Scenario 6 - Watch the Watchers
Shift Turnover Notes
Section titled “Shift Turnover Notes”Date: Monday, 1345 Local (Galway runs UTC in March) Station: GW-01 Galway, Ireland - NATS Europe Operator on Duty: You Site Lead: Charlie Brooks (on-site, in and out) Group Security: Priya Sharma, NATS Group Security (London; reads the return a fortnight after you file it)
Quiet one. SAR-1 at 14:03 and SAR-2 at 14:18, both routine downlinks that need nothing from you beyond doing them properly. The item that actually needs you is the monthly security baseline, which nobody enjoys and which I want done properly too.
Every console action at this site is logged. Once a month somebody reads all of it. This month that is you. You’ll find nothing. Find it properly. And do not miss the pass while you are finding it.
- Charlie (text, 1344)
Group Security Memo
Section titled “Group Security Memo”Ref: GS-BASELINE-GW01-03 From: P. Sharma, NATS Group Security To: GW-01 Site Lead Subject: March station baseline return
Monthly return for GW-01 is due by close of business Friday. Standard scope: full audit-trail review since the last return, every warning-severity event dispositioned, and an account roster reconciled against current authorisation. Anything flagged, tell us what it was and what you did about it. Anything not flagged, we assume you looked.
A note for new sites: the install phase leaves things behind. Check that every account still corresponds to somebody who should have it.
Current Operations (epoch 13:45:00 UTC, 5° mask)
Section titled “Current Operations (epoch 13:45:00 UTC, 5° mask)”| Satellite | Contact | AOS | Rise az | Max El | LOS | Tasking |
|---|---|---|---|---|---|---|
| MERIDIAN-SAR-1 | Routine downlink | 14:03:10 | 000° | 28° at 14:06:45 | 14:10:18 | Decode; no acceptance, no command |
| MERIDIAN-SAR-2 | Routine downlink | 14:18:42 | 130° | 25° at 14:22:10 | 14:25:40 | Decode |
Decode windows (C/N ≥ 8 dB): SAR-1 about 14:05 to 14:08:30; SAR-2 about 14:20:30 to 14:24. Both sites are operational. SH-02 is logged in remotely for its own work.
The baseline fits around the passes, not instead of them: sweep and set up, read the trail and disposition the benign warnings before 14:03, decode SAR-1, then the finding, the roster and SAR-2.
Link Parameters
Section titled “Link Parameters”LNB is high-side injection: IF = LO − RF (13,100 MHz LO).
| Signal | RF (MHz) | IF (MHz) | Format |
|---|---|---|---|
| SAR-1 imagery downlink | 11,686 | 1,414 | QPSK 3/4, 36 MHz |
| SAR-1 telemetry beacon | 11,711 | 1,389 | CW |
| SAR-2 imagery downlink | 11,730 | 1,370 | QPSK 3/4, 36 MHz |
| SAR-2 telemetry beacon | 11,703 | 1,397 | CW |
Account Roster (Access Control panel)
Section titled “Account Roster (Access Control panel)”| Account | Holder | Role | Status at Turnover | Authorisation |
|---|---|---|---|---|
| op-charlie | C. Brooks | Site Lead | active | Current |
| op-duty | Operator on duty (you) | Operator | active | Current |
| op-fiona | F. MacLeod | Operator (SH-02) | active | Current; remote login expected |
| svc-monitor | Monitoring Service | Service account | active | Current; polls telemetry on schedule |
| op-guest | Kilbride Antenna Services | Maintenance (contractor) | active | Feed work completed three weeks ago; install window closed |
| op-relief | T. Nakamura | Relief Operator (Vermont secondment) | active | Secondment ended 28 February; last entry is a logout on the 27th |
Available statuses on the panel: active, disabled, expired. Disabled is a deliberate shut-off; expired records that the authorisation lapsed and forces re-authorisation through London before any further use. Same effect today, different story in the return.
