Tactics
Techniques
Countermeasures
Countermeasures
SPARTA Requirements
Space Segment Control Tailoring
Ground Segment Cyber Defenses
NIST References
ISO IEC 27001
NASA Best Practice Guide
D3FEND
Tactics
Technqiues
Artifacts
Resources
SPARTA User Guide
TTP Recommended Practices
General Information
FAQ
Working with SPARTA
Updates
SPARTA Versions
Contribute
Related Work
Indicators of Behavior
Spacecraft Functional Decomposition
Space System Cybersecurity Questionnaire
Defense-in-Depth Space Systems
Threat Levels
Threats
Risk Assessment
Cybersecurity Protections for
Spacecraft: A Threat Based
Approach (pdf)
Tools
Navigator
Countermeasure Mapper
Control Mapper
Spacecraft Mapper
JSON Creator
Notional Risk Scores
Attack Flow (
Code
|
Tool
)
Spacetrail
Search
Updates
v4.0.1
v4.0
v3.2
v3.1
v3.0
v2.0
v1.6
v1.5
v1.5.1
v1.4
v1.3
v1.3.2
v1.3.1
v1.3.1.1
v1.2
v1.1
v1.0
Home
Resources
Updates
v4.0
Update - v4.0
Start Date
End Date
August 06 2026
August 24 2026
Below highlights the changes to the website, techniques, sub-techniques, and/or countermeasures.
Website Updates
Ground System Defense
Updated and Expanded Countermeasures
Updated Impact Techniques
Spacetrail - The Game
Paper Release -
Conducting Cyber Tabletop Exercises for Space Systems Using SPARTA
DEFCON 34 Presentation -
DEF CON 34: SpaceCOP - Houston, We Have an Intrusion
Techniques
New Techniques
IMP-0007:
Native Functionality Abuse
IMP-0008:
State or Mode Manipulation
IMP-0009:
Configuration Manipulation
IMP-0010:
Data Manipulation
IMP-0011:
Command and Data Flow Manipulation
IMP-0012:
Software, Firmware, or Programmable Logic Manipulation
IMP-0013:
Resource Exhaustion or Contention
IMP-0014:
Timing or Synchronization Manipulation
Modified Techniques
REC-0005:
Eavesdropping
IA-0001:
Compromise Supply Chain
IA-0005:
Rendezvous & Proximity Operations
IA-0008:
Rogue External Entity
IA-0009:
Trusted Relationship
EX-0001:
Replay
EX-0005:
Exploit Hardware/Firmware Corruption
EX-0010:
Malicious Code
EX-0014:
Spoofing
EX-0016:
Jamming
EX-0017:
Kinetic Physical Attack
PER-0002:
Backdoor
DE-0002:
Disrupt or Deceive Downlink
DE-0003:
On-Board Values Obfuscation
DE-0009:
Camouflage, Concealment, and Decoys (CCD)
EXF-0003:
Signal Interception
EXF-0009:
Compromised Partner Site
IMP-0001:
[DEPRECATED] Deception (or Misdirection)
IMP-0002:
[DEPRECATED] Disruption
IMP-0003:
[DEPRECATED] Denial
IMP-0004:
[DEPRECATED] Degradation
IMP-0005:
[DEPRECATED] Destruction
IMP-0006:
[DEPRECATED] Theft
Sub-Techniques
New Sub-Techniques
EX-0010.05:
On-Board Process Injection
DE-0003.13:
Trusted Process Reporting Suppression
Modified Sub-Techniques
REC-0003.04:
Valid Credentials
RD-0004.02:
Upload Exploit/Payload
IA-0008.01:
Rogue Ground Station
EX-0009.02:
Operating System
EX-0010.02:
Wiper Malware
EX-0014.02:
Bus Traffic Spoofing
EX-0014.03:
Sensor Data
EX-0014.04:
Position, Navigation, and Timing (PNT) Spoofing
DE-0002.01:
Inhibit Ground System Functionality
Countermeasures
New Countermeasures
Modified Countermeasures
CM0001:
Protect Sensitive Information
CM0008:
Security Testing Results
CM0009:
Threat Intelligence Program
CM0020:
Threat modeling
CM0022:
Criticality Analysis
CM0024:
Anti-counterfeit Hardware
CM0025:
Supplier Review
CM0026:
Original Component Manufacturer
CM0027:
ASIC/FPGA Manufacturing
CM0028:
Tamper Protection
CM0041:
User Training
CM0052:
Insider Threat Protection
CM0054:
Two-Person Rule
CM0074:
Distributed Constellations
CM0075:
Proliferated Constellations
CM0076:
Diversified Architectures
CM0077:
Space Domain Awareness
CM0078:
Space-Based Radio Frequency Mapping
CM0079:
Maneuverability
CM0080:
Stealth Technology
CM0081:
Defensive Jamming and Spoofing
CM0082:
Deception and Decoys
CM0083:
Antenna Nulling and Adaptive Filtering
CM0084:
Physical Seizure
CM0085:
Electromagnetic Shielding
CM0086:
Filtering and Shuttering
CM0087:
Defensive Dazzling/Blinding
CM0088:
Organizational Policy
CM0089:
Assessment & Authorization
CM0090:
Continuous Monitoring
CM0002:
COMSEC
CM0030:
Crypto Key Management
CM0031:
Authentication
CM0033:
Relay Protection
CM0073:
Traffic Flow Analysis Defense
CM0003:
TEMPEST
CM0040:
Shared Resource Leakage
CM0049:
Machine Learning Data Integrity
CM0050:
On-board Message Encryption
CM0004:
Development Environment Security
CM0007:
Software Version Numbers
CM0010:
Update Software
CM0011:
Vulnerability Scanning
CM0012:
Software Bill of Materials
CM0013:
Dependency Confusion
CM0015:
Software Source Control
CM0016:
CWE List
CM0017:
Coding Standard
CM0018:
Dynamic Testing
CM0019:
Static Analysis
CM0021:
Software Digital Signature
CM0023:
Configuration Management
CM0036:
Session Termination
CM0039:
Least Privilege
CM0046:
Long Duration Testing
CM0047:
Operating System Security
CM0055:
Secure Command Mode(s)
CM0062:
Dummy Process - Aggregator Node
CM0069:
Process White Listing
CM0005:
Ground-based Countermeasures
CM0034:
Monitor Critical Telemetry Points
CM0035:
Protect Authenticators
CM0053:
Physical Security Controls
CM0056:
Data Backup
CM0070:
Alternate Communications Paths
CM0006:
Cloaking Safe-mode
CM0032:
On-board Intrusion Detection & Prevention
CM0042:
Robust Fault Management
CM0044:
Cyber-safe Mode
CM0051:
Fault Injection Redundancy
CM0066:
Model-based System Verification
CM0067:
Smart Contracts
CM0068:
Reinforcement Learning
CM0014:
Secure boot
CM0037:
Disable Physical Ports
CM0038:
Segmentation
CM0043:
Backdoor Commands
CM0045:
Error Detection and Correcting Memory
CM0048:
Resilient Position, Navigation, and Timing
CM0057:
Tamper Resistant Body
CM0058:
Power Randomization
CM0059:
Power Consumption Obfuscation
CM0060:
Secret Shares
CM0061:
Power Masking
CM0063:
Increase Clock Cycles/Timing
CM0064:
Dual Layer Protection
CM0065:
OSAM Dual Authorization
CM0071:
Communication Physical Medium
CM0072:
Protocol Update / Refactoring
CM0029:
TRANSEC
×