Risk
3/28/2013
12:43 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Air Force Seeks Stronger Spacecraft Cybersecurity

Air Force is looking for cutting-edge research into improved security for spacecraft IT, according to newly released procurement documents.

10 Space Technologies That Help On Earth
10 Space Technologies That Help On Earth
(click image for slideshow)
The Air Force is looking for ways to improve the cybersecurity of spacecraft IT systems, according to new procurement documents.

According to a new call for research released last Wednesday by the Space Electronics Branch of the Air Force Research Laboratory's Space Vehicles Directorate, the Air Force wants to improve its understanding of industry research into spacecraft cybersecurity with the intention of funding such research in the future.

The RFI, which the Air Force says is for "space systems cyber resiliency," asks for research in 13 different areas, many of which are further broken down into a number of different elements. The areas of investigation focus on everything from hardware to software and secure architectures to the supply chain.

[ Are we cluttering space? Read DARPA Takes Aim At Space Junk. ]

Specifically, the areas of research include, among other things:

-- Spacecraft cyber defense-in-depth, which would focus on avoiding threats by patching vulnerabilities and on allowing even compromised missions to continue unabated through "graceful degradation" in the face of cyber attacks.

-- An array of secure hardware, including embedded flight computers, chips, field-programmable gate arrays, and networks.

-- "Analytical tools and frameworks" to improve both the Air Force's current understanding of vulnerabilities and future abilities to engineer more secure systems.

-- Technologies to distinguish cyber attacks from other system anomalies such as system failures or problems caused by environmental effects.

-- Intrusion and cyber attack detection technologies.

Spacecraft systems, as the Air Force Research Lab defines them, include spacecraft mission systems, networks and busses, ground operations systems and more. The Air Force is looking for research across multiple levels of classification, from unclassified to top secret.

Although it is the Air Force that is interested in this research, NASA has recently been under increased scrutiny for its cybersecurity efforts, albeit not directly because of any perceived weakness to spacecraft security. NASA had to scramble to encrypt computers after an unencrypted laptop was stolen last fall. More recently, NASA restricted access to a technical database after a Chinese citizen was detained by the FBI with sensitive data in his possession.

A 2011 report, however, found vulnerabilities in "six computer servers associated with IT assets that control spacecraft" that, according to NASA's inspector general, could allow hackers to "take control of or render [the servers] unavailable," possibly thereby interfering with spacecraft missions.

"Until NASA addresses these critical deficiencies and improves its IT security practices," the inspector general wrote at the time, "the agency is vulnerable to computer incidents that could have a severe to catastrophic effect on agency assets, operations, and personnel."

No such risk explicitly underpins any of the Army Research Lab's latest foray into research into spacecraft cybersecurity, but cyber attacks against spacecraft could clearly have devastating and even life-threatening effects.

InformationWeek is conducting a survey on security and risk management. Take the InformationWeek 2013 Strategic Security Survey today. Survey ends March 29.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
4/8/2013 | 11:04:46 AM
re: Air Force Seeks Stronger Spacecraft Cybersecurity
I can recall reading an article awhile backs about students who could hack and did hack drones, and the military was completely unaware that it did so. I say that to say this, there is an obvious need for higher security if a pack of college kids can hack into their systems with little knowledge and less than $1000. I think that this should not be getting addressed now, but should have been a long time ago. I imagine our government does not want to loose control of those servers that operate and control aircraft.

Paul Sprague
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3587
Published: 2014-08-22
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists bec...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.