C5I Support

Keeping the Warfighter Connected 24/7/365

SPATHE is comprised of seasoned professionals with extensive experience in developing, implementing, and managing C5I systems. We understand the critical role that these systems play in modern defense operations and are committed to delivering solutions that enhance operational efficiency, situational awareness, and decision-making capabilities. We offer advanced command and control solutions that ensure seamless communication and coordination across various defense units. Our systems are designed to provide real-time data sharing and situational awareness, enabling commanders to make informed decisions swiftly and effectively.

Alignment to the C5I Framework

Hover or Click on any of the icons below to read more.

COMMAND

CONTROL

COMMUNICATIONS

COMPUTERS

CYBER

INTELLIGENCE

COMMAND

Spathe Systems supports numerous commanders across the SIE through many contracts we support, which include classified networks being used throughout the globe.

COMMUNICATIONS

Spathe Systems provides communication vehicles across the SIE that allow for frequent, highly mobile and capable to the SOF professionals to the information they need before they need it.

CONTROL

Spathe Systems manages classified, stand alone, and mobile which gives commanders a network platform to deliver on the spot directives to their subordinate commanders.

CYBER

We have experts in Computer Network Defense for multiple USSOCOM Networks that support the US War Fighter and the Mission Partner Environment.

COMPUTERS

Spathe Systems is leading the SOCOM Innovation Team for C4 Programs of Record in providing solutions to SOF to solve the problems of stagnant technology, problematic legacy processes and limited technology, including portable computing across secured networks.

INFORMATION

Spathe Systems currently provides solutions that allow new technologies for the existing SIE as it moves into a Cloud-based Enterprise DEVSECOPS, leading the Innovation Team. These new technologies will allow SOCOM to incorporate Artificial Intelligence and Machine Learning.

Click on an icon to see Spathe's work in each C5ISR category

Hover over each icon to read more about our capabilities in C5I

COMMAND

Vivamus varius eros id lectus auctor, dictum venenatis ex lacinia. Ut congue ultricies scelerisque. Nullam ex nMorbi sed ipsum non erat mattis sollicitudin ullamcorper et nisl. Fusce rhoncus ligula id metus fringilla consequat. Nunc auctor libero ac erat varius, ac ultrices lorem tempus. Nam sodales, metus nec semper posuere, velit velit commodo dolor, sit amet eleifend magna mauris sed enim. Quisque volutpat dui non nibh dignissim, ut interdum nulla pharetra. Etiam ullamcorper feugiat erat, ac accumsan odio rhoncus et. Cras lobortis urna vel feugiat fringilla. Suspendisse congue consectetur congue.

Vivamus varius eros id lectus auctor, dictum venenatis ex lacinia. Ut congue ultricies scelerisque. Nullam ex nibh, pellentesque vitae felis at, maximus auctor metus. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aliquam erat volutpat. Phasellus eros dui, tincidunt et bibendum sed, eleifend vel justo. Nulla nec turpis non turpis congue venenatis. Nam et nunc ac nisl ultricies porta.

Morbi sed ipsum non erat mattis sollicitudin ullamcorper et nisl. Fusce rhoncus ligula id metus fringilla consequat. Nunc auctor libero ac erat varius, ac ultrices lorem tempus. Nam sodales, metus nec semper posuere, velit velit commodo dolor, sit amet eleifend magna mauris sed enim. Quisque volutpat dui non nibh dignissim, ut interdum nulla pharetra. Etiam ullamcorper feugiat erat, ac accumsan odio rhoncus et. Cras lobortis urna vel feugiat fringilla. Suspendisse congue consectetur congue.

COMMUNICATIONS

CONTROL

COMBAT SYSTEMS

COMPUTERS

INTELLIGENCE

COMMUNICATIONS

Alignment to the C5I Framework

Tap on any of the icons below to read more about our C5ISR capabilities!

CORE CAPABILITIES

ALL THINGS CLOUD

SYSTEMS/SOLUTIONS

IT OPERATIONS

DEVSECOPS

BIG DATA

AISR

APPLICATION DEVELOPMENT

CYBER SECURITY

MACHINE LEARNING

Spathe Systems assists a secure, reliable, 24x7x365 global Command, Control, Computer, Cyber, Communications, Intelligence, Surveillance and Reconnaissance (C5ISR) Environment.

