Menu
The Ukrainian conflict amplified serious questions about satellite security in this year’s conference. But questions aren’t action, which is needed now to protect this critical industry.
The Ukrainian conflict amplified serious questions about satellite security in this year’s conference. But questions aren’t action, which is needed now to protect this critical industry.
The Ukrainian conflict amplified serious questions about satellite security in this year’s conference. But questions aren’t action, which is needed now to protect this critical industry.
After two years of virtual conferences, Red Balloon Security was grateful to attend Satellite 2022 in person, and to leave not just better informed but just as healthy. We extend our thanks to the organizers and already are looking forward to attending Satellite 2023.
We took encouragement when panel moderators and attendees raised insightful questions about the state of cybersecurity in satellite systems, and aerospace in general, often in terms of recently reported events in Ukraine. But we wish the queries had received more substantial, action-based responses.
For the most part, participants were in a reactive stance that presumed bad cyber actors have a jumpstart on commercial and governmental operators and equipment manufacturers in aerospace. But we need solutions today, which will defend aerospace deployments’ growing attack surface, and provide a framework where mature security controls can be built into — rather than being bolted onto — future designs.
The work can’t begin too soon, given that we have more satellites in every orbit than ever before. This includes an exponential increase in the number of low earth orbit (LEO) satellites and the emergence of small GEO satellites. This means more methods of connectivity, in space and on the ground, and a corresponding increase in opportunities for cyber malfeasance.
To help stimulate innovation and partnership, here are three messages we hope will continue to gain traction before Satellite 2023 convenes:
Much attention has been paid to the threat of signal jamming or spoofing directed at satellite vehicles, which could lead to collisions or disruption of internet access and vital industry or governmental communications. But the same threats could be realized by cyberattacks that focus on any part of a satellite network, including multiple devices that support satellite base stations and communications hubs.
These assets on the ground can be accessed remotely or, in many cases physically, since they often are in isolated locations with variable perimeter security. The objective of such attacks could also be the compromise or destruction of land-based equipment, as seems to be the case with the ViaSat/KA-SAT attack, which disabled thousands of modems in several countries.
An analysis by Ruben Santamarta makes a strong argument that the KA-SAT attack began with a compromise of a network operations center (NOC), from which malicious commands were sent to the terminals that were ultimately disabled.[1] If correct, this shows us attackers using methods we’ve seen in many other industries, and beginning with a compromise of a land-based target: No knowledge or exploit of a satellite vehicle needed.
The growth of commercial aerospace and satellite deployments is impressive, but it complicates efforts to elevate industry security standards. In an effort to build out and scale viable business opportunities, we can expect more players to enter the space, and more reliance on increasingly complex supply chains — both of which will elevate cyber risk. We are past the days in which a few established private sector enterprises supplied technology and devices to a few dedicated clients, each of which was a branch of the government.
Given this new reality, collaboration around industry standards will be essential to satellite network security. As more companies move in, it’s critical that established players advocate and fight for high security standards that reflect the current threat climate. This can help establish benchmarks that exceed current standards, promote accountability, and incorporate security solutions for devices and systems.
The U.S. government will remain hugely influential, due to the power of its purse, decades of aerospace engagement, and history of collaboration with industry leaders. But can it actually incentivize commercial suppliers to invest in advanced security controls by demanding them?
The U.S. government will remain hugely influential, due to the power of its purse, decades of aerospace engagement, and history of collaboration with industry leaders. But can it actually incentivize commercial suppliers to invest in advanced security controls by demanding them? This is a complex question, but we felt Satellite 2022 panelists from both sides were willing to grapple with it.
Setting that higher standard will require a high level of confidence in advanced security technologies and the requisite time to integrate them into existing systems. That means rigorous testing in controlled environments. Red Balloon Security has participated with the USAF in these types of exercises to help train military operators (such as red vs. blue exercises and Hack-A-Sat). Just like deployments we have participated in for the electrical grid and building management systems, these should include both commercial OEMs and operators going forward.
Government regulators have created timely responses to emerging SATCOM network threats. CISA issued an alert for service providers and customers (and a second in collaboration with the FBI), while NIST has pushed to update its guidelines for SATCOM cybersecurity risk management.
