WEBVTT 00:00.000 --> 00:06.400 Brandon Bailey is a Senior Project Leader in the Cyber Assessments and Research Department at the Aerospace Corporation. 00:06.420 --> 00:13.200 He performs cybersecurity research on ground systems and spacecraft systems to better protect our critical space infrastructure. 00:13.760 --> 00:21.160 He will be speaking about developing a tactic against space misuse using Space Attack Research and Tactic Analysis, or SPARTA. 00:21.160 --> 00:26.660 And with that, please welcome once again Brandon to the Aerospace Builders stage. 00:33.080 --> 00:34.780 Thanks a lot. 00:35.060 --> 00:36.640 Appreciate you guys coming in here. 00:36.640 --> 00:43.460 So , just by a show of hands real quick, who has not heard of the SPARTA work that we've been doing yet? 00:43.920 --> 00:45.120 Has not. 00:45.180 --> 00:45.760 Good. 00:45.760 --> 00:51.420 Alright, so we're going to spend a few minutes introing what it is and what it isn't. 00:51.420 --> 00:57.080 Just to, because I know I'll get this question, these slides are already available on the SPARTA website. 00:57.080 --> 01:04.360 So, on the bottom here, if you go to sparta.aerospace.org slash resources, there will be a PDF version of the slides there. 01:04.560 --> 01:10.740 As well as, there's links throughout the presentation for lots of resources, papers, things that we've been doing. 01:11.180 --> 01:26.680 So, I'm not going to touch too much on my background, but basically I've spent the last 10 years either trying to hack into ground systems, of operational systems, or hacking into like digital twins, like last year at DEF CON, as well as attacking kind of real spacecraft. 01:26.680 --> 01:32.760 So, I've got a background in this area, and it kind of fostered the work that I'm going to talk about today. 01:34.260 --> 01:40.140 So, what's the problem we're dealing with when we think about cyber and space and things? 01:40.140 --> 01:44.000 And we just saw the weather balloon discussion a minute ago. 01:44.640 --> 01:47.600 He was talking a little bit about authentication and encryption at the end. 01:47.640 --> 01:56.760 And one of the things you'll notice in the space domain, which is probably similar to what you just saw, is encryption authentication are kind of sometimes mainstays of the security approach. 01:57.380 --> 02:02.760 And unfortunately, that is sometimes the only security that's implemented on these systems. 02:02.760 --> 02:15.200 And what we're seeing with the difference in different attacks, you know, with supply chain, or very other attack vectors, insider threat, and things like that, we need to think outside the box. 02:15.200 --> 02:21.620 So , if encryption is like your only defense on a satellite, you're more vulnerable than you realize. 02:21.620 --> 02:25.200 And you need to think about how do we actually, you know, get above that. 02:25.340 --> 02:29.460 So , aerospace is a federally funded research and development center. 02:29.600 --> 02:34.400 We are basically a non-profit research institute for the government. 02:34.720 --> 02:38.220 And we're trying to, you know, lead advancement in this area. 02:38.320 --> 02:39.940 There's a lot of great things that are going on. 02:39.940 --> 02:42.460 You know, the Hackasat has been going on for a few years. 02:42.460 --> 02:46.180 And there's other entities and national labs in this space as well. 02:46.400 --> 02:57.660 So, one of the things we noticed a few years ago when we really got into this problem was there was a lot of articles, papers written that talked about cyber as a problem in space, or cyber as a threat to space. 02:57.680 --> 02:59.140 But it was a black box. 02:59.140 --> 03:02.980 It was basically a cyber boogeyman that would just get you and attack your space system. 03:02.980 --> 03:05.940 But no one ever decomposed the problem into something manageable. 03:05.940 --> 03:08.880 You can't solve a problem unless you kind of understand the problem. 03:08.880 --> 03:11.560 And just saying cyber will get you is not really helpful. 03:11.640 --> 03:20.880 So, what we've been doing is really have a concerted effort on our end is to push out information in the public domain, as well as in the government sector, to get the information out there. 03:20.880 --> 03:36.000 So, what we're seeing with the commercialization in space and the boom that's happening in all the startups, we can't necessarily keep all this security information and the way you need to protect the space system kind of behind lock and key. 03:36.000 --> 03:37.020 It needs to be shared. 03:37.020 --> 03:44.920 We need to benefit with what we've seen in other industries, from the industrial control system to just DEF CON in general. 03:44.920 --> 03:48.900 Getting the word out, getting people educated on the problem is a big thing. 03:48.940 --> 03:55.080 So, we've been working on identifying what we call the requirements, the countermeasures and things like that. 03:55.080 --> 04:02.020 And the way we view this is we want to use threats and or TTPs to help push the corrections. 04:02.180 --> 04:04.360 So, what we have in the federal space... 04:04.360 --> 04:06.480 You were here yesterday and saw the White House talk, right? 04:06.480 --> 04:10.620 We have a lot of compliance and legislation and various things. 04:10.620 --> 04:15.920 But sometimes we don't have the low-level details that we need to really mitigate the threat. 04:16.060 --> 04:19.220 So, that's just kind of what we're trying to do with this product and we'll talk all about it. 04:19.220 --> 04:29.700 So, we feel like if we can help define what those right requirements are, help define what are the critical controls and critical defenses you need to build into a space system, up front, we're going to be way better off. 04:30.040 --> 04:35.900 And one of the reasons we need to do that is, it's pretty apparent if you're not aware, but this is just an example. 04:36.420 --> 04:43.660 This slide kind of cut off at 2018, but you're seeing a kind of an increase in security incidents for space systems. 04:43.700 --> 04:50.580 So, you see the red line indicates the operational satellites and the blue bars are kind of the incidents that we're seeing. 04:50.580 --> 04:56.000 So, you're seeing a little bit of that correlation between the more we deploy out there and the more incidents. 04:56.000 --> 05:05.620 Now, this graph will probably get a little different looking when Starlink launches because there's thousands of satellites and you don't have that proportionality yet on the attack side. 05:05.620 --> 05:10.020 But this does show that correlation over from the 60s until now. 05:10.020 --> 05:13.440 We continue to get incidents as it relates. 05:14.200 --> 05:21.300 So, when we were looking at this problem, we were saying, okay, how do we decompose this to something manageable? 05:21.500 --> 05:24.240 And what we're trying to figure out is mission impact. 