Outer space is considered one of the final frontiers. For nearly 70 years, we have traveled to space with rockets, satellites, probes, crewed vessels, and rovers to other planets and moons and beyond. From scientific exploration to military operations to, more recently, commercial ventures, we have seen many academic communities, governments, and private organizations see space as an opportunity to expand networking, communications, surveillance, and understanding. With this in mind, space is quickly becoming a critical infrastructure, using GPS navigation, satellite communications, weather monitoring, and national defense systems. However, as with systems on Earth, these space environment systems are subject to cybersecurity attacks, and threat modeling is critical more than ever to address these challenges in the space environment.
Attack Surface and Threat Vectors in Space Cybersecurity
There is a significant attack surface extending hundreds of miles above the Earth. Today’s spacecraft are computers with processors, sensors, communication systems, and autonomous decision-making capabilities. Physical access for updates or repairs is extremely limited or impossible, making cybersecurity failures potentially catastrophic.
Some threat vectors are especially unique to space systems. For example, interference and signal jamming can disrupt radio frequencies used in space communications. GPS coordinates can be spoofed, which can cause navigation failures. GPS timing signals synchronizing financial networks, power grids, and telecommunications systems can also be compromised. A successful attack on GPS satellites could affect everything from ATM networks to cellular communications.
Satellite internet constellations are becoming critical infrastructure for remote regions and backup communications. The interdependence between terrestrial and space-based networks means that attacks on space assets can immediately impact ground-based services, and vice versa.
Supply chains for space systems can also be compromised. Many components for spacecraft come from multiple countries and vendors, each potentially becoming an open point for backdoors in hardware and software.
Natural events in space, such as solar storms or other space weather events, can cause interference with space operations and security monitoring systems. Attackers might then use timing attacks and these events to cover malicious activities.
Threat Modeling Frameworks for Space Systems
Traditional threat modeling approaches, like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), can help identify some threats applicable to space systems. However, STRIDE may require significant adaptation for space environments. An alternative approach is the Space Attack Research and Tactic Analysis (SPARTA) matrix created by The Aerospace Corporation in October 2022 (see: https://sparta.aerospace.org/).