WHAT WE DO

CAPABILITIES

ALL THINGS CLOUD

SYSTEMS/SOLUTIONS

IT OPERATIONS

DEVSECOPS

BIG DATA

AISR

APP DEVELOPMENT

CYBER SECURITY

MACHINE LEARNING

CAPABILITIES

ALL THINGS CLOUD

SYSTEMS/SOLUTIONS

IT OPERATIONS

DEVSECOPS

BIG DATA

AISR

APP DEVELOPMENT

CYBER SECURITY

MACHINE LEARNING

CLOUD COMPUTING

Spathe Systems will help you modernize your organization to a Cloud Computing environment. We will bring our experience transforming DOD clients like yourself by guiding you through all phases of the transition including assessment of your current environment, recommend solutions with IAAS industry leaders, implementing the solutions, assessing your current application catalog and identifying those that could modernize to a container environment, and modernizing the applications. Spathe Systems has direct relationships with Amazon, Microsoft, Pivotal, IBM, Google, Red Hat and various other Cloud services and technology providers, and these relationships ensure that SPATHE is situated to provide you with the highest level of support. Spathe can leverage our cloud experience to assist with completing the following:

Develop a best practice prioritization criterion for application assessments and obtain government approval of the criteria.
Assess applications and their associated data stores in government designated priority order and determine the modernization requirements for each application. These requirements may include rehosting on IaaS, refactoring for PaaS, revising for IaaS or PaaS, rebuilding on PaaS, or replacing with SaaS based on cost, schedule and/or performance factors.
Collaborate with application developers, functional leads and program offices to obtain information on application programming language, functions, programming Interfaces (APIs), server-client relationships, data structure, system dependencies, and other data points as needed to complete the assessments.
Identify dependencies required for modernizing applications to operate on a private cloud.
Identify standards for how applications are to be developed in accordance with industry best practices for cloud security.
Upon request, provide guidance and assistance to local developers who are refactoring, revising, or rebuilding their applications and/or performing application testing or validation steps prior to delivering containerized applications for operation on the private cloud.

SYSTEMS/SOLUTIONS INTEGRATION

Spathe Systems will partner with you to determine answers to your most complex IT problems. As a Systems and Solutions integrator, we can assess your current environment and identify opportunities for efficiencies, provide proposed courses of action for the challenges you are facing and upgrading your ecosystem. Spathe has the knowledge, skills and ability to help you find solutions to support your environment and bring together the systems, hardware and software to integrate effectively.

Network Cabling Infrastructure upgrades and installation
AV/ VTC upgrade and installation
Software and Hardware upgrades and installations
Hardware lifecycle replacement (CERP)
Mobile Workforce Solutions Integration

IT OPERATIONS & MAINTENANCE

Spathe Systems provides skilled resources to keep small and large scale IT operations available and accessible to the customer. Spathe’s team of multi-discipline IT professionals provide C5 enterprise level services in support of customer operations. Private or public Local and Wide Area Networks and the associated services (email, portal, collaboration, information management) are dynamic and complex operations that are essential to the customer’s mission. Spathe has the professionals and industry partner relationships to alleviate the operations and maintenance burden from the customer so the customer can focus on the core mission.

IT event management processes that focuses on detecting specific, pre-defined events rather than general event monitoring
IT incident management that is goal oriented on restoring services to the customer as fast as possible with minimal impact to operations
IT problem management that prevents problems from occurring, eliminates or reduces recurring incidents, and minimizes incident severity
Desk-Side support services that support client image management, hardware/software configuration management, VTC management, and end user Information Assurance related activities
Field Service support that covers the customers area of operations
Server management providing Tier I and II troubleshooting and server life cycle support from commissioning to decommissioning
Network management of firewalls, routers, data and voice switches, virtual private networks and virtual private clouds
Service Desk support that provides frontline – single point of contact for the myriad of enterprise services.

DEVSECOPS

Hover over any of the icons below to read more about each DevSecOps Security Protocol Procedure

Secure Transfer

Transport Layer Security (TLS) is the successor from the legacy Secure Sockets Layer (SSL). A mutual TLS protocol ensures that all data transferred over a network is encrypted with 256-bit encryption. However, encryption is only part of the communication protocol. Public Key cryptography also ensures that the parties sending and receiving data or communication requests are also authenticated using a Message Authentication Code (MAC).

