Earth's expanding attack surface.

Andy Olchawa: It used to be sci-fi just a few years ago, but looking at the things, how they are right now and how much there is a push to go back to the Moon, I think it's not only sci-fi. It's going to happen within the next couple of years.

Maria Varmazis: Welcome. I'm Maria Varmazis, and you are listening to T-Minus: Space-Cyber Briefing. In this show, we examine the evolution of cybersecurity in the global and orbital infrastructure that powers, protects, and connects our lives.

Maria Varmazis: Hello, everyone. I appreciate you joining me today. Our episode today picks up where last week's left off. In other words, this is Part 2 of 2, and if you haven't listened to Part 1 just yet, I highly recommend that you go and do that first. Link is in the show notes for you.

Maria Varmazis: But to refresh your memory, I am speaking with two foundational experts in space cybersecurity today, and they are Milenko Starcik, Cybersecurity Lead at VisionSpace, and Andy Olchawa, Space Cybersecurity Researcher, also at VisionSpace. Their new book is hot off the presses, and it is called "The Spacecraft Hacker's Handbook: Exploiting Ground Stations, Flight Software, and Satellite Terminals." I just got my copy, and it is on my desk right now. It's out from No Starch Press, which is, as far as I'm concerned, an endorsement in and of itself. And no, I have no affiliation, nor am I being paid to say any of this. This is me genuinely recommending this book to you as someone who's listening to this podcast. The book is targeted at IT security professionals and has a great deal of technical content to sink your teeth into. It also has a lot of essential information on how space missions work from the inside out. So if you are an InfoSec pro who hasn't yet had a chance to see space really up close, you are not alone by a long shot, by the way. This book fills in a lot of gaps that you might have in terms of industry-specific knowledge. So back to the show.

Maria Varmazis: My conversation with Milenko and Andy last week touched on some of the more technical aspects of what this book covers, and what we've saved for today's show is more high-level. My first question was one that likely Milenko and Andy get more than any other, and that is, what advice do they give people looking for a job in the space industry as an InfoSec professional? The voice you'll hear first is Milenko answering the question.

Milenko Starcik: I mean, realistically, in the space industry -- space industry is very compliance-driven. So, as with most of cybersecurity, most of the jobs will actually not be in testing the system, which is, of course, the interesting part and what everyone wants to focus on. But I would say that the majority of the jobs will actually be in compliance and auditing of these systems. There might be, like, a testing component to that. But in the end, you need to meet the requirements. And that's what the space industry is very famous for, I would say. And now with more security being applied, this is what they -- what they come up with to solve the same problem is more security requirements, testing them, auditing them. So I think that's maybe a point or a warning for people who are, like, excited about finally hacking space systems and more cybersecurity there. But it is like with every cybersecurity, if it grows, also the overhead for compliance grows. Yeah. And that's what we see.

Andy Olchawa: Yeah, from the technical perspective, we already discussed about the base -- the skill sets required, that it could be pretty much anything. But from the space-specific skills, I would try to do some OSINT and try to find out what different agencies are using for their space missions. And then it just happens that most of the information is open source. All the standards -- many software applications are open source as well. I would probably start with that and play with those and see what it is. It's not that difficult to have your own space mission digital twin on your own laptop and see how it works, see what are the telecommands, see what is the telemetry. Of course, it requires some time and, you know, no one is advertising that. So that's why we probably could get the book and learn how to do it quicker, but most of the information is open source and what we are actually trying -- so when we started publishing our findings on space systems, for us, it was very easy because we come from a space background, so we have developed some of the stuff that we are now hacking on. So for us, it's easy. But when we started publishing our findings and our vulnerabilities in space systems, every single time we were going somewhere, people were asking, how do we start with this? How did you find out? What is the system? And for us, it's experience.

Maria Varmazis: Yeah.

Andy Olchawa: But we were trying to answer all those questions, and that's pretty much impossible with, like, 20 -- you know, 20 slides or 30 slides for a 20 or 30-minute talk. So that's why -- that was the main reason why we decided to write a book about it so that, you know, we can put everything we know into this one piece and share with anyone who's interested in this.

Maria Varmazis: And I so appreciate that you've done that because I often think about who's really building the community around, you know, space cyber, and the two of you are at the top of my list of people who are doing that hard work. So thank you for doing that. So many people are very interested in this, and it can be a bit of a mystery about how to figure out your way in there, which is part of the fun. But at the same time, you know, it's nice to know that there are guides that you can go to that help walk you through it.