05:24.240 --> 05:29.180 What is the potential impact to a space system from a cyber perspective? 05:29.180 --> 05:40.140 And we back this up with Space Policy Directive 5, which basically says that you need to identify existing and anticipated threats and mitigate those. 05:40.660 --> 05:46.140 And it talks about it at the space system level, and the space system is ground, link, and vehicle. 05:46.320 --> 05:53.240 So, what we were really concerned about was, okay, let's look at the TTP, the threat action. 05:53.240 --> 06:02.540 So , yeah, there's actors out there, there's nation states, there's varying levels of people that are doing the things, but it doesn't help you that much of knowing who's doing it. 06:02.540 --> 06:05.840 It's what are they doing and how are they doing it is the important thing. 06:05.960 --> 06:11.940 And if we can really decompose that problem down, help people get educated on it, we're going to be in a much better situation. 06:12.320 --> 06:20.160 So, we said, all right, how would we document TTPs from a space cyber perspective? 06:20.160 --> 06:27.180 And we said, well, hmm, I think there's a framework out there that exists that does decomposition of TTPs. 06:27.320 --> 06:28.740 It's called the MITRE ATT&CK Framework. 06:29.080 --> 06:34.980 10 years from 2013 to 2023, 10 years running, it's kind of industry standard. 06:34.980 --> 06:40.060 So, we said, okay, call our friends at MITRE and say, hey, are you guys working on something similar? 06:40.260 --> 06:41.720 They said, no, not really. 06:41.780 --> 06:43.800 We said, all right, cool, let's do that. 06:43.800 --> 06:51.020 We're going to basically use your open source framework like ATT&CK, but we're going to kind of put our space spin on it. 06:51.020 --> 06:52.960 And then we're going to integrate a bunch of other information. 06:53.360 --> 07:01.020 So, we felt like cybersecurity matrices have been kind of the industry standard in the last 10 years as it relates to communicating this type of information. 07:01.100 --> 07:05.300 And we wanted to help fill that kind of critical knowledge gap on adversary behaviors. 07:05.460 --> 07:06.520 And that's what we did. 07:07.040 --> 07:15.500 And if you think about the way the MITRE ATT&CK Framework is currently built, and from a TTP perspective, it's really focused solely on the stuff that's on the ground. 07:15.500 --> 07:19.500 It doesn't really talk about how you would actually attack something like a space system. 07:19.800 --> 07:25.460 So, from that perspective, you want to make sure you kind of understand both, because the ground is an attack vector, obviously. 07:25.460 --> 07:30.220 So, from a TTP mitigation perspective, the MITRE ATT&CK Framework is where you want to go. 07:30.220 --> 07:41.860 But once you get to the point where you're no longer attacking a Windows or a Linux system, and you're trying to pivot and have some sort of impact on a space platform, that's when you kind of, what's called pivot, which is a concept published on MITRE as well, 07:41.860 --> 07:43.860 that pivot into something called Sparta. 07:44.840 --> 07:52.380 So, what we found out, you know, after doing this, talking to a lot of people, putting this together, it really is kind of the first of its kind of body of knowledge. 07:52.380 --> 08:00.760 Because one of the things we're really focused on is, some people get really squirrelly about saying, oh, well, why are you documenting all these TTPs for space? 08:01.020 --> 08:06.420 Well, that's just the why of why you need to implement the security that we think you need to implement. 08:06.420 --> 08:09.200 So, some people would say, well, why do I need to do X? 08:09.200 --> 08:14.940 Why do I need to put some sort of AI, machine learning, intrusion detection on a spacecraft? 08:15.400 --> 08:21.020 Well, if you can't articulate the threat, then they're not going to implement the countermeasure. 08:21.060 --> 08:26.000 So, for us, the means to implement the countermeasure is using the threat and TTP. 08:26.000 --> 08:27.600 And that's what we've really been focused on. 08:27.600 --> 08:33.200 So, every individual technique that we have has some sort of countermeasure tied to it. 08:33.200 --> 08:38.040 And that's really the benefit of what we're trying to publish with this work. 08:38.480 --> 08:41.120 And it's not just us. 08:41.120 --> 08:44.500 So, we've had some international collaboration as well. 08:44.520 --> 08:48.940 When we first launched Sparta, we got contributions from the European Space Agency. 08:49.120 --> 08:56.980 We got contributions from John Hopkins, some individuals at NASA here and there, and other agencies. 08:56.980 --> 09:02.100 So , this isn't just, hey, go listen to these few people at aerospace. 09:02.100 --> 09:04.720 It's been an international collaboration, and we want to continue that. 09:04.720 --> 09:10.840 Most recently, we started working with Cyber Inflight, and he's down here in the front. 09:10.840 --> 09:19.400 He's basically, they maintain a database of attacks against space systems, and we've integrated that information into Sparta. 09:19.620 --> 09:26.080 And we continue to extend invitations for anyone who wants to collaborate on this information. 09:26.080 --> 09:28.500 So , go to our contribute page. 09:28.500 --> 09:30.860 The list keeps growing as we go. 09:30.860 --> 09:34.140 So, if you're into this type of thing, please jump in. 09:34.140 --> 09:36.640 So , what would we actually do with Sparta? 09:36.640 --> 09:39.960 And this will kind of wrap up the introduction before we jump into the attack chain stuff. 09:40.120 --> 09:46.560 So, first and foremost, what we feel like Sparta is really meant for is the space system developers. 09:46.980 --> 09:55.440 So , I think it was Chad Luck, who was here yesterday, who worked for SpaceX, said a really good question to the White House OECD folks. 09:55.440 --> 09:58.640 It was like, well, how do we know what are the right controls to implement? 09:58.640 --> 10:14.340 And so, what we wanted to do is basically say, hey, we want to educate developers, engineers, people who build these systems, on what is the actual threat, TTP, that could impact their system, so they can implement the countermeasure. 10:14.340 --> 10:18.480 Because if they don't know how someone can impact their system, how are they going to know how to fix it? 10:18.760 --> 10:30.660 And so, what we've seen in the past with security in general, with like NIST, Cybersecurity Framework, or Risk Manager Framework, those are general guidance and abstracted levels of information. 10:30.980 --> 10:40.880 So, what we're trying to do is help bridge the gap between threat, TTP, to countermeasure, to even NIST controls, and some level of requirements, and we'll show you how that works. 10:40.880 --> 10:44.420 But basically, educate the developers, get the countermeasures implemented. 