Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control PlanCP-19Autonomous System Intervention

Proposed Control Plan. Subject to technical and publication approval.

An autonomous system acts beyond its remit. Which network connections can you withdraw?

CP-19 Autonomous System Intervention Control Plan icon

Disconnect the communications of an autonomous system.

Plan
CP-19
Purpose
Autonomous System Intervention
Selected connections
8
Modules
Fracture · Isolate · Execute · Validate · Anchor · Lock
Scope
Registered external communications and authorised management crossings.

What is at stake

Why autonomous system intervention matters.

The operating risk includes both continued access and the consequences of losing it.

Persistent autonomous connectivityThe autonomous system network connections can remain available beyond the approved need.
Continued local executionNetwork disconnection does not stop local execution. Independent safety controls remain necessary.
Autonomous system ownershipName the autonomous system owner and the conditions for a connection change.
Autonomous connection checksCheck the observed state of the autonomous system network connections, including parallel routes.

The problem today

Where you are IP connected today.

CP-19 reviews eight IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

8IP-connected paths reviewed
8Risks to agree with owners
6Control modules applied
  1. Risk 1Autonomous external crossing · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected within approved operating scope

  2. Risk 2Remote instruction route · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected within approved operating scope

  3. Risk 3Engineering management path · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  4. Risk 4External service boundary · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected within approved operating scope

  5. Risk 5Review workspace crossing · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  6. Risk 6Secondary site route · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected within approved operating scope

  7. Risk 7Equipment integration conduit · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected within approved operating scope

  8. Risk 8Internet service crossing · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected within approved operating scope

Matching industry Blueprints

What Firevault changes

What changes with this Plan.

Withdraw selected autonomous network connections while assessing local behaviour separately.

Connection Agreed normal state Control action
Autonomous external crossing · All physical members and parallel paths to be mapped. Connected within approved operating scope Isolate groups registered conduits; Fracture withdraws each authorised connection; Execute applies the action.
Remote instruction route · All physical members and parallel paths to be mapped. Connected within approved operating scope Fracture withdraws this authorised connection. Validate checks authority before action.
Engineering management path · All physical members and parallel paths to be mapped. Disconnected by default Fracture withdraws this authorised connection. Validate checks authority before action.
External service boundary · All physical members and parallel paths to be mapped. Connected within approved operating scope Fracture withdraws this authorised connection. Validate checks authority before action.
Review workspace crossing · All physical members and parallel paths to be mapped. Disconnected by default Fracture withdraws this authorised connection. Validate checks authority before action.
Secondary site route · All physical members and parallel paths to be mapped. Connected within approved operating scope Fracture withdraws this authorised connection. Validate checks authority before action.
Equipment integration conduit · All physical members and parallel paths to be mapped. Connected within approved operating scope Fracture withdraws this authorised connection. Validate checks authority before action.
Internet service crossing · All physical members and parallel paths to be mapped. Connected within approved operating scope Fracture withdraws this authorised connection. Validate checks authority before action.

Local execution, model shutdown, physical stopping and unregistered communication channels.

Control in Action

Autonomous System Intervention: see the selected path change.

Withdraw selected autonomous network connections while assessing local behaviour separately.

Control in Action

Stage

Before agreed physical control

The operating risk includes both continued access and the consequences of losing it.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack
10still running

Physical crossings

  • Autonomous external crossing · All physical members and parallel paths to be mapped.Always connected
  • Remote instruction route · All physical members and parallel paths to be mapped.Always connected
  • Engineering management path · All physical members and parallel paths to be mapped.Always connected
  • External service boundary · All physical members and parallel paths to be mapped.Always connected
  • Recovery access (OSS)Not in place
  1. FBFracture · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

In CP-19: withdraws the scoped external path. In CP-19: groups every registered autonomous-zone conduit. In CP-19: applies the authorised communications intervention.

CP-19Autonomous System Intervention

Z0Requesting environment
Z1Protected systems
Z2Related operations
Held in Offline Secure Storage®Selected recovery material, held separately
Out-of-band command path

This Control Plan

Withdraw selected autonomous network connections while assessing local behaviour separately.

Primary modules: Fracture, Isolate, Execute, Validate, Anchor and Lock.

Read the operational detail

Module in this plan

Fracture module icon

Fracture

Controls the path

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore the Fracture module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The Control Plan specification

Each selected connection, written down.

Withdraw selected autonomous network connections while assessing local behaviour separately.

