15 juin 2021 | International, Aérospatial, Naval, Terrestre, C4ISR, Sécurité
Contracts for June 14, 2021
Today
3 novembre 2020 | International, Aérospatial, C4ISR, Sécurité
Kevin Coggins
The United States and our allies are increasingly dependent on unfettered access to space. However, it has become abundantly clear that our space systems have significant cybersecurity vulnerabilities that our adversaries are eager to exploit.
Earlier this year, William Akoto wrote about the growing constellations of satellites operated by private industry, led by SpaceX, Blue Origin and others: “If hackers were to take control of these satellites, the consequences could be dire. On the mundane end of scale, hackers could simply shut satellites down, denying access to their services. Hackers could also jam or spoof the signals from satellites, creating havoc for critical infrastructure. This includes electric grids, water networks and transportation systems.”
Space Policy Directive 5, recently issued by the White House, notes that “cybersecurity principles and practices that apply to terrestrial systems also apply to space systems” and that we must integrate these principles and practices into every phase of the space system life cycle.
SPD-5 is charting the right course toward assuring our cybersecurity in the space domain. This article highlights the unique vulnerabilities of space systems and how innovative solutions like “digital twins” can help us protect systems in orbit today and design more secure ones for the future.
Cyberattacks on space systems — comprised of satellites, ground control stations, and user terminals (e.g., GPS receivers) — are appealing to nation-states, criminal groups, hackers and other bad actors. It's a tremendous opportunity to breach data and disrupt operations in a low-risk way with a low cost of execution. The different components that make up space systems each come with their own set of cyber vulnerabilities, the ground segment in particular.
Some space systems were built with speed to market rather than cybersecurity in mind. In contrast, for traditional defense-focused space systems, a slower design and development process has introduced vulnerabilities as well. Space systems operating today may have taken a full 20 years to go from paper to launch and lack the capabilities to recognize or respond to today's cyberthreats. Space systems are increasingly interconnected — a malicious attack can easily spread from a single point of vulnerability in a ground station to the satellites.
Cybersecurity in space systems has struggled to keep pace with the rapid evolution of threat actors and exploits. Given these challenges, how can organizations with space systems stay ahead of cyberthreats and protect their missions and users?
The older approach of paper-based assessments has significant limitations, like the inability to duplicate reactions to all possible scenarios. At the other end of the spectrum, full-scale replicas are expensive and time-consuming to build.
In the middle is the “digital twin” concept — a virtual mirror model that synchronizes a physical object with a cyber representation. With this approach, organizations can test a satellite in different scenarios to identify vulnerabilities and develop protection strategies, even before the satellite is built.
One specific project that demonstrated digital twins' strengths and capabilities: testing Air Force GPS space systems for vulnerabilities after the passage of Section 1647 of the 2016 National Defense Authorization Act.
Starting with a model-based system engineering review of thousands of pages of design documents, we built a digital replica of critical GPS Block IIR satellite components launched between 1987 and 2004 that ran on a single laptop with lightweight applications.
Our digital twin created the foundation for a flexible cyber test bed — a suite of scalable software applications to demonstrate and validate cyber vulnerabilities and protection strategies as the system is designed or modified. The test bed can connect with assets beyond the network to generate data, provide war-gaming support and explore attack scenarios.
We need this flexibility and functionality for future space system protection. The next generation of satellites will encounter more extreme service conditions and increased, simultaneous cyberattack vectors over longer periods of time. To respond to these challenges, these space systems will need increasingly complex designs, and with such complexity comes potentially greater vulnerability to cyberattacks and threats.
Digital twins and model-based system engineering approaches can strengthen security throughout the acquisition and sustainment phases. Use them to:
What can space system acquisition professionals, developers and operators learn here? Digital twins offer an innovative approach that can streamline and strengthen the testing and design process of our space assets. They can also provide insights on as-built systems and enable the buydown of risks across the space system life cycle, enabling affordability across the entire system life cycle. Now is the time to leverage their capabilities, to ensure that the space infrastructure so vital to our security and American way of life has the protection it requires.