10:44.900 --> 10:48.980 Another one is people who are actually doing monitoring on the ground. 10:48.980 --> 10:58.600 So, some people actually, from a defensive cyber operation perspective, some people monitor their network for security impact. 10:58.880 --> 10:59.960 That's a novel concept, right? 10:59.960 --> 11:02.860 Monitor the network, look for, do the detect, and defend. 11:03.820 --> 11:20.020 So, if you're thinking about monitoring the ground infrastructure, and you have Splunk, or you have Elk Stack or something, those type of things can really understand TTPs from the MITRE perspective, because that's how they've been programmed. 11:20.200 --> 11:27.440 But now you have something that can educate you on what to look for, how to build dashboards from a TTNC perspective on space. 11:27.440 --> 11:40.300 So, that's something we feel like it can help with as well, because you see something go across the wire, if you don't have the context of how that can be bad, which Sparta helps you with, then you have a gap. 11:40.680 --> 11:57.900 Another thing we're seeing, and we've gotten some really good adoptions, if you're not familiar with the Space ISAC, the Space ISAC has a watch center that they just set up in March, and essentially what they're going to be doing is tagging all their threat intelligence reports with the appropriate Sparta TTPs as well as MITRE ATT&CK TTPs and things like that. 11:57.960 --> 12:07.380 So, we feel like from a threat intelligence, threat reporting, attack chain building, education of actual things out there, this can be used for that purpose. 12:08.320 --> 12:14.180 That's mostly a lot of the examples that we're going to talk through, is kind of this threat intelligence, attack chain reporting aspect of it. 12:14.180 --> 12:31.900 Assessments and tabletops, so if you're in the federal space, or I guess technically even the commercial space now, and you're responsible for some level of compliance audit through NIST 853, or now even ISO 27001, Sparta has basically all of our information counter-correlated to all those frameworks. 12:31.900 --> 12:40.140 So basically you can go in and say, if I don't implement ISO control 5.6, what space context does that have? 12:40.140 --> 12:43.680 What kind of gaps do I have? 12:43.680 --> 12:49.480 If I'm not implementing NIST control AC4, for instance, what does that mean in the space context? 12:49.480 --> 12:53.400 That's all information that's now in a tool and is publicly available. 12:54.320 --> 12:57.140 And one big thing, education and training. 12:57.140 --> 13:09.120 So we heard this yesterday during the ONCD discussion, was we have kind of a shortage of skilled people in this area, space cyber area. 13:09.120 --> 13:12.980 That's a problem in cyber in general, but it's even more so a problem in the space context. 13:13.300 --> 13:25.380 So what we did was, let's take virtually all the knowledge that we have in our collective heads, and let's put it in a repository, in a database, so that we can all kind of start from the same sheet of music. 13:25.640 --> 13:33.020 Instead of gatekeeping information and saying, oh well, I know how to attack a space system with cyber, so pay me a lot of money. 13:33.020 --> 13:34.520 That's not going to help the nation, right? 13:34.520 --> 13:40.360 So we want to get all the information out there as much as possible and raise that bar of what we call common knowledge. 13:41.200 --> 13:44.600 And like I said before, we continuously outsource this information. 13:47.940 --> 13:51.280 Crowdsource the information so we can get input from everyone. 13:51.280 --> 14:01.500 So you can always email sparta.arrow.org and we'll take new TTPs, new defenses, whatever it is that you can come up with, corrections or whatever. 14:02.260 --> 14:08.220 Okay, so we'll start talking about the meat of this, the attack chain development. 14:08.220 --> 14:14.580 So if you think about attacking a space system, it can be an attack chain, right? 14:14.580 --> 14:25.400 If you're thinking about, I'm going to do some sort of RF injection, RFI injection, or I'm going to basically attack the ground system and not only move through the network and whatever. 14:27.320 --> 14:29.980 Basically, Sparta can help you kind of do all those things. 14:30.240 --> 14:40.640 And one of the things to think about is attack chains and attack flows, different terminology for different people, but basically you can document kind of every step of the way. 14:40.640 --> 14:55.540 And that's important to break these things down is because, for instance, if you were to go look at the Viasat thing that happened in February, there were multiple stages through that attack chain where if certain countermeasures were implemented, it would have actually stopped it. 14:55.540 --> 15:02.520 So it's really important to understand not just, hey, this was the vulnerability at the end that got us, but how did they get from point A to point B? 15:02.520 --> 15:07.720 And having frameworks like ATT&CK, Sparta, and these other things like this really help understand that thing. 15:07.720 --> 15:11.300 And this is not to be confused with the cyber kill chain because these are different things. 15:11.780 --> 15:15.940 The cyber kill chain is a little more, you know, it's just phases. 15:15.940 --> 15:19.000 It's not really, and it's a sequential order of things. 15:19.840 --> 15:23.360 ATT&CK chains and Sparta and these other frameworks are a little bit different. 15:24.420 --> 15:28.420 It's more than just a sequence because it breaks things down differently. 15:28.500 --> 15:31.640 It gives you, talks about, all right, how do they achieve initial access? 15:31.640 --> 15:32.700 How do they escalate? 15:32.700 --> 15:34.420 How do they laterally move? 15:34.460 --> 15:35.680 Whatever it is. 15:35.680 --> 15:43.500 So one of the benefits of using something like Sparta to do this, so, you know, we've seen other frameworks that are out there. 15:43.500 --> 15:53.000 They basically, sometimes you have to go in one framework to see the TTPs and go to the next framework to see how you defend against those things. 15:53.060 --> 15:56.620 So what we're trying to do is actually aggregate all that together on one spot. 15:56.760 --> 16:08.540 So if you start using Sparta to build ATT&CK chains, we have tools that I'll show you that can help you get educated on what are the countermeasures and show you exactly how, what you need to do to kind of mitigate those all in one place. 16:08.660 --> 16:13.240 That way you don't have to go to like, you don't have to go read this 700 page NIST document. 16:13.240 --> 16:16.480 You don't have to go read, you know, a thousand controls from REV5. 16:16.480 --> 16:24.880 Or you don't have to go read the ISO standard to understand how all this interrelates together and helps you mitigate the cyber issues on your space system. 