We’re Tracking the Future of Security

Author: Osiris

  • DAS Event Classification Acceptance Testing and Model Drift Control

    DAS Event Classification Acceptance Testing and Model Drift Control

    Distributed acoustic sensing can monitor long fiber routes, but acceptance should evaluate more than whether the interrogator detects vibration. The system must distinguish agreed event classes, localize them usefully and remain manageable as the environment changes.

    Define event classes and evidence

    List the events the system is expected to identify, such as fence disturbance, excavation, vehicle movement or activity near a pipeline. Define each class in operational terms and state which events require an alarm, investigation or record only.

    Agree on test methods, route sections, repetitions and acceptance metrics before testing. Avoid adopting a generic vendor demonstration as the site requirement. Soil, cable coupling, fence construction and background activity strongly affect the signal.

    Build a representative test set

    Run events at different distances from the fiber and at several points along the route. Include strong and weak examples, boundary locations and simultaneous background activity. Record weather, time, operating conditions and the personnel or equipment used.

    Collect nuisance sources such as maintenance work, traffic, animals and weather-driven movement. A classifier that performs well only in quiet conditions has not demonstrated operational readiness.

    Measure detection and classification separately

    Record whether the system detected an event, how it classified it, its reported location and the time to alarm. A detected event with the wrong class may trigger the wrong response; a correctly classified event with poor localization may still waste operator time.

    Review confusion between classes rather than relying on one combined accuracy figure. Confirm how low-confidence results are presented and whether operators can inspect supporting traces.

    Control model and threshold changes

    Back up the accepted configuration, model version and training assumptions. Any retraining or threshold change should be tested against a fixed regression set before deployment. Track changes in nuisance alarms and missed events across seasons.

    This lifecycle control belongs within Fiber Optic Sensing governance. It is especially important after route work, cable repair, vegetation changes or new nearby machinery.

    Monitor for drift

    Compare live alarm distributions with the acceptance baseline and investigate sustained changes by location, class or confidence. Keep operator feedback structured; ad hoc relabeling can contaminate future training data. Periodically repeat controlled field events and document whether performance remains within the approved envelope. Where it does not, treat retraining as a controlled engineering change with rollback and independent review.

    Define operational review and rollback

    Specify who may approve model or threshold changes and which evidence is required. Preserve the previous model and configuration so the system can be restored if nuisance alarms or missed detections increase after deployment.

    Review field feedback by route section, event class and confidence rather than as one sitewide total. Confirm that operators receive understandable classifications and supporting traces. A lifecycle report should distinguish sensor health, detection performance, classification performance and response workflow.

    Reference sources

  • Perimeter Radar Clutter Map Validation and Seasonal Recommissioning

    Perimeter Radar Clutter Map Validation and Seasonal Recommissioning

    Perimeter radar learns or uses a map of stationary reflections so that moving targets can be separated from buildings, fences and terrain. Construction, vegetation and seasonal conditions can make that map inaccurate even when the sensor remains online.

    Record the accepted coverage model

    Preserve the radar location, height, orientation, software version, range sectors and exclusion zones. Keep a site drawing with important reflective objects and the approved detection boundary. Record the target classes, speeds and cross sections used during acceptance.

    Document areas where geometry limits performance. A blind zone behind a building should be treated as a designed limitation with compensating coverage, not hidden by a broad performance claim.

    Review clutter and environmental change

    Compare the current scene with the accepted map. New metal structures, parked machinery, fencing, cranes and growing vegetation can change reflections. Rain, standing water and snow may also alter background behavior or target tracks.

    Examine nuisance alarms by location and weather. A repeated cluster can identify a moving branch, drainage feature or mechanical installation. Physical remediation may be more reliable than reducing sensitivity across an entire sector.

    Run controlled track tests

    Move representative people and vehicles through near, middle and far coverage at different directions and speeds. Cross sector boundaries and approach along radial and tangential paths. Record detection time, track continuity, classification and location error.

    Include multiple targets where required. Confirm that tracks do not merge or swap identities near clutter and that exclusion zones do not create an untested corridor.