15 juin 2021 | International, Aérospatial, Naval, Terrestre, C4ISR, Sécurité
Today
19 février 2021 | International, C4ISR
DÉFENSE Thales va renforcer le système de télécommunications satellitaires de l'Armée française Thales a annoncé, jeudi 18 février, avoir remporté auprès de la Direction générale de l'armement (DGA) un contrat dans le cadre du programme français de satellite de télécommunications protégées Syracuse (SYstème de RAdioCommunication Utilisant un SatellitE). Après avoir été sélectionné pour les satellites en 2015 et pour la première partie du segment sol en 2019, Thales assurera la maîtrise d'oeuvre pour le développement et le déploiement du segment sol du système Syracuse IV. Le groupe livrera près de 200 nouvelles stations sol ainsi que le système de gestion de bout en bout, assurant une interopérabilité interarmées complète. « Les armées françaises des trois milieux (terre, air et mer) bénéficieront de capacités de communication interopérables fortement accrues en termes de débit, de disponibilité, de résistance aux menaces et de connectivité de bout-en-bout », précise Thales ; « gr'ce à la technologie unique d'antibrouillage modem 21 de Thales, les Forces disposeront de débits et d'optimisation à même de garantir la souveraineté et la supériorité informationnelle indispensable aux opérations, quelle que soit leur position sur le globe ». Les Echos du 19 février
31 décembre 2018 | International, C4ISR
By: Mike Gruss Lt. Gen. Bruce Crawford is quick to remind his audience that the United States Army is one of the largest organizations in the world. Crawford understands the scope because, as the service's top uniformed IT official, any way the Army wants to take advantage of the revolution taking place in information technology must go through his office. Crawford became the service's chief information officer in August 2017 and since then has focused on the move to the cloud, hiring staff and protecting data. “A lot of things that we're looking at are aspirational, but what I will tell you is institutionally we are fundamentally in a different place than we were just 12 months ago,” he said. Crawford spoke recently with C4ISRNET Editor Mike Gruss. C4ISRNET: Talk about the Army's enterprise network and the major muscle movements taking place. LT. GEN. BRUCE CRAWFORD: For about the last 18 months, the Army's been focused on the tactical network. We really needed to take a step back from 17 years of continuous combat and say, “Have we properly networked the soldier?” Of course, the answer was “No.” In terms of the enterprise, there are about three big pieces to it. One has to do with our data. It's not just about storing our data. How do we better protect our data? If you pay attention to a lot of the research, 90 percent of the data that exists in the world today has been generated just in the last 24 months. You combine that with investments in cloud. So today it's about $200 billion. By 2020-2021 it's supposed to go to about $500 billion. One of the big focus areas has to be shifting from defending our networks to how do we protect our data. C4ISRNET: What else? CRAWFORD: I call it a triad of opportunity: you have got cloud, identity and access management and credentialing. Once we put our data in a secure, accessible, elastic environment, then how are we going to make sure that we can authenticate who you are, but you can actually access that data? So, taking on the issue of identity, credentialing and access management is the second leg in that stool. Last, but certainly not least, is the power of artificial intelligence and machine learning. The real value of that data is your ability to analyze that data, to predict what some of the challenges may be. C4ISRNET: Do you expect to see two-factor authentication or biometrics being used on the battlefield? CRAWFORD: That technology is here today. The vast majority of our Guard and Reserve forces don't get a government-issued Blackberry. When they come to work, they bring their device. So why shouldn't they be able to leverage their personal device and get access to information that has been put behind a two-party authentication firewall? One of the efforts that we have ongoing is to do exactly that. We're looking at the next six months before we have that capability, at least able to test it and put it in the hands of soldiers. C4ISRNET: Some of those technologies will rely on the cloud. How does the cloud help the Army make decisions faster? CRAWFORD: Right now, the Army has 1,112 data centers. Our goal is to have about 296 centers by 2022. So, you've got to ask yourself, with cloud technology available, do we even need data centers? Being able to aggregate that data, allowing the deployed soldiers to not have to take servers to the battlefield with them. Giving them the ability to be lighter and more mobile and being able to access that data from anywhere they are on the battlefield. It's pretty powerful in terms of increasing their mobility and the survivability of their data. C4ISRNET: How does cybersecurity fit into the Army's modernization process? CRAWFORD: You've heard about this concept of multidomain operations. It's not moving from this domain to this domain to this domain; it's organizing ourselves as an Army and posturing ourselves as an institution to be lethal in all these environments at once if we had to. So this idea of cybersecurity is critical to that. It