16:25.200 --> 16:29.700 So if we have time at the end, we'll show a little demonstration of those tools that can help. 16:29.780 --> 16:32.860 All right, so let's jump into a couple of ATT&CK chains just for the fun of it. 16:32.860 --> 16:41.780 So if you've seen the talks that I've done in previous aerospace villages, I did a replay ATT&CK, which is a very basic ATT&CK in the space context. 16:41.780 --> 16:47.140 Basically replaying the RF signal to call some sort of execution on a spacecraft. 16:47.360 --> 16:55.860 Last year, did a memory injection ATT&CK on a PowerPC 750, where you could corrupt the memory space and basically render the embedded processor useless. 16:56.100 --> 16:59.160 And then we'll do a couple of new things, just for the sake of doing new ones. 16:59.160 --> 17:03.800 And then I'll break down something from SISAT 2023. 17:03.800 --> 17:16.820 So if you are not aware, back in April of 2023, Thales Group, which is a European contractor, basically carried out a controlled cyber experiment on an operational asset at ESA. 17:16.820 --> 17:19.820 And we have documented kind of how that works. 17:20.920 --> 17:27.480 So if you think about building ATT&CK chains and what you need to know, I put some resources here for people to help you understand. 17:28.580 --> 17:31.800 I'm all about using what information is valuable. 17:32.180 --> 17:40.620 And it doesn't matter if SISA produced it, it doesn't matter if MITRE produced it, it doesn't matter if some European agency produced it. 17:40.620 --> 17:43.800 If it's valuable information, we're going to use it. 17:43.800 --> 17:52.020 So we're going to talk about... I have some screenshots from a DHS paper that talks about how to use the MITRE ATT&CK framework to kind of document ATT&CK chains. 17:52.020 --> 17:56.140 But that exact same concept applies to Sparta, because it's built the same way. 17:56.140 --> 18:02.940 So these are all the resources that you kind of have here at your disposal to kind of build ATT&CK chains and what that looks like. 18:02.940 --> 18:09.700 So the next one is... so this is a paper from SISA, and it's a good paper. 18:09.700 --> 18:19.580 So if you don't really understand, all right, this ATT&CK happened, or this ATT&CK chain, how do I build some sort of ATT&CK chain whenever there's an incident? 18:19.660 --> 18:23.560 So SISA wrote this really good paper that says, this is kind of how you do it. 18:23.560 --> 18:28.280 And they wrote it in the context of ATT&CK, but it applies to any of these frameworks that are built like this. 18:28.500 --> 18:34.560 So basically, you find the behavior, and then you can potentially put it into... 18:36.040 --> 18:37.800 ATT&CK has a thing called Navigator. 18:37.800 --> 18:39.220 Sparta has a thing called Navigator. 18:39.420 --> 18:44.160 And what you're trying to do is find the behavior, find the why, find the tactic. 18:44.160 --> 18:45.660 Are they trying to get initial access? 18:45.660 --> 18:46.660 Are they trying to execute? 18:46.660 --> 18:47.860 Are they trying to escalate? 18:48.060 --> 18:51.200 And then identify what's the technique or sub-technique underneath that. 18:51.200 --> 18:54.900 So it's pretty basic, but this is a good document to kind of help break that down. 18:54.900 --> 19:02.180 Because it helps you understand, all right, step one of any ATT&CK is initial access, right? 19:02.180 --> 19:03.380 So what's the behavior? 19:03.380 --> 19:04.780 How do they get initial access? 19:05.360 --> 19:08.980 And then it's, all right, once they got initial access, what did they actually do? 19:08.980 --> 19:11.060 How did they gain initial access? 19:11.220 --> 19:12.600 And then so forth and so on. 19:12.600 --> 19:18.700 And there's a lot of resources you can use within these tools to help you do that. 19:18.700 --> 19:25.440 So just wanted to throw this paper up there for people who aren't familiar with it and want to kind of dive into ATT&CK development. 19:25.640 --> 19:27.360 This is a good resource. 19:27.960 --> 19:33.820 And then once you have the technique identified, you can identify the sub-techniques and then you can kind of map all this stuff out. 19:33.960 --> 19:34.820 And it's all written here. 19:34.820 --> 19:36.200 I'm not going to kind of belabor the issue. 19:36.200 --> 19:45.280 But the takeaway here was it's a good 15, 20-page paper, 30-minute read to kind of really get accustomed to using these frameworks to kind of do ATT&CK development. 19:45.280 --> 19:49.020 So let's move in to one simple ATT&CK chain. 19:49.020 --> 19:57.840 So this ATT&CK chain was basically done in 2020 at DEF CON, Aerospace Village, and it's on YouTube. 19:57.840 --> 20:01.700 But this happened prior to Sparta, right? 20:01.700 --> 20:05.400 Sparta was something that we built and deployed in 2022 in October. 20:05.820 --> 20:17.320 So the reason I'm bringing this up is basically think about how beneficial it would be if we retrospectively went through and looked at all the past incidents that we had, right? 20:17.320 --> 20:24.400 And then we started rewriting them, these reports, or redoing the analysis with these frameworks in mind from an ATT&CK chain perspective. 20:24.520 --> 20:26.820 Because what does that allow you to do, right? 20:26.820 --> 20:28.280 Over time, you're going to trend. 20:28.280 --> 20:30.580 You're going to see what's the most prevalent TTPs that are out there. 20:30.580 --> 20:34.040 So what is the most highest risk area that we're at? 20:34.040 --> 20:43.880 And this is why working with CyberInFlight was such a good thing for us because they've already done all this analysis of a hundred and some different attacks that have happened. 20:43.960 --> 20:48.940 And then we work together and basically come up with a translation mapping of what they had versus Sparta. 20:48.940 --> 20:57.200 So now we actually do have some level of trend over the last 15 years of what are the most prevalent TTPs from a space perspective that are out there. 20:57.420 --> 20:59.120 So this is just very simple. 20:59.640 --> 21:01.840 I'm not going to dive into too much. 21:01.840 --> 21:10.580 But basically, from an ATT&CK chain perspective for a replay, you record the RF, you replay it, and then it causes some sort of impact. 21:10.780 --> 21:15.940 So this is what it would look like, and this is just some screenshots from that demonstration in 2020. 21:16.000 --> 21:23.440 Basically, we've done eavesdropping, the TTP of eavesdropping, as the RF signal was being transmitted, or in our case, a simulated RF signal. 21:24.380 --> 21:30.700 And once it went up there, you could see the command counters in the top right corner. 21:30.700 --> 21:31.540 They're at 1. 21:31.800 --> 21:34.180 We replay the traffic, they go to 2. 21:34.180 --> 21:35.740 Not that impressive, right? 