Defending Space as Critical Infrastructure.

Sean MacKirdy: One of the various ways an adversary can compromise a spacecraft so that as a defender one can start to look at the inventory of assets one has and the technologies that are deployed and start to map those various compromises against your inventory. And where I think we've got a real opportunity as a holistic cybersecurity industry supporting this space function and the space domain as a whole, whether it's commercial or it's federal, is to take those legacy devices and start to map the way they communicate in to human readable messages that can then in turn be mapped to the SPARTA framework.

Maria Varmazis: Welcome. I'm Maria Varmazis. And you're listening to "T-Minus Space Cyber Briefing." In this show we examine the evolution of cybersecurity in the global and orbital infrastructure that powers, protects, and connects our lives.

Maria Varmazis: Hi, everyone. Welcome. It is perhaps hard to believe if you're a frequent listener to this show, but even with all of our modern infrastructure's reliance on position navigation and timing systems like GPS space is still not technically classified as critical infrastructure by the U.S federal government. Yeah. It's wild. Right? And that is where we'll start my conversation today with Sean MacKirdy who is the area vice president for national security at Elastic Government Solutions. He says that when it comes to keeping space secure it can help to frame space as an operational technology ecosystem, one that is analogous to terrestrial critical infrastructure. And he breaks it down in to four segments, not two, all of which have their own distinct cybersecurity considerations and maintenance timelines. Let's learn more.

Sean MacKirdy: My name's Sean MacKirdy. I'm the area vice president for our national security vertical at Elastic Government Solutions which is a subsidiary of Elastic. I've been in the IT industry a little over 30 years and started on the software development side first in the web 1.0 era doing web development and front end user interfaces then in high performance computing then moved over in to the side of being a technology consultant and spent about 17 years with Cisco systems before venturing off in to the cyber world about 10 years ago.

Maria Varmazis: So today we are going to be chatting about somehow a controversial opinion or fact truly about space being critical infrastructure which I almost can't believe that even that's considered somewhat controversial. I don't even understand why it is, but in some cases it is. But walk me through to you why space is so critical. Let's start there. Space is critical infrastructure. Why is it critical?

Sean MacKirdy: I couldn't agree more with that comment, Maria. Space is critical infrastructure because every day we use space based technologies pretty much without thinking about them in the modern world. Right? We use GPS so that we can tell where we took that picture of our kids on the phone app. Right? When we start scrolling through photos and we post it on a map. We use it every day when we navigate to where we're going because different maps providers whether it's Apple Maps or Google Maps, pick your map provider, gosh they've integrated so nicely with GPS that we can get from point A to point B way more efficiently than we ever could before. Right? And so we take for granted these space based technologies and, you know, when we look at the kinds of connected environments that we see today whether it's, you know, somebody camping out in the middle of the Utah desert in a beautiful national park, but with Starlink so they can keep up with world events or other things that are going on or we look at some of the conflicts that are happening around the globe where those new commercial satellite constellations are coming in to play as a critical part of how communications are kept up in an otherwise denied, degraded, intermittent, limited environment, gosh it's all space technology that's doing that. Right? And so the space domain I think very rightly back in 2019 was acknowledged by then the Department of Defense as being a true domain of conflict. Right? So we've got land, sea, undersea, cyberspace. Well, guess what? Space deserved that recognition. So, you know, I think the DOD at the time was really leaning in to the thought process that space assets are critical assets. So just go back to that GPS example.

Maria Varmazis: Yep.

Sean MacKirdy: You know, gosh. Jamming technologies, dazzling technologies, spoofing technologies, our adversaries have gotten to a place where those are all quite effective. And when we don't have precision navigation and timing, right, P and T, which is what GPS falls in the family of -- right? It's a constellation of satellites that are made to give us precision navigation and timing. We don't have the ability to get places or to connect with people or to, you know, meet our loved ones where we want to meet them. So if you think just for a second about what would it be like today in 2026 if GPS were shut off for a day or a week or a month. How can one not think that is a critical infrastructure component of our daily lives?

Maria Varmazis: Yeah. I completely agree. Yeah. And there was a sort of a positioning paper from the U.S space force saying that from this point on we need to assume that space is a contested environment by default as opposed to potentially contested.

Sean MacKirdy: Right?

Maria Varmazis: Sometimes for me when I think about the space environment as, you know, an OT environment it's it feels like the wrong path to be going down, but also the parallels are there. Can you walk me through that at all?

