PaperlayerView exact revision on arXiv

Source-linked AI summary

Towards Principled Risk Scores for Space Cyber Risk Management

Ekzhin Ear, Brandon Bailey, Shouhuai Xu

arXiv:2402.02635v1cs.CR

TL;DR

NRS is intended to help practitioners manage space cyber risks, but its application methodology is scant and its effectiveness had not been analyzed with real-world scenarios. The paper applies NRS to a real-world satellite attack, characterizes its strengths and weaknesses, and proposes properties and a formalism for future scores. In the case study, four techniques associated with the real attack’s control and downlink flows were identified for mitigation, while a payload attack was treated as tolerable.

  • Problem

    NRS is intended to support space cyber risk management, but its application methodology is scant and it had not been analyzed with real-world scenarios.

    Source: §I · p. 1

  • Method

    The authors describe an NRS algorithm, assess it through a real-world satellite-attack case study, and propose desired properties and a mission, control-flow, and data-flow formalism for future NRS.

    Source: §I · p. 1

  • Results

    Four techniques—EX-0013, IA-0007, EX-0012.10, and T1133—were identified for mitigation, and the authors say the real attack’s control and downlink flows could have been prevented; the payload attack was deemed tolerable.

    Source: A. Case Study Based on a Real-World… · p. 5

  • Takeaways & Limitations

    The proposed desired properties and formalism are starting points for developing future NRS and automated space cyber risk-management tools.

    Source: §VI · p. 8

    Objective base scores and objective tailoring of space cyber risk scores remain open design problems for future NRS.

    Source: §VI · p. 8

Abstract

from arXiv · show

Space is an emerging domain critical to humankind. Correspondingly, space cybersecurity is an emerging field with much research to be done. To help space cybersecurity practitioners better manage cyber risks, The Aerospace Corporation proposed Notional Risk Scores (NRS) within their Space Attack Research and Tactic Analysis (SPARTA) framework, which can be applied to quantify the cyber risks associated with space infrastructures and systems. While intended for adoption by practitioners, NRS has not been analyzed with real-world scenarios, putting its effectiveness into question. In this paper we analyze NRS via a real-world cyber attack scenario against a satellite, and characterize the strengths, weaknesses, and applicability of NRS. The characterization prompts us to propose a set of desired properties to guide the design of future NRS. As a first step along this direction, we further propose a formalism to serve as a baseline for designing future NRS with those desired properties.

I. INTRODUCTION

NRS is intended to help practitioners manage space cyber risk, but its application methodology is scant and its effectiveness had not been analyzed with real-world scenarios. The paper characterizes NRS, proposes desired properties and a formalism for future scores, and adopts a structured space-system model.

I. INTRODUCTION

  • The paper provides the first algorithmic description of applying NRS and uses it to characterize NRS through a real-world satellite-attack case study.The current NRS description did not thoroughly explain the details practitioners need to understand, adopt, and apply it.Source: §I · p. 1
  • The proposed desired properties are intended to guide future NRS development and assess the competency of current and future versions.The authors say these properties can help avoid ad hoc development.Source: §I · p. 1
  • The proposed formalism centers on mission, mission control flow, and mission data flow as a starting point for future NRS and automated risk-management tools.Mission specifies supported tasks; control flow describes command chains; data flow describes data transmission and processing.Source: §I · p. 1

II. A REVIEW OF NRS

  • NRS adapts enterprise IT security controls to space-related countermeasures, while NIST and NASA work provides space-operation profiles and high-level controls.The cited work covers profiles for PNT services, ground-segment command and control, and hybrid satellite networks.Source: §I · p. 2
  • The paper distinguishes its comprehensive NRS properties from prior work and notes that its formalism can build on Ear et al.’s framework.Ear et al.’s framework includes a space-system model and metrics for attack consequence and sophistication.Source: §I · p. 2

A. Space System Model and Terminology

B. Overview of the Space Cyber NRS

SPARTA organizes space-attack information into tactics, techniques, and sub-techniques, while NRS assigns technique scores and links techniques to mitigations. Criticality and likelihood assessments help practitioners select the applicable base scores and characterize risk.