21:35.920 --> 21:39.500 A counter went from 1 to 2, so it's not that big of a deal. 21:39.820 --> 21:49.240 So then, in that demonstration, what we did was, all right, let's basically leverage the fact that this replay works, and let's modify the bits that get sent and cause a different action. 21:49.320 --> 22:01.540 So we recorded the actual action of a command, just a basic ping no-op command, but then we manipulated the data packets and then re-sent it again, and then caused some sort of reset failure on the vehicle. 22:01.540 --> 22:04.560 And this is what the thing would look like. 22:04.620 --> 22:17.240 And this is why I'm advocating for doing things like this, because this is a very basic attack, so people generally know how to prevent replay attacks, encryption authentication, basic principles. 22:17.400 --> 22:30.800 But the concept is, if you throw these things in Sparta from a TTP perspective, you immediately get feedback in the tool that says, oh, these things in the green, these are the countermeasures you should consider implementing to mitigate that thing. 22:32.300 --> 22:40.140 And then you can kind of pick from there, like it'll give you a list of ones that you want, and then you pick the ones that are most applicable for your attack chain, or what you're trying to do. 22:40.620 --> 22:42.060 This is the one from last year. 22:42.580 --> 22:43.880 This is a memory injection. 22:44.240 --> 23:01.620 So basically, similar thing, you do a bunch of reconnaissance, you've got to figure out the memory layout and a bunch of things like that, and then you've got to actually get your initial access, which in this case was through the ground system, to send the packet to the simulator to cause the effect. 23:01.980 --> 23:16.580 So from this attack chain, the way this works is basically, this specific one requires a lot of reconnaissance, because you basically have to do some sort of inspection of the memory layout and the memory contents and how that works. 23:17.160 --> 23:23.920 But in this case, all we really did was review the documentation and the fault management. 23:23.920 --> 23:40.060 So if you're into the space world, and you're wanting to learn how to really attack a spacecraft, just go read the ICDs and the fault management documents, because it is just full of juicy data that says, don't do this, it'll crash. 23:40.120 --> 23:41.480 So as a hacker, what are you going to do? 23:41.480 --> 23:42.700 You're going to do that, right? 23:44.640 --> 23:54.300 So I bring that up because some people don't really understand or realize, from a space perspective, how critical what I would say that reconnaissance step is in the design information. 23:54.460 --> 24:05.420 So if you've seen any reports over the past 20 years, their adversaries are basically eating their lunch from an exfiltration perspective. 24:05.740 --> 24:12.520 It is a huge issue to get your design artifacts, especially your fault management and your software, exfiled. 24:12.520 --> 24:17.920 Because that can be the first, that's the pre-attack, that's the first step to generate things. 24:17.920 --> 24:21.600 You're not just going to be able to send a signal and have an impact, right? 24:21.600 --> 24:24.140 You have to know what kind of signal you need to do. 24:24.140 --> 24:25.780 All that's in the design docs. 24:25.780 --> 24:27.740 So the reconnaissance is extremely important. 24:28.000 --> 24:30.300 And make sure you keep that stuff under close hold. 24:30.300 --> 24:31.960 It's very important to do that. 24:31.980 --> 24:36.980 So this was just some screenshots of showing, you know, of the attack chain. 24:37.040 --> 24:57.600 It's nothing crazy, but basically what we did, and you can watch that video from last year on YouTube, but basically we figured out a way to construct a packet, a CCSDS ring, and send that CCSDS ring through the front-end processor to the vehicle to basically cause the denial of disruption. 24:57.600 --> 25:07.860 So what we did was come up with the right contents of the frame, shoot it across, and then you see the segfault, basically, in the PowerPC, which killed the system. 25:08.020 --> 25:09.420 So why does that matter? 25:09.420 --> 25:11.140 Why is it important to break that down? 25:11.140 --> 25:22.580 Very similarly, you break down those TTPs, Sparta tells you which countermeasures you need to implement to mitigate it, and then you can pick out which ones you want and then go from there. 25:22.980 --> 25:24.340 And you kind of see that on the right. 25:24.340 --> 25:25.940 Those are NIST controls. 25:25.980 --> 25:30.660 It's an eye chart from here, but when you get these charts, you'll see how that works and how we type. 25:31.220 --> 25:32.380 Here's another thing. 25:32.380 --> 25:35.880 So this is another example of, like, design artifacts. 25:35.880 --> 25:40.880 So this is a very basic attack on NASA's core flight system, which is open source. 25:41.120 --> 25:49.560 So if you go on GitHub and you look at their individual design artifacts and how that system works, it tells you this is how the system works. 25:49.560 --> 25:58.220 And the way it does is, like, in this example, it's like, oh, every time our flight software starts, we run this basic thing called a relative time sequence. 25:58.440 --> 25:59.920 Relative time sequence one. 26:00.100 --> 26:10.020 So if you're a bad guy, you're like, oh, well, every time the thing runs, it's just going to run this, basically this script, you know, while I'll just inject in there and see what happens. 26:10.160 --> 26:13.160 So that's what we did in this specific attack, right? 26:13.160 --> 26:23.540 So we were simulating a supply chain attack in this example just to kind of show, hey, this can be, you know, some people think of, like, a supply chain attack as being, like, something super sophisticated. 26:24.000 --> 26:25.400 This is one example. 26:25.400 --> 26:30.800 This is just one line in a C file that's buried down into the flight software. 26:30.860 --> 26:36.380 And static code analysis isn't going to find it because it's basically, it's a legitimate command. 26:36.480 --> 26:44.480 So if you think about space, to me, some of our biggest vulnerabilities in space is more so using the system against itself. 26:44.480 --> 26:50.600 So it's not, in my opinion, it's not, oh, a buffer overflow on the satellite. 26:50.820 --> 26:53.000 Those do exist, and those could be impactful. 26:53.000 --> 26:56.180 But it's more so of actually just using the system against itself. 26:56.180 --> 27:00.180 It's a cyber-physical system, and there's a lot of trust between the ground and the spacecraft. 27:00.180 --> 27:02.780 So you tell it to do something, it's just going to do it. 27:02.780 --> 27:08.340 And it's not really built from the perspective that says, oh, I'm going to attack myself against some sort of intrusion. 27:08.520 --> 27:12.560 Yet, that's why the countermeasures that we have in our system are important. 