Although welcome, these documents focus on network-based security controls that are essential, but not sufficient to meet current threats. Like other recent directives, they do not adequately address security challenges in embedded systems and the devices that support them. What guidance there is focuses on network controls: also essential, also unable to provide a comprehensive security posture.
For decades, security policy has exempted special purpose and embedded systems as being too difficult to secure while maintaining real-time performance. It is time for policy to catch up with technology and mandate the levels of security controls that are now feasible for aerospace, and many other industries.
Encouragingly, several USG panelists made this point at Satellite 2022. They emphasized the need for multi-level security (which should include the device level) and defense-in-depth, which suggests a paradigm shift may be underway. Defense in depth is not a catch-all solution; there is a risk that the strategy may still focus on a few security layers that are easy to deploy while others are overlooked or inadequately deployed. Nevertheless, we were encouraged to hear more urgency around these discussions than in years past.
To bring advanced or simply adequate security to SATCOM networks, embedded devices need attack surface hardening, runtime monitoring, and runtime protection capabilities that focus on the critical firmware level.
In order to address the market needs both for the large installed base and the increasing number of newly deployed devices, the solutions for embedded devices need to be reliable and applicable to legacy systems and new deployments alike. Implementing these embedded device solutions during the development stage is optimal, since that will reduce the deployment costs, provide the highest reliability, and make secure devices an indispensable part of system level defense in depth.
We left Satellite 2022 feeling energized about the future of aerospace and SATCOM technology and its applications. Let’s bring modern approaches so that we get cybersecurity right and fully realize the opportunities space is offering us.
Learn more about Red Balloon Security’s solutions.
After two years of virtual conferences, Red Balloon Security was grateful to attend Satellite 2022 in person, and to leave not just better informed but just as healthy. We extend our thanks to the organizers and already are looking forward to attending Satellite 2023.
We took encouragement when panel moderators and attendees raised insightful questions about the state of cybersecurity in satellite systems, and aerospace in general, often in terms of recently reported events in Ukraine. But we wish the queries had received more substantial, action-based responses.
For the most part, participants were in a reactive stance that presumed bad cyber actors have a jumpstart on commercial and governmental operators and equipment manufacturers in aerospace. But we need solutions today, which address immediate vulnerabilities and provide a framework where mature security controls can be built into — rather than being bolted onto — future designs.
The work can’t begin too soon, given that we have more satellites in every orbit than ever before. This includes an exponential increase in the number of low earth orbit (LEO) satellites and the emergence of small GEO satellites. This means more methods of connectivity, in space and on the ground, and a corresponding increase in opportunities for cyber malfeasance.
To help stimulate innovation and partnership, here are three messages we hope will continue to gain traction before Satellite 2023 convenes:
Much attention has been paid to the threat of signal jamming or spoofing directed at satellite vehicles, which could lead to collisions or disruption of internet access and vital industry or governmental communications. But the same threats could be realized by cyberattacks that focus on any part of a satellite network, including multiple devices that support satellite base stations and communications hubs.
These assets on the ground can be accessed remotely or, in many cases physically, since they often are in isolated locations with variable perimeter security. The objective of such attacks could also be the compromise or destruction of land-based equipment, as seems to be the case with the ViaSat/KA-SAT attack, which disabled thousands of modems in several countries.
An analysis by Ruben Santamarta makes a strong argument that the KA-SAT attack began with a compromise of a network operations center (NOC), from which malicious commands were sent to the terminals that were ultimately disabled.[1] If correct, this shows us attackers using methods we’ve seen in many other industries, and beginning with a compromise of a land-based target: No knowledge or exploit of a satellite vehicle needed.
The growth of commercial aerospace and satellite deployments is impressive, but it complicates efforts to elevate industry security standards. In an effort to build out and scale viable business opportunities, we can expect more players to enter the space, and more reliance on increasingly complex supply chains — both of which will elevate cyber risk. We are past the days in which a few established private sector enterprises supplied technology and devices to a few dedicated clients, each of which was a branch of the government.
Given this new reality, collaboration around industry standards will be essential to satellite network security. As more companies move in, it’s critical that established players advocate and fight for high security standards that reflect the current threat climate. This can help establish benchmarks that exceed current standards, promote accountability, and incorporate security solutions for devices and systems.
