Jon Fielding is Managing Director of Apricorn in EMEA, responsible for sales and operations strategy, revenue growth and channel development. CISSP certified, he has 28 years’ experience in information security, spanning IBM and security start-ups including Valicert and Tumbleweed. Before joining Apricorn, Jon established IronKey’s first EMEA office and specialised in the secure USB market, remaining with the business through its acquisitions by Imation and Kingston.
The spacesector has low cybermaturity compared to other critical sectors, having relied for years on security through obscurity, and that’s now threatening its integrity. The opening up of the industry is leading to a growing attack surface created by unpatched legacy software and commercial off-the-shelf (COTS) hardware.
Consequently, <a href="https://bisi.org.uk/reports/cybersecurity-vulnerabilities-in-north-american-satellite-ground-segments” rel=”nofollow noopener” target=”_blank”>the Bloomsbury Intelligence and Security Institute (BISI) warned back in February that there was an imminent risk of a ground station in the US being subjected to a ransomware attack, the possibility of unpatched VPNs being used for espionage in ground stations before a year is out, and the risk of a major systemic failure in 2027 if the current global regulation vacuum remains unchanged.
If the situation looks dire in the US, consider their European counterparts. They’re said to lag behind when it comes to basic hygiene and awareness, according to the UK government report Cyber risks of cloud computing in the ground segment of the space sector.
The result of a three-month study, it found a significant divide between larger organisations, which had the resources to devote to bolstering resilience, compared to smaller, newer satellite operators.
As those organisations move to the cloud, they are becoming dangerously exposed, particularly with respect to burgeoning Ground Station/Segment as a Service offerings.
This is because the cloud sees previously air-gapped legacy systems and Operational Technology (OT) systems integrated into a wider infrastructure and ground stations connected to one another. Those ground stations are then at risk of being attacked and the operations of the satellite operator and their satellites disrupted.
Nation-state cyberattacks on satellite ground systems
Just how devastating these attacks can be was demonstrated back in 2022 when ViaSat’sKA-SAT modems were compromised. Attributed to the Russian military intelligence agency (GRU), it involved a two-phase attack that saw a VPN taken over, giving access to management servers.
From there, wiper malware was installed, disabling 40,000-45,000 modems and overwhelming the ViaSat incident response team. Even when systems were brought back online, the attackers continued to pivot for months.
How the GRU was able to access the VPN still remains unknown, but the speculation is that this could have been carried out by an insider. It did, however, act as a wake-up call to the industry and made clear that nation-state actors were actively looking for ways to infiltrate these systems.
Exacerbating the situation for the ground segment is a lack of control over the supply chain. There’s often little transparency when it comes to third-party security controls with respect to both hardware and software, requiring organisations to adopt vendor assurance measures such as vendor risk management frameworks, security audits and to specify their security requirements in their contractual obligations.
Tackling space supply chain security with AS9100
The UK government report suggests the risk of such attacks can be mitigated through end-to-end encryption and authentication, which must be securely implemented at every stage from the satellite down to the ground station/s and storage. But in addition to this, operators can seek assurances such as accreditation from their suppliers.
With respect to hardware, for instance, the quality management standard AS9100 is specifically designed for the needs of the aviation, space and defence industries. It incorporates the ISO 9001 standard but adds over a hundred extra requirements, with a far greater emphasis on risk management, supply chain oversight and product traceability and also complements the EU’s EASA (European Union Aviation Safety Agency) rules.
With respect to risk management, AS9100 requires manufacturers to prove to the industry that they have robust processes in place to identify and mitigate risks, and this spans the whole product lifecycle. Configuration management is also stringent, requiring all configurations to be documented throughout their lifespan, which in turn makes it easier to trace back issues or perform change management.
Plus, AS9100 features additional controls to prevent the use of counterfeit components, govern project management and manage suppliers. The latter means all manufacturers adhering to the standard must take steps to assess and review their suppliers on a regular basis and hold these to the same account as expected of aerospace manufacturers.
Why AS9100 matters for space sector resilience
AS9100 is crucial because it provides independent assurance that hardware products are developed under a quality management framework and are designed for mission-critical use. Organisations then know these suppliers maintain disciplined, repeatable processes designed to meet exacting regulatory and performance requirements.
Certified products can then be trusted to secure data both in transit and at rest. So, while AS9100 is typically regarded as a quality management standard, it does in fact also confer operational resilience through these controls.
Subjecting the hardware used in the sector to these rigorous requirements therefore ensures a baseline of security in the supply chain. But, as both reports reveal, work is still needed at the regulatory level.
In the UK, space SMEs are now being offered cybersecurity support and certification in association with the Cyber Essentials Scheme and recognising the scale of the threat, Europe is spearheading the EU Space Act, which aligns with the requirements under NIS2 for critical national infrastructure organisations and DORA for financial services.
However, the Act isn’t expected to come into force until 2030, which means for now operators are on their own. Existing standards such as AS9100 can help fill that gap by providing some much-needed assurance at a time when the sector is all too aware of its increased exposure and vulnerability.
Find more insight and discussion fro,m aerospace experts in our dedicated section hereFind more insight and discussion fro,m aerospace experts in our dedicated section here
Opinions
SpaceCyber securitySatelliteSecuritySpaceSupply chain
Sign up for our newsletter and get our latest content in your
inbox.
1
Beyond the free pen: What defence brands can learn from Eurosatory’s best giveawaysBeyond the free pen: What defence brands can learn from…
Eurosatory
2
Forced labour, Section 301 and the aerospace exemption worth checkingForced labour, Section 301 and the aerospace exemption worth checking
finance
3
The day the signal dies: Inside the race to survive a ‘Silent GPS’ attackThe day the signal dies: Inside the race to survive…
GPS
4
What happens when GPS goes down? Aviation’s backup plan explainedWhat happens when GPS goes down? Aviation’s backup plan explained
Safran
