Star Wars: The hackers fight back

John Fokker at Trellix asks what business should do to improve their security and mitigate cyberattacks

 

What was once considered the realm of science fiction has gradually shifted to becoming a greater reality. From telecommunications and security, to providing internet for millions of people around the globe, space and satellites have quickly become important to operating modern society.

 

Kicking off the international space race in 1957, Sputnik 1 oversaw global superpowers shift gears to try and explore the possibilities that the void beyond could hold. Over the next 60 years, we’ve observed nearly 600 individual satellite launches per year, with that number skyrocketing significantly over the past two years, to nearly 1800 satellite launches per year. It’s clear that societal reliance on satellite communications and internet access is at unprecedented levels.

 

Whilst pushing the technological boundaries in this way offers flexibility and long-term growth for businesses, it can be a double-edged sword. This “out-of-this-world” technology offers more attack vectors for malicious threat actors to exploit.

 

As space continues to be commercialised, it is likely that the compromise of satellites and other space assets will increase in a far more visible way. The question that businesses face now is, what can they do to improve their security and mitigate cyberattacks from happening.

 

The ever-looming threat of ransomware

Utilising satellite technology is not a new venture for most organisations. Pushing technology to the edge not only offers physical benefits, but also works to improve network connectivity across the globe – this weaves a web between organisations and individuals that was historically unprecedented.

 

However, access to satellite technology that was once gatekept by network industry giants is gradually becoming the new normal. Whilst the ability to use space technology is great news for new players entering the market, malicious actors will naturally shift their focus.

 

The current reliance on satellite technology and its use in maintaining the backbone of many organisational core systems is at a high risk of exploitation. This technology was not initially designed with security at the fore and so over time critical vulnerabilities have emerged that, if exploited, could have a potentially detrimental impact on organisations. By attacking and compromising satellites, threat actors can effectively knockout entire operations and networks, holding them hostage for potentially huge pay-outs.

 

Without levels of redundancy inbuilt in the operational design philosophy, the damage caused by ransomware, and double extortion ransomware can be catastrophic. Coupled with this, the costs associated with these types of attacks will only continue to get more expensive over time. It’s clear that getting the security right while the hardware and software is being developed is a crucial step.

 

Decoding the “CubeSat” dilemma and prioritising cybersecurity

There have been historical occurrences of core infrastructure and critical systems being compromised such as the Goddard Space Flight Center in Maryland. This was a high-profile incident through which threat actors compromised the ground control of a satellite. This allowed the hackers to gain full control of the satellite and reorientate it to face the sun, frying the solar panels which inevitably resulted in its breakdown.

 

Of course, learning from past mistakes sparks innovation and we have seen significant steps being taken to rectify and reinforce ground control vulnerabilities. However, this may result in cases of organisations jumping from the frying pan, directly into the fire. As innovation grows within the satellite component industry, reduced part costs may present new threats – enter CubeSats.

 

CubeSats are off the shelf satellite parts used to keep manufacturing costs low. Whilst they can be a useful, cheap alternative to hard-to-get components, they are often not secure. Combined with inexpensive and poor-quality ground control communications equipment, malicious hijacking can be as easy as a simple waiting game.

 

When establishing priorities and developing a functional operational plan, cybersecurity can often fall to the wayside. Taking care and investing in secure components can be the deciding factor in threat actors being able to gain access to satellites and other vulnerable equipment. It is vital to ensure that security is front of mind and a part of every phase – from design, to manufacture, to launch, and post launch activities. The cost of best practice can be steep, initially. However, it is a far cheaper alternative to opening operations up to exploitation and outage.

 

Having an agile cybersecurity policy

Flexibility is at the core of security, and satellite-specific security is no different. Organisations need to look at how resources can be managed and sifted on the fly when responding to emergencies. Building in levels of redundancy and having multiple alternative responses to compromises in security is needed, especially when there could be thousands of vulnerable points within the operational chain.

 

However, there are tools available to companies that are venturing into the world of space and satellite technology. Ensuring firmware is robust and up to date is the first step. Yet, as threat actors improve the sophistication of their tools, this type of solution is becoming increasingly redundant. By integrating security that reshapes itself to match the changing threat landscape – adapting to threats across clouds, infrastructure, devices, teams, and data – the technology will be better positioned to learn from any incoming threats and remain secure.

 

There is an ever-increasing need for tools that utilise artificial intelligence (AI) and machine learning (ML) to provide full coverage of all endpoints, networks, and management systems. Weaving in predictive technologies and analytics that extends to all aspects of security. This provides an umbrella of security over all aspects of an operation, allowing for automated and timely action when potential security compromises crop up.

 

Staying in orbit

Cyber security is a game of cat and mouse, with providers and IT professionals having to constantly keep up with new tactics from threat actors, learning from previous security incidents to inform future practice. The added complexity of space age technology means that this is an ever-evolving landscape for all parties involved.

 

However, complexity doesn’t have to equate to difficulty. There will always be security challenges to face, especially when navigating uncertain territory. By ensuring that secure technology is at the heart of decision making and that staff are fully educated on operational processes, in conjunction with a robust security infrastructure is the cornerstone of allowing companies to embrace space safely.

 

---

 

John Fokker is Head of Threat Intelligence at Trellix

 

Main image courtesy of iStockPhoto.com