Sean MacKirdy: Yeah. Absolutely. So, you know, I think the way we have to think about space, and you said it perfectly, it is an operational technology environment. Right? It's an OT environment. I think the parallels we have here on Earth are maybe the easiest paradigm to start with. Right? We all want our drinking water supply to be clean and reliable. We all have some kind of heating need at some point in the year no matter where you live in the United States or elsewhere. Right? If you're listening from abroad. We all have energy needs, right, for transportation whether you have an electric car or a traditional ice vehicle. Gosh. You know, an internal combustion engine still relies on gasoline or diesel. Right?

Maria Varmazis: Sure does. Yep.

Sean MacKirdy: They're all distributed by legacy industrial control systems, ICS. Right? And to your point, those following the broad category that we IT or information technology people call OT, operational technology, and no I have heard a couple say "Oh. Other technology." Not quite. Operational technologies. Right?

Maria Varmazis: Yeah.

Sean MacKirdy: OT is an essential part of every day. Right? We're talking right now across the internet. Right? The internet is a series of operational technologies as well as IT technologies. Right? Information technologies. Because, you know, if the power of a transmission line between you and I goes down at some segment in that wide area network that's connecting us we're relying then on a diesel generator to keep that link running. Right? All of those links in the chain that provide the infrastructure that makes IT work have to be secured. And, you know, I think as a nation we have really started to put some emphasis on critical national infrastructure and defense critical infrastructure. So CNI or CI, critical infrastructure, and defense critical infrastructure, DCI. As we think about space we're now taking that same set of problems which is technologies that maybe were invented 50 to 100 years ago that are still in use, require constant updates, but don't have the benefit of, for example, being able to put like advanced malware detection on them because they just weren't designed with that in mind in many cases. Right?

Maria Varmazis: Yep.

Sean MacKirdy: And when you think of the life cycle of things that are in orbit the majority of satellites we have put on orbit as a species in the last 50 years are still up in orbit. And while some are not, some have gracefully declined and burned up or fallen in to the ocean or, you know, fallen in a cornfield somewhere, most of that stuff, to use a technical term, that's on orbit is still on orbit. Right? So when one thinks about designing for space, you know, the whole ecosystem thinks in a different timeline. And I think that's been one of the traps that we've fallen in to as an industry supporting spaces. It takes so long to build a satellite and there's so much involved in the beautiful thing that is launching a satellite or launching humans, right, in to orbit that we neglect to think about the maintenance tail of that spacecraft and what's involved in that. And, you know, as you look at that OT infrastructure you have the very obvious. Right? The space segment. So we've got the actual birds in orbit, things that are rotating around the Earth performing various functions whether they're telecommunications or intelligence collection or other functions. Right? You have the link which is the actual communication from that spacecraft to the ground. You have the ground segment which is, you know, the antennas and receivers of that content. And again traditionally those are, you know, huge devices or maybe 3 meter devices or 1 meter devices. Now we've got Starlink where the miniaturization of the capability to communicate with a space based object is just incredible in my mind. Right?

Maria Varmazis: Yeah.

Sean MacKirdy: But on the ground segment we also have all of the mission control components. Right? So it's not just the receiving of data. It's the attitude and altitude adjustments of the spacecraft. Right? It's the care and feeding of that device that's up in orbit. It's that mission control center, if you will. Right? If you think about it. I think all of us or many of us are familiar with NASA. Right? You know, think about mission control and, you know, hey Houston. Right?

Maria Varmazis: Yeah.

Sean MacKirdy: That's all a very complex infrastructure and then you have the last link in the chain. Right? Which is the user which is that last mile, the human that's actually benefiting from those services. Right? And again whether that's somebody carrying a GPS receiver or it's a person that's leveraging a data connection to perform their mission for the United States or again one of our partner nations over that satellite communications, right, and so when you think about those four segments, right, space, the link, ground, and the user there is so much complexity there. And you have so many different technology life cycles that are all in play at the same time. It is again just like generating power and transmitting it or pumping clean drinking water to your house. It's a complex ecosystem that has to be protected.

