1. Home
  2. Related Work
  3. Threats
  4. SV-CF-4

SV-CF-4

Adversary monitors for safe-mode indicators such that they know when satellite is in weakened state and then they launch attack


Informational References

  • CENTRA - Chinese Research into Cyber Vulnerabilities of Satellite Bus Standards
ID: SV-CF-4
DiD Layer: Crypto
CAPEC #:  20 | 97 | 117 | 158 | 620 | 621 | 622
NIST Rev5 Control Tag Mapping:  SA-8 | SA-8(23) | SA-8(24) | SC-8 | SC-13
Lowest Threat Tier to
Create Threat Event:  V
Notional Risk Rank Score: 

High-Level Requirements

The spacecraft shall protect the confidentiality and integrity of all information at all times (i.e., transmission, preparation, storage, etc.).

Low-Level Requirements

Requirement Rationale/Additional Guidance/Notes
The [spacecraft] shall encrypt all telemetry on downlink regardless of operating mode to protect current state of spacecraft.{SV-CF-4}{AC-3(10),RA-5(4),SA-8(18),SA-8(19),SC-8,SC-8(1),SC-13}

Related SPARTA Techniques and Sub-Techniques

ID Name Description
REC-0007 Monitor for Safe-Mode Indicators Threat actors may gather information regarding safe-mode indicators on the victim SV. Safe-mode is when all non-essential systems are shut down and only essential functions within the SV are active. During this mode, several commands are available to be processed that are not normally processed. Further, many protections may be disabled at this time.
EX-0006 Disable/Bypass Encryption Threat actors may perform specific techniques in order to bypass or disable the encryption mechanism onboard the victim SV. By bypassing or disabling this particular mechanism, further tactics can be performed, such as Exfiltration, that may have not been possible with the internal encryption process in place.
EX-0011 Exploit Reduced Protections During Safe-Mode Threat actors may take advantage of the victim SV being in safe mode and send malicious commands that may not otherwise be processed. Safe-mode is when all non-essential systems are shut down and only essential functions within the SV are active. During this mode, several commands are available to be processed that are not normally processed. Further, many protections may be disabled at this time.
DE-0005 Exploit Reduced Protections During Safe-Mode Threat actors may take advantage of the victim SV being in safe mode and send malicious commands that may not otherwise be processed. Safe-mode is when all non-essential systems are shut down and only essential functions within the SV are active. During this mode, several commands are available to be processed that are not normally processed. Further, many protections (i.e. security features) may be disabled at this time which would ensure the threat actor achieves evasion.

Related SPARTA Countermeasures

ID Name Description NIST Rev5 D3FEND ISO 27001