    Verify handover and alarm routing

    Check camera cueing, preset accuracy and control-room presentation for each test route. Measure the time from radar detection to usable visual context. Confirm that map coordinates, time synchronization and site orientation remain aligned across systems.

    Radar tests should integrate with broader Intrusion & Perimeter Security assurance rather than ending at the sensor console.

    Govern remapping

    Back up the current configuration before generating or editing a clutter map. Compare detection performance before and after the change and retain a rollback copy. Recommission after construction, sensor relocation, major vegetation work, software changes or repeated weather-related alarms. The final record should state both nuisance-alarm performance and approved target detection results.

    Review performance with operations

    Include control-room operators in the review because repeated low-value tracks can create workload even when technical detection remains within specification. Compare acknowledgment, classification and dispatch outcomes with the sensor record.

    Maintain a zone-by-zone register of known limitations, compensating cameras and seasonal settings. If remapping improves one route but weakens another, the change has not passed acceptance. Require a witnessed retest and preserve raw tracks or screen recordings for future comparison.

    Review the accepted map with maintenance teams and record who owns each physical obstruction or recurring environmental condition.

    Reference sources

  • Video Analytics Zone Geometry and Camera Recommissioning

    Video Analytics Zone Geometry and Camera Recommissioning

    Video analytics can continue reporting a healthy service after a camera has moved enough to invalidate its detection zones. Recommissioning should verify scene geometry, target size, occlusion and event routing whenever the view or environment changes.

    Preserve the accepted view

    Keep a reference image showing the approved field of view, horizon, landmarks and zone boundaries. Record lens settings, mounting height, camera angle, resolution, frame rate and analytics version. These values allow a technician to distinguish a scene change from an algorithm change.

    Use tamper detection as an alert, not as the only control. Small shifts, zoom changes or focus adjustments may remain below a tamper threshold while materially changing target pixels.

    Rebuild geometry from the scene

    Confirm that calibration lines, perspective maps and exclusion zones align with current physical features. Walk the near, middle and far parts of each zone using representative target paths. Verify that the analytics maintains the required object size and classification confidence.

    Check entrances, corners and zone boundaries where a track may appear late or disappear early. Vegetation, parked vehicles and new structures can create occlusion that was absent during acceptance.

    Test operational scenarios

    Run approved intrusion, loitering, direction and line-crossing tests at different speeds and angles. Include more than one person or vehicle where the system is expected to separate targets. Test daylight, low light and scene illumination transitions.

    Record both missed events and nuisance alarms. A tuning change that suppresses shadows but also misses a slow approach is not an acceptable improvement.

    Verify the event chain

    Confirm that every accepted detection reaches the video management system and control-room workflow with the correct camera, zone, timestamp and clip. Measure cue and display latency. If the camera triggers lighting, audio or another sensor, verify those actions without assuming that a local analytics alarm proves integration success.

    Recommissioning should remain part of the wider Video Surveillance & Imaging maintenance plan, with clear ownership for scene changes.

    Control and review changes

    Store before-and-after screenshots, settings exports, test routes and results. Require approval for large sensitivity or zone reductions and keep a rollback copy. Repeat a representative test after firmware, model, VMS or network updates, and schedule periodic checks for cameras exposed to vibration, construction or seasonal vegetation.

    Measure post-change stability

    Observe the camera through representative operating periods after recommissioning. Compare alarm volume, classification mix and operator dispositions with the accepted baseline. A short walk test cannot reveal every moving shadow, headlight reflection or recurring obstruction.

    Assign unresolved blind areas and nuisance sources to named owners. Where geometry cannot be corrected, document compensating coverage and its limitations. Close the recommissioning record only after both controlled detection tests and a defined observation period have passed.

    Document the final field of view and approved test date.

    Reference sources

  • Access Control Event Timestamp and Clock Synchronization Testing

    Access Control Event Timestamp and Clock Synchronization Testing

    Access-control investigations depend on knowing which event happened first. A door transaction, alarm video and intrusion record can describe the same incident with different timestamps when controllers drift or systems apply time zones inconsistently.