Maria Varmazis: Time for a quick break. Be right back.

Maria Varmazis: All right. Welcome back. Let's jump back into my chat with Andy Olchawa and Milenko Starcik of VisionSpace.

Maria Varmazis: I have a curiosity question about just given where you both are in, you know, space cyber and how much you're seeing in terms of, like, the practical realities of things. I'm just curious if there's anything going on in terms of general space capabilities that you are keeping an eye on with any kind of personal or professional interest, anything that you see coming down over the next five, 10 years that you're like, "That could be really interesting." Or are you just more living in the moment right now?

Milenko Starcik: I think, currently, people are experiencing the adoption of space technology, for example, with Starlink terminals at their homes. Or if they have a caravan or something. But I think what will shock people's mind at some point is when you get this direct-to-device communication with mobile communication, and you will get actually satellite internet on your mobile phone in the next years, which is a capability that is currently being developed and slowly rolled out. And I think this is when also the security of these systems and any outages will have millions of people affected. Right now, it is often just a secondary effect if something fails in a space system. But with the big number of constellations being built up and the number of services and people depending on it growing, not just for critical infrastructure, but for everyday use, I think the impacts will grow exponentially in the coming years on everyday people.

Maria Varmazis: Absolutely. And Andy, over to you.

Andy Olchawa: I started saying at the beginning of the conversation that the attack surface in space is extremely small because there might be a spacecraft or there might be a constellation of spacecraft. But this movement now of having much more assets in space, which are not necessarily spacecraft the way we understand, but people started thinking and talking about data centers in space, or the moment we go back or get back to the Moon, there will be infrastructure there, and suddenly this attack surface will become pretty much what we have on the ground. So that's -- I think it's going to be very interesting to see how security will play into that and whether it is -- people would pay much more attention because it's an actual infrastructure on the Moon, they would pay much more attention to security, or it will be just like any other space asset vulnerable. And whenever you look at it, there will be a security flaw which someone can exploit.

Maria Varmazis: A fun sci-fi but not so sci-fi thing of imagining somebody hacking a Moon base, but at the same time -- yep.

Andy Olchawa: It used to be sci-fi. It used to be sci-fi just a few years ago, but looking at the things -- looking at the things how they are right now and how much there is a push to go back to the Moon, I think it's no longer sci-fi. It's going to happen within the next couple of years or maybe --

Maria Varmazis: It is a fascinating prospect. It truly -- this sci-fi is becoming reality very quickly, much more quickly than I would have thought. I want to make sure I give you that opportunity to promote or conclude in any way you like. So I guess last words for either of you, anything you want to add?

Andy Olchawa: I think we can mention we have recently teamed up with Hack The Box, and a couple of guys from our team launched the whole spacecraft or satellite hacking track. With Hack The Box, I think it would be interesting for anyone who would like to start with space cybersecurity. They could also give it a try and do some challenges.

Maria Varmazis: I will make sure that we have links to Hack The Box in our show notes as well, so everyone who's listening, who is interested, and who wants to learn more, can follow that along. So, Milenko and Andy, thank you both so much for not just joining me today, but truly for everything you're doing for space cyber understanding and the community in general. So thank you for all that you've been doing and congratulations on the launch of your book. I really can't wait to get my hands on it. So thank you for joining me today.

Milenko Starcik: Thank you very much.

Andy Olchawa: Thank you for having us.

Maria Varmazis: And that's T-Minus: Space-Cyber Briefing, brought to you by N2K CyberWire. If you like what you heard today, you will also enjoy our newsletter: Signals and Space. You'll get research and notes pulled together by our producer Ethan Cook and me, along with this week's top space cyber news stories. We will also be sure to put in a link to last week's episode, which, again, was Part 1 of today's conversation, just in case you missed it. Subscribe by visiting thecyberwire.com/newsletters. We'd love to know what you think of our podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing cybersecurity landscape. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to space@n2k.com. We're proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies. N2K helps cybersecurity professionals grow, learn, and stay informed. As a nexus for discovery and connection, we bring you the people, the technology, and the ideas shaping the future of secure innovation. Learn how at n2k.com. Thank you for listening to T-Minus. I am your host, Maria Varmazis.

Maria Varmazis: The show is produced by Ethan Cook and Liz Stokes. We are mixed by Elliott Peltzman and Tré Hester, with original music by Elliott Peltzman. Our executive producer is Jennifer Eiben, with content strategy by Ma'ayan Plaut. Peter Kilpe is our publisher. See you next week.