Securing Space: The Next Frontier of Credential-Based Attacks

Since President John F. Kennedy announced plans for a lunar landing in 1961, the United States has led space exploration and innovation. Technology has played a massive role in the nation’s successes across the space industry, but it has also provided adversaries with new opportunities to infiltrate and dismantle our galactic efforts and national security through cyberattacks in space systems and devices.

Taking Action Out of This World

In September, the Trump administration recognized mounting threats by issuing the Cybersecurity Principles for Space Systems policy directive. Detailing the importance of protecting space systems and devices from cybercrime, the directive calls on agencies to “define best practices, establish cybersecurity-informed norms, and promote improved cybersecurity behaviors throughout the nation’s industrial base for space systems,” focusing on securing the supply chain from start to finish and sharing information with the appropriate governments and private actors. 

The recommendations and examples of malicious attacks outlined in the directive align with growing concerns over the shortcomings of traditional security solutions that leave operational technology—the software and hardware that controls physical devices—vulnerable to attacks. With this knowledge, protecting space systems can be achieved by following the current approach to securing critical infrastructure: fighting credential-based attacks.

Operational Technology in Space: All Systems Go

Organizations that rely on OT branch several sectors, including utilities, transportation and manufacturing. Historically, critical infrastructure has fallen victim to cyberattacks through vulnerabilities in system designs, outsourcing, and an emphasis on function over security. IT security departments have also faced staff shortages and a lack of expertise across critical infrastructure organizations has led to the introduction of automation and machine learning as effective measures to help combat insider threats.

Examples of critical infrastructure in space include the NASA satellites orbiting Earth, which are equipped with cameras and scientific sensors to collect data about the planet. Satellites can help scientists control the spread of disease, monitor wildfires and volcanoes, and predict weather and climate. If compromised, these machines could potentially risk lives by disrupting communication, impacting food crops, or providing misleading information. Rovers, spacecrafts and the International Space Station are also susceptible to cybercrimes where hackers can infiltrate coded messages and computer algorithms, underscoring the risks associated with insider threats and the need to secure space systems against credential-based attacks. 

Houston, We Have Some Critical Infrastructure Problems

Securing the systems, networks and channels for space systems starts by protecting data during the creation stage where IT teams can test the security of devices, discovering vulnerabilities early in the process. For example, the creation of shuttles, rovers and other space vehicles begins with design and identifying necessary tools, then moves to construction and rigorous testing. Issues flagged during this process allow teams to make necessary adjustments to the infrastructure. Teams examining the function and performance of these devices should also incorporate testing for security and implement tools capable of identifying issues down the line.

Used for their detection capabilities, user and entity behavior analytics, or UEBA, tools use advanced analytics, allowing IT teams to quickly identify device behavior that is abnormal and/or risky; find compromised user credentials and privileged user accounts, and malicious insiders; and create operational efficiency with automated incident response. UEBA achieves this in critical infrastructure environments by using all of the ingested data points to baseline normal behavior for all users and machines. Applying these technologies to space systems and devices means risky or abnormal behavior can be caught early, preventing severe damage, intercepting mixed messages, and ensuring that communication signals remain uninterrupted.

Small Steps for Organizations, Giant Leaps Against Insider Threats 

Modern space systems require equally modern UEBA solutions over legacy tools unable to detect abnormal behavior of OT devices or their users. While the focus of securing OT and supporting resilient critical infrastructure has traditionally been applied to more familiar systems on Earth, the most recent directive recognizes that securing our space systems and their OT devices is just as vital to the continuity of critical services, protection of the nation and the safety of people as it is to expand our knowledge of the cosmos.

Trevor Daughney is vice president of product marketing at Exabeam.