27:13.200 --> 27:17.100 So all I did in this demonstration in attack chain was something pretty basic. 27:17.160 --> 27:27.900 Was basically injected through the supply chain in this example, and said, all right, look, I want to basically tell this thing to reboot after like 60 seconds. 27:28.420 --> 27:37.540 So basically, if this was real, right, you would put this one line of code in, and then every time the system boots, 60 seconds later, it reboots. 27:37.640 --> 27:39.520 And then it just reboots, and then it just reboots. 27:39.520 --> 27:44.640 So you never actually can kind of get going until you figure out kind of what happened. 27:46.180 --> 27:50.080 Similarly, put the attack chain, countermeasures, go from there. 27:50.240 --> 27:52.640 So here's another one. 27:52.640 --> 27:55.700 So there's some CubeSats, obviously, that are out here. 27:55.700 --> 27:58.160 There's the Moonlighter thing that's going on out there. 27:58.340 --> 28:04.020 And I hear this sometimes, and I heard this in Europe, in that SciSat. 28:04.020 --> 28:17.140 I was kind of surprised, because they were talking about how, well, even to this day, a lot of the CubeSats, these smaller academic things, aren't implementing, some of them aren't doing any encryption, and some are maybe barely doing authentication. 28:17.420 --> 28:20.820 And it's like, well, some of these CubeSats actually have maneuverability. 28:20.820 --> 28:22.280 They have reaction wheels, right? 28:22.280 --> 28:30.760 So if you don't have basic protections on these things, like authentication and encryption, it's very easy to do bad things. 28:30.760 --> 28:35.180 So this is just an example of kind of showing an attack chain and how that would work, right? 28:35.180 --> 28:37.460 You do some recon, right? 28:37.460 --> 28:40.400 You got to get the design information to kind of know what it looks like. 28:40.500 --> 28:46.960 But once you kind of get that command database, so this is another thing that people talk about in the context of space, right? 28:46.960 --> 28:51.060 There's the design artifacts, but there's these command dictionaries. 28:51.220 --> 28:59.840 So one of the things that some people don't realize is a lot of times they use the same command dictionaries in the lab environments that they use in operations. 28:59.840 --> 29:01.680 They don't make changes, right? 29:01.680 --> 29:07.960 So people think, oh yeah, well, my command database is under lock and key in this operational system. 29:07.960 --> 29:13.940 But for the two years you were developing it, it was just on some guy's laptop that anybody could get access to. 29:13.940 --> 29:15.820 So it's not really that hard to get this information. 29:15.820 --> 29:17.180 People need to realize that. 29:17.500 --> 29:27.480 So this example basically just analyzed what the command structure looked like in the CCSDS frame, and then pushed this value to it. 29:27.780 --> 29:31.260 And then what you get is... 29:32.240 --> 29:33.120 Let's see. 29:33.120 --> 29:34.300 It might just play. 29:35.620 --> 29:36.200 Oh. 29:41.100 --> 29:41.940 Yeah. 29:41.940 --> 29:56.620 So this is pretty basic, but basically all it is, it's, you know, the kubectl and then all of a sudden you shoot the wrong type of command because the encryption is not working right and it just starts in a freefall tumble because you... 29:56.620 --> 30:03.640 Actually, it wasn't like, oh look, we sent a buffer overflow to this thing and it corrupted the memory and did something crazy. 30:03.660 --> 30:04.000 No. 30:04.000 --> 30:11.520 You just told it, hey, increase your factor of your momentum on your reaction wheel by a hundred times and it'll do it. 30:11.520 --> 30:13.700 Because this is like, not set up to not do that. 30:14.080 --> 30:29.680 So that's some of the important stuff that people need to understand and realize that these systems need to be built with less trust and, you know, I don't like to use the term zero trust necessarily, but the tenets of zero trust make sense in the context of space, 30:29.680 --> 30:30.120 right? 30:30.120 --> 30:35.820 Segmentation, least privilege, don't just do anything the ground says because the ground says to do it. 30:35.820 --> 30:37.580 It's very important to do that. 30:37.760 --> 30:45.680 And if you were to model out these attack chains in something like Sparta and you get the countermeasures, you'll be able to figure out what you need to do. 30:45.760 --> 30:49.620 So what I did was basically took these four attack chains that we built. 30:49.620 --> 30:55.540 So you think about, if you're building a system and your people say, you should do threat modeling against your system. 30:55.580 --> 30:58.580 Well, this is kind of a macro level of threat modeling to an extent. 30:58.580 --> 31:08.420 So I took these four attack chains that, you know, let's all make believe that this is one system and not like four different simulators. 31:08.840 --> 31:18.180 So I modeled out these attack chains in Sparta and then I basically said, all right, these are the things that I care about or that I think is most likely to happen on my system. 31:18.300 --> 31:22.080 Sparta will shoot out the countermeasures and then you can pick out the ones you want. 31:22.220 --> 31:34.040 So something you can do in Sparta is export everything in Excel because if you're an engineer in this room who doesn't love Excel and so we've made everything in Excel exportable so people can do all their data transforms they want in Excel. 31:34.400 --> 31:45.520 So basically, map out the attack chain, dump it to Excel, you can start pulling out all the countermeasures, miscontrols, you can even get down to the shell statement requirements if you want. 31:45.880 --> 31:50.640 So we have a couple hundred shell statement requirements that are implemented in Sparta as well. 31:50.640 --> 31:53.620 We're going to increase that number over the next year. 31:53.620 --> 31:55.760 So keep in tune for that. 31:55.760 --> 31:57.300 And we're continuously pushing out releases. 31:57.300 --> 31:58.380 We pushed out one this week. 31:58.380 --> 32:01.680 And I'll show you a few features if I have time of what that looks like. 32:03.180 --> 32:09.560 So if you were to put those four things in there, the countermeasures would light up, you can pull out the information in Excel. 32:10.340 --> 32:17.400 It'll show you the countermeasure name, it'll show you what miscontrol, it'll show you sample shell statements, all that stuff. 32:18.820 --> 32:23.840 This is kind of the importance is trying to answer that question that was asked yesterday. 32:23.840 --> 32:27.440 It was like, what are those important controls and why? 32:27.660 --> 32:36.340 And if you do attack chain development or you do threat modeling, you can in using these type of tools, you can get to that control list. 32:36.340 --> 32:45.560 It's not, hey listen, because some compliance exercise told me that I'm a moderate level impact, so let's go from there. 