B. Overview of the Space Cyber NRS

  • SPARTA maps tactics to techniques and sub-techniques, and maps techniques to countermeasures and NIST security controls; NRS supplies base risk scores and mitigations for SPARTA techniques.NRS scores reflect assessed technique likelihood and impact through a risk matrix.Source: B. Overview of the Space Cyber NRS · p. 3

1) System Criticality:

  • Experts assign technique base scores at high, medium, and low system-criticality levels, which practitioners select by subjectively assessing each affected unit’s criticality.The categories respectively cover critical, military, and intelligence functions; civil, science, weather, and commercial systems; and academic or research systems.Source: 1) System Criticality · p. 3

2) SPARTA Technique Likelihood:

  • Likelihood is subjectively scored from 1 to 5 using adversary motivation, exploitation difficulty, and capability across seven tiers, from script kiddies to the most capable state actors.Source: 2) SPARTA Technique Likelihood · p. 3

3) SPARTA Technique Impact:

The paper describes NRS’s impact and risk-matrix concepts, its mitigation process, and a Terra satellite case study. In that case, four techniques tied to the real attack’s control and downlink flows were identified for mitigation, while the payload attack was treated as tolerable.

3) SPARTA Technique Impact:

  • Technique impact means consequences of successful execution, potentially including mission disruption, data-integrity effects, loss of control or availability, financial harm, safety effects, or national-security implications.Source: 3) SPARTA Technique Impact · p. 3

4) Risk Matrix Representation (Risk Scores):

  • The 5×5 matrix maps assessed impact and likelihood to scores from 1 to 25, with low, medium, and high bands; the scores are not the product of impact and likelihood.The bands are 1–10 low, 11–19 medium, and 20–25 high.Source: 4) Risk Matrix Representation (Risk… · p. 3

5) Countermeasures and Security Controls:

  • Countermeasures provide space-specific protections that security controls can instantiate; one technique may map to multiple countermeasures and controls.For example, CM0021 calls for verifying flight-software digital signatures before installation and maps to 19 controls.Source: 5) Countermeasures and Security Controls · p. 3

C. Algorithm for Using NRS

  • The algorithm identifies applicable SPARTA techniques, tailors impact and likelihood subjectively to the system’s conditions, uses a 5×5 matrix, and selects controls for intolerable risks.Countermeasures and security controls are subjectively selected when a technique is not tolerable.Source: C. Algorithm for Using NRS · p. 3

A. Case Study Based on a Real-World Attack

  • The 2008 Terra case considered a compromised ground-station vulnerability and assessed three objectives; four techniques were high risk and T1586 was medium under the analysts’ subjective assumptions.The assumed high criticality of mission modules and a Tier VI adversary influenced the tailored scores.Source: A. Case Study Based on a Real-World… · pp. 3–5
  • Four techniques—EX-0013, IA-0007, EX-0012.10, and T1133—were identified for mitigation, and the authors say the real attack’s control and downlink flows could have been prevented; the payload attack was not thwarted because it was deemed tolerable.Source: A. Case Study Based on a Real-World… · p. 5

1) Strengths of NRS:

The authors characterize NRS as a practical starting point for space cyber risk management and as a baseline for prioritizing assessment.

1) Strengths of NRS:

  • NRS provides a starting point for incorporating principled cyber risk management into space-system design, development, operation, and maintenance.The authors note that engineers tend to assess cyber risks superficially as low, and that NRS can identify intolerable risks for mitigation.Source: 1) Strengths of NRS · p. 5
  • NRS reduces assessment workforce burden by identifying high-score SPARTA techniques for priority review, including EX-0012.10 and EX-0013.Source: 1) Strengths of NRS · p. 5

2) Weaknesses of NRS:

NRS leaves key risk-score judgments and several risk-management choices to practitioners, while its broad applicability depends on substantial analyst expertise. These weaknesses motivate properties to guide future NRS design.

2) Weaknesses of NRS:

  • NRS does not justify its likelihood, impact, or criticality scores, and practitioners must subjectively tailor them to their systems.It also lacks guidance for threat modeling, setting risk thresholds, and selecting countermeasures and controls; risks remain tied to individual techniques rather than attack flows.Source: 2) Weaknesses of NRS · pp. 5–6

3) Applicability of NRS:

  • NRS can apply across space systems and their lifecycles, but analysts need expertise to identify relevant techniques, adjust scores, choose countermeasures, and map IT controls to space systems.This work spans adversary capabilities, spacecraft technical operations, cyber impacts, and the applicability of IT security controls.Source: 3) Applicability of NRS · p. 6

IV. DESIRED PROPERTIES OF SPACE CYBER NOTIONAL RISK SCORES

  • The characterization motivates three categories of desired properties—usability, usefulness, and robustness—for an ideal NRS.Source: §IV · p. 6

A. Properties Related to Usability

The proposed usability properties are motivation, simplicity, and automation. They focus on serving defined audiences, making NRS understandable, and supporting consistent analysis at scale.

