- Good day.
My name is Scott Kordella,
and I work for the MITRE Corporation,
and I'm joined by my colleague, Sam Visner, also of MITRE,
and today we are speaking about a topic
that we call Cyber Best Practices for Space Satellites.
In this next chart, we share some of the activities
that MITRE is involved in with respect to space
to give some context for this work.
As shown on the left, we saw
the National Space Council Executive Office of the President
and the Space Policy Directives
that that group has put forward,
Space Policy Directives 1, 2, 3, 4, and 5.
I won't summarize all of them,
but rather highlight number five in a subsequent chart.
On the right,
we show MITRE's work.
MITRE is a not-for-profit whose business is to operate
federally funded research and development centers.
MITRE has a uniquely large footprint
of operations of FFRDCs,
we operate seven of them,
and we work across all of them in favor of large outcomes,
such as those that align with these Space Policy Directives.
This talk is one of those alignments.
It focuses on Space Policy Directive-5,
namely Cybersecurity Principles for Space Systems.
In the next chart,
Space Policy Directive-5
has these critical aspects.
It seeks to provide protection
against unauthorized access
to critical space vehicle functions.
It seeks to reduce the vulnerabilities
of those space vehicles,
including their command and control,
their telemetry receiver systems.
It seeks to protect those systems, communication systems,
from jamming and spoofing.
Space Policy Directive-5 also addresses issues
associated with ground systems of space systems.
That is, those aspects that pertain
to information technology, information processing systems,
operationally dissemination of the information
that space systems develop.
And exclusively into the point of our talk,
Space Policy Directive addresses the approaches
used by the National Institute of Standards
and Technology's Cybersecurity Framework,
the NIST Cybersecurity Framework,
as the appropriate means to develop these best practices.
The best practices that are cited in SPD-5 include
cybersecurity hygiene practices,
physical security practices, machine automation, and others.
And ultimately,
going upstream of the actual provider of space capabilities,
namely through supply chain risks, mitigating those risks.
So altogether, these best practices
are areas that we will speak about in our paper
and relate them to the work that we do
through Sam and his team with NIST.
First, in this next chart,
the space industry threats that we're trying to address,
and we can group them in three basic groups.
One, operationally related threats.
As I mentioned, supply chain threats,
those threats associated
with the integration of new equipment, data,
the design of our systems, and so on.
A second grouping is business systems,
how we manage our space systems,
how we provide data security, software assurance,
how we train employees,
how we manage the overall enterprise of cybersecurity.
And finally, the third group is in the missions themselves,
how we protect communications
to and from the space systems and the ground,
how we secure the ground network,
how we maintain positive command and control
of our space systems
so that adversaries cannot do harm.
These are the basic areas that we described as the threats.
In the next chart, this is essentially the gist of the talk.
What are these best practices?
How can we use the NIST Cybersecurity Framework
that's been developed for other use cases, but for space,
and address the IT ecosystem that we're trying to develop
in support of low Earth orbit,
providing greater cybersecurity and resilience?
And ultimately, these best practices
become guidelines for industry
to implement and become more protected through their use.
I'll now turn this talk over to my colleague, Sam Visner,
who can speak in more depth
about the NIST Cybersecurity Framework on the next chart.
- Thank you, Scott.
And I appreciate very much the honor of being asked to speak
at this year's ASCEND event.
I'm Sam Visner, and I am the Director
of the National Cybersecurity Federally Funded
Research and Development Center.
I'm gonna talk a little bit about that center in a minute
because that center's approach to cybersecurity architecture
is really core to the message that I wanna send today.
And that is, that the security of space systems,
particularly proliferated LEO systems,
with hundreds and eventually thousands,
and perhaps tens of thousands of small satellites,
is gonna be a major challenge.
These satellites are designed as our all space systems
with space power and weight, constraints,
and more so in the case
of these small LEO sats and small satellites
than has been the case, for example, perhaps
with larger national security and national platforms.