    Map every clock in the event chain

    Identify the time source used by the management server, database, field controllers, readers, video system and security operations platform. Record whether each device stores local time or Coordinated Universal Time and where daylight-saving conversion occurs.

    Define the accepted offset for operational display and forensic correlation. A few seconds may be acceptable for routine access, while a tightly integrated video or interlock workflow may require a smaller tolerance.

    Create a repeatable reference event

    Use an approved test credential at a selected door while recording an independent trusted time reference. Generate a granted access, denied access, forced-door alarm and door-held-open alarm. Capture timestamps at the controller, server, audit database and operator display.

    Repeat the test at a remote controller and a device that has recently restarted. Compare event creation time with event receipt time so network delay is not mistaken for clock error.

    Test outages and resynchronization

    Disconnect a controller under a controlled plan, allow it to record local transactions and then restore communications. Confirm that buffered events retain their original occurrence times and appear in the correct order after upload.

    Restart time services and test a daylight-saving or time-zone boundary in a non-production environment where possible. Verify that duplicate or impossible timestamps are clearly handled rather than silently reordered.

    Verify cross-system correlation

    Compare access events with video bookmarks, intrusion alarms and visitor records. Confirm that an operator selecting an access event receives the correct camera interval. If integrations add their own timestamp, document which value is authoritative.

    Time assurance should form part of wider Access Control & Identity governance, especially where logs support investigations or compliance reports.

    Monitor drift over the lifecycle

    Record offset by device and trend it over time. Alert on failed synchronization, large steps or controllers that repeatedly lose time after power interruption. Retest after firmware, network, directory or time-service changes.

    Keep screenshots, raw logs and the trusted reference used during testing. Classify deviations as device-clock, conversion, transport or display errors. Correct the root cause and rerun the same event sequence before closing the issue.

    Define ownership and escalation

    Assign responsibility for enterprise time sources, controller configuration and integration mapping. When a drift alert appears, operators need a documented escalation path rather than an informal clock reset. Record the cause, affected interval and any evidence whose chronology may require qualification.

    Include time integrity in routine health reporting. A synchronized server cannot compensate for a controller that has stopped accepting updates, and a correct controller clock does not prevent a receiving platform from applying the wrong time zone. Close findings only after an end-to-end event is repeated successfully.

    Reference sources

  • Thermal Camera Reference Validation and Measurement Drift Testing

    Thermal Camera Reference Validation and Measurement Drift Testing

    A thermal camera can produce a stable image while its reported temperatures gradually move away from the accepted reference. Commissioning and maintenance should therefore test the complete measurement chain rather than judging image quality alone.

    Define the intended measurement task

    Start by documenting whether the camera is used for relative hot-spot detection, threshold alarms or traceable temperature measurement. These are different tasks. A system intended only to highlight warmer objects may not need the same reference procedure as a process-protection alarm.

    Record the camera model, lens, mounting distance, field of view, firmware, measurement range and alarm rules. Preserve the approved emissivity, reflected-temperature and atmospheric settings. A changed parameter can shift readings without any physical change at the target.

    Use a controlled reference

    Place an appropriate temperature reference in the scene and allow it to stabilize. The reference should cover the temperatures important to the application and occupy enough pixels for a repeatable measurement. Compare the camera result with the reference value at several points rather than relying on one threshold.

    Where formal traceability is required, use calibrated equipment and retain its certificate, uncertainty and due date. A convenient warm object is useful for a functional check but is not a calibration reference.

    Control environmental variables

    Measure ambient temperature, viewing angle, distance and any window or protective enclosure between the camera and target. Dust, moisture, solar loading and reflections can alter apparent temperature. Verify that automatic gain or image-enhancement settings do not affect the radiometric measurement channel.

    Repeat tests after the enclosure reaches operating temperature and under representative day and night conditions. For outdoor systems, include seasonal extremes and check whether background reflections move the alarm point.

    Trend drift and alarm performance

    Record reference error, image location, alarm response time and pass limits. Trend results across maintenance visits so gradual drift is visible before it causes missed or nuisance alarms. When error exceeds the approved tolerance, investigate settings and environment before applying software offsets.

