{"id":48033,"date":"2025-11-17T17:02:08","date_gmt":"2025-11-17T09:02:08","guid":{"rendered":"https:\/\/wp-productionenv-bjg9h2g2bgg5b8aa.southeastasia-01.azurewebsites.net\/news\/dhs-wants-satellite-volunteers-to-test-new-cyber-tools\/"},"modified":"2025-11-17T17:02:08","modified_gmt":"2025-11-17T09:02:08","slug":"dhs-wants-satellite-volunteers-to-test-new-cyber-tools","status":"publish","type":"post","link":"https:\/\/starpath.global\/news\/dhs-wants-satellite-volunteers-to-test-new-cyber-tools\/","title":{"rendered":"DHS Wants Satellite Volunteers to Test New Cyber Tools"},"content":{"rendered":"<\/p>\n

RESTON, Virginia<\/em> \u2014 The Department of Homeland Security <\/strong>(DHS) and Aerospace Corp.<\/strong> want satellite operators to volunteer to test out new tools they\u2019re building to detect cyberattacks on spacecraft, officials said at Monday\u2019s CyberSat conference.<\/p>\n

As part of its mission to protect critical infrastructure, DHS is working to develop cyber resilience tools for satellites that provide vital resources including position, navigation and timing (PNT) services like GPS, as well as communication channels like phone and internet, said Ernest Wong, the technical lead for PNT & Space Systems at DHS\u2019s Science and Technology Division.<\/p>\n

Over the past year, said Wong, DHS realized that there was a \u201cdetection gap, specifically an onboard detection gap, because a lot of detection right now is based on telemetry.\u201d And that wasn\u2019t enough, because there are too many cyber attacks that \u201ccannot be detected through telemetry-based threat detection.\u201d<\/p>\n

Moreover, Wong pointed out, the more advanced forms of automated cyber defense will require on-board detection to power autonomous responses.<\/p>\n

\u201cOur primary goal here is to lower the cost of security so we can reduce the barriers to the adoption of cyber resilience based systems\u201d on satellites, Wong said.<\/p>\n

Working with Aerospace Corp., DHS started by developing a list of indicators that satellite operators could look for on their spacecraft to show they might be under cyber attack. \u201cThe idea here was to develop some of the foundational knowledge to identify what we should look for, when trying to detect threats,\u201d he said.<\/p>\n

Once their work developing prototypes is finished, Wong explained, the results will be open sourced, so as to make them freely available for the whole satellite industry. They will then start integrating the tools into NASA\u2019s core flight system (CFS) \u2014 a widely used open source spacecraft operating system. \u201cThe idea is that if we can bake in security to CFS, that just makes it easier for everyone,\u201d he said.<\/p>\n

Brandon Bailey, a cybersecurity specialist with Aerospace Corp. who works with Wong on the project, said they developed the list of indicators by starting with the top 50 attacks from Aerospace\u2019s SPARTA framework, which breaks down possible cyber intrusions against spacecraft into their component stages, providing a complete taxonomy of potential attacks.<\/p>\n

\u201cTo help people build intrusion detection on space vehicles, we needed to document, generically, what [such an intrusion] would look like,\u201d he said. So Aerospace engineers ran the top 50 attacks against simulated spacecraft \u2014 both real space hardware in a lab, called \u201cflat sats\u201d and \u201cdigital twins,\u201d sophisticated computer representations of a satellite and its operating system. Then they watched and documented what happened.<\/p>\n

Logs from the tests, Bailey said, revealed a list of almost 200 spacecraft behaviors which could be indicative of a cyber attack. These are called indicators of behavior, or IOBs, he explained, and they are different from the indicators of compromise, or IOCs, which are more familiar to cybersecurity practitioners. IOCs are deterministic, Bailey explained: If it\u2019s correctly drawn up, an IOC is pretty much definitive evidence of an intrusion. IOBs, on the other hand, \u201care more probabilistic and behavior based,\u201d he said, and their presence only suggests the possibility of an attack.<\/p>\n

Using these IOBs, Aerospace built a prototype intrusion detection system (IDS) they call SpaceCOP. As a proof of concept, it was successful, Bailey said, demonstrating the ability to detect attacks that would be invisible to telemetry based systems.<\/p>\n

But detection is only the first step, he cautioned. Satellite operators would have to learn how to react to alerts and warnings from IDSs like SpaceCOP, both to mitigate attacks on board the spacecraft, and to share the IOBs as a warning to other operators.<\/p>\n

The next step, Bailey said, is to test out the concept and the technology on real spacecraft, putting out a call to attendees to be part of the experiment. He suggested that they can start by receiving the warnings downloaded from SpaceCOP. \u201cIngest it and see if you can update and make sense of it in your platform, and go from there,\u201d he said.<\/p>\n

Free government cybersecurity tools for the space sector may compete to some degree with private sector security vendors\u2019 products, said Joseph Davis of BigBear.ai, which is working on a commercial on-board IDS. But they\u2019ll also provide a baseline on which private sector companies can build more sophisticated platforms and tools. \u201cThey have years of research we can build on,\u201d he told Via Satellite<\/em> after the session.<\/p>\n

More from CyberSat 2025: <\/strong><\/p>\n