Security Config

The Security CI/CD Pipeline consists of a sequence of checks: Pre-Commit Checks, Commit-Time Checks, Build-Time Checks, Test-Time Checks, Pre-Deployment Checks and Post-Deployment Checks. These checks are identified in a pre-determined set of configuration files (typically YAML). The developer should only be concerned that the code compiles and runs through both Unit testing and Integration Testing. The Security checks that include SAST/DAST and other vulnerability tests will be executed once the developer initiates a commit of the code changes into a specific branch of the project in GitLab.

Security Scan

DevSecOps has fine grain scanning, depending on which branch of development the code is being evaluated. For example, if checking into a Unit Testing branch, the SAST testing may execute but not necessarily the DAST or full penetration scanning, until the code has passed SAST scanning and can be deployed into a pre-production branch. The pre-configured list of security scans that are required to be executed in order to successfully "pass" the code before it can be deployed into a higher branch is often referred to as a playbook.

Security Patch

As a software developer develops code and imports new libraries or dependencies into the framework, they may import code at a "feature" level. Security patch scanning is an automated process that will verify that each module is compliant - it must be hardened appropriately for the container environment in which it runs, and therefore should be compared against known vulnerabilities. Certain libraries will need to be at a minimum release level before it can be considered compliant. In these cases, the build will fail with a report of these violations, and the developer will need to update the libraries and re-test their code in order to satisfy this level of patching.

Security Audit

While some scans will catch vulnerabilities at commit and deployment time, a security Audit will run continuously against an automatically updated list of known vulnerabilities. The CI/CD development would continuously attempt to build the code multiple times per day, so even though a project successfully passed a security Audit one day, it may still fail if a vulnerability is detected after the code is deployed.

Security Monitor

Security Monitoring is a pro-active mechanism to observe and track the behavior of the code as it runs. Security Vulnerabilities can occur over a broad spectrum of conditions that changes as the code executes. There may be features of the code that do not execute frequently and the vulnerability exposed by a set of conditions would be difficult to find through any manual process. Continuous Penetration testing after a project is deployed would help to monitor and report the behavior of the software under these conditions.

Security Analysis

In addition to a security check playbook, a scorecard is used to indicate the threat of a vulnerability in the code as it is detected, and the environmental and user statistics that existed when the vulnerability is detected. Many of these conditions would be difficult to reproduce, so the Security Analysis is an essential part of resolving threats and vulnerabilities.

Digital Sign

Certificate of Authority (CA) is an important part of modern cryptography that is the underlining component of Mutual TLS. Developers need a trusted root anchor that can manage the public key that is exposed to end users while protecting the private key of the hosted environment. Removing this responsibility in a dependable and reliable mechanism that is external to the application development effort drastically speeds up the development cycle without compromising security.

Pen Test

Penetration Testing is a part of the Continuous Development Life Cycle that provides constant, automated testing and scanning for vulnerabilities. These tests run frequently and without notice (like real-world attacks) and are virtually unbeknownst to the developer, so it minimizes any chance to prepare for the actual penetration test.

DAST

Dynamic Application Security Testing (DAST) is the process of testing for vulnerabilities from the outside and is independent of the source code languages used and does not test for code defects such as dangling pointers.

IAST

According to the Open Web Application Security Project (OWASP), Interactive Application Security Testing (IAST) combines both SAST and DAST components to improve detection of vulnerabilities like SQL Injection and cross site scripting (XSS) vulnerabilities and can control the runtime execution. Run-Time Application Security Protection (RASP) tools are an alternative to IAST, although is intended specifically for validating security and less with the intended execution behavior of the application.

SAST

Static Application Security Testing (SAST) is the process of examining source code for security defects. GitLab Runners are used to execute jobs on different hosts (written in Go). CI/CD, “Enable Auto DevOps” and GitOps are all SAST tools used to automate the scanning of code and loosely coupled components or libraries for vulnerabilities and is language specific. SAST Testing does not detect run time errors.