So the question is, is there a way, is there a roadmap,
to improving the cybersecurity of these systems,
particularly these commercial systems,
that is incremental?
And the approach that I wanna discuss today
is essentially an approach that uses architecture.
And I'm gonna point to an example in an industry
not necessarily related to space systems
but I think of as indicative and hopefully informative
of the approach that one might take.
The overarching approach we use
to cybersecurity architecture
is NIST Cybersecurity Framework,
which essentially allows for both self-assessment
and the building of a cybersecurity architecture and program
according to various phases:
identify threats and vulnerabilities, to protect yourself
against these threats and vulnerabilities,
to detect threats, to respond to them, and to recover.
And these five categories allow for the development
in the imposition of specific controls
which are easy to understand,
and the building of a cybersecurity architecture
that can be mapped to these phases
and to the subphases and controls under them.
Let me move to the next slide.
What we do in support of NIST is really quite unique.
We work with NIST
National Cybersecurity Center of Excellence.
That center assembles experts from business,
from the nation's business infrastructure and community,
from academia, and from the government.
And we operate in the development
of cybersecurity architectures
that use essentially commercial technologies
that can be employed together
to protect the nation's business infrastructure.
The NCCoE that we operate is a collaborative environment.
And that collaborative environment
is, you can see on the next slide,
public-private partnerships,
we bring in standards organizations from NIST,
companies that make cybersecurity products.
We look at policies, in this case like SPD-5,
the Space Policy Directive-5,
to which Dr. Kordella referred a minute ago.
We bring in academic experts,
and we bring in experts from the industries
that need cybersecurity,
so both the product vendors who produce the solutions
and those that need them in the various industry sectors.
On the next slide, that gives you a sense of how we work.
Everything has to be standards-based.
We ask, "What are the cybersecurity standards
relevant to this industry?"
Everything has to be modular, plug and play.
You don't have to use a product that we've used
in a reference architecture,
but it should allow you to achieve the same functionality
and achieve the same standard.
Everything is published
as a repeatable sort of practice guide, a how to do it,
so that you can, as we say, do this at home.
All of the products with which we work
are commercially available.
There are no architectures that have a big thing in them
that says, "Here goes the super classified technology
you can't afford and to which you don't have access."
Everything is available.
Things have to be usable and practical.
And all of the work is open and transparent and published
so that the industry,
an industry that doesn't have lots of people
with security clearances, can use it.
Moving to the next slide,
the way in which an architecture is published
is really quite straightforward.
NIST publishes them
under the Special Publication's 1800 series,
known as Practice Guides,
but these Practice Guides are how to assemble
a cybersecurity architecture.
Volume A, the problem we're trying to solve,
and why you wanna solve it,
and what benefits you get from doing so.
Volume B, the architecture itself
mapped to the various controls and standards
applicable to the industry.
And Volume C is the assembly manual
right down to the glue code to make different pieces
of commercial cybersecurity technology work together.
Let me give you an example
of how this has been done for the medical industry,
in this case, for wireless infusion pumps.
These are IoT, Internet of Things, devices.
They connected to human beings,
but they're also connected to the hospital IT.
They're connected to the pharmacy.
They're connected to the patient's record.
They're connected to all of the various IT systems
that need to be involved in caring for a patient.
These systems were designed initially
without a lot of security features.
They're connected to the hospital IT estate by Wi-Fi,
possibly using a Wi-Fi password.
The question was asked, "Would it be possible to develop
an architecture with compensating controls
that would add security in the absence of security features
on these devices themselves?"
And this is a device, this is an architecture that we use.
In this case, a fairly complex system with data transfer,
physical connectivity, lots of information flow.
And in this case, you can even see a wireless link
where the medical device was connected
to the hospital's wireless network using Wi-Fi.
This is the kind of approach that we use,
is to specify compensating security controls
and commercial cybersecurity products.
