A satellite service has a terrestrial attack surface
Commercial space can add capacity, coverage, and new capabilities without requiring the government to develop every component itself. The economic benefit varies by mission and contract; lower acquisition cost does not automatically mean lower total operating cost or acceptable resilience.
The 2022 KA-SAT incident shows why terrestrial infrastructure belongs in a space-security discussion. Viasat's investigation reported that an attacker exploited a misconfigured VPN appliance, reached a trusted management network, and issued destructive commands to residential modems. The attack interrupted part of a consumer-oriented broadband service. Viasat reported no evidence that the satellite itself was compromised. Viasat incident account.
The distinction is operationally significant. A functioning spacecraft cannot deliver useful service to a customer whose terminal has been disabled. Security boundaries and recovery plans must therefore follow the path from mission application to network management, ground infrastructure, radio link, and user equipment.
Commercial ownership alone does not establish weak security. Nor does government ownership eliminate shared dependencies. The relevant question is which organizations control each part of the service, how access is restricted, and how a failure or compromise can spread between them.
Ground systems need a clear trust boundary
Ground operations can include antennas, mission and payload control, data processing, remote maintenance, and contracted network services. Some functions may use internet-facing infrastructure, while others are isolated or tightly restricted. An assessment should identify the actual connections rather than assume every ground station is publicly accessible.
NIST's Satellite Ground Segment Profile, IR 8401, applies the Cybersecurity Framework to satellite command and control. It provides a way to define the current and desired security posture; it is guidance for risk management, not a certification that guarantees acceptable risk. NIST IR 8401.
For a defense customer evaluating a provider, useful questions include:
- Administrative access: who can change configurations, issue commands, or reset terminals, and how is that identity verified?
- Separation: can a customer-service account or contractor connection reach satellite-control or fleet-management functions?
- Change control: who approves software and configuration updates, and how are failed changes rolled back?
- Visibility: which security events reach the customer, how quickly, and with enough context to change mission plans?
- Recovery: can the provider restore both central systems and geographically dispersed user equipment?
These questions make shared responsibility explicit. A provider may secure its core network while the customer remains responsible for terminal configuration, local credentials, or the application using the link. An unassigned responsibility is a practical vulnerability even when each party has an impressive security program.
Supply-chain and radio-link risks need different controls
The space supply chain includes hardware, firmware, application software, ground services, and maintenance access. A component's country of origin or commercial availability is only one part of its risk. Provenance, supportability, update authority, and the ability to detect unauthorized changes are also important.
Buyers should ask for evidence appropriate to the mission: component inventories, supported software versions, vulnerability handling, protected update mechanisms, and notification of changes to critical subcontractors. Compressed schedules can put testing under pressure, but that is a risk to manage—not proof that every commercial operator skips testing.
The radio link introduces separate failure modes. NIST's commercial-satellite guidance discusses jamming, spoofing, interception, unauthorized commands, and corrupted sensor information. These hazards affect different functions and require different responses. Encryption can protect confidentiality and integrity; it does not, by itself, prevent a jammer from denying reception. NIST IR 8270.
The mission consequence also varies. Losing a nonurgent imagery delivery is different from losing the communications path supporting an active operation. Security evaluation should reflect that difference through outage tolerance, alternate paths, priority of service, and the time available to recover.
Turn a security partnership into enforceable operating terms
CISA and the FBI issued a joint SATCOM advisory in March 2022, emphasizing stronger authentication, least privilege, and review of trust relationships. It gives providers and customers a shared starting point for improving network security. Threat-information exchange should feed a defined response process rather than end with an advisory in an inbox. Official advisory announcement and links.
The Space ISAC also supports member exchange of threat information and industry collaboration. That exchange complements government advisories; each provider and customer still needs an assigned process for acting on the information.
For contracts supporting defense missions, we recommend a graduated approach. A service used for supplemental analysis may need different assurance from one on which a time-critical operation depends. The distinction should be documented, with testable requirements attached to each level of reliance.
- Map the service and its dependencies. Include customer terminals, terrestrial carriers, cloud services, software suppliers, and alternate ground sites.
- Set mission-specific thresholds. Define tolerated outage, data corruption, delay, and loss of coverage in operational terms.
- Assign incident responsibilities. Establish notification triggers, decision authority, evidence preservation, and customer access to relevant findings.
- Exercise disruption and restoration. Test provider outage, disabled terminals, suspect data, and loss of an assumed alternate route.
- Review changes over the contract's life. Reassess significant architecture, ownership, supplier, or operating-location changes rather than relying only on an initial review.
A second provider can improve resilience, but only if the alternative is sufficiently independent. Two services may share a ground facility, communications carrier, identity provider, or hardware supplier. The dependency map is what reveals whether redundancy survives the event the customer is planning for.
Commercial and government teams can preserve the speed and flexibility of commercial services while demanding credible security evidence. The objective is a service whose limitations are understood, whose responsibilities are assigned, and whose recovery plan has been exercised before the mission needs it.
Sources and further reading
- Viasat: KA-SAT cyberattack investigation
- NIST IR 8401: satellite ground-segment cybersecurity
- NIST IR 8270: commercial satellite operations cybersecurity
- Office of Space Commerce: CISA and FBI SATCOM advisory
Spartan X's cybersecurity and engineering practices bring mission dependencies into the security assessment, connecting provider controls, operational requirements, and recovery planning across the service the customer actually uses.