Security as Code

The development environment will test the Infrastructure as Code (IaC) before a new version is rolled out. “Everything as Code” means that iterative testing would be continuous even when there are no code changes. Simply updating the virus definition dictionary would trigger an automatic re-testing of all code in a project.

Secure Coding

The one-time testing approach that has typically been utilized in the software development life cycle no longer proves to be an effective way to safeguard against constant threats and exposure of vulnerabilities to attackers. Secure Coding involves test bedding to routinely test code and scan for vulnerabilities on every change that is made in an application or framework.

Threat Model

Software Development threats come in many varieties. Primarily, malicious attacks on vulnerabilities can be accounted for in the design of the application, as microservices architecture minimizes the attack surface for each component. However, non-malicious vulnerabilities can still be exploited by savvy attackers. DevSecOps provides a risk mitigation strategy to minimize the total exposure to these non-intentional and non-malicious vulnerabilities that may be introduced with or without the developer being aware of the possible threat.

Secure Transfer

Security Config

Security Scan

Security Patch

Security Audit

Security Monitor

Security Analysis

Digital Sign

Pen Test

DAST

IAST

SAST

Security as Code

Secure Coding

Threat Model

Secure Transfer

Security Config

Security Scan

Security Patch

As a software developer develops code and imports new libraries or dependencies into the framework, they may import code at a "feature" level. Security patch scanning is an automated process that will verify that each module is compliant - it must be hardened appropriately for the container environment in which it runs, and there should be compared against known vulnerabilities. Certain libraries will need to be at a minimum release level before it can be considered compliant. In these cases, the build will fail with a report of these violations, and the developer will need to update the libraries and re-test their code in order to satisfy this level of patching.

Security Audit

Security Monitor

Security Analysis

Digital Sign

Pen Test

DAST

IAST

SAST

Security as Code

Secure Coding

The 1-time testing approach that has typically been utilized in the software development life cycle no longer proves to be an effective way to safe-guard against constant threats and exposure of vulnerabilities to attackers. Secure Coding involves test bed to iteratively test code and scan for vulnerabilities on every change that is made in an application or framework.

Threat Model

Software Development threats come in many varieties. Primarily, Malicious attacks on vulnerabilities can be accounted for in the design of the application, as microservices architecture minimizes the attack surface for each component. However, Non-malicious vulnerabilities can still be exploited by savvy attackers. DevSecOps provides a risk mitigation strategy to minimize the total exposure to these non-intentional and non-malicious vulnerabilities that may be introduced with or without the developer being aware of the possible threat.

Spathe Systems can help to transform your organization and modernize your application development towards a DEVSECOPS focus, and to capture the value that it brings – the speed, agility, and flexibility to deliver faster. Transitioning to an application development approach with security and operations in mind at the outset will help to reduce the cycle times of development and decrease the re-work inherent in a traditional development approach. Spathe Systems can help to create a Certification process using as much automation as possible to provide easily consumable Cyber Security verification documentation to aid in rapid decisions of application net worthiness.

We Offer In-Depth Devsecops Training:

“Dev” training includes:

Agile/Scrum software development principles and practices
Microservices Architecture and software development principles
Container software development principles in relation to Greenfield development of new applications and modernization of monolithic applications into
containers
Microservices based database development for High-Availability (HA)
Test Driven Development principles and processes
CI/CD Pipeline review

“Sec” training includes:

Container Security principles (Dev Scanning, PROD Support, Remediation, etc.)
Application STIG requirements and certificate of Net Worthiness process
Software Defined Networking and associated security

“Ops” training includes:

Explanation and examples of selected container orchestration tools
Traceability of requirements from Product Owners to Development along with Test Driven Development Principles as it relates to functionality requirements

APPLICATION DEVELOPMENT

Spathe Systems provides expert application and database developers for customers to leverage modern software application development methodologies to create tailored solutions to unique problems. By combining DevSecOps and Agile approaches, Spathe can develop solutions that iteratively answer the customer’s needs without compromising security. The key to Spathe’s success is our continuous engagement and involvement of the customer as the Product Owner throughout the development process.