The U.S. government will remain hugely influential, due to the power of its purse, decades of aerospace engagement, and history of collaboration with industry leaders. But can it actually incentivize commercial suppliers to invest in advanced security controls by demanding them? This is a complex question, but we felt Satellite 2022 panelists from both sides were willing to grapple with it.
Setting that higher standard will require a high level of confidence in advanced security technologies and the requisite time to integrate them into existing systems. That means rigorous testing in controlled environments. Red Balloon Security has participated with the USAF in these types of exercises to help train military operators (such as red vs. blue exercises and Hack-A-Sat). Just like deployments we have participated in for the electrical grid and building management systems, these should include both commercial OEMs and operators going forward.
Government regulators have created timely responses to emerging SATCOM network threats. CISA issued an alert for service providers and customers (and a second in collaboration with the FBI), while NIST has pushed to update its guidelines for SATCOM cybersecurity risk management.
Although welcome, these documents focus on network-based security controls that are essential, but not sufficient to meet current threats. Like other recent directives, they do not adequately address security challenges in embedded systems and the devices that support them. What guidance there is focuses on network controls: also essential, also unable to provide a comprehensive security posture.
For decades, security policy has exempted special purpose and embedded systems as being too difficult to secure while maintaining real-time performance. It is time for policy to catch up with technology and mandate the levels of security controls that are now feasible for aerospace, and many other industries.
Encouragingly, several USG panelists made this point at Satellite 2022. They emphasized the need for multi-level security (which should include the device level) and defense-in-depth, which suggests a paradigm shift may be underway. Defense in depth is not a catch-all solution; there is a risk that the strategy may still focus on a few security layers that are easy to deploy while others are overlooked or inadequately deployed. Nevertheless, we were encouraged to hear more urgency around these discussions than in years past.
To bring advanced or simply adequate security to SATCOM networks, embedded devices need attack surface hardening, runtime monitoring, and runtime protection capabilities that focus on the critical firmware level.
In order to address the market needs both for the large installed base and the increasing number of newly deployed devices, the solutions for embedded devices need to be reliable and applicable to legacy systems and new deployments alike. Implementing these embedded device solutions during the development stage is optimal, since that will reduce the deployment costs, provide the highest reliability, and make secure devices an indispensable part of system level defense in depth.
We left Satellite 2022 feeling energized about the future of aerospace and SATCOM technology and its applications. Let’s bring modern approaches so that we get cybersecurity right and fully realize the opportunities space is offering us.
Learn more about Red Balloon Security’s solutions.
After two years of virtual conferences, Red Balloon Security was grateful to attend Satellite 2022 in person, and to leave not just better informed but just as healthy. We extend our thanks to the organizers and already are looking forward to attending Satellite 2023.
We took encouragement when panel moderators and attendees raised insightful questions about the state of cybersecurity in satellite systems, and aerospace in general, often in terms of recently reported events in Ukraine. But we wish the queries had received more substantial, action-based responses.
For the most part, participants were in a reactive stance that presumed bad cyber actors have a jumpstart on commercial and governmental operators and equipment manufacturers in aerospace. But we need solutions today, which address immediate vulnerabilities and provide a framework where mature security controls can be built into — rather than being bolted onto — future designs.
The work can’t begin too soon, given that we have more satellites in every orbit than ever before. This includes an exponential increase in the number of low earth orbit (LEO) satellites and the emergence of small GEO satellites. This means more methods of connectivity, in space and on the ground, and a corresponding increase in opportunities for cyber malfeasance.
To help stimulate innovation and partnership, here are three messages we hope will continue to gain traction before Satellite 2023 convenes:
Much attention has been paid to the threat of signal jamming or spoofing directed at satellite vehicles, which could lead to collisions or disruption of internet access and vital industry or governmental communications. But the same threats could be realized by cyberattacks that focus on any part of a satellite network, including multiple devices that support satellite base stations and communications hubs.
These assets on the ground can be accessed remotely or, in many cases physically, since they often are in isolated locations with variable perimeter security. The objective of such attacks could also be the compromise or destruction of land-based equipment, as seems to be the case with the ViaSat/KA-SAT attack, which disabled thousands of modems in several countries.