Autonomous external crossing · All physical members and parallel paths to be mapped.Connected within approved operating scope
Normal state
Connected within approved operating scope
Authorisation
Authorised intervention after scope and operational-impact review
Module action
Isolate groups registered conduits; Fracture withdraws each authorised connection; Execute applies the action.
Business effect
Connectivity across this crossing is lost. Assess affected supervision, tools and local dependencies.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.
Remote instruction route · All physical members and parallel paths to be mapped.Connected within approved operating scope
Normal state
Connected within approved operating scope
Authorisation
Authorised intervention after scope and operational-impact review
Module action
Fracture withdraws this authorised connection. Validate checks authority before action.
Business effect
Connectivity across this crossing is lost. Assess affected supervision, tools and local dependencies.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.
Engineering management path · All physical members and parallel paths to be mapped.Disconnected by default
Normal state
Disconnected by default
Authorisation
Authorised intervention after scope and operational-impact review
Module action
Fracture withdraws this authorised connection. Validate checks authority before action.
Business effect
Connectivity across this crossing is lost. Assess affected supervision, tools and local dependencies.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.
External service boundary · All physical members and parallel paths to be mapped.Connected within approved operating scope
Normal state
Connected within approved operating scope
Authorisation
Authorised intervention after scope and operational-impact review
Module action
Fracture withdraws this authorised connection. Validate checks authority before action.
Business effect
Connectivity across this crossing is lost. Assess affected supervision, tools and local dependencies.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.
Review workspace crossing · All physical members and parallel paths to be mapped.Disconnected by default
Normal state
Disconnected by default
Authorisation
Authorised intervention after scope and operational-impact review
Module action
Fracture withdraws this authorised connection. Validate checks authority before action.
Business effect
Connectivity across this crossing is lost. Assess affected supervision, tools and local dependencies.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.
Secondary site route · All physical members and parallel paths to be mapped.Connected within approved operating scope
Normal state
Connected within approved operating scope
Authorisation
Authorised intervention after scope and operational-impact review
Module action
Fracture withdraws this authorised connection. Validate checks authority before action.
Business effect
Connectivity across this crossing is lost. Assess affected supervision, tools and local dependencies.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.
Equipment integration conduit · All physical members and parallel paths to be mapped.Connected within approved operating scope
Normal state
Connected within approved operating scope
Authorisation
Authorised intervention after scope and operational-impact review
Module action
Fracture withdraws this authorised connection. Validate checks authority before action.
Business effect
Connectivity across this crossing is lost. Assess affected supervision, tools and local dependencies.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.
Internet service crossing · All physical members and parallel paths to be mapped.Connected within approved operating scope
Normal state
Connected within approved operating scope
Authorisation
Authorised intervention after scope and operational-impact review
Module action
Fracture withdraws this authorised connection. Validate checks authority before action.
Business effect
Connectivity across this crossing is lost. Assess affected supervision, tools and local dependencies.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.

Local execution, model shutdown, physical stopping and unregistered communication channels.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record
1Normal operationAgreed states held

Withdraw selected autonomous network connections while assessing local behaviour separately. Each selected connection sits at its agreed normal state.Anchor

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Isolate groups registered conduits; Fracture withdraws each authorised connection; Execute applies the action.ValidateLock

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Withdraw selected autonomous network connections while assessing local behaviour separately.FractureIsolate

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

Restoring a physical path is a new operating decision. Review the current system state, outstanding risks and authority before reconnecting.

The operational owner authorises each reconnection.

Each check and each reconnection.

Local execution, model shutdown, physical stopping and unregistered communication channels.

Engineering and integration

Fit the control around your existing environment.

Registered external communications and authorised management crossings.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.
Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.
Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.
Controlled changeVerify approved opening, closure and the operational impact.
Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Restoring a physical path is a new operating decision. Review the current system state, outstanding risks and authority before reconnecting.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

Local execution, model shutdown, physical stopping and unregistered communication channels.

What this addressesWithdraw selected autonomous network connections while assessing local behaviour separately.
What it does not replaceLocal execution, model shutdown, physical stopping and unregistered communication channels.
Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

Use this draft register to discuss connection scope and unresolved operating decisions. It is a discovery aid, not an approved deployment configuration.

Questions worth asking

Before you rely on CP-19.

Practical questions for the people who own these connections.

Withdraw selected autonomous network connections while assessing local behaviour separately.

Registered external communications and authorised management crossings.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

Local execution, model shutdown, physical stopping and unregistered communication channels.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Use this draft register to discuss connection scope and unresolved operating decisions. It is a discovery aid, not an approved deployment configuration.

Your next step

Take the next step with autonomous system intervention.

Use this draft register to discuss connection scope and unresolved operating decisions. It is a discovery aid, not an approved deployment configuration.

Book a briefing

Prefer to talk first? Speak to the team