Monitoring and response: a security operations desk triaging an alert from a field node. The loop, step by step: 1. A security centre watches a mesh of nodes. 2. Sensor, link, edge and console stand ready. 3. A node starts sending to an unknown address. 4. The anomaly reaches the security centre. 5. The relay forwards sealed packets untouched. 6. Signatures are checked before any model runs. 7. Analysts confirm a compromised service. 8. The edge releases confirmed results only. 9. The node is isolated from the grid. 10. Instruments confirm the response took effect. 11. A crew drives out to reimage it. 12. Sensors check that the response worked. 13. The incident closes with a full timeline. 14. The alert arrives with its evidence attached. 15. Record, proof and action are archived together. 16. Everything settles back to idle.

01 / 16

A security centre watches a mesh of nodes

/

/

Monitoring and response, inside Security and trust: incident response, security monitoring and logging, coordinated vulnerability disclosure, CSIRT services and more. Every item is traced to its specification, from NIST SP 800-61 Rev. 3 to ISO/IEC 27035-1:2023, and runs on the open Observatory Protocol.

Technologies

8

At the frontier

0

Protocol functions

4 of 12

Industries served

5

At a glance

Incident response

Preparing, detecting, containing, recovering and learning, tied to risk management. In monitoring and response, part of Security and trust, the monitoring, incident response and governance layer holds incident response, drawn against NIST SP 800-61 Rev. 3 and ISO/IEC 27035-1:2023 and used beside information security management on the same sites.

问题所在

Detect, contain, recover, with the evidence kept

Field devices sit in public places, run for years and join networks that also carry control traffic. A single unverified node or unsigned update can reach far beyond the sensor it came with. Security has to be built into how every node joins, updates and reports, because nobody can guard unattended sites in person.

Key facts

Specification

NIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023

Specification

ISO/IEC 27037

Specification

ISO/IEC 29147 · ISO/IEC 30111

Specification

FIRST CSIRT Services Framework

Specification

NIST SP 800-92 (log management)

Components

• Rugged field tablet on a mast bracket
• Fixed gas detectors on a drift wall
• Particulate monitoring station and sensor node
• Overhead line sensor on a distribution span
• Private LTE mast on a solar skid
• “AI tower in a box”
• Hardware security module, 1U, in an edge rack
• Data hall row pair with cold-aisle containment

Interfaces

Radio

Wi-Fi · LTE / 5G

Where it works

• Digital evidence handling
• CSIRT services

In the story below

1. The system, part by part
2. Assembly
3. Installation
4. Deployment
5. Connections
6. 运行
7. Failure and recovery
8. Scale and federation
9. What you get

Scenes · 13

Next steps

1. Security and trust · Monitoring and response

   Detect, contain, recover, with the evidence kept

   Field devices sit in public places, run for years and join networks that also carry control traffic. A single unverified node or unsigned update can reach far beyond the sensor it came with. Security has to be built into how every node joins, updates and reports, because nobody can guard unattended sites in person.

2. 功能

   Incident response

   Preparing, detecting, containing, recovering and learning, tied to risk management. In monitoring and response, part of Security and trust, the monitoring, incident response and governance layer holds incident response, drawn against NIST SP 800-61 Rev. 3 and ISO/IEC 27035-1:2023 and used beside information security management on the same sites.

   Specification

   NIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023

3. 监测

   Digital evidence handling

   Identification, collection and preservation of evidence after an incident. In monitoring and response, part of Security and trust, the monitoring, incident response and governance layer holds digital evidence handling, drawn against ISO/IEC 27037. We build it into every site for monitoring and response against that standard, and keep its version and its test results on the site’s record.

   Specification

   ISO/IEC 27037

4. 监测

   Coordinated vulnerability disclosure

   Receiving, triaging and fixing reported vulnerabilities, with a published contact. In monitoring and response, part of Security and trust, the monitoring, incident response and governance layer holds coordinated vulnerability disclosure, drawn against ISO/IEC 29147 and ISO/IEC 30111 and used beside product security evaluation on the same sites.

   Specification

   ISO/IEC 29147 · ISO/IEC 30111

5. 监测

   CSIRT services

   The services a security response team provides to its constituency. In monitoring and response, part of Security and trust, the monitoring, incident response and governance layer holds CSIRT services, drawn against FIRST CSIRT Services Framework. We build it into every site for monitoring and response against that standard, and keep its version and its test results on the site’s record.

   Specification

   FIRST CSIRT Services Framework

6. Time and place

   When and where, on every record

   Every record made for monitoring and response carries its time, from a clock disciplined by satellite time or a PTP grandmaster, with the position and siting record of the station that made it. When time or position degrades, the record for monitoring and response says so, and every user downstream sees the same warning.

