Risk
3/28/2013
12:43 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Air Force Seeks Stronger Spacecraft Cybersecurity

Air Force is looking for cutting-edge research into improved security for spacecraft IT, according to newly released procurement documents.

10 Space Technologies That Help On Earth
10 Space Technologies That Help On Earth
(click image for slideshow)
The Air Force is looking for ways to improve the cybersecurity of spacecraft IT systems, according to new procurement documents.

According to a new call for research released last Wednesday by the Space Electronics Branch of the Air Force Research Laboratory's Space Vehicles Directorate, the Air Force wants to improve its understanding of industry research into spacecraft cybersecurity with the intention of funding such research in the future.

The RFI, which the Air Force says is for "space systems cyber resiliency," asks for research in 13 different areas, many of which are further broken down into a number of different elements. The areas of investigation focus on everything from hardware to software and secure architectures to the supply chain.

[ Are we cluttering space? Read DARPA Takes Aim At Space Junk. ]

Specifically, the areas of research include, among other things:

-- Spacecraft cyber defense-in-depth, which would focus on avoiding threats by patching vulnerabilities and on allowing even compromised missions to continue unabated through "graceful degradation" in the face of cyber attacks.

-- An array of secure hardware, including embedded flight computers, chips, field-programmable gate arrays, and networks.

-- "Analytical tools and frameworks" to improve both the Air Force's current understanding of vulnerabilities and future abilities to engineer more secure systems.

-- Technologies to distinguish cyber attacks from other system anomalies such as system failures or problems caused by environmental effects.

-- Intrusion and cyber attack detection technologies.

Spacecraft systems, as the Air Force Research Lab defines them, include spacecraft mission systems, networks and busses, ground operations systems and more. The Air Force is looking for research across multiple levels of classification, from unclassified to top secret.

Although it is the Air Force that is interested in this research, NASA has recently been under increased scrutiny for its cybersecurity efforts, albeit not directly because of any perceived weakness to spacecraft security. NASA had to scramble to encrypt computers after an unencrypted laptop was stolen last fall. More recently, NASA restricted access to a technical database after a Chinese citizen was detained by the FBI with sensitive data in his possession.

A 2011 report, however, found vulnerabilities in "six computer servers associated with IT assets that control spacecraft" that, according to NASA's inspector general, could allow hackers to "take control of or render [the servers] unavailable," possibly thereby interfering with spacecraft missions.

"Until NASA addresses these critical deficiencies and improves its IT security practices," the inspector general wrote at the time, "the agency is vulnerable to computer incidents that could have a severe to catastrophic effect on agency assets, operations, and personnel."

No such risk explicitly underpins any of the Army Research Lab's latest foray into research into spacecraft cybersecurity, but cyber attacks against spacecraft could clearly have devastating and even life-threatening effects.

InformationWeek is conducting a survey on security and risk management. Take the InformationWeek 2013 Strategic Security Survey today. Survey ends March 29.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
PJS880
50%
50%
PJS880,
User Rank: Ninja
4/8/2013 | 11:04:46 AM
re: Air Force Seeks Stronger Spacecraft Cybersecurity
I can recall reading an article awhile backs about students who could hack and did hack drones, and the military was completely unaware that it did so. I say that to say this, there is an obvious need for higher security if a pack of college kids can hack into their systems with little knowledge and less than $1000. I think that this should not be getting addressed now, but should have been a long time ago. I imagine our government does not want to loose control of those servers that operate and control aircraft.

Paul Sprague
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio