As critical infrastructures increasingly rely on interconnected devices, cloud platforms, and edge computing, one question keeps coming up: when something suspicious happens somewhere in that chain, who decides what to do about it and how fast?

Inside the CyberNEMO project, that job belongs to the Continuum Access Security Broker (CASB), a component designed and developed by SPACE Hellas.

What CASB Actually Does

Think of CASB as a dispatcher for security incidents, the same role a control room plays at a power plant or a water treatment facility when something goes wrong, just applied to cybersecurity instead of physical operations. Across a modern IT environment spanning cloud, edge devices, and everything in between many different tools are constantly watching for suspicious behavior: unusual logins, strange network traffic, unexpected system activity. On their own, these are just incoming signals; someone, or something, still has to decide what to actually do about each one.

That’s where CASB comes in and, like any good dispatcher, it can respond in two ways.

Most of the time, CASB reacts automatically: it takes incoming alerts, matches them against known attack patterns, and immediately dispatches the appropriate response for example, restricting network access to an affected device or service. A set of guardrail policies acts as a safety net on this automatic path, stopping any action that could affect sensitive, core parts of the underlying infrastructure itself.

Alongside that, a security operator can also step in directly and dispatch a mitigation themselves through the CASB dashboard (based on Airflow software) useful when a situation calls for human judgement rather than an automatic reaction. Whichever path is used, every action is logged and visible to the team in real time, so nothing happens without a clear, traceable record of what was done and why.

This combination is deliberate. In an active incident, low-risk, well-understood responses can be dispatched instantly without waiting on a person while operators retain the ability to step in and dispatch a response themselves whenever a situation calls for their judgement, with full visibility into everything that happens either way.

Why This Matters for Critical Infrastructure

CyberNEMO’s mission is to strengthen cybersecurity across sectors like energy, water, healthcare, media, and finance sectors where a slow or wrong response to a cyberattack can have real-world consequences. CASB doesn’t work alone: it’s one piece of a larger CyberNEMO security framework, coordinating closely with other components that detect threats, enforce network policies, and maintain an overall picture of the system’s security posture.

By centralizing how response decisions are made rather than leaving each tool to act independently CASB aims to make security responses more consistent, auditable, and easier to manage across large, distributed environments.

Where Things Stand Today

CASB’s architecture is fully designed, and the core building blocks automatic detection-to-response processing, safety guardrails, and the operator dashboard have been implemented and are running in CyberNEMO’s experimental lab infrastructure. The team is now working on broadening guardrail coverage and hardening the component ahead of the next stage: validation within CyberNEMO’s real-world pilot sites.

As with any research project, this is progress-in-motion rather than a finished product and we’ll share concrete results from pilot testing as they become available, rather than before.

What’s Next

Over the coming months, the CASB team at SPACE Hellas will focus on integrating the component more tightly with the rest of the CyberNEMO platform and preparing it for pilot deployment. We’ll follow up with a more detailed look at how CASB performs once it’s tested in a live environment.

The Media and Broadcasting Industry: New Opportunities, New Cybersecurity Challenges

The media and broadcasting industry is undergoing an unprecedented transformation. The need to produce and distribute high-quality multimedia content with massive bandwidth and minimal latency has driven the adoption of distributed infrastructures across the Edge-Cloud continuum.

However, this technological evolution brings a critical challenge: a significant increase in the surface area exposed to cyberattacks.

What is the CyberNEMO Project?

CyberNEMO (End-to-end CYBERsecurity to NEMO meta-OS) is an innovative initiative funded by the European Union’s Horizon Europe programme.

Its main objective is to add a transversal layer of comprehensive cybersecurity and trust to the IoT-Edge-Cloud computing ecosystem. To achieve massive adoption and technological maturity, CyberNEMO builds upon Zero-Trust cybersecurity systems, privacy-by-design protection, innovation, and collaboration, introducing new methods, tools, and threat analysis platforms.

The Smart Media Pilot: A Critical Environment

One of the key validation environments within the project is Pilot 3: Secure and Intelligent Media Content Supply Chain Ecosystems.

This pilot focuses on validating end-to-end cybersecurity measures throughout the entire lifecycle of professional media workflows.