7. 监测

   Security monitoring and logging

   Central collection and correlation of device, network and application events. In monitoring and response, part of Security and trust, the monitoring, incident response and governance layer holds security monitoring and logging, drawn against NIST SP 800-92 and used beside government security control profiles on the same sites.

   Specification

   NIST SP 800-92 (log management)

8. 信任

   Proved before it is trusted

   A node joins a network for monitoring and response only after its hardware root of trust answers an attestation challenge. Its keys stay in secure hardware, its software arrives signed and every record it makes for monitoring and response carries a signature, so anyone downstream can check where a value came from.

9. 证据

   Traced to its specifications

   We trace each part of monitoring and response to its specification: NIST SP 800-61 Rev. 3, ISO/IEC 27035-1:2023 and NIST SP 800-92. We keep the versions, configurations and test results of monitoring and response as signed records, so a buyer or an auditor can check what was delivered against what was specified.

   标准

   NIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023 · NIST SP 800-92 · ISO/IEC 29147

10. 动态

    Updates in rings, with rollback

    Software and configuration reach a fleet for monitoring and response in rings: one canary site first, then a few, then all, each ring gated on health and data completeness. A failed gate stops the wave, and each node for monitoring and response returns to its last good release without a site visit.

11. How it scales

    One base unit, repeated

    A network for monitoring and response starts with one base node and the instruments it reads. A station adds power and radio, a site adds a relay and a fleet repeats the proven site, so capacity for monitoring and response grows by adding units, never by replacing what works.

12. What you get

    Operational-technology assurance for observing sites

    Identity, attestation, segmentation and monitoring for instruments and edge nodes, with evidence for audits. Stated as services, never as a security guarantee. For monitoring and response, it goes to operators of critical sites and agencies as a managed service or professional services, sized to the sites they run.

    Talk to sales

13. Next step

    Monitoring and response, planned with you

    Tell us the sites, the systems monitoring and response must work with and the outcome you need, with a map or a list of addresses if you have one. An engineer replies with a survey proposal, a design and a scope for monitoring and response, and the plan grows from one site to the network you need.

    Plan a deploymentOpen the Field Deployment StudioSee Security and trust

More presentations

See it from every side.

Each opens as a full-screen presentation: deeper pages on the same subject, explainers, stories, guided tours of the places, network scenes and the observatories that came before.

In depth

Explainers

Stories

Places and networks

Heritage observatories

Interactive tools

01概述

Monitoring, incident response and governance.

How every node proves what it is and what it runs, how links and keys are protected, how software is traced to its source, how personal data is minimised, and how incidents are found and handled. Each technology below carries what it is, what we do with it, and the standard it is drawn against.

02Architecture

Where it sits, and what it speaks.

Monitoring and response draws on the spectrum below; the highlighted layers carry this area, and the protocol functions it speaks are marked.

Device identity and attestation

8

PKI, secure boot and updates

7

Zero trust and network security

7

5G and wireless security

6

OT security and software supply chain

9

隐私与数据保护

7

Keys, cryptography and post-quantum migration

9

Monitoring, incident response and governance

8

01加入 Identity, attestation quote, signed policy.

02Admit Admitted for a stated scope, nothing wider.

03描述 What, where, how and by whom, with calibration.

04Time One clock across the grid, with its error bound.

05Observe Every value with quality and provenance.

06Qualify Tested against the specification, state on record.

07Federate Signed exchange across grids and trust domains.

08Orchestrate Software and configuration by signed plan.

09Correct A correction marks what depends on it and publishes a new version.

10Exchange Products reach people and applications through versioned interfaces.

11Prove Signed proof receipts that an independent verifier can check.

12Exit and decommission An open exit path, and a record that closes.

03On the grid

Every site joins one observing grid.

The open networks on the grid today, over real relief and the geodesic cells we count them into. A site built here enrols into the same grid.

04In the field

Where this runs, sector by sector.

Deployment scenarios from the sector research that rely on monitoring and response.

05Open and enterprise

Open by default. Enterprise by contract.

The open counterpart lives on the main site for anyone to read and run. The enterprise service is designed, deployed and operated with you, under contract.

Open, on the main site

• Threat model for observing sites
• Attestation profile in the protocol

Enterprise, on this site

• Operational-technology assurance
• Security monitoring for observing sites
• Key and PKI operations

06The rest of the line

Security and trust, area by area.

Bring us the site.

Survey, design, deployment and operation for monitoring and response. The form names who receives your details.