Going to the next slide gives you a sense,
you can see on the left, several of the various phases
of the NSIT Cybersecurity Framework,
in this case, identify, protect, and detect,
and within those functional areas, specific categories,
and within those, specific controls that are applied.
And this shows you that the architecture itself maps
specifically to the requirements
that are requisite to that industry,
in this case, the healthcare industry,
in this case, IEC, ISO, and HIPPA privacy rules,
as well as the specific phases
of the NIST Cybersecurity Framework.
In other words, this is an architectural approach
that allows us to build an architecture
specific to an industry that maps to known controls
and a known architectural,
and a known architectural framework.
So moving to the next slide,
we believe it is possible to develop
cybersecurity reference architectures
for all of the segments
to which Dr. Kordella referred a few minutes ago.
Certainly, the user segment,
those that in fact represent the workload
that will be carried by these satellites,
the space segment itself on board these satellites,
as well as the ground segment,
with an understanding that more and more of these
will be connected through the Internet
and, in future, connected
through the next generation of the Internet known as 5G.
Here's a brief comparison
of how these two architectures would work.
In the case of healthcare,
you can see this delivers medical fluid
in a controllable way to a patient
using wired and wired networking.
A lot of the devices are used simultaneously.
Every pump has to be hooked to a server
for configuration setup, for updating,
and drug library installation.
There's a small device which on each pump provides
a little bit of limited computing.
Devices communicate
through several different operating systems
which may be fully equipped,
or depending on the need,
these may be very small and compact operating systems.
They're designed for long lifespan usage.
Hospitals can't be switching these things out all the time.
And they have a complex set of security controls:
asset tracking, inventory management, patch management,
network segmentation.
We have to be able to look at abnormal behavior
and to be able to detect that,
white listing, the ability to communicate with encryption,
a number of security controls.
This has an analog in the space case.
If you take a look at this,
we have to obtain observations, maybe imagery,
or provide communications,
so there is an analogous function.
Just as we have a large number of infusion pumps,
we have a large number of these satellites
which are used simultaneously.
Everyone has to be managed,
has to be connected to some kind of a data server
for configuration, software update.
Just as the medical devices have on board computers,
so does the satellite with limited computing in some cases
to be able to manage the functions
for which they're responsible.
These systems may be designed
for relatively short lifespan.
That is the difference that would have to be accounted for
so that they can be de-orbited and replenished,
but some of these may stay up for a very long time.
And lastly, just like in the healthcare case,
a very wide variety of security controls,
Authenticated Communication,
the need to encrypt data in transit,
Access Control to the operating systems,
white listing of the applications
that are allowed to be used on these,
and the ability to verify input
and to constraint input according to that white list,
to log and audit events,
to be able to update devices securely, to make sure
that the engineering processes themselves is secure,
make sure that antivirus defenses
have been mounted and are maintained to make sure
that the BIOSes in the operating systems are secure,
and to make sure that they're fail safe.
A different set of controls in the healthcare case,
but like the healthcare case, a wide set of controls.
And I believe an architectural approach, one that uses,
for example, the NIST Cybersecurity Framework
is the way to go.
We've used this approach for a number of industries:
healthcare, energy, transportation, finance, and others.
We think the healthcare approach is a rough analogy.
It's not a perfect analogy,
but it might be a guide to the approach
to building cybersecurity architectures for Space Systems.
SPD-5 is a driver. It's a driving event.
It makes clear these controls are important.
We need an architectural approach that allows us to tailor
the controls and requirements in SPD5
to the commercial cyber,
to the commercial space environment.
With that, we're gonna conclude.
Dr. Kordella and I are both grateful
for the opportunity to have presented to you at ASCEND.
And our contact information is on the last slide.
We would be grateful if you would contact us.
And certainly, we'd be willing to try to work with you
in answering your questions about this approach
to securing the ever-expanding environment
of commercial and small satellite systems.
Thank you.