The pilot addresses the inherent conflict in the media industry: the operational demand for high speed and low latency versus the critical need for robust, multi-layered security.

It focuses on mitigating sophisticated threats that can compromise the supply chain at any point—from the initial content capture (contribution phase), through intermediate processing stages (production phase), to final delivery to users (distribution phase). Protecting this ecosystem requires guaranteeing data sovereignty and system resilience without degrading media quality or introducing unacceptable delays.

The pilot is divided into two main use cases:

• Secure and Collaborative Multimedia Content Production: Focused on secure content contribution, access control, content integrity verification, and anomaly detection during remote production.
• Efficient and Secure Distribution across Multi-domain Edge-Cloud: Focused on secure distribution to authorized users, malicious traffic detection, and the implementation of countermeasure actions during content delivery.

How Does CyberNEMO Support the Smart Media Pilot?

The integration of CyberNEMO technologies transforms this pilot into a highly secure environment. By deploying advanced cybersecurity components, CyberNEMO provides fundamental capabilities such as:

• Zero-Trust Architecture: Implementing strict security policies where no device or user is trusted by default, ensuring that production tools and media streams communicate only through authenticated and authorized channels.
• Intelligent Anomaly Detection: Using behavioural analysis and security logs (network logs, video quality metrics, and access logs) to identify unusual activities that may indicate cyberattacks, credential theft, or malicious actions during live media transmission.
• Proactive Mitigation: Detecting malicious traffic or content integrity violations in real time and automatically isolating compromised components without disrupting live production or media distribution workflows.

Building Secure Media Ecosystems

CyberNEMO provides the Smart Media sector with the cybersecurity framework and intelligent tools required to operate decentralised remote production infrastructures with confidence, resilience, and operational continuity.

As part of the CyberNEMO project, ASM Terni contributes as the pilot partner for Trial #2, focused on Smart Energy and Smart Water Critical Infrastructures.

ASM operates essential urban services in Terni, including electricity distribution, water services, and related digital monitoring systems. These infrastructures are increasingly connected through sensors, smart meters, SCADA systems, communication networks, and data platforms. While this digital transformation improves efficiency and service quality, it also introduces new cybersecurity challenges. Within CyberNEMO, ASM provides a real pilot environment where innovative cybersecurity solutions can be validated in practical conditions.

The trial focuses on understanding how cyber threats may affect interconnected energy and water assets. It also supports the analysis of anonymized operational data, network events, and security-related information.

The objective is not only to detect possible cyber incidents, but also to improve preparedness, resilience, and response capabilities. CyberNEMO technologies will help explore advanced monitoring, risk analysis, and mitigation approaches across the cloud-edge-IoT continuum.

For ASM, this represents an important opportunity to connect research outcomes with the needs of real critical infrastructure operators.

The pilot also highlights the importance of protecting citizen services, operational continuity, and data privacy. By participating in CyberNEMO, ASM contributes to building more secure, resilient, and trustworthy smart utility systems.

Trial #2 demonstrates how collaboration between technology providers, researchers, and infrastructure operators can support the future of European critical infrastructure protection.

Cyber threat intelligence is often hidden inside unstructured sources such as security blogs, advisories, and open-source reports. Although these sources contain valuable information, manually turning them into actionable intelligence is slow, difficult, and not scalable.

STS, within CyberNEMO, proposes an automated pipeline that transforms open-source cyber threat intelligence into structured and usable knowledge. The pipeline combines deterministic methods with Generative AI to support the full process: scraping threat reports, extracting relevant information, converting it into STIX 2.1 objects, storing it in OpenCTI, and using it for threat hunting and response.

The system uses a modular Python architecture and Docker-based deployment to connect different tools in a reproducible way. Stixify is used to convert raw text into structured STIX objects, while OpenCTI currently acts as the central knowledge base for visualization, sharing, and standardization.

The main contribution is showing that Generative AI can strengthen cyber defense when combined with existing standards and tools. Deterministic methods remain useful for clear indicators of compromise, while AI helps extract context, relationships, and more complex threat patterns.

Overall, STS’ initial work shows a practical path toward proactive cyber defense: transforming unstructured threat information into standardized intelligence that can support faster analysis, hunting, and response.