A. Properties Related to Usability

  • An NRS should identify its intended audiences and document its purpose with use cases suited to their differing concerns.Developers and operators of infrastructure, components, or modules may have different needs.Source: A. Properties Related to Usability · p. 6
  • A simpler NRS should make inputs, outputs, guidance, and technical reasoning intuitive and transparent to practitioners.Simplicity is proposed as a way to improve the chance of practitioner adoption.Source: A. Properties Related to Usability · p. 6
  • An NRS should provide automated tools for each audience because manual analysis can produce inconsistent results and automation is needed for large datasets.Source: A. Properties Related to Usability · p. 6

B. Properties Related to Usefulness

The usefulness properties call for mission-level risk analysis, compatibility with existing standards and practices, and applicability to unknown vulnerabilities.

B. Properties Related to Usefulness

  • An NRS should analyze risks associated with missions so defenders can focus on affected tasks rather than securing an entire complex infrastructure at all times.Source: B. Properties Related to Usefulness · pp. 6–7
  • An NRS should accommodate existing government and industry standards and best practices while avoiding their potential weaknesses or flaws.The paper names NIST, ATT&CK, SPARTA, and NASA cybersecurity best practices as examples.Source: B. Properties Related to Usefulness · p. 7
  • An NRS should address unknown as well as known vulnerabilities; a notional-scenario study found that including latent vulnerabilities led to more effective space cyber risk analysis.Source: B. Properties Related to Usefulness · p. 7

C. Properties Related to Robustness

The robustness properties call for objective, rigorous, and valid NRS designs that quantify uncertainty and account for evolving risks. The paper connects these requirements to subjective scoring, validation, and changing attack and defense capabilities.

C. Properties Related to Robustness

  • An NRS should be as objective as possible because subjective application can be error-prone, including when analysts tailor scores to different attacks.The paper notes that space engineers lacking cybersecurity expertise have sometimes estimated cyber risk as low.Source: C. Properties Related to Robustness · p. 7
  • An NRS should use rigorous design and analysis to make assumptions and conditions of use clear, reducing ambiguity and misinterpretation.Source: C. Properties Related to Robustness · p. 7
  • An NRS should validate its models, algorithms, methods, and parameters; past-attack data may not reflect current attacks.The paper suggests considering predictions of evolving attack capabilities and their distribution, which leads to uncertainty quantification.Source: C. Properties Related to Robustness · p. 7
  • An NRS should quantify uncertainty in its outputs, including uncertainty from approximations in its model or errors in parameter measurements.Decision-makers should take that uncertainty into account when using NRS outputs as assistance.Source: C. Properties Related to Robustness · p. 7
  • An NRS should handle evolving risk because attack and defense capabilities change over time and interact.Source: C. Properties Related to Robustness · p. 7

V. A FORMALISM FOR DESIGNING FUTURE NRS

The formalism defines missions through their control and data flows, then represents those flows and the mission itself with graphs. It is intended to address mission-centricity and rigorousness in future NRS.

  • A mission is a task accomplished with or without humans in or on the loop, described through its mission control and data flows.The formalism targets Properties 4 (mission-centricity) and 8 (rigorousness).Source: §V · p. 7
  • Mission control flows model commands between space units, and their granularity-neutral definition supports segment-, component-, or module-level descriptions.The paper does not advocate drilling down to program-analysis control-flow granularity because it may not capture the high-level meaning of a mission.Source: §V · pp. 7–8
  • A mission control flow graph combines a mission’s control flows, allowing shared nodes or arcs, command initiators, and command executors; it is ideally acyclic.A loop may prevent mission completion.Source: §V · p. 8
  • Mission data flows describe data sent between space units, and their graph may be cyclic when opposite-direction edges carry different kinds of data.Mission data flows can overlap with control flows; a command to send data one way can correspond to data flowing in the reverse direction.Source: §V · p. 8
  • The formalism describes a mission using both its mission control flow graph and mission data flow graph.These preceding definitions provide the basis for formalizing a mission.Source: §V · p. 8

VI. CONCLUSION AND FUTURE DIRECTIONS

The paper presents an algorithmic description and initial characterization of NRS, desired properties for future versions, and a formalism as a starting point for developing them. It identifies open problems in refining risk scores and building automated space cyber risk-management tools.

  • The paper presents an algorithmic description and first characterization of NRS, desired properties for future versions, and a formalism as a starting point for their development.Source: §VI · p. 8
  • Open problems for future NRS include making base risk scores and practitioner tailoring objective while supporting varied audiences without losing simplicity.The paper also asks how automated tools can determine mission-graph node criticality and impact, and whether additional desired properties are needed.Source: §VI · p. 8
  • Automated space cyber risk-management tools remain an open direction, including incorporating attack chains and replacing heuristic 5×5 risk matrices with principled methods.Other questions include extracting mission graphs and computing unit criticality and impact from system specifications, environmental conditions, cyber threat intelligence, and mission requirements.Source: §VI · pp. 8–9
Loading 2402.02635v1…