Security, identity and trust
Incident response
Preparing, detecting, containing, recovering and learning, tied to risk management.
We design, operate and support.
NIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023
Monitoring and response: a security operations desk triaging an alert from a field node. The loop, step by step: 1. A security centre watches a mesh of nodes. 2. Sensor, link, edge and console stand ready. 3. A node starts sending to an unknown address. 4. The anomaly reaches the security centre. 5. The relay forwards sealed packets untouched. 6. Signatures are checked before any model runs. 7. Analysts confirm a compromised service. 8. The edge releases confirmed results only. 9. The node is isolated from the grid. 10. Instruments confirm the response took effect. 11. A crew drives out to reimage it. 12. Sensors check that the response worked. 13. The incident closes with a full timeline. 14. The alert arrives with its evidence attached. 15. Record, proof and action are archived together. 16. Everything settles back to idle.
01 / 16
A security centre watches a mesh of nodes
Nexus Observatory/
Security and trust/
Monitoring and responseDetect, contain, recover, with the evidence kept.
Monitoring and response, inside Security and trust: incident response, security monitoring and logging, coordinated vulnerability disclosure, CSIRT services and more. Every item is traced to its specification, from NIST SP 800-61 Rev. 3 to ISO/IEC 27035-1:2023, and runs on the open Observatory Protocol.
Plan with usArchitectureThe protocol- Technologies
- 8
- At the frontier
- 0
- Protocol functions
- 4 of 12
- Industries served
- 5
At a glance
Incident response
Preparing, detecting, containing, recovering and learning, tied to risk management. In monitoring and response, part of Security and trust, the monitoring, incident response and governance layer holds incident response, drawn against NIST SP 800-61 Rev. 3 and ISO/IEC 27035-1:2023 and used beside information security management on the same sites.
Tatizo
Detect, contain, recover, with the evidence kept
Field devices sit in public places, run for years and join networks that also carry control traffic. A single unverified node or unsigned update can reach far beyond the sensor it came with. Security has to be built into how every node joins, updates and reports, because nobody can guard unattended sites in person.
Key facts
- Specification
- NIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023
- Specification
- ISO/IEC 27037
- Specification
- ISO/IEC 29147 · ISO/IEC 30111
- Specification
- FIRST CSIRT Services Framework
- Specification
- NIST SP 800-92 (log management)
Components
- Rugged field tablet on a mast bracket
- Fixed gas detectors on a drift wall
- Particulate monitoring station and sensor node
- Overhead line sensor on a distribution span
- Private LTE mast on a solar skid
- “AI tower in a box”
- Hardware security module, 1U, in an edge rack
- Data hall row pair with cold-aisle containment
Interfaces
- Radio
- Wi-Fi · LTE / 5G
Where it works
- Digital evidence handling
- CSIRT services
In the story below
- The system, part by part
- Assembly
- Installation
- Deployment
- Connections
- Operation
- Failure and recovery
- Scale and federation
- What you get
Scenes · 13
Next steps
Plan a deploymentOpen the Field Deployment StudioSee Security and trustTalk to salesSecurity and trust · Monitoring and response
Detect, contain, recover, with the evidence kept
Field devices sit in public places, run for years and join networks that also carry control traffic. A single unverified node or unsigned update can reach far beyond the sensor it came with. Security has to be built into how every node joins, updates and reports, because nobody can guard unattended sites in person.
What it does
Incident response
Preparing, detecting, containing, recovering and learning, tied to risk management. In monitoring and response, part of Security and trust, the monitoring, incident response and governance layer holds incident response, drawn against NIST SP 800-61 Rev. 3 and ISO/IEC 27035-1:2023 and used beside information security management on the same sites.
- Specification
- NIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023
Ufuatiliaji
Digital evidence handling
Identification, collection and preservation of evidence after an incident. In monitoring and response, part of Security and trust, the monitoring, incident response and governance layer holds digital evidence handling, drawn against ISO/IEC 27037. We build it into every site for monitoring and response against that standard, and keep its version and its test results on the site’s record.
- Specification
- ISO/IEC 27037
Ufuatiliaji
Coordinated vulnerability disclosure
Receiving, triaging and fixing reported vulnerabilities, with a published contact. In monitoring and response, part of Security and trust, the monitoring, incident response and governance layer holds coordinated vulnerability disclosure, drawn against ISO/IEC 29147 and ISO/IEC 30111 and used beside product security evaluation on the same sites.
- Specification
- ISO/IEC 29147 · ISO/IEC 30111
Ufuatiliaji
CSIRT services
The services a security response team provides to its constituency. In monitoring and response, part of Security and trust, the monitoring, incident response and governance layer holds CSIRT services, drawn against FIRST CSIRT Services Framework. We build it into every site for monitoring and response against that standard, and keep its version and its test results on the site’s record.
