[ Music ]
>> Maria Varmazis: Welcome to T-Minus Deep Space from N2K networks. I'm Maria Varmazis, host of the T-Minus Space Daily podcast. Deep Space includes extended interviews and bonus content for a deeper look into some of the topics that we cover on our daily program, T-Minus Space Daily.
[ Music ]
Now in this episode, I'm speaking with Moez Kamel, Threat Management Security Technical Specialist at IBM Security, and a subject matter expert on cybersecurity in space. It's an area of growing interest from both a cybersecurity and a space perspective. So, why do space programs need to bolster their cybersecurity and why now? And what kind of cybersecurity threats are unique to space infrastructure? Well, Moez will walk us through it all in this interview. First, he's going to give us some helpful context into why it seems like we're all talking about cybersecurity in space so much more now than we used to.
>> Moez Kamel: Before we talk about the threats, I will give a glimpse, a glimpse why we are talking about cybersecurity today in space. This also appear with the appearance of the new space age. So, earlier the space industry was just a nation level domain. It means that it was just related to two countries, to two nations, the United States of America and the USSR nation. Also, the space was related to government and defense department. So, the objectives were essentially political and strategic ones. Then, so then, we notice that this paradigm shift in the space industry. Which was characterized by the emergence of private companies and more commercially driven approach to space exploration and activities. But unfortunately, this new space has indeed led to an expansion of cyber threats for space systems. Today we have several factors that contribute to this phenomenon. Like geopolitical tensions, growing commercialization and democratization. And also, the limited focus on cybersecurity. So, that's why today we have many cybersecurity threats related to space system.
>> Maria Varmazis: Excellent. Yep. Thank you for saying that [inaudible]. Appreciate it.
>> Moez Kamel: So, if we dig more now on other threats, related to cyber threats, related to space, to space systems. So, if we take a look at the space system architecture. So, we will find three main components today. We have the ground segment, which includes all the terrestrial elements of the space system. And which allows the command, control and the management of the satellite itself. And also the data coming from the payload which is transmitted to the users. The second main component would be the space segments. So, here we are talking about the satellites. And here we can talk also about the tracking, telemetry command, the control, the monitoring, and all the related facilities and the equipment used to support the satellite operations. And the third one is, the main component of the space system architecture is the link or communication segment. So, the link segment is all the data and signals exchanged between the ground segment and the space segment. And we have a fourth component, which is not the main one, but it's included in this space system architecture, which is the user segment. So, the user segment includes all the user terminal stations that can launch operation, humans, operators, space operators that can as I said, launch operations with the satellite in the form for example, of signals, transmission and reception.
>> Maria Varmazis: That's interesting. Yeah. I don't often hear that fourth one mentioned.
>> Moez Kamel: Exactly. So, of these I would say, three main components, or even the fourth component of the space architecture are targeted today by cyber attack.
>> Maria Varmazis: Mmm, okay. Yep.
>> Moez Kamel: So, today we have, we can compromise the ground station. We can interfere with the communication and the signals. We can attack directly and compromise the satellite and et cetera. So, we have many, many threats related to the component. Most of the attacks today, and vulnerabilities are related to communication link. Such as for example, radio frequency links or other ground segment in general. So, if we dig more on the threats related to each component. So, if we begin for example, with the ground segment threats. Today, we need to keep in mind that breaking into the ground station network will give the attacker access to the satellite itself. So, once inside the ground station network, attackers can gain access to the satellite, and can perform many types of attacks. For example, the DOS attacks which is the denial of service attack. It means that we will send many, many requests to the satellite and we will, we will put the satellite down. We have also the hijack of the industrial control systems. And the purpose is to control and damage the satellites. So, in the ground station we have also, even in the ground station or also in the satellite segment, we have the use, many usage of COTS components. So, today, COTS, which are a commercial off the shelf product. So they are ready-made hardware or software that can be [inaudible] purchased sorry, and designed to be easily installed, and interoperate with existing systems. So, they are a cheap product that can be integrated in the satellite or in the ground segment. So, today the space COTS component, they are the main component that support today the new space technology development. So, with their qualifications, especially for small satellite missions like CubeSat missions. So, these components are well known and widely available. And we can find many public information related to their security, including configuration, vulnerabilities, and software versions, and more and more. So, the COTS, the usage of COTS today is very risky and its one of the vectors, or one of the surface attack that can be used by a hacker to get first intrusion to the system, or to the grounds segement.
