With the growing and insatiable demand of data and connectivity from government and consumers, satellite solutions need to have information assurance. We are in an era of increased threat from elaborate data breaches and denials of service; these threats to information assurance are on the rise and are increasing in sophistication.
On March 1, the CompTIA Space Enterprise Council along with the Satellite Industry Association and Space News held a webinar titled “How Secure Are Our Nation’s Satellites?” Speakers included Greg Garcia, executive vice president, signal group and first Department of Homeland Security (DHS) assistant secretary for cybersecurity; John Toomer, director, intelligence, information and cyber systems, Defense, Space and Security Group, Boeing; and Ethan Lucarelli, director, regulatory and public policy at Inmarsat. The moderator was Brian Berger, editor of Space News.
Garcia said cyber threats are evolving against satellites and the services they support; including defense systems, environmental/weather monitoring, maritime, broadcasting, financial services, energy exploration and communications. “If we can imagine satellites being disabled or corrupted in their delivery of signals to any of these critical infrastructure sectors, we can expect to experience cascading effects related to public safety, economic loss, and loss of life,” he said “These threats are exacerbated by government and industry data communications services moving to the cloud, global sourcing of components and software, and lack of consensus of cyber best practices.”
He stressed the importance of partnerships between the public and private sectors to address the dynamic challenges of cybersecurity. DHS is a principal partner of the U.S. Communications Sector Coordinating Council, which includes the satellite subsector. The group has 40 to 50 member organizations who meet on a regular basis to consider their vulnerabilities; explore ways to develop best practices; work with federal government to exchange information about threats, attacks and incidences; as well as discuss and consider ways to mitigate and respond to incidents. He urged the satellite industry to get more involved with this group.
Garcia said the National Institute of Standards and Technology (NIST) has just issued a draft update to the Framework for Improving Critical Infrastructure Cybersecurity—also known as the Cybersecurity Framework. “What’s interesting about the updates to the framework is that it provides new details on managing cyber supply chain risks and this might be one of the most important components in dealing with cyber threats affecting satellites,” Garcia said. “We are a global industry and we are globally sourcing software from all over the world. The challenge is to provide assurances that the software products customers are using and which you are selling are free from malware or other cyber methods that steal data or disable systems.” He urged the satellite industry to get involved with this framework and to integrate itself more with other industry sectors working to mitigate cyber-threats.
Lucarelli was our next speaker. He began by saying that satellite networks are increasingly integrated into all global networks that make up the Internet. The satellite industry has a long history of providing information assurance for some of the world’s most sensitive data for government, military and enterprise clients. He said the growth of broadband across the industry allows for new services of which security must be at the forefront of those operations.
“We see several types of cyber-threats affecting our customers,” Lucarelli said. “Foreign and non-state actors are increasingly attempting to exploit, penetrate and disrupt satellite industry infrastructure. These threats are manifested through hacktivism, industrial and state-based espionage, cyber-terrorism, as well cyberwarfare state sponsored disruptions and a wide range criminal activity that is aimed at penetrating and exploiting networks.”
The motivation of cyber-threats can be varied. “One of the biggest threats facing customers is from criminal organizations who want to manipulate IoT sensors or put ransomware in client systems,” Lucarelli said. “These threats call for an all hands-on-deck approach that recognizes the responsibilities of not just network operators, software solutions providers, integrators and hardware manufacturers but everyone in between.”
Because security and stability have been essential to the satellite value proposition from the start, as is collaboration with customers like the military who seek satellite systems that are hardy, secure and reliable, Lucarelli feels that the satellite industry is well-suited to handle emerging cyber-threats and respond to new threats while providing stability, resiliency and security to all their networks.
Lucarelli discussed a recent joint statement on the industry’s commitment to cybersecurity developed by the Satellite Industry Association (SIA) and the Global VSAT Forum (GVF). “It’s a policy position that embraces a need for action while also recognizing that innovation needs to be nurtured. It’s a set of industry wide principles that could be applied across the industry that addresses the entire satellite value chain. It advocates a risk management approach and is in line with the NIST Cybersecurity Framework. It’s an important milestone and we’re very proud of that effort.”
Toomer was our next speaker. He said as Boeing looks at cybersecurity-specific protection and the future design of satellite systems, it’ll be critical to use better hardware and software to monitor onboarding operations; rooted trust processors; more robust software code; enhanced architecture to isolate critical systems; as well as the ability for frequent software and information assurance updates to guard against cybersecurity exploits. “We’ve looked at chips and artificial intelligence to help with this,” he said. “And while the engineering side of this has not been baffling, it is difficult.”
Toomer said that things are changing rapidly and that it is important for satellite providers to continue to update voluntary agreements and best practices within the NIST arrangement. He urged industry to lead the way and to communicate and share information between government and industry.
To learn more about what was discussed, click here.
