> For the complete documentation index, see [llms.txt](https://martian1337.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://martian1337.gitbook.io/notes/security-engineering/transportation-and-autonomous-systems-security/space-systems-security/space-systems-hardening-checklist.md).

# Space Systems Hardening Checklist

Controls for a space mission, organized by segment, with the link-layer encryption and authentication that the threat model demands. The control goals are durable; the standard document issues and NIST report revisions are fast-moving. Aligned to SPD-5, the NIST space cybersecurity reports (IR 8270, 8323, 8401), and the CCSDS Space Data Link Security standards.

## Program and lifecycle (SPD-5)

* [ ] Cybersecurity integrated across the mission lifecycle (requirements, design, build, test, operations, and disposal), not added after launch, because most of the spacecraft cannot be changed once in orbit.
* [ ] A cybersecurity plan that protects against unauthorized access, jamming and spoofing, attacks on command and control, and supply-chain and physical threats, and that provides for retaining and recovering positive control of the vehicle.
* [ ] The threat model built against a space-specific matrix (SPARTA) so the plan addresses real space-system tactics, not only enterprise IT ones.
* [ ] Controls sized to mission risk and to the size, weight, and power budget, so security is proportionate and actually flyable.

## Link segment: encrypt and authenticate the RF

* [ ] Telecommand (uplink) authenticated so the spacecraft executes only commands from an authorized controller, using a message authentication code as in CCSDS Space Data Link Security (SDLS).
* [ ] Telemetry and command links encrypted so intercepted traffic does not leak mission data or the protocol knowledge needed to forge commands.
* [ ] Anti-replay protection enabled (sequence or freshness in SDLS) so a captured legitimate command cannot be replayed.
* [ ] Key management operationalized: secure loading, rotation, and revocation, with over-the-air rekeying and security-association management as in the SDLS Extended Procedures, so keys can be changed across a long mission without a site visit.
* [ ] Cryptography chosen for the mission lifetime, accounting for the decade-plus horizon and the migration path (see [Cryptography and Key Management](/notes/security-engineering/cryptography-and-trust-infrastructure/cryptography-and-key-management.md)).

## PNT and GNSS resilience (user and link)

* [ ] Receivers hardened against jamming and spoofing: antenna and signal-quality monitoring, plausibility checks on position and time, and multi-constellation or multi-frequency use where available.
* [ ] Signal authentication used where the constellation offers it, since civil GNSS signals are otherwise unauthenticated and low-power.
* [ ] A holdover or alternative timing source for systems that depend on GNSS time, so a PNT denial does not cascade (align to the NIST IR 8323 PNT profile).

## Ground segment: the most-exploited surface

* [ ] The ground network segmented so operations and command-and-control systems are isolated from general IT and the internet, with default-deny between zones (see [Network Security](/notes/security-engineering/network-and-communications-security/network-security.md) and [Zero Trust Architecture](/notes/security-engineering/identity-and-access-management/zero-trust-architecture.md)).
* [ ] Remote access to the ground segment brokered, logged, and protected with phishing-resistant MFA, because a misconfigured remote-access appliance was the entry point in the Viasat KA-SAT intrusion (see [Identity and Access Management](/notes/security-engineering/identity-and-access-management/identity-and-access-management.md)).
* [ ] Least privilege and privileged access management on operations consoles and the command chain, so no single compromised account can command the spacecraft.
* [ ] Ground systems patched, securely configured, and monitored like the high-value IT they are (see [Secure Configuration and Hardening Baselines](/notes/security-engineering/cloud-platform-and-endpoint-security/secure-configuration-and-hardening-baselines.md), [Vulnerability and Exposure Management](/notes/security-engineering/security-architecture-threat-and-exposure-management/vulnerability-and-exposure-management.md), and [Logging and Monitoring](/notes/security-engineering/security-operations-detection-and-response/logging-and-monitoring.md)).
* [ ] Command issuance monitored and alertable, so anomalous or unauthorized commanding is detected and can trigger incident response (see [Detection Engineering Catalog](/notes/security-engineering/security-operations-detection-and-response/detection-engineering-catalog.md) and [Incident Response](/notes/security-engineering/security-operations-detection-and-response/incident-response.md)).

## Space segment: the spacecraft

* [ ] The command path on the spacecraft enforces authentication, so the vehicle rejects unauthenticated commands even if the link is reached.
* [ ] Secure and, where feasible, authenticated firmware update for on-board software, since this is the only in-orbit change mechanism (see [Hardware and Firmware Security](/notes/security-engineering/operational-technology-embedded-and-connected-device-security/hardware-and-firmware-security.md)).
* [ ] A safe mode and a recovery path that let operators regain positive control after an anomaly or a suspected compromise.
* [ ] Fault and intrusion tolerance appropriate to the mission, given that the hardware cannot be replaced.

## Supply chain and personnel

* [ ] Hardware and software components, tools, and updates vetted through the mission supply chain, with provenance and integrity checks (see [Supply Chain and Third-Party Risk](/notes/security-engineering/security-governance-risk-and-compliance/supply-chain-and-third-party-risk.md)).
* [ ] Insider risk and physical access to ground facilities managed (see [Human and Insider Risk](/notes/security-engineering/security-governance-risk-and-compliance/human-and-insider-risk.md) and [Physical and Environmental Security](/notes/security-engineering/resilience-continuity-and-physical-security/physical-and-environmental-security.md)).

## Governance

* [ ] The program mapped to the NIST space cybersecurity reports (IR 8270 for the commercial-operations baseline, IR 8323 for PNT, IR 8401 for the ground segment), verifying current revisions against NIST.
* [ ] Threat and incident information shared with the relevant space information sharing and analysis community, per the SPD-5 collaboration principle (see [Threat Intelligence](/notes/security-engineering/security-architecture-threat-and-exposure-management/threat-intelligence.md)).

## References

* [The White House, Space Policy Directive-5, Cybersecurity Principles for Space Systems](https://www.cisa.gov/resources-tools/resources/space-policy-directive-5)
* [CCSDS, Space Data Link Security Protocol (CCSDS 355.0-B)](https://ccsds.org/Pubs/355x0b2.pdf)
* [NIST IR 8401, Satellite Ground Segment](https://csrc.nist.gov/pubs/ir/8401/final)
* [NIST IR 8323 Rev 1, Foundational PNT Profile](https://csrc.nist.gov/pubs/ir/8323/r1/final)

## Sources

* [NIST IR 8270, Introduction to Cybersecurity for Commercial Satellite Operations](https://csrc.nist.gov/pubs/ir/8270/final)
* [NIST IR 8323 Rev 1, Foundational PNT Profile](https://csrc.nist.gov/pubs/ir/8323/r1/final)
* [NIST IR 8401, Satellite Ground Segment: Applying the Cybersecurity Framework to Satellite Command and Control](https://csrc.nist.gov/pubs/ir/8401/final)
* [The Aerospace Corporation, SPARTA](https://sparta.aerospace.org/)
* [The Aerospace Corporation, Space Cyber (four-segment model)](https://aerospace.org/fact-sheet/space-cyber)
* [CCSDS, Space Data Link Security Protocol (CCSDS 355.0-B)](https://ccsds.org/Pubs/355x0b2.pdf)
* [CISA, Space Policy Directive 5](https://www.cisa.gov/resources-tools/resources/space-policy-directive-5)
* [Viasat, KA-SAT Network cyber attack overview](https://www.viasat.com/perspectives/corporate/2022/ka-sat-network-cyber-attack-overview/)