>> Maria Varmazis: Right. Because if one vulnerability is found or known that is maybe unpatched at that point, then a whole bunch of systems are vulnerable. So, that, that scale can sort of be a multiplier there, in that case.
>> Moez Kamel: Exactly. Yeah, exactly. The second point we can discuss about the unauthorized access. So, this attack can lead to the for example, to the theft of sensitive data or that can be used by the hacker to for example, against a mission operation. So, this is also one of the threats that are, that the ground segment is facing. The third one is the data manipulation attack. So, a data manipulation attack, also known as the data tampering attack. So, it's a type of cyber attack where an unauthorized individual or entity will alter or modify or manipulate the data to achieve specific goals. It means that today in the space industry, a typical use case is to corrupt data and send wrong commands to the command and data handling, CDH, which is a component in the satellite, and in the spacecraft. And yeah, the purpose is to compromise the mission. So, this is one of these, of the threat that also facing the ground segment. We can talk also about the supply chain attack. So, the supply chain attack will, will seek to harm the, the space ground segment by targeting the less secure element of the chain. So, at this stage the adversary for example, can take advantage of these vulnerabilities and some exploit, then it can for example, create a backdoor in the embedded system of the supply chain. For example, of the supply chain microelectronics devices. So, a backdoor that will be created by the hacker will allow him to communicate after that with the satellite or with the, this component in the ground segment.
>> Maria Varmazis: Right, right. So, once they get in, in that, backdoor is the best way to put it obviously. Then, if I understand correctly, then they basically have access to the broader system if they, they can work their way in. So, even if you as the main company, for lack of a better time, have locked down, if your subcomponent has a vulnerability that someone can access then the access is the same. Okay.
>> Moez Kamel: Also, we have also the computer network exploitation. So, this is a term used to describe the process of infiltrating or exploiting computer networks for various purpose. So, also to gather intelligence about target, to figure out how they work or how they are configured. So, this also, we have many attacks related to the computer network exploitation in the ground segment today. And the last one for the ground segment, the cloud platform attacks. The new space era is marked by the expansion of cloud infrastructure use. So, today we have many organization, organizations and companies that rely on cloud services for various purpose, for example. And relying on cloud, it means that we are, we face all the cloud attacks, all cloud vulnerabilities. So, the hacker can compromise the cloud asset or the cloud application to gain access to the ground station or to the satellite itself.
>> Maria Varmazis: Lots of different ways in this. We're still just talking about ground at this point. [laughter]
>> Moez Kamel: Exactly.
>> Maria Varmazis: It's like, we haven't even gotten to the other ones yet. There's lots of different ways in, for lack of better terminology on my part. And my understanding is, is that many people might think well, I'm not a big target or I'm not a big player, so I don't need to worry about stuff like this. Can you talk a little bit about maybe that perception, of people thinking like that's not something they need to worry about or, I'm not trying to put fear in people. I'm just saying, like it's a concern why people should, maybe who think this doesn't apply to them, should actually think twice.
>> Moez Kamel: This period when we talk about cybersecurity space, and it's the same, I face it in 2014 when I worked on security on SCADA systems and industrial control systems. When we met industrial operators and industrial companies, the first step, it's not to present or to propose the solution that we'd secure the industrial control system. But the first step is the awareness. We need to aware people. We need to aware industrial people that your system is vulnerable. And the SCADA systems at that time, or the industrial control system is vulnerable and can be hacked an adversary. So, we are facing the same situation today with the space operators. So, today with this new age of, or new space age, the hackers today are more and more interested on space systems. Because, because of the groundbreaking technology deployed or because of the, the commercialization that we will have, or the private ventures that are deploying more and more, maybe applications or many different type of missions into space. So, the hackers also are getting more and more interested to attack these systems. And also, I think the threats related even to ground segment. Also, we have threats related to the space satellite itself, or threats related to the communication. All of these confirm that today we need to be aware about the cybersecurity in space, and to be aware about the cyber threats and the space system design today.
