In a space context, auditing privileged functions can ensure that actions with high consequences, such as changing cryptographic keys, reconfiguring flight software, or commanding propulsion, are monitored with exceptional scrutiny. Since many satellites rely on highly privileged commands to maintain mission-critical operations (e.g., orbit adjustments, thermal management), each invocation of such a command can be decisive for spacecraft safety and mission success. An audit trail that records who (or which process) issued the privileged instruction, when it was issued, and whether it was successfully authenticated is essential for forensic analysis and anomaly response. Because on-board memory is at a premium, many space programs implement a “store-and-forward” system that offloads logs to ground stations at scheduled downlink opportunities. By carefully auditing privileged usage, organizations can detect suspicious patterns (e.g., repeated execution attempts outside standard contact windows) and respond proactively by blocking further commands, switching to redundant subsystems, or investigating potential insider threats.
The spacecraft will monitor and collect data that provides accountability of activity occurring onboard the spacecraft. Due to resource limitations on the spacecraft, analysis must be performed to determine which data is critical for retention and which can be filtered. Full system coverage of data and actions is desired as an objective; it will likely be impractical due to the resource limitations. “Cyber-relevant data” refers to all data and actions deemed necessary to support accountability and awareness of onboard cyber activities for the mission. This would include data that may indicate abnormal activities, critical configuration parameters, transmissions on onboard networks, command logging, or other such data items. This set of data items should be identified early in the system requirements and design phase. Cyber-relevant data should support the ability to assess whether abnormal events are unintended anomalies or actual cyber threats. Actual cyber threats may rarely or never occur, but non-threat anomalies occur regularly. The ability to filter out cyber threats for non-cyber threats in relevant time would provide a needed capability. Examples could include successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels).
Least privilege limits damage from compromised processes or insider misuse. Processes receive only the minimum access necessary for assigned functions. This reduces lateral movement and privilege escalation pathways. In deterministic spacecraft systems, privilege boundaries must be tightly defined and enforced.
SPR-161
The [spacecraft] shall log and monitor critical activities to detect and respond to unauthorized or malicious activities.{SV-DCO-1,SV-AC-4}{AC-6(9),AC-17(4)}
Critical commands will vary across missions and systems but commonly include commands resulting in maneuvering of the spacecraft or modifying on-board configurations/software.
SPR-164
The [spacecraft] shall implement access control mechanisms to ensure that individuals with privileged access only utilize their privileges as necessary to perform their official duties.{SV-AC-4}{AC-6(9)}
Privileged users must operate within defined boundaries. Monitoring and constraint reduce insider misuse. Privilege minimization lowers damage potential. Accountability deters abuse.