NIST released IR 8401, a new guidance named “Satellite Ground Segment: Applying the Cybersecurity Framework to Assure Satellite Command and Control”.
NIST IR 8401 is a Cybersecurity Framework for Addressing Satellite Cybersecurity to the Ground Segment of Space Operations
NIST recognizes the importance of the infrastructure that provides positioning, timing, and navigation (PNT) information to the scientific knowledge, economy, and security of the Nation. This infrastructure consists of three parts: the space segment, the ground segment, and the users of PNT.
NIST IR 8401, Satellite Ground Segment: Applying the Cybersecurity Framework to Assure Satellite Command and Control, applies the NIST CSF to the ground segment of space operations. The document defines the ground segment, outlines its responsibilities, and presents a mapping to relevant information references. The Profile defined in this report provides a flexible framework for managing risk and addresses the goals of Space Policy Directive 5 (SPD-5) for securing space.
Ground Segment is composed of Terminals, Mission Operation Centers and Payload Operation Centers as described in the figure below.
Find below the Abstract of the IR 8401
Space operations are increasingly important to the national and economic security of the United States. Commercial space’s contribution to the critical infrastructure is growing in both volume and diversity of services, as illustrated by the increased use of commercial communications satellite (COMSAT) bandwidth, the purchase of commercial imagery, and the hosting of government payloads on commercial satellites. The U.S. Government recognizes and supports space resilience through numerous space policies, executive orders, and the National Cyber Strategy. The space cyber-ecosystem is an inherently risky, high-cost, and often inaccessible environment consisting of distinct yet interdependent segments. This report applies the NIST Cybersecurity Framework to the ground segment of space operations with an emphasis on the command and control of satellite buses and payloads.
Find below some Editor’s Note regarding NIST IR 8401
« This is intended as guidance, not a regulatory requirement, to raise the bar on the security of the ground-based components of satellite systems. They start with the basics: know what hardware you have, know what software is running, know what it is connected to and what your information protection requirements are. Each of the sections of the CSF (Identify, Protect, Detect, Respond and Recover) include sub-categories you should review, including applicability and references to identify gaps or things you may not have considered. »
Lee Neely, senior IT and security professional at Lawrence Livermore National Laboratory (LLNL)
« Since the NIST profile applies to ground segments of satellite systems, the guidance in NIST IR 8401 is pretty much the same as any guidance for any computer system. The key phrase in it is “Traditionally, ground segment isolation was accomplished through air gapping or limited connections. Increasingly, isolation is being accomplished via accounts, tenant isolation, and identities when using third-party services.” If you run, or are paying for, ground systems for satellite systems that are still claiming to be air gapped and no external connections, big red flags should be flapping. »
John Pescatore, Director of Emerging Security Trends
« Satellites and the ground stations that control them use the same IT and communication technologies found in other critical infrastructure. The threat is really about who can access the ground station, directly or via remote means. Not surprisingly, the same set of basic security safeguards need to be employed to protect this critical infrastructure. »
Curtis Dukes, CIS’s Executive Vice President and General Manager of the Best Practices and Automation Group
Community of Interest
The Approach used by NIST is to solicit Participation in a “Community Of Interest”, with about 130 Members representing over thirty organizations.
- Satellite Vendors, Operators, Government, Academia,
- Consultants, Private Individuals, Cloud Service Providers
Separate NISTIRs for Other Segments
In addition to the Ground Segment profile (NISTFR 8401), there are two other profiles already released :
Possible Future Profiles
NIST is working for possible future profiles as :
- Launch Profile
- Transfer Profile
- IMINT Profile
- Satellite Internet Service Provider Profile
More détails about NISTIR 8401
Read more in
- NIST: Applying the Cybersecurity Framework to Satellite Command and Control: NIST Interagency Report (IR) 8401
- NIST: Satellite Ground Segment: Applying the Cybersecurity Framework to Satellite Command and Control (PDF)
- Security Week: NIST Finalizes Cybersecurity Guidance for Ground Segment of Space Operations