[ Music ]
>> Maria Varmazis: We'll be right back after this quick break.
[ Music ]
>> Maria Varmazis: We talked about ground. And I know ground is the major point but for space and link, are there, I mean those are pretty unique to the space, or not entirely, but those are pretty unique to the space industry.
>> Moez Kamel: Okay. So, yeah. In the space segment also, we have many threats related to space segment. And even in the space segment, we will talk about COTS component also. So, as I explained earlier, the COTS are reliable solutions for space ventures today, especially in the new space age. So, we can deploy COTS hardware also, or what we call also the plastic encapsulation, encapsulated microcircuits of electronic parts. So, these components also are used on board the SmallSat, especially SmallSat satellites, such as CubeSat. And we have today, many vulnerabilities that are related to these COTS components and can be exploited by adversaries. Also, we have also threats related to specific components on the satellite. So, for example the GNC, the guidance, navigation, and control. Because attackers will attempt to compromise the GNC system, for the purpose of creating wrong navigation data. And the purpose, the big goal is to impede the capability to navigate. The second component which is targeted by hackers today in the satellite, is the SDR. So, the software development ratio, which is the component that will allow, allows the satellite to communicate with the ground station. So, both for transmitting and receiving signals. And the adversary can send malformed packets to the SDR component, to perform the buffer overflow attack and gain unauthorized access. And the final component also, which is, can be risky, and can be targeted by hackers or adversaries is the, sorry, the electrical power system, EPS. So, why the hacker will be interested in the EPS component, because of the limited power of the EPS today in the CubeSat. So, the attacker will be interested to flood, just to flood the satellite with unnecessary process to consume this power. So, he leads to the outage of the satellite. So, here the threat is not, is not a malicious attack or something abnormal behavior. No. He will just flood the satellite with unnecessary process, so it will appear like legitimate traffic going to the satellite. But this unnecessary process will consume all the power on the CubeSat, and will lead to the outage of the CubeSat or of the SmallSat.
>> Maria Varmazis: And totally disabling it, yeah. Yeah, yeah. That's, yep. Don't need to send a missile to disable a satellite. There are other ways to do it. Yeah. Absolutely. Yeah. And you also mentioned the user segment. Which I really appreciate that you brought that up because sometimes when I look at cybersecurity in space, that part doesn't come up. And putting on my old cybersecurity hat for a moment, there's [laughter] it's not a pleasant thing to talk about, in terms of how users can be compromised either purposely or, or maybe even be an insider threat. And I know that's a slightly different thing. But it is still worth talking about because it's, I know for folks who maybe are coming from a military or intelligence background this is a given, but I don't know if everyone in the commercial space understands this. So, can you talk about that a little bit?
>> Moez Kamel: Yeah. As I said, the user segment is the segment which includes the user terminals and station. So, from the station, we will launch the operation, we will launch the command. We will maybe communicate with the ground station or communicate directly with the satellite. So, a hacker of course, if you have bad users or bad operators working on these stations or on these user terminals, it means that it's more easy for a hacker to send malformed packet or to send malicious traffic to the ground station and compromise the ground station and the satellite. So, of course, I think this part of user segment, of course we need to secure the components but we need to secure or to, to do some awareness training to these space operators that are working, that their daily work is in ground segment or communicating with satellites. So, that's why yeah the, I think the awareness training of these people is very important to be aware about the threats of space systems today.
>> Maria Varmazis: Right. I mean, I'm thinking something as like I guess, unsexy but as proliferated as ransomware. You know, that's not, I don't hear that talked about much. But it's like it's a real threat. It can be very disabling. And yeah. So, sorry, now I'm on my soapbox but [laughter] right.
