Network Visibility · Security · Threat intelligence
Bastion is organised around a single premise: that the network, observed with sufficient breadth and sufficient patience, already contains most of what a security posture needs to know about itself, and a considerable amount of what it needs to know about everyone else. Our work is the business of making that observation possible, making it useful, and making the resulting intelligence available to those for whom it is relevant.
Most security programmes are built outward from the asset: inventory it, harden it, monitor it, and hope the monitoring is looking in the right direction. Bastion works inward from the network instead. By establishing visibility first — of traffic, of behaviour, of the adversarial activity that reaches any sufficiently exposed infrastructure as a matter of course — the security measures that follow are shaped by evidence rather than by assumption.
The same visibility, viewed over time and across vantage points, becomes a research instrument in its own right. The patterns, infrastructure and tradecraft it surfaces are analysed, contextualised and, where appropriate, developed into cyber threat intelligence whose value lies precisely in having been observed rather than reported.
Four overlapping areas of practice, each of which informs the others and none of which is offered entirely on its own.
Establishing, maintaining and extending the ability to observe what traverses a network and what attempts to — across protocols, address families and the ambiguous spaces between perimeter and internet, where the majority of interesting activity tends to occur.
Controls, detections and architectural adjustments that are proposed because the observation warranted them, prioritised according to what the network is demonstrably experiencing, and revised as that experience changes.
The sustained study of adversarial behaviour as it presents itself to observed infrastructure: reconnaissance, exploitation attempts, post-compromise activity and the tooling behind each, examined for what it reveals about intent and capability.
Research findings refined into indicators, context and assessment that are relevant to a particular recipient at a particular time — disseminated on a basis that is deliberately selective, and withheld where dissemination would reduce their value.
A control that was not informed by observation is a guess with a budget. We prefer to look first, at length, and decide afterwards.
Seeing something and keeping it are different acts. What is studied is kept for as long as the study requires, and the remainder is not kept at all.
A finding is only intelligence in the hands of someone who can act on it. We are correspondingly careful about whose hands those are.
If any of the above describes a problem you have, or a question you have been unable to resolve elsewhere, we would be interested to hear about it.
