Society globally is becoming increasingly dependent on space products and services, both for business and in our personal lives. Anything that involves accurate timing and positioning almost certainly depends on satellites.
Without these space-enabled services, many things we take for granted, such as utilities, transportation, banking and communications, would either be lost or, at best, provided at lower quality and might be unreliable. The consequences would be serious.
Defence is clearly not immune from these issues. In fact, arguably, its reliance on space is even more pervasive than that of society generally. Whether it be inter- or intra-theater communications, weapons guidance, signals or image intelligence, or simply moving around air, land and sea battlespaces, defence relies very heavily on space.
For these reasons, it is essential that we understand the threats, vulnerabilities and risks associated with loss of space products. It is also vital that we find ways to mitigate them. Thanks to the interdependence of space and security, there is a solution in the form of a cyber-range, which builds on space and cyber attributes to provide ways to protect against cyber threats and mitigate cyberattacks.
Offensive or Defensive?
The boundaries between space and cyber are blurring, seemingly particularly benefitting those who seek to do harm. The distinction between military and non-military is no longer as clear as it once was, as dual-use technologies and capabilities in the space domain make it less clear who is using what, when and for what purpose.
Similarly, in the cyber domain, the line between ‘offensive’ and ‘defensive’ actions is no longer always clear, especially as offensive activities are being justified as defensive, thus shifting the norms of acceptable behavior toward the ‘offensive’ end of the spectrum. It does not help that in space and cyber, the cost of attacking is comparatively low compared with the high cost of defence.
As a result, highly developed countries can be vulnerable to attack from less developed ones, as well as from terrorist groups and other actors. Unlike other areas of society, defence does not have the luxury of waiting for international norms of behavior to be agreed — if, indeed, that is even possible. As history repeatedly shows us, the next conflict may be just around the corner and could be very different from the last. There is, therefore, a need for a clear understanding of how military operations can be waged successfully in the contested environments of both space and cyber.
While resilience and reversionary are the words that spring to mind and, of course, they have an important role, it is axiomatic that operations are going to happen alongside cyberattacks against space assets. It is highly likely that those operations will not sit comfortably under the umbrellas of the right of self-defence or the law of armed conflict and that the grey zone is here to stay; for now, anyway.
It may seem defeatist, but it is probably a truism that there is no way of easily solving the blurred lines and grey zone, so we have to find some other way. With the pace of change of technology, it is not always helpful to look to history for solace.
However, just like our forebears facing new military capabilities, there is considerable value in understanding, scenario testing and rehearsal. In the case of the space-cyber dynamic, this means protecting space assets and, when they can’t be protected, exploiting testing scenarios, understanding what is happening, how to react, how to work with it and how to undertake operations in a degraded or denied environment.
Armed with these insights, exercising serves to hone the skills of those required to operate effectively in the absence of, or with degraded, space products – as alluded to earlier, this fundamental war-gaming concept would be familiar to those who have gone before.
The Value of an Emulated Environment Exploring ways to operate effectively in an environment where critical space services are denied or degraded is not something you would ideally do in a live environment. It is expensive and difficult to do at scale.
In most cases, it is also impossible to forensically examine a satellite following an attack in order to understand what happened. Fortunately, there is an inexpensive, scalable and effective way of generating the required understanding, scenario testing and rehearsal, and one that does not impact on the primary purpose of orbital and ground assets — a space cyber-range.
Space is totally reliant on cyber. Space architecture is, with very few exceptions, managed, connected, controlled and exploited via the medium of cyberspace. This means we can precisely recreate space (and other domain) architectures in a virtual environment, using software – and sometimes, if required, hardware – modules to simulate real assets.
This allows us to interact with any space architecture and its assets in a safe and secure virtual environment. More importantly, we can interfere with the emulated architecture and be as intrusive as we want while testing and practicing responses to attacks.
In addition, non-space assets can be connected and integrated into the cyber test and evaluation setup in a holistic and enterprise level way. These could be critical national infrastructure (CNI) nodes and assets, for example.
Cyber-ranges, whether including space assets or not, are not limited to threat, vulnerability and mitigation analysis. They are also perfectly suited to planning and rehearsing missions and activities, testing new concepts and capabilities, and assessing the integration of digital assets.
Securing Space Products for Defence
At a time when providing space capabilities are shifting from the preserve of governments to the private sector, there is an increasing need to use cyber to secure space assets, including orbital, ground, links and people.
Specifically, in defence terms, we need to secure those space products upon which we rely. As an example, RHEA Group provides such a capability for the European Space Agency, based in Redu, Belgium. The first dedicated cyber-range for space, the facility provides the capability to create virtual architectures, including space and, when required, non-space assets emulation. This enables operator training and system of systems testing and evaluation, and provides a safe and secure setting to understand and successfully manage space operations in a hostile cyber environment.
The ability to understand and protect our own space assets and capabilities from cyber threats is essential, as is the need to operate successfully in a degraded or denied environment. This type of war-gaming approach is not new, but the application of the synergies between space and cyber at least allows us to accurately replicate space in a safe and secure virtual environment.
In a sense, the synthetic emulation of the space environment can be more holistic than other environments, allowing a cyber-range to provide a very authentic platform to understand, scenario test and rehearse, thereby underpinning a defensive position.
www.rheagroup.com
Mark Roberts is the Defence and Security lead for RHEA Group in the UK, having joined the company in January 2019. Previously, Mark undertook a variety of lead consultancy roles in the defence, security, energy, education and transportation sectors with Atkins. He was Operations Director for Atkins Security Business before moving into Business Development in 2016. Mark is the Project Director for the Spaceport 1 Consortium, developing a vertical launch capability in the Outer Hebrides. He is also a member of the Faculty of the London Institute of Space Policy And Law. Before moving into the commercial world, Mark was in the Royal Air Force, where he was an operational pilot and commanded both 12 Squadron and RAF Lossiemouth. Mark was Director of the Air Staff in MoD (2007-2010) with Space and Cyber Policy in his portfolio, and Head of Capability Deep Target Attack, with responsibility for Combat Air, Complex Weapons, Land Engagement and elements of the Queen Elizabeth class carrier programme.