>> Moez Kamel: Yeah. It's true, yeah. Also, ransomwares today in space system is a fact also. Especially today, the ransomwares are getting more and more complex, more and more sophisticated. It means that today the ransomware, if it's deployed, he will not give you the time to stop him or to remediate or to get back to the normal status on the machine. So, today also, we need specific solutions that will secure the endpoints of the space systems, or the station of the space system against the ransomwares. So, yeah. It's very important also, to take the case of the ransomware and to fight against ransomwares today in the space systems. And yeah, finally, we have the communications phrase. So, the communication part, the link part, the link segment between the ground station and the satellite also can be targeted by attack. And today we have many techniques that can be used by adversaries. The first or the very well-known one is the jamming. So, it's disrupting or interfering with the communication between the ground segment and space segment. We have also the spoofing technique, which is more sophisticated interference method than jamming. Adversary can use the eavesdropping technique which is the concept of man in the middle attack. It means that the attacker can be in the middle of a communication for example, for between a ship and a satellite for GPS positioning, for example. So, he can interfere the communication and send for example, wrong information to the ship for his directions, et cetera. So, this attack also can be used by adversary. And the first, the last one sorry, is the hijacking. So, the hijacking is gaining unauthorized control of the satellite to transmit the attacker's signals instead of the legitimate signal. So, yeah. Here I give you, I don't know, an overview of the threats related to or to the components of space design.
>> Maria Varmazis: Thank you. That was an amazing walkthrough. Because it is a very multifaceted landscape. There are a lot of different threats. And as we talked about, it's people but it's also a lot of technological issues as well. And it's, a lot of things are enmeshed. So, it can be both at the same time. The question that I'm sure a lot of people have that I have to ask is, how do we protect against this, which is an extremely complicated answer. So, it's like how much time do we have to get into that? But I mean, it will depend I imagine, on specifically what the threat is. But for maybe a space organization that is beginning their journey on becoming a more cybersecurity savvy organization, maybe we could start with like what steps they should take to improve their cybersecurity maturity, awareness, and practice. Maybe we could start there.
>> Moez Kamel: Yeah. Actually, these companies or these ventures need to, before thinking about the solution that they will deploy, that they will deploy in the system or on the space system, they need to think about the approach, the security approach first. And today we have let's say, three main security approach that can be applied on a space system. So, the first one and the most important one, is the security by design. Today, if you have a vulnerable component in its conception, if anyway you, I don't know, you put many layers of security, the component will be vulnerable. So, the approach of security by design is to designing systems with security as a primary consideration from the outset. So, rather than adding in as I said, as an afterthought. So, for example today, there were many researches that were carried out on the architecture of the SDR component, the use of software defined radio. And there are many proposal of new architectures secured by design, as a result. So, today we have many researchers that are working on changing the architecture of some components on space systems. And one of them, the SDR component because the SDR is very important. Because he will take the role of communicating and transmitting the signal between the ground segment and the satellite. So, as I said, the security by design is very important. And we need today that all the space operators, to give more I don't know, more budget, more people to work on this, on this topic. Then we have two other approach. So, the first one is the proactive defense approach. So, proactive defense approach is all the measures and strategies designed to prevent a potential cyber threat, to assets or to space system before that, before they can cause harm. And this approach, we have many measures or technologies that can be deployed. Like for example, the vulnerability management, the patch management to apply software patches and updates on the space asset. Risk assessment also. Threat modeling also is very important. So, by identifying the potential threats and attack vectors on space systems. We have also the attack surface management also, solutions that are very important to know what, which of our assets is vulnerable or is exposed to internet, for example. And what is the risk created to these assets from the perspective of the hacker. The endpoint protection also, is one of the proactive defense approach. And it's very important to protect the endpoint because we have today, the user terminals for example, or the stations are based on many endpoints, so we need to protect them. Also the security awareness training, we talked about that for space system operators. So, the purpose is to educate potential space security risk, and best practice, so this is very, very, very important. And finally, the offensive security assessment. So, including the pen test, including the red teaming campaigns, to apply an adversarial approach and determine the weakness in the space system component.
