More
View

Observability & Verification
for Earth Observation
& Geospatial Services

SPHEROID independently verifies the quality of delivered EO data and geospatial services, detecting issues that infrastructure monitoring may miss.

Request a technical briefing
Back to top
ScaleApp

Geospatial Security Assessment

Specialised security assessments of EO and geospatial services: how they enforce access restrictions, preserve data integrity and what they expose.

Discuss a security assessmentExplore assessment scope

Security blind spots

What Security Monitoring Can Miss

IT security tools inspect hosts, ports and HTTP traffic. They do not check whether the features in a response fall inside the area a user is permitted to see.

Request or assetRecorded by WAF and SIEMWhat actually happened
WFS GetFeature200 OK, normal trafficFeatures returned outside the user's authorised areaPartner sees other operators' assets
Map tile requestCache hitCached tile exposed data restricted at the source serviceRestricted layer made public
STAC catalogueItem servedRestricted asset reachable through an exposed signed URLDownload without authorisation
Imagery with a TIME parameterValid requestEmbargoed acquisitions released before their datePre-release imagery made public

These cases are not software vulnerabilities and cannot be fixed with a patch. They are found by reading responses as geospatial data, against the access policy of each service.

Intended for

Security officers

Findings with evidence, referenced to the frameworks they use.

SDI and geoportal operators

Access verified per role, layer and area.

EO service operators

Data served checked against data produced.

Defence and security organisations

Assessment within the organisation's own infrastructure.

Assessment scope

Three Areas We Assess

01

Geospatial Access Control

Evaluate how access restrictions are implemented and enforced across geospatial services, including geographic coverage, data resolution, coordinate precision and user permissions.

Access policy per role

+
-

Access by role, layer, area, attribute and export, tested within scope with a recorded result.

Cache and tile bypass

+
-

Cached tiles served without the access rules of the source service.

Embargo and licensing

+
-

Data released before its date or above its licensed resolution.

Location precision

+
-

Protected features published with more precision than policy allows.

02

Data Integrity & Provenance

Assess mechanisms used to detect unauthorised or unexpected changes to geospatial datasets, metadata and published services.

Spatial data changes

+
-

Geometries and attributes changed outside the expected update process.

Metadata and position checks

+
-

CRS, bounds, timestamps and positions checked against what each product should carry.

Asset integrity and signatures

+
-

Served assets compared with catalogue checksums, sizes and signatures where published.

EO processing provenance

+
-

Where records exist, derived datasets traced to approved sources and processing steps.

03

Attack Surface & Exposure

Assess how geospatial APIs, services and infrastructure components expose interfaces, data and potentially sensitive information.

Inventory and known vulnerabilities

+
-

Endpoints in scope and their software versions, reviewed against published and exploited vulnerabilities.

Exposed write and administration functions

+
-

Write methods, processing services and administration consoles reachable without intended controls.

Server-side request forgery

+
-

Remote styles, processing inputs and URL-based rendering that can reach the internal network.

Credentials and public storage

+
-

Credentials in service URLs and catalogue links, and buckets open beyond intended publication.

How We Work

The process and its limits, agreed before any testing starts.

  • Scope, rules and least-privilege accounts agreed first
  • Testing only within the authorised scope and constraints
  • Findings verified and documented with evidence
  • Results reviewed with your engineering and security teams
  • Retest of remediated findings, where agreed

What You Receive

A technical assessment report documenting:

  • Identified security weaknesses and exposure risks
  • Affected services, interfaces or configurations
  • Supporting technical evidence
  • Risk prioritisation
  • Recommended remediation actions

Standards and Frameworks

  • NIS2 and CERRisk management measures of NIS2 Article 21 and CER.
  • ISO/IEC 27001:2022Relevant Annex A controls.
  • OWASP API Security Top 10Relevant API security risks.
  • MITRE ATT&CKTechniques, where applicable.

Tell us which services you operate, and we will propose a scope, a timeline and the access needed.

Discuss a Security Assessment

Discuss a security assessment