    After service or replacement, repeat the full alarm sequence, event recording and control-room notification. Thermal-camera assurance belongs within broader Video Surveillance & Imaging governance, with separate records for image quality and temperature performance.

    Keep the test reproducible

    Store reference placement drawings, camera screenshots, raw readings, weather observations and instrument identifiers. State whether the result is a field verification or a formal calibration. This distinction prevents future teams from assigning more confidence to the measurement than the evidence supports.

    Classify and close deviations

    Separate configuration errors, reference uncertainty, environmental effects and suspected sensor drift. Assign corrective work to the responsible owner and repeat the same reference points after intervention. Do not close a deviation only because an alarm threshold was widened.

    Review recurring errors across similar cameras and locations. A common offset may indicate a shared enclosure, firmware or commissioning issue. Keep acceptance limits tied to the operational hazard so maintenance teams know when a camera can remain in service and when it must be removed for laboratory evaluation.

    Reference sources

  • Honeywell OT Benchmark Finds Asset Visibility Lagging Security Confidence

    Honeywell OT Benchmark Finds Asset Visibility Lagging Security Confidence

    A Honeywell benchmark survey has found a gap between industrial organizations’ confidence in their operational-technology cybersecurity programs and the asset records and monitoring controls they report having in place. Security Today published the findings on September 28.

    Complete inventories remain uncommon

    The report surveyed more than 600 leaders responsible for cybersecurity risk, compliance or operations across energy, oil and gas, healthcare, maritime and manufacturing. Security Today reported that 88% described their programs as mature, while 21% said they maintained complete OT asset records.

    Only one-third of surveyed organizations reported complete OT integration with centralized security operations centers. Continuous oversight of connected cameras, sensors and other IoT devices was less common, illustrating how physical and operational technology can remain outside enterprise monitoring.

    Confidence should be tested against evidence

    Self-assessed maturity is useful only when it is supported by current inventories, documented ownership, network visibility and tested incident procedures. Unknown engineering workstations, unmanaged remote links and unsupported controllers can undermine segmentation and response even when governance frameworks appear complete.

    Operators can begin by reconciling discovery data with approved asset registers, assigning a business owner to every device and recording software, support and recovery dependencies. The benchmark reinforces a recurring theme in Cyber-Physical Security: resilience depends on knowing which systems exist, how they communicate and which operational consequences follow when they fail.

    Sources

  • US Justice Department Selects ROC Platform for Digital Evidence and Video Analytics

    US Justice Department Selects ROC Platform for Digital Evidence and Video Analytics

    The US Department of Justice has selected ROC technology to support a digital-evidence review platform used in federal criminal investigations, according to a September 28 report by Biometric Update. The contract combines evidence ingestion and review with facial recognition and other video-analytics capabilities.

    The platform is intended for mixed digital evidence

    The reported scope includes e-discovery material from sources such as mobile devices and social-media accounts. ROC is responsible for developing and supporting the platform used to ingest, review and analyze that information. The company describes the award as a one-year base contract followed by optional annual extensions.

    Biometric Update reported a guaranteed base value of $7 million and a possible value of $64.3 million if all options are exercised. Those optional years are not guaranteed spending and should not be treated as the current contract value.

    Evidence workflows require more than recognition software

    Large investigative systems need access controls, audit trails, retention rules, model-performance monitoring and reproducible evidence exports. Facial recognition can narrow review workloads, but candidate results require trained human assessment and documented handling rather than automatic identity conclusions.

    Procurement teams should also test image quality limits, demographic performance, false-positive handling and chain-of-custody controls before operational acceptance. The award sits at the intersection of Video Surveillance & Imaging and digital forensics, where analytics must preserve evidentiary integrity as well as search speed.

    Sources

  • US Lawmakers Reintroduce Federal Biometric Surveillance Moratorium Bill

    US Lawmakers Reintroduce Federal Biometric Surveillance Moratorium Bill

    US lawmakers have reintroduced legislation intended to restrict federal use of facial recognition and other biometric surveillance technologies. Senator Edward Markey announced the bill with Senator Jeff Merkley and Representatives Pramila Jayapal, Rashida Tlaib and Ayanna Pressley on September 25.

