awesome-space-security

Awesome Space Security

A curated list of awesome resources about the security of space systems.

If you would like to contribute, please read CONTRIBUTING.md first. It contains a lot of tips and guidelines to help keep things organized. Just click README.md to submit a pull request. If this list is not complete, you can contribute to make it so. Here is a great video tutorial to learn how to contribute on Github.

Please, help organize these resources so that they are easy to find and understand for newcomers.

If you see a link here that is not (any longer) a good fit, you can fix it by submitting a pull request to improve this file. Thank you!

Inspired by awesome-python.

Table of contents

• Table of contents
• Legend
• Books
• Directives
• Papers
• Reports
• Talks
• Threat Modeling
• Tools

Legend

• Draft :construction:
• Paid :heavy_dollar_sign:
• Abandoned :skull:

---

Books

• 2020.03.31 Cybersecurity for Space: Protecting the Final Frontier: The first book focused on the implementation of cybersecurity for space systems :heavy_dollar_sign:

Directives

Aerospace Industries Association (AIA)

• 2018.11.29 NAS9933: Critical Security Controls for Effective Capability in Cyber Defense :heavy_dollar_sign:

Committee on National Security Systems (CNSS)

• 2012.11.28 CNSSP-12: National Information Assurance Policy for Space Systems used to Support National Security Missions

Consultative Committee for Space Data Systems (CCSDS)

• 2011.11 CCSDS 350.6-G-1: Space Missions Key Management Concept
• 2012.11 CCSDS 351.0-M-1: Security Architecture for Space Data Systems
• 2014.12 CCSDS 350.9-G-1: CCSDS Cryptographic Algorithms
• 2018.06 CCSDS 350.5-G-1: Space Data Link Security Protocol - Summary of Concept and Rationale
• 2018.06 CCSDS 356.0-B-1: Network Layer Security Adaptation Profile
• 2018.06 CCSDS A13.1-Y-1: CCSDS Recommended Procedures for Cloud-Based Interoperability Testing
• 2019.03 CCSDS 350.0-G-3: The Application of Security to CCSDS Protocols
• 2019.04 CCSDS 350.4-G-2: CCSDS Guide for Secure System Interconnection
• 2019.04 CCSDS 350.7-G-2: Security Guide for Mission Planners
• 2019.07 CCSDS 357.0-B-1: CCSDS Authentication Credentials
• 2019.08 CCSDS 352.0-B-2: CCSDS Cryptographic Algorithms
• 2020.02 CCSDS 350.8-M-2: Information Security Glossary of Terms
• 2020.02 CCSDS 355.1-B-1: Space Data Link Security Protocol - Extended Procedures
• 2022.02 CCSDS 350.1-G-3: Security Threats against Space Missions
• 2022.07 CCSDS 355.0-B-2: Space Data Link Security Protocol

European Space Agency (ESA)

• 1994.10 ESA PSS-05-0 Issue 2: ESA software engineering standards
• 2000.03.30 BSSC(2000)1 Issue 1: ESA C and C++ Coding Standards
• 2009.03.06 ECSS-E-ST-40C: Software
• 2013.12.11 ECSS-E-HB-40A: Software engineering handbook
• 2017.02.15 ECSS-Q-ST-80C: Software product assurance
• 2017.11.22 ECSS-Q-HB-80-03A Rev.1: Software dependability and safety
• 2022.05.31 ECSS-E-ST-10-03C Rev.1: Testing

Federal Office for Information Security (BSI)

• 2022.06.30 IT baseline protection profile for space infrastructures: Minimum Protection for Satellites Covering their Entire Life Cycle
• 2023.07.28 Technical Guideline BSI TR-03184: Information Security for Space Systems - Part 1: Space segment

Ministry of Economy, Trade and Industry (METI)

• 2023.03 Cybersecurity Guidelines for Commercial Space Systems

National Aeronautics and Space Administration (NASA)

• 2011.11 NASA/SP-2010-580: NASA System Safety Handbook Volume 1: System Safety Framework and Concepts for Implementation
• 2014.11 NASA/SP-2014-612: NASA System Safety Handbook Volume 2: System Safety Concepts, Guidelines, and Implementation Examples
• 2020.09.04 SPD-5: Cybersecurity Principles for Space Systems
• 2020.12.16 MRPP.CPS.20201216: Candidate Protection Strategies
• 2022.07.15 NASA-STD-1006A: Space System Protection Standard

National Institute of Standards and Technology (NIST)