>> Maria Varmazis: Yeah. Yeah. For folks who may not be familiar with what that is, as you said, it's the adversarial approach. It's literally, you hire somebody who is on your side, who kind of just tries to imitate what a hacker would do. And it's a great way to sort of figure out if your systems are going to hold up in the way you hope and find any weak points. It's a really great program to do. Yeah.
>> Moez Kamel: And the second approach, or the third approach in our security approaches is the reactive defense. So, reactive defense refers to the approach of responding to the cyber threats and attacks after they have already occurred. So, here we have also many technology that can be deployed. Like the CIEM, the security information and event management solution. For example, this solution will collect, analyze, respond to security events and alerts form various sources within the space system components. We have also the forensic analysis. We have also the incident response solutions. And we can also apply a disaster recovery plan. So, here, yeah here, an overview of the approach that can be deployed before thinking to solutions. After that yeah, the solutions, we can have many security measures that can be deployed. For example, the signal authentication for the link segment. And here we talk, we can talk about both data level and signal level authentication. And I think this is the concept of supersonic codes. We can find algorithm today that authenticate the data and signal level [inaudible] in the link segment communications. We can talk also about the quantum. In the quantum we have the quantum key distribution, which is an emerging technique that relies on the unique properties of quantum mechanism. And we provide a tamper evident communication, use it to deploy new cryptographic keys with the unconditional post quantum security and without direct physical contact. So, this is the method can be used to exchange keys in cryptography, for example, to encrypt communication between I don't know, between two satellites or between ground station to satellite. So, the quantum key distribution can be a good solution. And also, we have the post quantum cryptography. So, the quantum safe cryptography includes a suite of algorithm that are resistant to attacks by both classical and quantum computers. Also, another point we need to think about the security of standards and protocol used in the communication especially.
>> Maria Varmazis: Right. Okay. Yep.
>> Moez Kamel: Today, we need to secure some protocols or we need to use some protocols that are dedicated for security. For example, the space data link security protocol, the SDLS, it's one of the protocol that will have security features. But also, we have the CCSDS protocol stack, which is a set of communication protocols designed especially for space missions, and the exchange of data between the spacecraft and the ground-based system. So, this protocol stack is very used, is used widely in the satellites, in even CubeSat, SmallSat, so we need to secure this protocol. Because I don't know, the compromising of this protocol will lead to the compromising of the communication between the satellite or satellite and ground station.
>> Maria Varmazis: And then if that happens, yeah. [laughter] Big problems. Yeah.
>> Moez Kamel: Exactly, yeah. Yeah. So, there's different measures that can be used, that can be integrated in space system to secure the space system design. But as I said, we need to think first about the approach, security approach, then think about the solutions.
>> Maria Varmazis: Absolutely. You've given me an amazing walkthrough of the landscape for cybersecurity for space. And I'm hoping our listeners have a much better understanding now. And at least a starting point, or a continuation point. Hopefully, they're not just starting out. But a continuation point on maybe what to think about next. Because certainly, every one's situation is going to be different. Everyone's system is unique. But there are a lot of different things and components to think about here. So, thank you so much for walking me through this. I really appreciate your time today.
[ Music ]
>> Maria Varmazis: And that's it for T-Minus Deep Space, for July 8th, 2023. We'd love to know what you think of our podcast. You can email us at space@n2k.com or submit the survey in our show notes. Your feedback ensures that we deliver the information that keeps you a step ahead in the rapidly changing space industry. This episode was produced by Alice Carruth. Mixing by Elliott Peltzman and Tre Hester with original music and sound design by Elliott Peltzman. Our executive producer is Brandon Karpf. Our chief intelligence officer is Eric Tillman. And I'm Maria Varmazis. Thank you for listening.
[ Music ]
