Network segmentation design
Networks are divided into zones with controlled connections, especially between corporate IT and operational technology, to limit how far an intrusion can spread.
GCRI · Cybersecurity and Digital Resilience
Secure communications
Communications and network technology carry the traffic that security protects and attackers target. In this field it covers network architecture, segmentation, secure protocols, resilience of telecommunications and the cryptographic protocols that must migrate to post-quantum algorithms.
01Contents
Secure communications in five parts.
02Application
What communications and network technology does here.
Communications and network technology cover the systems that carry voice, data and control signals, including fixed, mobile, satellite and undersea links. They are critical for coordination during crises and for the operation of other infrastructure. In cyber and digital resilience and critical infrastructure, communications analysis shows how outages cascade to payments, emergency services and grid control. It informs priorities for redundancy and emergency communication plans. The canonical description is on the STEM Commons.
Protocol security review
Protocols used by critical services are reviewed for authentication and encryption, and insecure legacy protocols are identified for replacement or isolation.
Post-quantum protocol readiness
Use of TLS, VPN and other protocols is inventoried to plan the move to hybrid and post-quantum key exchange.
03Monitor
Telemetry network.
The screen a team would use to follow this method: its measures, states and decisions. Names are examples and values are illustrative.
Telemetry network
Cybersecurity · Secure communications · Run R-1558
- Channels reporting97of 100Normal
- Median latency145ms
- Records failing checks0.3per 1,000Watch
- Backlog23min
Gaps on 6 channelsGCRI · Cybersecurity and Digital Resilience
Latency, p95
Events
- 06:34WarnChannel C-63 stale
- 07:52InfoSchema v4 accepted
- 08:39ErrorChecksum mismatch, batch quarantined
- 08:34DoneReplay complete
04Data
What the method consumes.
Datasets and records used by communications and network technology on this platform, with the role each plays and the label its values carry. Sources are listed in the source register.
| Data | Role | Label |
|---|---|---|
| Network architecture documentation | Segmentation | DECLARED |
| Traffic and flow logs | Actual connections | OBSERVED |
| Protocol inventories | Cryptographic use | DECLARED |
05Methods and evidence
How secure communications is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
System model
The couplings between the systems in secure communications: signs of influence, a reinforcing and a balancing loop, and cross-links where stress jumps.
FAIR guiding principles · GO FAIR and FORCE11W3C PROV · World Wide Web ConsortiumGuidance on consistent treatment of uncertainties · IPCCCEOS Analysis Ready Data · Committee on Earth Observation Satellites
06Validation
How results are checked.
Network designs are tested through simulation, field measurement and failover drills. Post-incident reviews compare expected and observed performance.
| Check | How it is done |
|---|---|
| Flow verification | Actual traffic is compared with intended segmentation rules |
| Configuration review | Protocol configurations are checked against hardened baselines |
| Interoperability testing | New protocol versions are tested before deployment |
Shared ducts, landing points and power supplies create hidden common-mode failures. Demand surges during emergencies can exceed planned capacity.
07Process
How the process runs.
Process explorer · Process
Secure communications: Source to evidence record
10 steps·4 stages·2 gates
Process
Secure communications: Source to evidence record
A source is registered and assessed, its record labelled and classified, and a Digital Evidence Passport carries provenance; a correction reaches every dependent record.
01 Intake
- 01Identify the sourceSource · The source stewardDiscovery is not ingestion. Source identification records the source class, steward, institutional role and jurisdiction.
- 03Register the sourceStepRegistration makes a discovered source a governed participant in the evidence lifecycle. It implies no endorsement or certification.
02 Assessment
- 04Jurisdiction and rights classificationGateRights classification identifies licence, consent, confidentiality and reuse limits. The result determines access and routing.
- 05Evidence quality assessmentStepQuality assessment decides whether a record is fit for a defined use. Quality is multidimensional and never a single score.
- 06Evidence labelStepEvery finding carries one of nine evidence labels. Missing data is shown as missing, never as zero.
03 Record
- 07Evidence classificationRecordClassification gives records lifecycle states, such as source-verified, public-safe or restricted. States can coexist and set evidence use.
- 08Source release and identifierRecord · NXS-GRX (canonical data, provenance and risk)A source release records rights, temporal coverage and source lineage. A UNI is allocated through a catalogue and never typed by hand.
- 09Digital Evidence PassportRecordThe passport records provenance, quality, rights, jurisdiction, permitted use and history, so evidence keeps its context when it travels.
04 Use and correction
- 02Correction reaches dependent recordsStep · NXS-GRX (canonical data, provenance and risk)A source correction propagates to dependent cuts and products without rewriting old results.
- 10Public-safe reviewGatePublic-safe review decides whether a record can be shared publicly. It is a distinct stage and is not validation.
Data protocols: evidence lifecycle · Data protocols: core data objects and evidence records · The Global Risks Index (NXS-GRX)Designed programme process, not a record of operation. No cycle has run and every programme is at service level R0. A gate is a programme decision, never a public-authority approval, certification or deployment authorisation. The data-protocol pages describe a design, not a running system.
08Connections
Topics that rely on this method.
09Stewardship
Who maintains the method.
Critical Infrastructure stewards communications and network technology for the Consortium and reviews how it is applied across platforms.
10Connected
Where this page leads across the Consortium.
11Questions
Questions and answers.
What are the limits of communications and network technology in this field?
Shared ducts, landing points and power supplies create hidden common-mode failures. Demand surges during emergencies can exceed planned capacity.
How are results checked?
Network designs are tested through simulation, field measurement and failover drills. Post-incident reviews compare expected and observed performance.
Are the values on this page real?
The data names, roles and checks are real descriptions of practice. The canvas shows a design of the method's use, not a run; no result is reported here.
Where else is this method applied?
The canonical method page lists every platform that applies it.
ReportsContribute
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
GCRICybersecurity and Digital ResilienceStrategic SystemsScenario and Stress-Test
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Cybersecurity and Digital Resilience
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.