2018-空间力量_太空资产网络安全（英文版）-1mb

Summary: Job One for Space Force: Space Asset Cybersecurity

Core Content

This report explores the growing cybersecurity risks associated with space systems, which are integral to many critical infrastructure sectors in the United States. It highlights the need for enhanced cybersecurity measures to protect these systems, which are currently under-regulated and often overlooked in security planning.

Main Points

• Space Systems as Critical Infrastructure: Space systems, such as satellites and their ground control systems, are foundational to sectors like defense, transportation, and communications. They support functions such as GPS navigation, weather monitoring, and global communications.

• Attractiveness to Cyber Threats: Space systems are attractive targets for cyber attackers due to their role as a central point of failure, lack of regulation, and the vast surface area of potential attack vectors. A single compromised satellite can disrupt multiple systems, including financial transactions, military operations, and commercial logistics.

• Security Challenges:

  • Lack of Standards: Unlike other critical infrastructure sectors, space systems do not have established cybersecurity regulations or standards.
  • Complex Supply Chains: The development of space assets involves multiple vendors and partners, each of which may introduce vulnerabilities. This complexity makes it difficult to assign clear cybersecurity responsibilities.
  • Legacy Systems: Many space systems are long-lived and cannot be easily updated or patched due to their mission-critical nature and operational constraints.
  • Institutional Gaps: Security teams in space organizations often lack the specialized knowledge required to secure space-specific assets, and cybersecurity is not always prioritized in budgets.

• Real-World Cyberattacks:

  • GPS Spoofing: Demonstrated by the Iranian capture of a U.S. drone in 2011, GPS spoofing can manipulate satellite signals to mislead navigation systems.
  • Satellite Hacking: The Turla group used satellite internet systems to conduct cyber-espionage, leveraging the satellite's IP address to remain undetected.
  • Cubesat Vulnerabilities: Low-cost cubesats using commercial-off-the-shelf (COTS) technology are more susceptible to hacking due to their open-source components and limited security features.

Key Recommendations

For Space Asset Organizations

• Apply existing cybersecurity standards and develop new, tailored ones for unique components.
• Assign security experts with specific knowledge of space systems and include cybersecurity as a budget line item.
• Foster a cybersecurity culture through incentives and gamification, such as internal phishing programs.
• Use encryption and threat intelligence tools to protect data integrity, even if the data is later made public.
• Collaborate with security researchers to identify and mitigate vulnerabilities.

For Policymakers

• Hold space asset organizations accountable for cybersecurity in government-contracted systems.
• Expand the Code of Federal Regulations to require reporting of cyber incidents by space asset organizations.
• Establish a Space System Information Sharing and Analysis Center (ISAC) to promote information sharing and coordination.

For the Department of Homeland Security

• Create a Space System ISAC that requires participation from government agencies and encourages private sector involvement.
• Ensure the ISAC mandates the disclosure of credible cyber threats within a set timeframe.
• Promote the documentation and adoption of space system security best practices.
• Encourage cooperation with existing ISACs in sectors like energy and emergency services to assess and remediate vulnerabilities.

Conclusion

Space systems are increasingly vulnerable to cyber threats due to their critical role in supporting infrastructure, lack of regulation, and complex supply chains. The report underscores the need for a coordinated approach involving both the private and public sectors to enhance cybersecurity for space assets. It calls for the development of clear standards, better accountability, and the establishment of a dedicated space cybersecurity framework to address these challenges effectively.

Acknowledgements

The report is authored by Gregory Falco, a Research Fellow at the Belfer Center for Science and International Affairs, Harvard Kennedy School. It is supported by the Cyber Security Project and includes contributions from various experts and organizations in the field of space and cybersecurity.