Royal Thai Navy: cybersecurity and surveillance enhancement through Section 31 International

A navy's networks hold identities, access and operational data that are worth attacking, and its estates are watched by camera hardware that was installed to record rather than to understand. The brief had two halves: keep the architecture hardened against attack without waiting for the next annual test, and make the existing cameras produce usable intelligence without replacing them.

The work is delivered through Section 31 International, Opsian's route into defence and critical-infrastructure work in Thailand.

A penetration test done once a year describes the system as it was on that day. The engagement covers automated penetration testing that runs continuously against the architecture, so that a change made this week is tested this week, and the findings feed back into hardening rather than into a report that waits for the next budget cycle.

Findings are ranked by risk and fixed in order, with least-privilege access, managed secrets, separation of duties and audit logging built into the systems themselves, the same practice Opsian applies to every system it secures.

On the surveillance side, the system is designed to run smoke, fire and facial detection in software on the feeds from existing cameras, so that the hardware already on the walls becomes a source of intelligence rather than a store of footage. Detection raises an event; the event reaches the person who should act on it; and the record of what was detected, when, and what was done about it is kept.

The defence context limits what can be said publicly about scope and results. What can be said is the shape of the work: a security posture that is tested continuously, and a surveillance estate that is read by software rather than only recorded.