Maria Varmazis: Yeah. The four segments that you listed out, space, link, ground, and user, I found that very interesting because a lot of times in sort of the general space industry parlance people just say, "Oh, there's two segments, ground and space." But when we're talking about specifically space cyber I mean we have to pull out specifically the link and user segments as well. I think it's noteworthy and I wanted to make sure I called it out. We're separating things out, not just going ground and space, because there's so much more going on than just that, especially when we're thinking about the cyber context. And you had mentioned sort of the maintenance tail which I thought was such a really interesting point and I just wanted to ask what would it look like if we were better about that maintenance tail for satellites. Well, especially in sort of a space cyber context, what would that look like?

Sean MacKirdy: Yeah. I think one of the most important things right now is a rationalization of the assets that are on orbit and understanding what assets are and aren't protected against various threats in the threat landscape. Right? And there are many different threats in the threat landscape. Right? One of those threats is someone hijacking the internet protocol based or TCP IP communication to and from a satellite. Right? So a modern satellite might have things like a software defined radio on it. It might have other software defined functions. And when we say software defined in the IT industry really what that means is it's reprogrammable or upgradable. Right? It is something that can be manipulated from the ground to function differently than it did when it launched. That's, you know -- that's on the most modern side. And where we've got software defined capabilities in orbit and you look at again some of the modern commercial constellations that are in orbit now in low Earth orbit that we're using, again I mentioned Starlink just as one brand name everybody might be familiar with out in the audience, those assets have a different threat profile or different cyber landscape than something that's been on orbit like the GPS constellation since the 1970s/1980s. Right? Those aren't reprogrammable in the sense that, you know, they -- you can do some minor software upgrades along the way. That was always intended. But you're not going to reprogram the whole function of that bird. Right? They just were never designed architecturally, you know, in terms of the way the software that's running on them works and the processors that run on them were built. They were built to be very specific about their purpose and their function. And so those have a different threat profile. Right? And in some cases they might actually have a more exposed threat profile because they aren't upgradable. Right? You know, we're all familiar with getting a Windows update or a Mac OS update when something goes wrong on our computer. If you think about those devices that are in orbit that aren't software defined they don't have that luxury. Right? That OS, that operating system, for that spacecraft it's kind of hard wired. Right? So if there's a vulnerability it's up to the cyber defenders, it's up to those space cyber defenders, to be very specific to figure out the mitigations that are going to keep the adversary from taking control of that craft. Right? And that's just a different type of trade craft. And I think that inventory, that rationalization of things, is really important.

Maria Varmazis: And I'll take a quick pause now as we think about the why of that space trade craft. And when we get back to my chat with Sean MacKirdy he will get in to the how. Be right back.

Maria Varmazis: We return now to my conversation with Sean MacKirdy, area vice president for national security at Elastic Government Solutions, all about how we classify common attacks on space architecture and map to common paths for mitigation.

Sean MacKirdy: And I know on your show the SPARTA framework has been talked about before.

Maria Varmazis: Oh yeah. Yeah. Yeah. It's been a while, admittedly, but yeah. I want to say three or four years ago I spoke with Brandon Bailey when he had just - he and the Aerospace Corporation had sort of just launched the SPARTA framework. We'll make sure to link it in the show notes for the audience.

Sean MacKirdy: Yeah. So just a quick highlight for traditional cybersecurity wonks like me, many of us are familiar with the MITRE ATT&CK framework. Right? It's a way to lay out, hey, is the adversary doing recon against my infrastructure? Have they exploited my infrastructure and gotten in to it and have started to execute say a command and control function? Or are they actively exfiltrating data from me? Right? And the MITRE ATT&CK framework gives us a way to bucket the various stages of an attack so that we have a common dictionary of how things are happening in the infrastructure, how adversaries are moving and how we detect various adversarial action. The SPARTA framework which was developed by the Aerospace Corporation which is a federally funded research and development center -- I know that's weird. Right? It's a corporation, but it's a federally funded.

Maria Varmazis: Yeah.