- Specification
- FIRST CSIRT Services Framework
Time and place
When and where, on every record
Every record made for monitoring and response carries its time, from a clock disciplined by satellite time or a PTP grandmaster, with the position and siting record of the station that made it. When time or position degrades, the record for monitoring and response says so, and every user downstream sees the same warning.
Ufuatiliaji
Security monitoring and logging
Central collection and correlation of device, network and application events. In monitoring and response, part of Security and trust, the monitoring, incident response and governance layer holds security monitoring and logging, drawn against NIST SP 800-92 and used beside government security control profiles on the same sites.
- Specification
- NIST SP 800-92 (log management)
Imani
Proved before it is trusted
A node joins a network for monitoring and response only after its hardware root of trust answers an attestation challenge. Its keys stay in secure hardware, its software arrives signed and every record it makes for monitoring and response carries a signature, so anyone downstream can check where a value came from.
Ushahidi
Traced to its specifications
We trace each part of monitoring and response to its specification: NIST SP 800-61 Rev. 3, ISO/IEC 27035-1:2023 and NIST SP 800-92. We keep the versions, configurations and test results of monitoring and response as signed records, so a buyer or an auditor can check what was delivered against what was specified.
- Viwango
- NIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023 · NIST SP 800-92 · ISO/IEC 29147
Taarifa mpya
Updates in rings, with rollback
Software and configuration reach a fleet for monitoring and response in rings: one canary site first, then a few, then all, each ring gated on health and data completeness. A failed gate stops the wave, and each node for monitoring and response returns to its last good release without a site visit.
How it scales
One base unit, repeated
A network for monitoring and response starts with one base node and the instruments it reads. A station adds power and radio, a site adds a relay and a fleet repeats the proven site, so capacity for monitoring and response grows by adding units, never by replacing what works.
What you get
Operational-technology assurance for observing sites
Identity, attestation, segmentation and monitoring for instruments and edge nodes, with evidence for audits. Stated as services, never as a security guarantee. For monitoring and response, it goes to operators of critical sites and agencies as a managed service or professional services, sized to the sites they run.
Talk to salesNext step
Monitoring and response, planned with you
Tell us the sites, the systems monitoring and response must work with and the outcome you need, with a map or a list of addresses if you have one. An engineer replies with a survey proposal, a design and a scope for monitoring and response, and the plan grows from one site to the network you need.
Plan a deploymentOpen the Field Deployment StudioSee Security and trust
More presentations
See it from every side.
Each opens as a full-screen presentation: deeper pages on the same subject, explainers, stories, guided tours of the places, network scenes and the observatories that came before.
All presentationsIn depth
Use case Utility grid-edge private LTE and wildfire weatherISIC section · ISIC F ConstructionISIC section · ISIC B Mining and quarryingSector IndustrialExplainers
Explainer · Industrial IndustrialBlast vibration at the pit, fire weather at the grid edge, methane at the fenceline and tailings movement from GNSS.Jukwaa Security and trustEvery unattended node is an entry pointJukwaa Sensors & instrumentsA number without its storyStories
Story · Private 5G and AI-RAN Private 5G with the inference in the radioA private cellular network gives a site its own coverage, its own security and its own priorities. AI-RAN adds a second idea: the accelerators that run the…Story · Post-quantum cryptography Cryptography that outlasts the quantum computerData signed today may need to be trusted in 2040. Post-quantum standards were first published in August 2024, and governments have set dates for leaving…Story · Timing and PNT Time as infrastructureA 5G cell must hold its phase within 3 µs of its neighbours, ±1.5 µs of a common reference; a synchrophasor’s one per cent vector error leaves room for only…Places and networks
Guided tour · Guided 3D tour Open-pit mineGNSS slope monitors on the benches, a blast seismograph at the boundary and a private cell for the fleet, around a benched pit cut into the ground.Guided tour · Guided 3D tour Transmission corridorLattice towers carry a line across open country; conductor sensors report temperature and sag, and the substation edge brings them into the grid operator’s systems.Network scene · Private 5G · Mining Private 5G in an open-pit mineA private network for haul trucks, drills and slope radar: a mast on the rim, a cell in the pit, the core at the plant, and coverage computed over the benches themselves.Heritage observatories
Heritage observatory · United States · 1994 International GNSS ServiceA voluntary federation of some two hundred agencies and universities that operate a global network of GNSS receivers and share the results, from which the precise orbits and…Heritage observatory · Italy (historic building on the slopes of Vesuvius) · 1841 Vesuvius ObservatoryFounded in 1841 on the slope of Vesuvius, this is the oldest volcano observatory in the world.Interactive tools
Interactive tool · Configure a station Station BuilderConfigure a station part by part in 3D, check the rules as you go and request a quote for the assembly.01Ni nini
Monitoring, incident response and governance.
