Space-Cyber trends and opportunities in Australia

By Jordan Plotnek Co-Founder and Lead Partner for Critical Infrastructure at Anchoram Consulting

In Australia we’re experiencing a massive boom in the space sector, as well as the manufacturing and technology sectors that feed the space supply chain. This is driving fast-paced business and technology development with the rapid deployment of advanced satellites and other space systems – each introducing new cybersecurity risks to an already congested and contested ecosystem.

Recent global events have demonstrated the immense appetite of various state and non-state actors to conduct offensive cyberspace operations against space systems. Most famously, Viasat communications outages were felt across Europe and SpaceX’s wellpublicised battle against hackers and signal jammers during the Ukraine invasion.

One of the most damaging aspects of a cyberattack is that its impacts can be felt globally. Take for example the WannaCry ransomware attack in 2017 that infected 200,000 devices across 150 countries. It forced hospital evacuations, manufacturing shutdowns, and rail halts – none of which were even specifically targeted. This threat must be taken seriously, and Australia is in the unique position to be building an entire commercial space industry mostly from scratch, giving us the opportunity to produce modern secure space technologies from the get-go.

Given the high risk of building and operating any technology in today’s threat environment, it is important to understand your risks and identify appropriate ways to mitigate them. There are four key trends that make space systems particularly vulnerable to cyberattack: 1. increasing technological complexity 2. increasing operational capability 3. increasingly hostile threat environment 4. increasing reliance on space infrastructure.

Technological Complexity

The second space race is shifting the focus from government to commercial interests, which is enabling a burst of innovation accompanied by sizeable funding opportunities. The next decade or so will see system-ona-chip avionics, self-optimizing autonomous systems, complex on-board satellite processing, autonomous satellite-to-satellite (S2S) communications, plus a number of other complex software and hardware enhancements. Each technological advancement introduces new vulnerabilities that could be exploited, producing yet unseen effects. For example, consider a piece of wormlike malware that corrupts a satellite connected via an autonomous S2S system – without proper safeguards the entire fleet could be compromised and potentially rendered unserviceable after a single infection.

Most famously, Viasat communications outages were felt across Europe and SpaceX’s well-publicised battle against hackers and signal jammers during the Ukraine invasion.

Operational Capability

Of course, the upside of the risks introduced by technological complexity is operational capability. New space technologies are developed to improve the functionality of the system, whether it be robotic arms, edge processing, or high-powered precision lasers. Each of these novel functionalities can not only increase the potential impacts associated with a cyber compromised system, but also the attractiveness of that system being actively targeted by threat actors. Additionally, given the increased militarisation of space, more advanced space systems can be more practicably weaponised in the case of cyberwarfare or cyberterrorism.

Threat Environment

New threats are consistently emerging due to global digitisation and increased accessibility to launch cyberattacks. Threats arising from cyberwarfare, cyberterrorism, and cybercrime are increasing and so are the capabilities of motivated threat actors. Both cyber and electronic weapons are becoming more effective and accessible by the day, with over 120 countries actively investing in their national cyber warfare capabilities. This means a significant increase in malicious cyber activity targeted towards critical systems such as satellites and launchpads. As has been experienced in the ongoing Russia-Ukraine war, commercially-owned systems are equally targeted and oftentimes more impacted (due to less preparation) than military or government systems during periods of cyber conflict.

Critical Space Infrastructure

Historical examples of previously deployed cyber weapons have painfully demonstrated the devastating impacts such an uncontrollable weapon can have on businesses and broader society. A hit to any critical infrastructure is felt throughout a society and can cause far reaching consequences to the economy, social stability, trust in public institutions, and psychological well-being of citizens. Satellite infrastructure in particular is the backbone of various terrestrial infrastructures, including power grids, banking systems, disaster response, and defence systems.

Mass-scale environmental and political events may also increase humankind's reliance on space infrastructure. For example, hazardous asteroids heading for earth or the growing threat of climate change, both of which are tracked, assessed, and potentially mitigated using space

infrastructure – a reliance that may evolve and become more critical as time goes on. Another example might be the continued increase of global political hostilities, which will only increase the need for military equipment to deepen dependence on satellite technologies for activities such as communications, surveillance, and targeting.

Compounding Factors

Compounding the trends above is the fact that space systems operate in very remote locations and are most often irretrievable for repairs or maintenance. These features exacerbate the impacts of a cyberattack and can result in total failure.

Additionally, space systems’ supply chains are incredibly complex and usually span the globe. From an adversarial perspective this provides many points of opportunity to compromise the end system. For example, physically tampering with an electronic component at the manufacturer to install undetectable malware. There are many recent examples of cyber supply chain attacks like this, such as the Tyupkin malware that infected more than 50 ATMs in Europe in 2014.

Space-Cyber Opportunities

Given that most of Australia’s commercial space industry is so-called ‘New Space’, the significant dilemma of space security could actually present an opportunity to domestic industry. Unshackled by the burdens of legacy systems and archaic infrastructure, Australia has the opportunity to build modern space technologies that are fit-for-purpose for the contemporary threat-drenched environment.

Whether you explicitly assess and accept a risk or not, the risk still remains to your systems and therefore your business. Novel technologies bring novel vulnerabilities and require thorough security testing and secure code review to ensure that the system is adequately hardened. With the right governance and risk management in place, security can also be embedded into the design and the operations to monitor any known vulnerabilities and protect the system against evolving cyber threats. This ensures not only the system’s ongoing viability, but also protects the business from any unnecessary operational risk – space operations are risky enough. When it comes to guidelines for implementing good cybersecurity practices into systems and operations, there are few standards that apply directly to space systems. The US National Institute of Standards and Technology (NIST) have recently released three standards that do apply to space systems: • NISTIR 8323: Foundational PNT Profile • NISTIR 8270: Introduction to Cybersecurity for Commercial Satellite • NISTIR 8401 Satellite Ground Segment.

Each of these standards provide detailed steps for applying the NIST Cyber Security Framework (CSF) in each of the user, space, and ground segments, with a focus on Positioning, Navigation, and Timing (PNT) applications. There are currently no standards that are tailored for space systems security in the Australian context. With world-renowned Australian cybersecurity standards such as the Information Security Manual (ISM), Essential Eight, and the Australian Energy Sector Cyber Security Framework (AESCSF), perhaps this another opportunity for Australia to draw international attention to our burgeoning domestic space industry.