While it is yet to be officially designated as part of the U.S. critical infrastructure, the space domain plays a role in nearly all industries. According to 2024 Cyber SIGACT metrics, manufacturing is the second most targeted industry sector in the United States, behind healthcare. State sponsored intrusions continue to threaten the space supply chain. Ongoing challenges such as open-source software, resource deficiency and a vast number of standards, create added layers of vulnerabilities.
By encouraging information sharing and threat awareness, space community partners and all critical infrastructure sectors will benefit from securing the space supply chain and ensuring its resilience.
“Our job is to be ahead of the bad guys,” said Dr. Allan Day, Maj. Gen., USAF (Ret.), vice president for industry strategy and supply chain and logistics for Salesforce.
The implementation of stringent cybersecurity standards and vetting of all vendors and suppliers, will help secure the foundation of the space supply chain.
Key Concerns
Just recently, the Space ISAC supply management working group was tasked to identify three key concerns in space supply chain resilience.
- Knowledge management discipline
Mature knowledge management will help supply chain risk management by identifying and mitigating risks, therefore helping leaders make informed decision. This means comprehensive knowledge of data sets to ensure reliability. There must be a trained workforce that has knowledge management system expertise to understand and regularly contribute to it. So said Meg Moloney, associate director with Guidehouse’s defense and intelligence segment and co-leader of the working group.
Knowledge management may be the most successful ingredient to a healthy supply chain; however, it is one of the most difficult to implement, Moloney said. “It’s touching on data, it’s touching on people, it’s touching on systems and it’s everchanging, so it’s very hard … there is not a finish line you’re going to cross.”
- Consistency and adequacy of supply chain management resource allocation
Due to administration, leadership and/or organizational changes, resourcing commitment is often inconsistent. This leads to unprecedented redirection, handicapping the supply chain resiliency. Consistent resourcing is necessary for the successful development, implementation and execution of supply chain risk management strategies for space resilience, Moloney explained.
- Open-source vulnerabilities
Whether used as a component of space assets or to manage business operations, open-source software is pervasive in the space industry,
Even with commercial off-the-shelf products, open software can be leveraged by malicious actors. “There is still a lack of documentation and transparency with some open-source code that can potentially impact end users,” she stated. In order to detect hidden flaws or traces of malicious elements, the space community must understand the open-source code enough to inspect it.
The challenge for small businesses
A lack or change in resources and allocation poses an even larger risk for small businesses, who are often met with the challenge of sifting through the chaos of regulatory frameworks.
“There’s almost too much information available and a lot of grey area in how to apply it,” said Dick Wilkinson, CTO of Proof Labs, a small business focused on protecting space systems from cyber-attacks.
Wilkinson therefore encourages the use of the Space Attack Research and Tactic Analysis (SPARTA) matrix to help find most helpful information from the many catalogues from National Institute of Standards and Technology, the International Standards Organization and the European Space Agency.
Reporting and information sharing
Still, the large number of strategies for military and commercial partners leaves room for vulnerabilities, which an evolving space industry cannot afford. This consequently adds complexity to an already complex environment: should a business share information if and when it has been targeted by a malicious actor?
According to Moloney, clear contractual language requiring fulsome reporting, from data extraction and anomaly detection, is vital. “It needs to be contractual because there is not an incentive for people to report. Unfortunately, in the current environment, many companies have the mindset that if they report an attack, they will be less likely to gain future work from that customer or client,” Moloney said, describing the disincentive.
In the Space ISAC, members believe in the success of transparency and the value of information sharing.
The organization’s traffic light protocol (TLP) helps members share threat information to aid in mitigation and awareness. TLP classifications are as follows:
- Red: restricted, not for disclosure
- Amber + Strict: limited disclosure restricted to participants’ organization
- Amber: limited disclosure restricted to participants’ organization and business partners
- Green: limited disclosure restricted to the community
- Clear: open to public
This is reflective of the fact that members must be discerning with what they share, because sharing everything with everyone all at once is also poor security practice.
Leveraging modern technology
Meanwhile, bad actors continue to leverage modern technology such as artificial intelligence (AI) to disrupt the space infrastructure and subsequently the supply chain. Through malicious code, hackers have posed as Americans, Day stated. “Everybody’s trying to catch up to the criminals.”
However, with anomaly detection, automated threat response and predictive analysis, AI can be applied to build a more resilient environment.
Explore More:
Podcast: Commercial Data, Open Source Intelligence and Moving at the Speed of Technology
Satellite Manufacturers Adapt Supply Chains Amid Demand for Mass Production
Space Industry Leverages Tabletop Wargames and ZTA to Tackle Novel Cyber Threats
