The White House today issued a new guidance outlining a series of guidelines and best practises to defend space networks from cyber-threats and cyber-attacks.
The new regulations, outlined in Space Policy Directive-5 (SPD-5), are intended to create a standard for cybersecurity for all space-bound vessels, systems , networks, and communication channels designed and operated by US government agencies and commercial space entities.
US officials fear that space-active US organisations will face cyber-attacks that could “deny, weaken, or interrupt space operations, or even kill satellites.”
‘Examples of malicious cyber activities harmful to space operations include spoofing sensor data; corrupting sensor systems; jamming or sending unauthorised guidance and control commands; inserting malicious code; and performing denial-of – service attacks,’ officials said.
These risks may be mitigated by a collection of best practises, already well-established, and implemented in other sectors of the industry, according to SPD-5.
Mechanisms upgrade, encryption and physical protection
For instance, officials say that space systems must provide “the ability to conduct updates and respond remotely to accidents” and that these features must be incorporated space vehicles during the design process, prior to launch.
Space systems and supporting infrastructure also need to be built and managed by cyber-safety training engineers, the White House said.
“Active and authenticated authentication or encryption” can also be used to secure functions from unauthorised access from command , control and telemetry.
The same roles of command , control, and telemetry — used by ground operators to control spacecraft — should also come with safeguards against jamming and spoofing communications, officials of the US government said.
This implies using monitoring programmes for signal strength, protected transmitters and receivers, authentication or “efficient, validated and checked encryption.”
But best practises in cybersecurity should not be extended only to spacecraft and their means of communication. It is just as necessary to protect the ground stations from which those communications are handled.
Ground stations, for example, should enforce the logical or physical segregation of IT networks, regular patch systems, apply physical security access rules, enforce restrictions on the use of portable media within their networks, use antivirus software and train staff accordingly, including against insider threats.
Also, risks to US space systems should be analysed further down the supply chain. This involves monitoring manufactured components, requiring sourcing from reputable suppliers, and detecting false, counterfeit and malicious equipment that may pose unexpected cybersecurity risks.
U.S. space systems operators can also seek to exchange hazard, alert, and incident information with industry stakeholders through Information Sharing and Analysis Centers (ISACs) in case threats are identified.
And because we’re talking about spacecraft, where size and weight matters, cybersecurity programmes and initiatives should also be planned so as not to hinder missions by affecting space vehicle size , weight, length of flight, or other technical specifications.
Speaking at a press conference on Friday, White House officials said the latest SPD-5 directive and the recommendations it made should help US space agencies set up basic security against cyber attacks that “have happened all the time” and “not just from China but also from non-state actors.”
Officials said such cyber-threats “linked to regularity.”
