The UK’s leading cybersecurity agency has urged device manufacturers to help incident response teams by making it easier for them to collect evidence after a compromise.
Chris A, technical director networking and infrastructure at the National Cyber Security Centre (NCSC), explained in a blog post on July 29 that firewalls, VPN gateways and other network devices are increasingly targeted by attackers.
“When incidents occur, organizations need reliable ways to understand what happened and assess whether a device can still be trusted. This is why forensic observability matters,” he said.
“It enables defenders to investigate compromise using supported capabilities built into the product, rather than relying on reverse engineering, or specialist vulnerability research – as is still often the case.”
Read more on forensics: Google Launches Android Spyware Forensics Tool for High-Risk Users
As defined by the NCSC, forensic observability means providing telemetry, logging, configuration state, and the ability to collect forensic data from memory and data at rest. It also demands transparency about the software running on a device, either via version information or a software bill of materials (SBOM).
However, many device manufacturers are falling short, even though “small design decisions can significantly reduce the time needed to triage and investigate incidents,” Chris A continued.
“Investigating a compromised device should not require discovering or exploiting vulnerabilities in the product itself. Instead, manufacturers should provide supported mechanisms for gathering the evidence needed to investigate incidents, assess impact and restore trust in affected systems.”
Dispelling Three Observability Myths
Chris A explained that observability means empowering defenders to do their job properly post incident. However, there are still misconceptions about the topic which may be holding manufacturers back from making the required design improvements, he added.
These are:
- Observability helps attackers: In fact, exposing telemetry will not provide more opportunities for exploitation. Well-designed features like structured logging, authenticated collection mechanisms, and clearly defined forensic interfaces will strengthen rather than undermine security, the NCSC said
- Customers will react negatively: Clear telemetry and forensic capabilities can actually build trust through improved visibility, the agency claimed
- It’s too difficult: Although it requires “careful engineering,” forensic observability is absolutely achievable, especially when prioritized early in the design process, the NCSC said
Chris A encouraged vendors to follow the NCSC’s guidance on building forensic observability in products, which was released in February 2025. He also urged IT buyers to push their vendors to provide such features.
In the meantime, the NCSC is working with global partners to develop a reference architecture for forensic observability in network appliances and similar devices.
Once finalized, this should help manufacturers provide “safe, reliable forensic access” which doesn’t diminish the security of their products.
