Threat actors may target the spacecraft hardware and/or software while the spacecraft is at Assembly, Test, and Launch Operation (ATLO). ATLO is often the first time pieces of the spacecraft are fully integrated and exchanging data across interfaces. Malware could propagate from infected devices across the integrated spacecraft. For example, test equipment (i.e., transient cyber asset) is often brought in for testing elements of the spacecraft. Additionally, varying levels of physical security is in place which may be a reduction in physical security typically seen during development. The ATLO environment should be considered a viable attack vector and the appropriate/equivalent security controls from the primary development environment should be implemented during ATLO as well.
| ID | Name | Description | STIX Pattern |
| SIUU-23 | Detection of Unauthorized Hardware Debugging | Identifies unauthorized activation of hardware debugging features, which could facilitate backdoor access. This pattern checks if the hardware debugging mode is activated at an unexpected time (activation_time != 'expected_time'). It is useful for scenarios where debugging activity might occur outside of predefined operational windows, potentially signaling malicious activity or tampering. | [x-opencti-hardware-log:debug_mode = true AND x-opencti-hardware-log:activation_time != 'expected_time'] |