• 1994.08.01 SEL-94-003: NASA C Coding Standard and Style Guide
• 2004.03.31 NASA-GB-8719.13: NASA Software Safety Guidebook
• 2005.05.24 SEL-94-003: NASA C++ Coding Standard and Style Guide
• 2020.09 NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations
• 2021.02 NIST IR 8323: Foundational PNT Profile: Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services
• 2022.02 NIST IR 8270: Introduction to Cybersecurity for Commercial Satellite Operations :construction:
• 2022.05 NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
• 2022.12 NIST IR 8401: Satellite Ground Segment: Applying the Cybersecurity Framework to Satellite Command and Control

Papers

• 2016.04.30 Satellite Network Hacking & Security Analysis, International Journal of Computer Science and Security (IJCSS)
• 2018.12 Cybersecurity Principles for Space Systems, Journal of Aerospace Computing, Information and Communication
• 2021.07 CubeSat Security Attack Tree Analysis, 8th IEEE International Conference on Space Mission Challenges for Information Technology (SMC-IT 2021)
• 2023.05.26 PCspooF: Compromising the Safety of Time-Triggered Ethernet, IEEE Symposium on Security and Privacy 2023

Reports

• 2019.11 Defending Spacecraft in the Cyber Domain
• 2020.10 Establishing Space Cybersecurity Policy, Standards, & Risk Management Practices
• 2021.04.29 Cybersecurity Protections for Spacecraft: A Threat Based Approach
• 2023.04 Space Threat Assessment: A Report of the CSIS Aerospace Security Project

Talks

Black Hat

• 2009.02.18 Satellite Hacking for Fun and Profit, Black Hat DC 2009
• 2014.08.06 SATCOM Terminals: Hacking by Air, Sea, and Land, Black Hat USA 2014
• 2015.08.05 Spread Spectrum Satcom Hacking Attacking The Globalstar Simplex Data Service, Black Hat USA 2015
• 2020.08.05 Whispers Among the Stars: A Practical Look at Perpetrating Satellite Eavesdropping Attacks, Black Hat USA 2020

CYSAT

• 2022.04.07 Cyber range for space a way to optimize the cybersecurity process, CYSAT 2022

DEF CON

• 2012.10.31 Satellite Hacking: An Introduction, DEF CON Switzerland 2012
• 2020.08.07 Exploiting Spacecraft, DEF CON 28 Aerospace Village
• 2021.08.06 Unboxing the Spacecraft Software BlackBox Hunting for Vulnerabilities, DEF CON 29 Aerospace Village
• 2022.08.13 Hunting for Spacecraft Zero Days using Digital Twins, DEF CON 30 Aerospace Village

Other conferences

• 2016.07.24 Iridium Satellite Hacking, HOPE XI 2016
• 2016.12.27 Reverse Engineering Outernet, 33C3
• 2017.01.27 Reverse Engineering Satellite Based IP Content Distribution, ReCon Brussels 2017
• 2018.10.12 Hacking Yachts Remotely via Satcom or Maritime Internet Router
• 2020.02 GPS As An Attack Vector, S4 Conference 2020
• 2022.09.10 Satellite Communications Reverse Engineering, GambiConf EU 2022

Threat Modeling

• MITRE ATT&CK® Matrix for ICS: Knowledge base of adversary tactics and techniques against Industrial Control Systems (ICS) based on real-world observations
• Space Attack Research & Tactic Analysis (SPARTA): Knowledge base of unclassified information to space professionals about how spacecraft may be compromised via cyber and traditional counterspace means
• Space Attacks and Countermeasures Engineering Shield (SPACE-SHIELD): A MITRE ATT&CK® like knowledge-base framework for Space Systems. It is a collection of adversary tactics and techniques, and a security tool applicable in the Space environment to strengthen the security level.

Tools

• CITEF: Next Generation Cyber-Range Services for space missions :heavy_dollar_sign:
• CryptoLib: Provide a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station.
• QA707: Fully configurable GNSS Software Defined Radio (SDR) simulator for flexible generations of GNSS signals, interferences and authentication schemes up to RF level :heavy_dollar_sign:
• iSAFT: Advanced solutions for the validation of satellite/spacecraft on-board data networks including SpaceWire, SpaceFibre, MIL-STD-1553, Time-Triggered Ethernet, CAN/CANOpen, WizardLink and others :heavy_dollar_sign:

---

If you have any question about this opinionated list, do not hesitate to contact me @Peco602 on Twitter or open an issue on GitHub.