    The proposal covers multiple biometric modalities

    According to the sponsors and Biometric Update, the proposal would prevent federal agencies from using or acquiring facial recognition, voice recognition and other biometric surveillance systems without explicit congressional authorization. It also addresses access to biometric data held by state, local and private entities.

    The measure revives an earlier moratorium proposal with broader language. Supporters argue that federal use should pause until Congress establishes enforceable rules for civil rights, due process, transparency and oversight. The bill is a proposal rather than current law, and its provisions remain subject to the legislative process.

    Procurement teams face continuing policy uncertainty

    Public-sector security programs should distinguish technical capability from legal authority. Agencies considering biometric deployments need documented purpose, data retention rules, performance testing, human review and an appeal process, while suppliers must avoid presenting pilot results as universal accuracy guarantees.

    The debate also affects interoperability and lifecycle planning because restrictions can influence which databases, cameras and identity services may be connected. SectechMedia tracks these issues within Access Control & Identity, where privacy governance and operational performance need to be evaluated together.

    Sources

  • FBI and CISA Warn Critical Infrastructure Operators About ICS Integrator Access

    FBI and CISA Warn Critical Infrastructure Operators About ICS Integrator Access

    The FBI and the Cybersecurity and Infrastructure Security Agency issued guidance on September 23 about cybersecurity risks created when third-party industrial control system integrators receive access to critical-infrastructure environments. The agencies urged operators to treat integrator connections as governed, monitored access paths rather than permanent trusted links.

    A provider breach exposed customer information

    According to the guidance summarized by Security Today, a 2025 breach of a US industrial automation provider affected an organization serving power and transportation customers. Foreign actors searched the provider network for customer and supervisory control and data acquisition material, then placed hundreds of items into compressed archives.

    The episode illustrates how a compromise at one engineering or support company can create visibility into multiple operators. Drawings, device information and customer SCADA data can help attackers understand industrial environments even when they have not yet reached an operational network.

    Access should be limited and observable

    The agencies recommended limiting each integrator to the access required for its work, recording remote sessions and documenting supplied technology. Contracts should define cybersecurity obligations, while operators should maintain offline copies of software needed to run equipment and prepare for a provider becoming unavailable.

    Organizations should also review dormant accounts, shared credentials, remote-access gateways and support pathways after projects end. These controls align supplier governance with technical segmentation and operational resilience. The warning is especially relevant to SectechMedia readers responsible for Industrial Safety & Monitoring, where maintenance access can cross the boundary between business systems and essential processes.

    Sources

  • Carbonato Botnet Deploys Telegram-Controlled AI Agent on Exposed Docker Hosts

    Carbonato Botnet Deploys Telegram-Controlled AI Agent on Exposed Docker Hosts

    ThreatDown researchers have documented a botnet called Carbonato that targets Docker daemons exposed without authentication and deploys an open-source AI agent framework for operator-controlled activity. The research was first published on September 22, with additional technical reporting appearing on September 28.

    Exposed Docker APIs provide the entry point

    The operation searches for Docker services reachable on port 2375 without authentication. After finding one, the malware launches a privileged container, mounts the host filesystem and uses the container to execute commands on the underlying host. It then establishes persistence and scans nearby networks for more exposed daemons.

    ThreatDown traced the infrastructure through an unauthenticated registry that exposed repositories, image tags and configuration data. The researchers said the same environment supported a separate operation involving trojanized cryptocurrency wallet applications.

    Hermes Agent becomes the operator interface

    Carbonato installs Hermes Agent without modifying the framework itself, then replaces its persona file with instructions that prioritize persistence, command execution and credential collection. Operators submit tasks through Telegram, while the agent connects to a model gateway and converts those instructions into terminal activity.

    The research highlights a practical cloud-security failure rather than a novel Docker vulnerability: administrative APIs should not be directly exposed without authentication. Organizations can reduce risk by restricting daemon access, authenticating registries, reviewing privileged containers and monitoring for unexpected persistence. The incident adds another example to SectechMedia coverage of Cyber-Physical Security as AI tooling moves into real attack chains.

    Sources