Our Project Team orchestrates application development adhering to the following industry best practices:

Representational State Transfer (REST) Architecture that leverages stateless micro-services
- reduces operational overhead
- provides scalability
- enables focused development teams to work in parallel
Specialized Development team skillsets that focus on development of application components to meet the customer’s current and future requirements
Certified Scrum Masters to lead overall project, prioritize requirements, and run development Sprints
Senior Application Developers versed in multiple development languages to collaborate across teams, preform code reviews and ensure highest quality coding methodology
An approach that embraces the use of micro-services and containerization to enable code reuse and ensure light weight modular applications
Product Owner engagement throughout the process from development of a Minimally Viable Product, to Fully Operational Capability and sustainment, inclusive of the integration of new requirements and capabilities

CYBER SECURITY

SPATHE has positioned itself as a premier provider of Cybersecurity services to Combatant Commands, Intelligence Agencies and Multi-nation Coalitions by embodying the five functions of the framework. We have developed robust scalable models based on doctrine, processes, and procedures to Identify threats, foster relationship with best of class solution providers to offer Protection products and solutions to safeguard our customers operations. We lean on our experience, personnel and practical application of technology to facilitate quick Detection, Response, and Recovery during and after an Incident.

Cyber security experts who understand the Risk Management Framework and will guide our customers through the process
Application developers with a security first mind set who fully embrace and understand the DEVSECOPs methodology
Network engineers who can help you design and maintain a defense in depth approach to secure your data
Security minded System Engineers capable designing, configuring, deploying and sustaining secure and reliable solutions to address customer complex IT requirements

Airborne Intelligence, Surveillance, and Reconnaissance (AISR)

Spathe Systems has extensive AISR experience and will help you manage your AISR infrastructure with our team of expert system and satellite engineers. Spathe can provide a team of professionals to monitor, control, and configure your global satellite communication network including forward deployed satellite earth terminals and embedded network communications equipment. Our goal is to ensure end-to-end transport of Full Motion Video (FMV) and other ISR payloads. Spathe provides services such as the following in support of AISR:

Continuously monitor network and space segment performance to provide customer tier 1, 2, and 3 support as required.
Monitor and report on the quality of user FMV
Manage service restoration activities and track/update trouble-ticketing system
Resolve customer issues related to broadband IP communication via satellite transmission, as well as support complex systems installations and startup at customer sites
Monitor and test network performance and provide network performance statistics and reports
Aid in the development of business continuity and disaster recovery plans, and maintain current knowledge of plan executables

C5I Support

Keeping the Warfighter Connected 24/7/365

Alignment to the C5I Framework

COMMAND

COMMUNICATIONS

CONTROL

CYBER

COMPUTERS

INFORMATION

Alignment to the C5I Framework

CORE CAPABILITIES

BIG DATA

MACHINE LEARNING

CAPABILITIES

BIG DATA

MACHINE LEARNING

CAPABILITIES

BIG DATA

CLOUD COMPUTING

SYSTEMS/SOLUTIONS INTEGRATION

IT OPERATIONS & MAINTENANCE

DEVSECOPS

Secure Transfer

Security Config

Security Scan

Security Patch

Security Audit

Security Monitor

Security Analysis

Digital Sign

Pen Test

DAST

IAST

SAST

Security as Code

Secure Coding

Threat Model

Secure Transfer

Security Config

Security Scan

Security Patch

Security Audit

Security Monitor

Security Analysis

Digital Sign

Pen Test

DAST

IAST

SAST

Security as Code

Secure Coding

Threat Model

Secure Transfer

Security Config

Security Scan

Security Patch

Security Audit

Security Monitor

Security Analysis

Digital Sign

Pen Test

DAST

IAST

SAST

Security as Code

Secure Coding

Threat Model

We Offer In-Depth Devsecops Training:

APPLICATION DEVELOPMENT

CYBER SECURITY

Airborne Intelligence, Surveillance, and Reconnaissance (AISR)

C5ISR Related Posts

SPATHE Supports AFCEA TechNet Conference in Ft. Liberty

Year Rewind: Spathe Systems’ 2023 Year in Review

Spathe Systems Wins Seat on GSA’s $50B STARS III GWAC

Spathe Systems Wins Seat on DIA SITE III IDIQ

Spathe Systems: A Year in Review

Georges Stokes: Top Four Cyber Certifications

Top Five Cybersecurity Threats in 2020

Spathe Systems Welcomes Col. Russell Voce as VP of C5ISR