configurations and test results of incident response as signed records, so a buyer or an auditor can check what was delivered against what was specified.

   Normas

   NIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023 · ISO 45001:2018 · ISO/IEC 29147

9. Failure and recovery

   When a node fails, the fleet knows first

   When a node for incident response goes silent or a sensor drifts, the node buffers its data and fails over to a second link where the site has one. The alert carries the evidence a responder needs, and the record for incident response loses nothing and counts nothing twice.

10. Field service

    One crew, from survey to repair

    One crew surveys, installs, commissions, calibrates and repairs the sites for incident response, working from each site’s own record. Each visit updates that record, so the next crew knows what is on a site for incident response, when it was last checked and why it changed, and plans spares from that history.

11. How it scales

    One base unit, repeated

    A network for incident response starts with one base node and the instruments it reads. A station adds power and radio, a site adds a relay and a fleet repeats the proven site, so capacity for incident response grows by adding units, never by replacing what works.

12. Managed services

    We run it; you use what it observes

    The status and incident record format is open. Managed Site, network operations and service-level reporting are contracted; pricing follows the sites and the service levels chosen, and changes as the network grows. You keep the data and the records; we keep the network healthy, updated, calibrated and repaired to the levels agreed.

    See Managed servicesTalk to sales

13. Next step

    Incident response, planned with you

    Tell us the sites, the systems incident response must work with and the outcome you need, with a map or a list of addresses if you have one. An engineer replies with a survey proposal, a design and a scope for incident response, and the plan grows from one site to the network you need.

    Plan a deploymentOpen the Field Deployment StudioSee Operations centre

More presentations

See it from every side.

Each opens as a full-screen presentation: deeper pages on the same subject, explainers, stories, guided tours of the places, network scenes and the observatories that came before.

In depth

Explainers

Stories

Places and networks

Heritage observatories

Interactive tools

01O que é

Monitoring, incident response and governance.

How every node proves what it is and what it runs, how links and keys are protected, how software is traced to its source, how personal data is minimised, and how incidents are found and handled. Everything that happens on the ground across a site’s life: survey, permits, design packs, logistics, installation, acceptance, training, operations, maintenance, upgrades, decommission and recycling, done safely and recorded as evidence. Each technology below carries what it is, what we do with it, and the standard it is drawn against.

02Architecture

Where it sits, and what it speaks.

Incident response draws on the spectrum below; the highlighted layers carry this area, and the protocol functions it speaks are marked.

Edge tiers and multi-access edge computing

9

Modular edge data centres and the AI tower in a box

8

Servers and accelerators

8

Storage and edge data management

6

Cooling and ruggedisation

10

Kubernetes and fleet orchestration

8

OTA updates, GitOps and software supply chain

8

Confidential computing and hardware trust

8

Device identity and attestation

8

PKI, secure boot and updates

7

Zero trust and network security

7

5G and wireless security

6

OT security and software supply chain

9

Privacidade e proteção de dados

7

Keys, cryptography and post-quantum migration

9

Monitoring, incident response and governance

8

01Aderir Identity, attestation quote, signed policy.

02Admit Admitted for a stated scope, nothing wider.

03Descrever What, where, how and by whom, with calibration.

04Time One clock across the grid, with its error bound.

05Observe Every value with quality and provenance.

06Qualify Tested against the specification, state on record.

07Federate Signed exchange across grids and trust domains.

08Orchestrate Software and configuration by signed plan.

09Correct A correction marks what depends on it and publishes a new version.

10Exchange Products reach people and applications through versioned interfaces.

11Prove Signed proof receipts that an independent verifier can check.

12Exit and decommission An open exit path, and a record that closes.

03On the grid

Every site joins one observing grid.

The open networks on the grid today, over real relief and the geodesic cells we count them into. A site built here enrols into the same grid.

04In the field

Where this runs, sector by sector.

Deployment scenarios from the sector research that rely on incident response.

05Open and enterprise

Open by default. Enterprise by contract.

The open counterpart lives on the main site for anyone to read and run. The enterprise service is designed, deployed and operated with you, under contract.

Open, on the main site

• Status and incident record format

Enterprise, on this site

• Managed Site
• Network operations
• Service-level reporting

06The rest of the line

Operations centre, area by area.

Bring us the site.

Survey, design, deployment and operation for incident response. The form names who receives your details.