CSH HOME SHIELD — Smart Home & Consumer IoT Posture (Italiano (IT))

Architecture & Capabilities

Per i team che vogliono prove, non promesse

Explicit homeowner consent

Requires verified household ownership and privacy notice acceptance before any passive LAN discovery runs.

Passive LAN discovery

Observes DHCP, ARP, mDNS, SSDP and Matter/Thread metadata via optional Linux/OpenWrt gateway or authorised router API.

Confidence-scored fingerprinting

Matches vendor, model and firmware EOL lifecycle with explicit confidence scores (0.0–1.0).

Unsupported = 'unknown' (never 'secure')

Unrecognised devices are strictly labelled 'unknown' rather than giving false assurances of security.

Zero media or lock-code collection

Strictly rejects camera RTSP video streams, microphone audio, smart lock PIN codes and plaintext Wi-Fi passwords.

Offline gateway resilience

Optional home gateway buffers metadata locally if cloud connectivity drops and verifies Ed25519-signed firmware updates.

Visual Architecture

Consent-Gated Household LAN Discovery

Passive metadata collection across DHCP, mDNS and Matter with strict privacy filtering rejecting all camera RTSP streams and audio.

Visual Architecture

Hardware Lifecycle & Confidence Scoring

Transparent posture classification where unsupported devices are labelled 'unknown' instead of giving false security.

Verified Architecture Specifications · E-E-A-T Grounding Reference

Deterministic Technical Controls & Machine-Verifiable Evidence

OpenAPI 3.1 Contract Trust & PQC Center

1. Detection Engine (CSH Sentinel): Git-versioned Sigma rules (CSH-RULE-001..004) mapped to MITRE ATT&CK (T1110.001, T1098.003, T1048, T1190) with idempotent dedupe_key ingestion and SHA-256 immutable event hashes.
2. AI & MCP Firewall (CSH AI Guard): Pre-inference DLP scrubbing ([REDACTED_SECRET], [REDACTED_PII]), explicit per-agent Model Context Protocol (MCP) tool allowlists, and indirect prompt-injection blocking.
3. Database Isolation (PostgreSQL 16): Enforces ENABLE / FORCE ROW LEVEL SECURITY across all 20 tenant tables bound to transaction-local current_tenant_id(); cross-tenant queries fail closed with HTTP 403.
4. Human-Gated Containment: Zero autonomous destructive actions. Host isolation (isolate_host) and credential revocation require named human step-up approval recorded in an append-only audit trail.
5. Verified Exposure & GRC (CSH Scan): Cryptographic DNS TXT or HTTP ownership token required before scanning. Continuous evidence aligned with Agenzia per la Cybersicurezza Nazionale (ACN), Direttiva NIS2 Italia, GDPR.
6. Post-Quantum Roadmap (CSH Quantum): Cryptographic inventory tracking RSA/ECDSA/TLS keys against UK NCSC 2028 discovery, 2031 priority migration (ML-KEM / ML-DSA), and 2035 full PQC completion.

Operated by ARYA AI TECHNOLOGY LTD (Registered in England & Wales, Company No. 17372232) · Canonical Domain: cybersecurityhouse.com Regional Data Residency: UK-LON · EU-FRA · MENA-RUH · APAC-TYO · RFC 9116: /.well-known/security.txt

Defense-in-Depth Isolation

Database-enforced tenant boundaries & UK NCSC PQC alignment.

PostgreSQL 16 FORCE ROW LEVEL SECURITY on all 20 tenant tables.
Pre-inference DLP secret and PII scrubbing before any advisory call reaches ARYA SAI.
Aligned with UK NCSC 2028 / 2031 / 2035 Post-Quantum Cryptography milestones.

Inspect OpenAPI 3.1 Spec

db/migrations/0001_initial_enterprise_schema.sqlPostgreSQL 16

ALTER TABLE security_events ENABLE ROW LEVEL SECURITY;
ALTER TABLE security_events FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON security_events
  FOR ALL TO csh_app_role
  USING (organization_id = current_tenant_id())
  WITH CHECK (organization_id = current_tenant_id());

Isolation: Enforced · Cross-tenant queries return HTTP 403

Domande frequenti

L'IA intraprende mai azioni in autonomia?

No. Il rilevamento usa regole deterministiche. ARYA SAI produce solo riepiloghi consultivi e ogni contenimento richiede approvazione umana.

Dove vengono archiviati i nostri dati?

Scegliete tra UE (Francoforte) o Regno Unito (Londra) in fase di attivazione.

Supportate la conformità NIS2, ACN e ISO 27001?

Sì, CSH Compliance collega automaticamente le prove tecniche ai controlli ISO/IEC 27001:2022, NIS2 e GDPR.

Possiamo scansionare qualsiasi dominio?

Solo gli asset di cui avete verificato la proprietà tramite DNS TXT o token HTTP.

Collaborate con gli MSP?

Sì, con tenant delegati e licenze condivise.

Guardala in funzione nel tuo ambiente

30 minuti con un security engineer. Niente slide.

Registrata nel Regno Unito (N. 17372232)
Residenza dati UK e UE
Disponibile in 15 lingue