Every day, critical infrastructures generate enormous amounts of cyber data, from hospitals and smart energy networks to drones, media platforms, and logistics systems. This information is essential for developing better cybersecurity tools, but it also raises an important question:

How can we share valuable cyber data without exposing people’s privacy?

At CyberNEMO, the answer is anonymisation.

Why Technical Data Isn’t as Anonymous as It Looks

Many people assume that if a dataset doesn’t contain names, it’s already anonymous. Unfortunately, that’s not always true.

Technical information such as IP addresses, timestamps, GPS locations, or device identifiers can often be linked back to individuals, organisations, or specific systems. Even cybersecurity logs can reveal working patterns, locations, or sensitive infrastructure details.

That’s why every dataset collected across CyberNEMO’s pilots is treated as potentially identifying, even when no personal names are present.

Turning Sensitive Data into Safe, Reusable Datasets

CyberNEMO applies several anonymisation techniques that protect privacy while preserving the information researchers need.

Some examples include:

• Replacing real identities with anonymous labels so users and devices can still be tracked within a dataset without revealing who they are.
• Masking IP addresses to hide the exact location of computers while keeping network traffic patterns intact.
• Generalising timestamps, for example recording activity by hour instead of by the exact second.
• Reducing GPS precision so drone flights and smart infrastructure can be analysed without revealing precise locations.
• Hiding sensitive server names and service details while maintaining realistic communication patterns.
• Generalising medical information so healthcare datasets remain useful for cybersecurity research without exposing patient information.

The goal is simple: preserve the value of the data while removing the details that could identify people or critical systems.

Why This Matters

Effective anonymisation allows CyberNEMO to balance two equally important goals:

• Protect citizens’ privacy and comply with GDPR.
• Enable researchers, innovators, and cybersecurity experts to work with realistic datasets.

This supports the European vision of privacy by design, helping organisations collaborate without exposing sensitive information.

From Protected Data to Shared Knowledge

Once anonymised and validated, CyberNEMO datasets can be securely shared across the consortium to support the development and validation of cybersecurity technologies.

Following the FAIR principles (Findable, Accessible, Interoperable and Reusable), selected anonymised datasets are planned to be published through trusted open-data repositories such as Zenodo, subject to consortium approval and the necessary legal and ethical clearances.

Publishing datasets through Zenodo provides long-term preservation, persistent Digital Object Identifiers (DOIs), and enables researchers worldwide to discover, cite, and reuse CyberNEMO research outputs.

This approach allows researchers to evaluate new cybersecurity techniques using realistic operational data while fully respecting privacy and data protection requirements.

The benefits extend well beyond the CyberNEMO project:

• Researchers can develop, benchmark, and validate new cybersecurity detection algorithms using realistic datasets.
• SMEs and technology providers can accelerate the development of innovative cybersecurity products and services.
• Public authorities and critical infrastructure operators can promote secure, trustworthy, and responsible data sharing across Europe.
• The wider research community benefits from reusable datasets that support reproducible research and future innovation in cybersecurity and critical infrastructure protection.

Privacy Enables Innovation

Anonymisation is often viewed as a compliance requirement, but in CyberNEMO it is much more than that.

It is the foundation that transforms sensitive operational data into trusted, reusable knowledge. Instead of keeping valuable cybersecurity information locked away, anonymisation allows Europe to share what matters while protecting the people behind the data.

That’s how CyberNEMO helps build a stronger, more collaborative, and more privacy-conscious cybersecurity ecosystem.

Kubernetes revolutionised the deployment of cloud-native applications by making workloads portable, scalable, and easy to orchestrate. However, while Kubernetes excels at managing applications, its networking model introduces an important challenge for network services: a lack of flexibility in its networking model.

Most Kubernetes deployments rely on a flat network approach where every pod can potentially communicate with every other pod inside the cluster. Although Network Policies can restrict some traffic flows, workloads still fundamentally share the same networking space. For traditional microservice applications, which are usually application-layer oriented, this behaviour may be acceptable, but for network functions, multi-tenant platforms, or security-sensitive services, this approach quickly becomes limiting. This is where micro-segmentation becomes critical.

Micro-segmentation is the practice of dividing an infrastructure into isolated virtual network segments, where workloads only communicate with the components explicitly allowed to them. Instead of treating the cluster as a single trusted environment, micro-segmentation applies the principles of least privilege directly to network connectivity.

