Lax satellite cybersecurity poses a global threat - WEF

With more players operating different parts of space infrastructure, the potential attack surface grows, providing more ways to conduct an attack.

Space services are becoming more integrated with the networks on Earth. While that allows for more space-based services, the interdependence also has security costs, authors of an article for the World Economic Forum‘s (WEF) Annual Meeting argue.

Fears over the security of space infrastructure have been exacerbated amidst Russia’s war in Ukraine. The Kremlin targeted a commercial space-based communications network on the first day of the conflict. SpaceX’s Starlink network has likely also been subjected to attacks over its involvement in supporting Ukraine with means to communicate.

According to the article’s authors, recent years have witnessed a substantial change in how humanity employs space assets, which impacts the safety of the infrastructure. While space and terrestrial systems were mainly isolated from each other, the advent of the new era of space exploration ushered in a slew of complex systems that are interconnected.

More companies, customers, and operators are involved in the creation and maintenance of space-based systems than ever before. The large satellite constellations, for example, the 2,000 satellite-strong Starlink, require complex ground infrastructure and services support.

The article’s authors claim that, unlike many older satellites, new gadgets sent to space are becoming more ‘software-defined.’ That means that the satellites are designed to offer reconfiguration options that can be carried out with the device still in space.

“[…] the sheer number of satellites in such networks means that if one satellite is compromised, a new path can be arranged but at the same time, however, potentially opens the door to take advantage of the satellite network due to their widely deployed terrestrial infrastructure and commoditized spacecraft design,” claim article’s authors.

To avoid scenarios where a single threat actor could threaten the destruction of space-based infrastructure, commercial and governmental stakeholders need to understand who’s responsible for what.

Many players are involved in the supply chain that puts up a constellation in space. However, there’s a lack of clear boundaries for the responsibility of hardware manufacturers, software developers, satellite manufacturers, operators, and commercial users.

“As terrestrial and space systems become ever more closely integrated and the distinctions blurred, a collaborative and informed exchange is needed between what has traditionally been seen as separate areas of cyber threat management,” reads the article.