has to be a part of our DNA as we move forward. The vast majority of the intrusions and vulnerabilities are human error. Cybersecurity has to be a part of who we are. The position now is that every domain that you're operating in is a contested environment. That requires a culture change to remain lethal. C4ISRNET: We hear a lot about Agile and Waterfall development. What's needed across the Army to make sure that it happens? CRAWFORD: A shared understanding of the problem. We recognized software optimization was a problem. The Army's expending a considerable amount of resources just on software sustainment over the [Future Year Defense Program]. Recognizing that it's an issue and then pulling together key stakeholders, not just the services, but organizations like the [National Security Agency] or organizations like FBI and CIA, which can innovate at a pace much faster than we can. My No. 1 concern when it comes to software optimization has to do with the resiliency of the applications developed by industry. A lot of the applications, they work great in the lab. But when you put them on a network, especially our tactical network, and then you have to try and extend that to the disadvantaged user at the tip of the spear? A lot of the applications don't perform as well as they would in a sterile environment. Applications have got to be more resilient. C4ISRNET: The storage of data is a challenge, but also the integration between networks or databases. What are the steps you're taking to make sure that soldiers can get all the information they need? CRAWFORD: One of the efforts that excites me the most has to do with this idea of a common operating environment. You're going to take 19 disparate battle command systems and collapse them onto three specific environments — a handheld environment, a mounted environment and a command post environment — and each is going to have the same look and feel. Now think about the infrastructure. If you can collapse these systems — all with their own server farms, all with their own standards, all developed by different people, all from different organizations — if you can collapse those all onto a common operating environment, think of the things that you can divest of, but also think of the complexity. We really need to remove the burden of integration from the backs of soldiers. There is a lot of value in that, to include increased mobility for the soldier. C4ISRNET: What are some of the technologies that get you excited? CRAWFORD: The U.S. Army is the third-largest organization of any kind in the world. You've got to ask yourself, “Do we have total asset visibility? Do we have the ability to know what's on our network?” Enterprise license agreements and the things of that nature. Imagine the power of that, if you had 100-percent visibility — not just of your network from a cybersecurity perspective, but when it comes to a term that I am calling information technology accountability, or investment accountability. If you had 100-percent investment accountability, meaning you knew every time an IT dollar was spent, who spent it and was that done against one of your modernization priorities. C4ISRNET: Those are a lot of the same problems that we see in the business world. You're not starting from scratch. You can use commercial products. CRAWFORD: Absolutely. So, there are several things that we are looking to partner more closely with industry. It's the technologies that give us total asset visibility and reduce the number of tools, reduce the number of enterprise license agreements, help us with better visibility of cybersecurity. Then there's another that I'm really interested in: it's talent. Do we have the talent, right now on board, to deliver the technologies that the Army's going to need in 2028 and the answer is no. We're in a race for talent. We've got an effort called “Workforce 2028” that is looking at the 13,600 IT professionals ... We've looked and asked, “OK, what skill sets are really required, based on what we know now, in the next 5 to 10 years?” That's a tough one. C4ISRNET: What do you hope to accomplish in the next 12 months? CRAWFORD: I talked about a race for talent. That's really important that we posture ourselves to get the right people on the team. C4ISRNET: How do you measure that, though? CRAWFORD: Well, you've got to measure it in terms of knowing what skill sets you need, so there's some work that has to be done upfront and we're doing that work now. And you either began — you created a process to allow you to iterate and field the skill sets — or you didn't. It won't be that difficult to measure, but it's got to be an institutional approach. It's not just in the Pentagon. I want to be able to tell you a year from now that we have created a process or leveraged an existing process, because we've actually been granted some authorities by Congress and others over the last couple of years to better posture ourselves. The other thing has to do with protecting our data. Over the next four years, I want to put 25 percent of 8,000 existing applications in a cloud hosting environment. And I've created a process that allows us to do that. It's in support of and synchronized with where the DoD, Mr. [Dana] Deasy is going with the JEDI effort. We live in times now where status quo can no longer be the norm. https://www.c4isrnet.com/it-networks/2018/12/28/the-armys-triad-of-opportunity