The benefit of applying micro-segmentation over K8s platforms can be substantial. First, micro-segmentation improves security by reducing lateral movement. If one workload becomes compromised, attackers cannot freely traverse the infrastructure to reach other services. Each segment behaves as an isolated environment with controlled entry and exit points.

Second, it enables the deployment of advanced network services inside Kubernetes. Functions such as firewalls, routers, proxies, or content delivery components often require separated Layer 2 or Layer 3 domains to operate correctly. In a flat network, these services lose much of their networking context because every workload remains directly reachable.

Third, micro-segmentation simplifies multi-tenant deployments. Different applications, customers, or services can coexist within the same Kubernetes infrastructure while remaining logically isolated from one another. This becomes increasingly important in edge computing, telecom platforms, and distributed cloud environments.

At the infrastructure level, achieving true micro-segmentation requires more than simple traffic filtering. It requires programmable virtual networking capable of creating isolated communication domains between workloads, independently of where they are physically deployed. This becomes even more relevant in distributed cloud-edge environments, where services may span multiple Kubernetes clusters and heterogeneous infrastructures.

To address these challenges, the CyberNEMO Zero Trust Network Access (ZTNA) framework extends the capabilities of the NEMO meta Network Cluster Controller (mNCC) to provide secure micro-segmentation mechanisms for both intra-cluster and inter-cluster communications. By enabling isolated virtual networking domains across cloud-native infrastructures, CyberNEMO introduces a flexible networking foundation for advanced network services, secure workload isolation, and distributed edge deployments. In next posts, we will explore in more detail the technology behind this functionality:

L2S-M.Why Micro-Segmentation Matters in Kubernetes

Kubernetes revolutionised the deployment of cloud-native applications by making workloads portable, scalable, and easy to orchestrate. However, while Kubernetes excels at managing applications, its networking model introduces an important challenge for network services: a lack of flexibility in its networking model.

Most Kubernetes deployments rely on a flat network approach where every pod can potentially communicate with every other pod inside the cluster. Although Network Policies can restrict some traffic flows, workloads still fundamentally share the same networking space. For traditional microservice applications, which are usually application-layer oriented, this behaviour may be acceptable, but for network functions, multi-tenant platforms, or security-sensitive services, this approach quickly becomes limiting. This is where micro-segmentation becomes critical.

Micro-segmentation is the practice of dividing an infrastructure into isolated virtual network segments, where workloads only communicate with the components explicitly allowed to them. Instead of treating the cluster as a single trusted environment, micro-segmentation applies the principles of least privilege directly to network connectivity.

The benefit of applying micro-segmentation over K8s platforms can be substantial. First, micro-segmentation improves security by reducing lateral movement. If one workload becomes compromised, attackers cannot freely traverse the infrastructure to reach other services. Each segment behaves as an isolated environment with controlled entry and exit points.

Second, it enables the deployment of advanced network services inside Kubernetes. Functions such as firewalls, routers, proxies, or content delivery components often require separated Layer 2 or Layer 3 domains to operate correctly. In a flat network, these services lose much of their networking context because every workload remains directly reachable.

Third, micro-segmentation simplifies multi-tenant deployments. Different applications, customers, or services can coexist within the same Kubernetes infrastructure while remaining logically isolated from one another. This becomes increasingly important in edge computing, telecom platforms, and distributed cloud environments.

At the infrastructure level, achieving true micro-segmentation requires more than simple traffic filtering. It requires programmable virtual networking capable of creating isolated communication domains between workloads, independently of where they are physically deployed. This becomes even more relevant in distributed cloud-edge environments, where services may span multiple Kubernetes clusters and heterogeneous infrastructures.

To address these challenges, the CyberNEMO Zero Trust Network Access (ZTNA) framework extends the capabilities of the NEMO meta Network Cluster Controller (mNCC) to provide secure micro-segmentation mechanisms for both intra-cluster and inter-cluster communications. By enabling isolated virtual networking domains across cloud-native infrastructures, CyberNEMO introduces a flexible networking foundation for advanced network services, secure workload isolation, and distributed edge deployments. In next posts, we will explore in more detail the technology behind this functionality: L2S-M.