The Global Landscape

A residual effect of war in Ukraine is that cybersecurity is no longer a sideshow in aerospace, if 2022 space-related trade events are any indication. The conflict has raised awareness and concerns about the security of every link in aerospace deployments. Now is the time for manufacturers, governments, and security providers to align with each other on solutions.

Although the initial Russian invasion did not lead to the unrestrained cyber warfare that many people feared, a February 2022 disruption of a satellite network, which was not restricted to Ukraine, added urgency to many conversations. However, while the space industry understands and puts a lot of thought in satellite security, it often lacks actionable next steps. The prevailing sentiment is that bad cyber actors have a jumpstart on governmental and operators and equipment manufacturers.

This is problematic on two levels. Aerospace and satellite deployments are mission-critical and indispensable to the growth of many industries and technologies. At the same time, their attack surfaces have also greatly expanded — and without corrective action, security controls will be bolted onto future designs in an insufficient manner, rather than being built into them with foresight and efficiency.

The projected expansion of satellite deployments provides a unique opportunity to build mature security solutions into government and commercial deployments. We can expect an exponential increase in the number of Low Earth Orbit (LEO) satellites, as well as the emergence of small GEO satellites. This means more methods of connectivity, in space and on the ground, and a corresponding increase in opportunities for cyber malfeasance. But it also gives system architects the chance to capitalize on a decade’s worth of advances in cybersecurity technology, and to launch hardened, new constellations — provided we take a proactive approach to investment and collaboration.

Shaping a Safer Future

To help stimulate innovation and partnership, we identify three messages that should gain traction in 2022 and beyond:

1. Don’t miss the threat on the ground for the threat in space

Much attention has been paid to the threat of signal jamming or spoofing directed at satellite vehicles, which could lead to collisions or disruption of internet access in vital industry or governmental communications. But dangerous cyberattacks can focus on any part of a satellite network, including multiple devices that support satellite base stations and communications hubs. These assets on the ground can be accessed remotely, or in many cases physically, since they often are in isolated locations with variable perimeter security.

The objective of such attacks could also be the compromise or destruction of land-based equipment, as seems to be the case with the Viasat/KA-SAT attack, which temporarily disabled thousands of modems in several countries. Viasat’s analysis indicates the attacker began by exploiting a VPN device misconfiguration, gained remote access to a segment of the company network, and then sent management commands to thousands of modems at once, which overwrote flash memory and temporarily knocked the modems offline. It was a consequential strike that required no knowledge or exploits of a satellite vehicle.

2. End users, manufacturers and security experts must collaborate on advanced solutions

The impressive growth of commercial aerospace and satellite deployments complicates efforts to elevate industry security standards. As more business opportunities are built out and scaled, we can expect more players to enter the space, and more reliance on increasingly complex supply chains — both of which will elevate cyber risk. The days in which a few established private sector enterprises supplied technology and devices to a few dedicated clients, each of which was a branch of the government, are past.

Given this new reality, collaboration around industry standards will be essential to satellite network security. As more companies move in, it’s critical that established players advocate and fight for high-security standards that reflect the current threat climate. This can help establish benchmarks that elevate current standards, promote accountability, and incorporate security solutions for devices and systems.

The U.S. government will remain hugely influential, due to the power of its purse, decades of aerospace engagement, and history of collaboration with industry leaders. It can actually incentivize commercial suppliers to invest in advanced security controls by demanding them — and it most certainly should do so.

There is also a need for rigorous testing of new security deployments in controlled environments, such as red vs. blue exercises. These can provide training for military operators and opportunities for them to work with device manufacturers to integrate security technology with new and legacy satellite communications equipment. Ideally, this training should include commercial equipment manufacturers, equipment operators, and security experts. Securing space will require a highly collaborative, multi-disciplinary approach: No one body of experts has all the answers.

3. We must expand regulations to cover embedded systems

Government regulators have had timely responses to emerging satellite communications network threats. In the first months of 2022, CISA issued two alerts (one in collaboration with the FBI) for service providers and customers, while NIST pushed to update its guidelines for satcom cybersecurity risk management.

Although welcome, these documents focus on network-based security controls that are essential, but not sufficient to meet current threats. Like other recent directives, they do not adequately address security challenges in embedded systems and the devices that support them. What guidance there is focuses on network controls: also essential, also unable to provide a comprehensive security posture.

For decades, security policy has exempted special purpose and embedded systems as being too difficult to secure while maintaining real-time performance. It is time for policy to catch up with technology and mandate the levels of security controls that are now feasible for aerospace, and many other industries.