Audit Trail Reference
Section titled “Audit Trail Reference”| Column | Meaning |
|---|---|
| Time | UTC timestamp of the action |
| Actor | Account that performed it |
| Category | auth, config, or command |
| Severity | info or warning |
| Flag | Marks the entry for the monthly return, with its disposition |
| Sign Off Review | Records that the whole trail was read, end to end |
What routine looks like at GW-01
Section titled “What routine looks like at GW-01”| Pattern | Expected |
|---|---|
| Console logins by site staff | During shift hours, 0600 onward |
| Receiver and antenna configuration changes | Made by op-charlie or the operator on duty, logged as config |
| TT&C command acknowledgements | Logged as command, during pass windows |
| COMSEC key rotation | Logged as command, by the operator who ran it |
| Monitoring service telemetry polls | Regular, on the half hour |
| Monitoring service configuration changes | Scheduled, with a change ticket reference |
| Remote logins from SH-02 | Fiona, during her shift |
The three warnings
Section titled “The three warnings”The logger scores rarity; you score meaning. Three entries carry warning severity this month, and each is dispositioned on who, what and when:
| Entry | Actor | What | Disposition |
|---|---|---|---|
| 06:30 | op-fiona | Console login from a source address the station has never seen | Shetland went operational this week; its address is new to the rule. Expected, explained, checkable against the site register. |
| 03:00 | svc-monitor | Configuration change to its own poll interval, change ticket CHG-0412 | The right actor doing the thing it exists to do, when the ticket said. Off-hours is a property of people, not of a scheduler. |
| 02:47 | op-guest | Six failed logins, off-hours | An account that should no longer exist, at an hour nobody authorised should be trying it. Finding, whether or not anything got in. |
Priya’s order: flag the entry, note the time you saw it, then disable the account. The order matters to her later.
Escalation
Section titled “Escalation”Handle yourself:
- Flagging entries for the return, with dispositions
- Disabling accounts whose authorisation has lapsed; expiring accounts whose holders have left
- Signing off the trail
Ring Charlie, then London:
- Any successful authentication by an account that should not have one
- Configuration or command entries by an actor you cannot account for
- Evidence that key material was touched outside a scheduled rotation
None of the above is expected today. That is why you read the whole log rather than the interesting-looking bits.
GW-01 Equipment Status
Section titled “GW-01 Equipment Status”| Equipment | Status | Notes |
|---|---|---|
| 4 m Ku tracker | Powered, manual, parked az 5° / el 3° | Program-track available |
| LNB | 13,100 MHz LO, reference locked | Stable |
| GPSDO | Locked, 9 satellites | Disciplined |
| RX modem 1 | 1,370 MHz / 36 MHz / QPSK 3/4 | Charlie’s 06:14 SAR-2 loopback test, as the log records. Retune to 1,414 MHz for SAR-1. |
| Spectrum analyzer | 1,414 MHz centre, 60 MHz span | Move to the SAR-1 beacon, 1,389 MHz, 2 MHz span |
| BUC / HPA | No drive / output disabled | No uplink tasking this shift |
Baseline Checklist
Section titled “Baseline Checklist”Before AOS (13:45 – 14:03)
Section titled “Before AOS (13:45 – 14:03)”- Dashboard: only the RX AGC no-carrier warning (noise only, empty sky); no faults
- GPS Timing: GPSDO locked, not in holdover
- RX modem 1: 1,414 MHz; analyzer centre 1,389 MHz, span 2 MHz
- Security console: audit trail read from first entry to last; review signed off
- 06:30 new-address login dispositioned (benign)
- 03:00 poll-interval change dispositioned (benign, CHG-0412)
SAR-1 (14:03 – 14:10)
Section titled “SAR-1 (14:03 – 14:10)”- Program-track on MERIDIAN-SAR-1; beacon on RX analysis
- Modem locked on 1,414 MHz, C/N ≥ 8 dB through the high segment
After LOS (14:10 – 14:18)
Section titled “After LOS (14:10 – 14:18)”- 02:47 off-hours failures flagged (finding)
- op-guest set to disabled
- op-relief set to expired
- RX modem 1: 1,370 MHz; analyzer centre 1,397 MHz
SAR-2 (14:18 – 14:25)
Section titled “SAR-2 (14:18 – 14:25)”- Program-track retargeted to MERIDIAN-SAR-2; modem locked, C/N ≥ 8 dB
The return
Section titled “The return”- Findings and dispositions recorded for the March return
End of Briefing
Section titled “End of Briefing”“Nothing happened” is a conclusion, not an assumption. You reach it by reading everything, and a return that says so is only worth anything if you did.
A dormant account with maintenance privileges is exposure whether or not anyone used it. If somebody was trying it at three in the morning, London will want to know that too. And a baseline that cost the station a pass would not be a baseline; it would be an outage with paperwork.
Good luck.