Awareness and training: sessions on counter-espionage, hybrid threats and subversion

In doing so we look at physical and digital security, and at what often goes unseen between the two: the room, the equipment and the signals that can fall outside regular security measures.

The content is based on academic research and years of practical experience, and is tailored to the threat profile, the audience and the context of each client.

Our sessions are usually commissioned by departmental security officers and CISOs. For a CISO they are relevant because the subject is information processed by network and information systems, while the Dutch Cybersecurity Act expressly brings the physical environment of those systems into the risk assessment as well. For a departmental security officer they connect to the responsibility for integrated security: physical, personnel and information security meet at technical espionage.

A system can be patched, encrypted and air-gapped and still give information away.

That is because digital information is ultimately processed physically. Electrical circuits, displays, cables and other components produce side effects. Information can be derived from those without the system having been hacked and without any regular network traffic taking place. Such compromising emanations are the domain of TEMPEST.

We use the physical layer, layer 1 of the OSI model, as a recognisable starting point, but the session reaches wider. We also cover other physical side channels, covert channels, covertly placed technical devices and situations where digital, physical and human attack techniques come together.

The view then shifts from what a system means to communicate to the broader question: what does the system give away unintentionally?

Our sessions are not intended for engineers alone. They are built up visually and practically, deliberately accessible to a broad audience of managers, policymakers, risk professionals, security officers, IT and OT teams and other staff who want to understand modern threats better.

Technical participants get enough depth. For non-technical participants the emphasis is on insight, recognition and the question of what these risks mean for their own organisation.

Subjects include

• what TEMPEST is and why it matters;
• why encryption, firewalls and air gaps do not cover every risk;
• electromagnetic, optical, acoustic and other physical side channels;
• the difference between unintentional leakage and deliberately created covert channels;
• how cybersecurity, physical security, subversion and hybrid threats hang together;
• how to weigh these risks realistically in a threat model.

Keynote demo: 60 to 75 minutes

A striking, energetic introduction for a broad audience. With a live demonstration, research and compelling examples from practice, we show how information can become visible or reachable outside the usual digital channels.

Suitable for conferences, awareness programmes, management meetings, security events and courses. The emphasis is on curiosity, understanding and discussion, introducing the subject without any technical background being required.

Half-day workshop with labs

For groups that want to go further into the technique. Alongside theory, participants work with signals, observations and simple experiments themselves. Step by step we build a threat model and examine how source, environment, distance and adversary capability determine whether a risk is genuinely relevant.

Suitable for security teams, engineers, students and groups that want to connect cybersecurity and physical security in an espionage or subversion context.

In-house session

A session shaped entirely around the organisation itself. TEMPEST, physical side channels and hybrid threats serve as a lens for looking again at your own environment: workplaces, meeting rooms, critical systems, OT, laboratories and other locations where sensitive information is processed.

The session can be set up for a technical team, a management group or a combination of the two. The aim is not to see hypothetical, exotic threats everywhere, but to establish together which scenarios are conceivable, which of those are relevant, and where the existing security model may need supplementing.

Afterwards, participants understand why the line between cyber and physical security is becoming less sharp. They recognise new kinds of information leak, can ask better questions about their own security, and have a practical framework for discussing advanced threats without disappearing straight into specialist technique.