SC-5(1) - Denial-of-service Protection | Restrict Ability to Attack Other Systems
Restrict the ability of individuals to launch the following denial-of-service attacks against other systems: [Assignment: organization-defined denial-of-service attacks].
Reducing attack surface helps mitigate DoS. Consider disabling unneeded services/parsers, constraining command verbs and parameters, bounding retransmissions/backoff that can amplify congestion, and validating inputs early to avoid expensive parsing. On the ground, segregate management pathways and use priority queues so safety-of-flight messages preempt routine products during overload.
Exploit ground system and use to maliciously to interact with the spacecraft
Sample Requirements
SPARTA ID
Requirement
Rationale/Additional Guidance/Notes
SPR-192
The [spacecraft] shall implement denial-of-service protection mechanisms that restrict the ability of the spacecraft to be used in an attack against other systems.{SV-AV-1,SV-AV-6}{SC-5(1)}
Examples include:
- Traffic Analysis and Filtering: The [spacecraft] shall deploy traffic analysis and filtering mechanisms to detect and mitigate denial-of-service attacks, preventing malicious or excessive traffic from impacting the availability of the spacecraft or any of its sub-components.
- Rate Limiting: The [spacecraft] shall implement rate limiting controls to restrict the rate of incoming and outgoing network traffic, preventing the system from being used to launch or amplify denial-of-service attacks.
- Resource Allocation: The [spacecraft] shall establish and enforce resource allocation policies to ensure that system resources are fairly and appropriately distributed, minimizing the impact of denial-of-service attacks.
- Anomaly Detection: The [spacecraft] shall employ anomaly detection mechanisms to identify unusual patterns of behavior indicative of denial-of-service attacks and take appropriate action to mitigate such attacks.