An analysis by Ruben Santamarta makes a strong argument that the KA-SAT attack began with a compromise of a network operations center (NOC), from which malicious commands were sent to the terminals that were ultimately disabled.[1] If correct, this shows us attackers using methods we’ve seen in many other industries, and beginning with a compromise of a land-based target: No knowledge or exploit of a satellite vehicle needed.
The growth of commercial aerospace and satellite deployments is impressive, but it complicates efforts to elevate industry security standards. In an effort to build out and scale viable business opportunities, we can expect more players to enter the space, and more reliance on increasingly complex supply chains — both of which will elevate cyber risk. We are past the days in which a few established private sector enterprises supplied technology and devices to a few dedicated clients, each of which was a branch of the government.
Given this new reality, collaboration around industry standards will be essential to satellite network security. As more companies move in, it’s critical that established players advocate and fight for high security standards that reflect the current threat climate. This can help establish benchmarks that exceed current standards, promote accountability, and incorporate security solutions for devices and systems.
The U.S. government will remain hugely influential, due to the power of its purse, decades of aerospace engagement, and history of collaboration with industry leaders. But can it actually incentivize commercial suppliers to invest in advanced security controls by demanding them?This is a complex question, but we felt Satellite 2022 panelists from both sides were willing to grapple with it.
Setting that higher standard will require a high level of confidence in advanced security technologies and the requisite time to integrate them into existing systems. That means rigorous testing in controlled environments. Red Balloon Security has participated with the USAF in these types of exercises to help train military operators (such as red vs. blue exercises and Hack-A-Sat). Just like deployments we have participated in for the electrical grid and building management systems, these should include both commercial OEMs and operators going forward.
Government regulators have created timely responses to emerging SATCOM network threats. CISA issued an alert for service providers and customers (and a second in collaboration with the FBI), while NIST has pushed to update its guidelines for SATCOM cybersecurity risk management.
Although welcome, these documents focus on network-based security controls that are essential, but not sufficient to meet current threats. Like other recent directives, they do not adequately address security challenges in embedded systems and the devices that support them. What guidance there is focuses on network controls: also essential, also unable to provide a comprehensive security posture.
For decades, security policy has exempted special purpose and embedded systems as being too difficult to secure while maintaining real-time performance. It is time for policy to catch up with technology and mandate the levels of security controls that are now feasible for aerospace, and many other industries.
Encouragingly, several USG panelists made this point at Satellite 2022. They emphasized the need for multi-level security (which should include the device level) and defense-in-depth, which suggests a paradigm shift may be underway. Defense in depth is not a catch-all solution; there is a risk that the strategy may still focus on a few security layers that are easy to deploy while others are overlooked or inadequately deployed. Nevertheless, we were encouraged to hear more urgency around these discussions than in years past.
To bring advanced or simply adequate security to SATCOM networks, embedded devices need attack surface hardening, runtime monitoring, and runtime protection capabilities that focus on the critical firmware level.
In order to address the market needs both for the large installed base and the increasing number of newly deployed devices, the solutions for embedded devices need to be reliable and applicable to legacy systems and new deployments alike. Implementing these embedded device solutions during the development stage is optimal, since that will reduce the deployment costs, provide the highest reliability, and make secure devices an indispensable part of system level defense in depth.
We left Satellite 2022 feeling energized about the future of aerospace and SATCOM technology and its applications. Let’s bring modern approaches so that we get cybersecurity right and fully realize the opportunities space is offering us.
Learn more about Red Balloon Security’s solutions.
[1] RBS has obtained a Viasat Surfbeam modem and will initiate a teardown and analysis in the coming weeks.
[1] RBS has obtained a Viasat Surfbeam modem and will initiate a teardown and analysis in the coming weeks.
[1] RBS has obtained a Viasat Surfbeam modem and will initiate a teardown and analysis in the coming weeks.
Sal Stolfo was an original founding member of Red Balloon Security, Inc.
© 2022 Red Balloon Security.
All Rights Reserved.
© 2022 Red Balloon Security. All Rights Reserved.
Reach out to learn more about our embedded security offering and to schedule a demo.
Reach out to learn more about our embedded security offering and to schedule a demo.
Reach out to learn more about our embedded security offering and to schedule a demo.
Reach out to learn more about our embedded security offering and to schedule a demo.