32:45.880 --> 32:50.700 This allows you to do threat modeling to an extent and generate those critical controls. 32:52.440 --> 32:59.080 The last thing here to kind of go through is this thing, the operational hacking thing that happened. 32:59.200 --> 33:05.880 So basically, this took place in April, sponsored by ESA, and it was performed by Thales Group. 33:06.000 --> 33:10.000 And it mimics a little bit what we're seeing with HackASet 4 over there to an extent. 33:10.000 --> 33:13.020 It's a controlled cyber experiment basically is what it is. 33:13.240 --> 33:22.080 So what we did was we said, okay, even though this is a contrived cyber exercise, let's analyze it like it was a real attack. 33:22.180 --> 33:42.140 So we said, alright, let's look at what this Thales did and let's break it down in the context of Sparta because what we had, when this first went in the news in April, we had customers coming to us and saying, well, what do we need to do to protect ourselves against what just happened there? 33:42.540 --> 33:51.240 And so I was like, well, one easy way to do that is actually just, alright, let's do the analysis, throw it in Sparta, spit out the countermeasures and say, does this make sense? 33:51.240 --> 33:53.820 And it actually worked out the way we thought it would. 33:53.920 --> 33:59.900 So we wrote a long article on Medium already and the link's in the charts, you can go read it, but we'll do just a little snippet of it. 34:00.200 --> 34:09.200 So one of the things that's interesting about Opsat when they did this event is Opsat's designed as an experimentation platform. 34:09.260 --> 34:17.600 So what that means is its mission is for the user community to upload software to it to do science. 34:17.980 --> 34:22.800 So if you think from a cyber perspective, initial access is basically granted at that point, right? 34:22.800 --> 34:29.080 Because the whole point of the experiment is you write code to put on this vehicle and they actually run it for you. 34:29.180 --> 34:40.600 So that provides an interesting attack vector because you don't have to do all the getting into the ground or get up through the RF leak or whatever, like, hey, here, put your software on here. 34:40.660 --> 34:47.440 But they have security things that they look through to see if the software is malicious. 34:47.620 --> 34:54.660 So the whole point of this attack was, you know, after initial access was granted, what next? 34:54.940 --> 35:02.340 So researchers were given the access to the payload to execute software, which is the design, but they get, like, low privilege access, right? 35:02.340 --> 35:06.400 So what would a user do if you're a malicious user? 35:06.400 --> 35:11.060 You're trying to escape the sandbox you're in, escalate, move, and do whatever. 35:11.060 --> 35:12.740 So that's exactly what they did. 35:13.440 --> 35:24.980 And what I did when I did the analysis is basically say, hey, listen, hey, if they weren't granted initial access, these are some of the TTPs that they would have to use to actually make that, you know, happen in real life. 35:24.980 --> 35:27.040 But in this case, initial access was granted. 35:27.460 --> 35:32.160 So what they did was the inject was a kind of a simulated supply chain injection. 35:32.320 --> 35:41.260 So what they did was, all right, they're permitted to actually upload software to the vehicle and their security check's done. 35:42.880 --> 35:48.040 So they'll basically, you know, I don't know exactly what they do, but I think they just run some static code analysis against it, right? 35:48.200 --> 35:49.140 Or whatever. 35:50.680 --> 35:53.520 Or analyze it for malware or something. 35:53.560 --> 35:56.820 What they did was basically they just injected their own vulnerability into the software. 35:56.820 --> 36:03.960 So they wrote unsecured code on purpose so that then they could just exploit their own code to get the escalation they needed to get. 36:03.960 --> 36:04.900 So that's what they did. 36:04.900 --> 36:09.420 So they injected a vulnerability into the software that they knew about and knew how to do it. 36:09.420 --> 36:11.840 And it was just a basic Java deserialization vulnerability. 36:11.840 --> 36:14.200 So it wasn't like super anything crazy in advance. 36:14.440 --> 36:19.140 And what that allowed them to do was execute basically shellcode on the system. 36:19.840 --> 36:24.300 And this specific offset has CAN bus. 36:24.480 --> 36:32.460 So if you know anything about 1553 or CAN bus, no segmentation, no security, really. 36:32.460 --> 36:40.040 So what they were able to do was execute, just send data across the CAN bus to laterally move across the thing. 36:40.220 --> 36:46.220 And you'll see links and these are all links to TTPs that are in Sparta as we did the mapping. 36:46.220 --> 36:50.960 And then they were able to get some sort of persistence through injection in the Java library. 36:51.040 --> 36:53.820 And then they basically modified the imagery coming down. 36:54.020 --> 36:57.900 So it's pretty interesting to kind of watch. 36:58.360 --> 37:03.060 So we wrote this article and we did this analysis so we could answer this next question. 37:03.680 --> 37:04.940 There's the link. 37:05.220 --> 37:08.720 Like I said, all these charts are on Sparta's website already so you can grab them. 37:08.780 --> 37:12.640 So this was the attack chain that they came up with, or attack flow, right? 37:12.640 --> 37:16.580 They evaded the detection by injecting their own vulnerability. 37:16.840 --> 37:24.520 They used the CAN bus to laterally move and they established a backdoor through Java library injections and they modified the imagery coming down. 37:25.260 --> 37:33.360 So what we said was, you know, Thales when they demonstrated this event, you know, this was the slide that they put up. 37:33.360 --> 37:35.460 Well, here's how you mitigate this risk. 37:35.460 --> 37:45.200 And it was like I looked at that and I was like, okay that's, I mean, that's none of it's wrong, but it's not super, super helpful from a detailed granularity perspective. 37:45.200 --> 37:49.120 And we wanted, our customers wanted to know, what exactly do I do? 37:49.220 --> 37:52.780 It would be like oh yeah, just do supply chain risk management. 37:52.780 --> 37:53.800 That'll solve your problem. 37:53.860 --> 37:56.300 It's like, well, I need to know, like, what can we do? 37:56.300 --> 37:59.320 So we threw all this stuff in the navigator tool. 37:59.540 --> 38:06.800 We dumped all the countermeasures in there and then basically said, oh look, this actually works. 38:06.960 --> 38:13.600 If you would have done proper analysis on the ground using these methods, you'd have probably caught that before it went up. 38:13.880 --> 38:21.680 If they got past that security using the fits and depth, if you actually had some level of segmentation on the canvas they wouldn't have been able to move. 38:21.740 --> 38:26.240 If you weren't running everything as root, they wouldn't have been able to escalate. 