How every node proves what it is and what it runs, how links and keys are protected, how software is traced to its source, how personal data is minimised, and how incidents are found and handled. Each technology below carries what it is, what we do with it, and the standard it is drawn against.
Security, identity and trust
Security monitoring and logging
Central collection and correlation of device, network and application events.
We design and operate.
NIST SP 800-92 (log management)
Security, identity and trust
Coordinated vulnerability disclosure
Receiving, triaging and fixing reported vulnerabilities, with a published contact.
We design, operate and support.
ISO/IEC 29147 · ISO/IEC 30111 · IETF RFC 9116 (security.txt)
Security, identity and trust
CSIRT services
The services a security response team provides to its constituency.
We operate and support.
FIRST CSIRT Services Framework
Security, identity and trust
Digital evidence handling
Identification, collection and preservation of evidence after an incident.
We operate.
ISO/IEC 27037
Security, identity and trust
Information security management
The management system that sets policy, risk treatment and audit.
We design and operate.
ISO/IEC 27001:2022 · NIST Cybersecurity Framework 2.0
Security, identity and trust
Government security control profiles
Control catalogues used for Canadian public sector systems.
We design and support.
CCCS ITSG-33
Security, identity and trust
Product security evaluation
Independent evaluation of security functions against protection profiles.
We design.
ISO/IEC 15408 (Common Criteria)
02Architecture
Where it sits, and what it speaks.
Monitoring and response draws on the spectrum below; the highlighted layers carry this area, and the protocol functions it speaks are marked.
Device identity and attestation
8
PKI, secure boot and updates
7
Zero trust and network security
7
5G and wireless security
6
OT security and software supply chain
9
Privacy and data protection
7
Keys, cryptography and post-quantum migration
9
Monitoring, incident response and governance
8
01Jiunge Identity, attestation quote, signed policy.
02Admit Admitted for a stated scope, nothing wider.
03Eleza What, where, how and by whom, with calibration.
04Time One clock across the grid, with its error bound.
05Observe Every value with quality and provenance.
06Qualify Tested against the specification, state on record.
07Federate Signed exchange across grids and trust domains.
08Orchestrate Software and configuration by signed plan.
09Correct A correction marks what depends on it and publishes a new version.
10Exchange Products reach people and applications through versioned interfaces.
11Prove Signed proof receipts that an independent verifier can check.
12Exit and decommission An open exit path, and a record that closes.
03On the grid
Every site joins one observing grid.
The open networks on the grid today, over real relief and the geodesic cells we count them into. A site built here enrols into the same grid.
The observing grid
- Open instruments on the observing grid.
04In the field
Where this runs, sector by sector.
Deployment scenarios from the sector research that rely on monitoring and response.
Defence-adjacent (civil dual-use)Critical-infrastructure resilience sensing
Utility and pipeline monitoring under grid-security rules.Government and public safetyNational GBON surface and upper-air network
WMO-grade stations reporting through WIS 2.0, funded through the systematic-observations financing pathway.Government and public safetyWildfire camera network and fire-weather stations
Camera towers with edge inference and co-located fire-weather stations, utility- or agency-funded.Government and public safetyUrban street-flood sensor network
Open-hardware depth sensors with open data and alerts to emergency management.Government and public safetyAlerting integration with the Common Alerting Protocol and cell broadcast
Software-heavy: sensor triggers feed an alert origination tool; the alert authority keeps every decision.Government and public safetyDeployable communications and sensing for incident command
A cell on wheels with satellite backhaul, mesh telemetry and environment nodes at the incident base.05Open and enterprise
Open by default. Enterprise by contract.
The open counterpart lives on the main site for anyone to read and run. The enterprise service is designed, deployed and operated with you, under contract.
Open, on the main site
- Threat model for observing sites
- Attestation profile in the protocol
Enterprise, on this site
- Operational-technology assurance
- Security monitoring for observing sites
- Key and PKI operations
06The rest of the line
Security and trust, area by area.
Security and trustIdentity and attestation
Hardware roots of trust, quotes checked at every join.Security and trustKeys and PKI
Issuance, rotation and post-quantum migration.Security and trustSegmentation and zero trust
Least privilege between nodes, tenants and sites.Security and trustOT and wireless security
Field networks, 5G and the software supply chain.Bring us the site.
Survey, design, deployment and operation for monitoring and response. The form names who receives your details.
Talk to usAsk for a quote