Sean MacKirdy: They're cool. Right? Aerospace does some really really neat things. And with some support from the Department of Homeland Security they have built out a space parallel to the MITRE ATT&CK framework called SPARTA, the Space Attack Research and Tactics Analysis framework. What does that really mean? Right? So what the SPARTA framework is trying to do, very similar to the ATT&CK framework on the IT side, is define the various ways an adversary, at a broad and kind of philosophical level, if you will, or theoretical level -- what are the various ways an adversary can compromise a spacecraft so that as a defender one can start to look the inventory of assets one has and the technologies that are deployed and start to map those various compromises against your inventory. Right? And where I think we've got a real opportunity as a holistic cybersecurity industry supporting the space function and the space domain as a whole, whether it's commercial or it's federal, is to take those legacy devices and start to map the way they communicate in to human readable messages that can then in turn be mapped to the SPARTA framework. And where I think that really has the opportunity as we move in to an agentic world all of us are starting to learn to live with we can start to look at how an operator in the loop system where large language models and other AI and machine learning based tools can bring data about what's happening in the space control infrastructure in to human readable terms and provide a direct translation between potential attacks and anomalies and their potential root causes based on the SPARTA framework. So, for example, you know, if you've got an asset that's in low Earth orbit and it starts to decline is that because of an adversarial action? Is it because a command was sent, logged or unlogged, to the spacecraft? Or did we miss a maintenance window? Right? Or did somebody fire a thruster that didn't get logged? All of those things can be discerned from the data that's already being collected if that telemetry is being normalized and brought in to a single framework where we can start to look at root cause rather than, you know, the cryptic old school signals that we were able to accommodate in computing systems in the '70s and '80s.

Maria Varmazis: Yeah. I was -- that sort of signals intelligence magic, sorry, for me it seems like it's indiscernible from magic. When I've learned about it I go whoa. That is fascinating stuff, but a bit of a barrier for a lot of people. I mean if you want to learn you can go for it, but I mean I'm just imagining when you're trying to ingest all that data and all these different formats, for lack of better terminology, I mean all these systems also, especially the older ones, they are often called exquisite because they're pretty one off. I would imagine this makes just reacting in a meaningful timeline very challenging for the average operator.

Sean MacKirdy: It absolutely does. And let's not overlook the fact that when we talk about the average operator in a defensive context, for example, inside of the Department of War we're talking about young men and women that are maybe in their twenties. Right? Some of them weren't alive when some of these spacecraft were put on orbit.

Maria Varmazis: Oh yeah. Yep.

Sean MacKirdy: And so there's that other component of the knowledge base. Right? Of the knowledge, the institutional knowledge and these ecosystems that are looking after the space domain where, you know, bringing this normalization or, you know, a common schema for how data is transmitted, how telemetry's transmitted, how we record and log the activities of a spacecraft where that normalization actually also then has the benefit of upleveling those operators. Right? By bringing it in to human readable terms and being able to apply context engineering which is again a very forward leaning term that we're starting to use across industry to say, you know, by powering an agent with a large language model and its reasoning capabilities, but then also securely adding our institutional knowledge that's proprietary, right, and whether that's strictly, you know, just industrial secrets in the commercial space or that's classified data in the military space irrelevant. Right? What we want to do is fuse our internal institutional knowledge with the power of the large language model in a private way that allows the operator to uplevel their capability to understand what's happening with the spacecraft. Right? And we are on that precipice where we can take the SPARTA framework and directly map it to the signals that are coming out of the infrastructure. It's about, you know, normalizing to a common schema for how we collect that telemetry, how we process that telemetry, and then providing the operator a single pane of glass, not 50 different systems to look at, where at agentic capability is providing them the inputs on what's happening in the infrastructure.

Maria Varmazis: It's fascinating to hear about and honestly it's a -- the opportunity there is massive.

Sean MacKirdy: Maria, I just come back to the beginning. Space is critical infrastructure. Right? We have such amazing opportunities every day in our lives because of the space domain. It's an asset we have to protect and I appreciate your show providing a venue for those of us that are in the industry and concerned about this topic to let our voice be heard. Thank you.

Maria Varmazis: And that's "T-Minus Space Cyber Briefing" brought to you by N2K CyberWire. If you like what you heard today you will also enjoy our newsletter "Signals in Space." You'll get research and notes pulled together by our producer Ethan Cook and me along with this week's top space cyber news stories. Subscribe by visiting thecyberwire.com/newsletters. As always, we would love to know what you think of our podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing cybersecurity landscape. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to space@n2k.com. We're proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector from the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies. N2K helps cybersecurity professionals grow, learn, and stay informed. As the nexus for discovery and connection we bring you the people, the technology, and the ideas shaping the future of secure innovation. Learn how at n2k.com. Thank you for listening to "T-Minus." I am your host, Maria Varmazis. The show was produced by Ethan Cook and Liz Stokes. We are mixed by Elliott Peltzman and Tre Hester with original music by Elliott Peltzman. Our executive producer is Jennifer Eiben with content strategy by Myon Plout. Peter Kilpe is our publisher. See you next week.