38:26.240 --> 38:32.380 If you actually were looking for some sort of onboard malicious activity using intrusion detection, you probably would have found it. 38:32.440 --> 38:41.720 So it was a good validation of that whole concept of like, alright, take an attack chain, throw it in a tool, dump out the countermeasures and go from there. 38:41.720 --> 38:47.060 So basically what we did in the article was show look, these are the TTPs they used. 38:47.060 --> 38:48.920 These are the countermeasures at the steps. 38:48.920 --> 38:56.000 If you were implementing using the fits and depth as a concept, you can see where you can mitigate this attack from that perspective. 38:56.900 --> 39:00.020 So what are some takeaways from this presentation I hope you got? 39:00.020 --> 39:05.940 So countermeasures can be deployed anywhere to disrupt and degrade steps on the attack chain. 39:06.820 --> 39:13.140 You really need to understand the importance of reconnaissance and resource development because it's usually a precursor to any attack. 39:13.240 --> 39:23.000 Basically using that cyber and flight data, 60% of the things that they had analyzed had all been basically reconnaissance, early stages of attacks. 39:23.260 --> 39:25.900 Or, conversely, maybe that was the attack. 39:25.900 --> 39:27.400 It was exfiltration. 39:27.520 --> 39:34.380 So you never know because there maybe hasn't been a carry on, a second phase of that attack chain, but it's just something to consider. 39:35.900 --> 39:45.420 For you think about attacks that are focused on the space segment, initial access can be difficult and probably the most difficult if you're using proper authentication and encryption. 39:45.600 --> 39:58.920 But I feel like with the prevalence of supply chain, the history we've seen with insider threat, getting access to a ground system, now a lot of our ground systems are going cloud, it's more interconnected, so getting access to the ground is a lot easier than it used to be. 39:59.060 --> 40:02.420 I think the likelihood is increasing that these are going to happen. 40:03.940 --> 40:15.520 And once initial access is granted, it's really I personally feel like our space vehicles aren't really resilient against basic execution, escalation, lateral movement types of things. 40:15.520 --> 40:31.880 Because we're not doing proper segmentation, we don't have least privilege, everything runs root, there's no monitoring, a lot of times there's not secure boot, digital signatures aren't a thing, so it's like all this basic stuff that we know is actually good in an embedded systems world, 40:31.880 --> 40:33.140 we're not doing it. 40:33.200 --> 40:36.040 And we would be a lot better off if we did that. 40:37.480 --> 40:51.340 And something that I don't want people to take away from some of these attack chains in this presentation, or what's going on with Moonlighter across the wall here, or what happened in SySat, yes, these are contrived experiments. 40:51.340 --> 40:53.920 But that's how we advance. 40:53.920 --> 40:56.380 We actually need to test these theories out. 40:57.040 --> 41:03.000 What we've seen with the Sparta work as far as, all the things that we've seen, we went back to HackAsset 3. 41:03.260 --> 41:14.480 We've actually analyzed all three HackAssets at this point, SySat, our own research, and basically we've covered every TTP that's been used already. 41:14.480 --> 41:18.880 My biggest thing is we've got to be able to protect against the no-knowns. 41:18.880 --> 41:22.140 We've got to know how to protect ourselves against things that we know can happen. 41:23.400 --> 41:28.820 Everybody wants to say, well, there's a big zero-day crazy vulnerability, and gets all excited about it. 41:28.820 --> 41:31.220 But it's like, we aren't even doing some of the basics. 41:31.220 --> 41:33.460 So let's get the basics done. 41:33.460 --> 41:34.800 Let's take care of the no-knowns. 41:34.800 --> 41:40.060 Things like Sparta, things like ATT&CK, can really help tell us what the no-knowns are so that we can actually mitigate those. 41:40.060 --> 41:44.120 Then we can maybe pivot and focus to some of the more harder things to solve. 41:47.120 --> 41:48.000 Let's see... 41:48.000 --> 41:51.440 I've already said this, but space vehicles must be able to protect itself. 41:52.400 --> 41:55.180 Some people say zero-trust in space. 41:55.220 --> 41:59.220 So if I was to say, what does zero-trust mean in space? 41:59.220 --> 42:06.700 Well, in the context of one space vehicle, these are the countermeasures that you can easily pull out of Sparta that kind of support the zero-trust concept. 42:07.800 --> 42:16.400 I think I've already shown a little bit of this type of slide, but basically if you throw in ATT&CK chains, you can dump out data on countermeasures. 42:16.680 --> 42:19.160 You've seen several of those demonstrations at this point. 42:20.420 --> 42:22.780 This is a chart that will be in here. 42:22.780 --> 42:31.340 There's all sorts of articles, blogs, some coverage from CyberScoop and Dark Reading and CyberWire. 42:32.760 --> 42:35.640 There's a lot of good information that's already out there. 42:36.540 --> 42:40.340 Congressional testimony, that link might be on there too, I don't know. 42:40.340 --> 42:44.740 I linked a lot of papers in here and resources. 42:45.780 --> 42:50.860 This top link is actually Indiana University is putting together a space cybersecurity digital badge program. 42:50.860 --> 42:53.880 If you want to go check that out, you can go to that URL. 42:53.960 --> 42:57.640 All the past presentations, all these papers are all listed here. 42:57.660 --> 42:59.080 Like I said, it's on the website. 42:59.500 --> 43:00.580 You can go from there. 43:01.040 --> 43:03.560 The one thing I wanted to do is 43:10.400 --> 43:18.020 hopefully real quick I think I should have some time. 43:18.300 --> 43:22.880 In preparation for DEF CON, we basically Oh, I'm not showing that screen. 43:23.360 --> 43:25.200 How do I show this screen there? 43:25.380 --> 43:26.140 Can you do that? 43:26.140 --> 43:26.640 No? 43:26.700 --> 43:27.280 Okay. 43:29.200 --> 43:33.440 One of the things that you I sent out a notice to a lot of people on the list. 43:33.500 --> 43:38.940 If you go to Sparta today, we launched a new release yesterday, two days ago. 43:39.400 --> 43:44.040 One of the big things that we did is ISO 27,000. 43:44.040 --> 43:50.580 So we had a lot of European customers asking for how do the countermeasures, how does Sparta actually interrelate with the ISO standard? 43:50.660 --> 43:51.760 So that's now out there. 43:51.760 --> 43:56.000 But I think the biggest thing we did, we kept having this question come up. 43:56.000 --> 44:00.180 We said, hey, you have 150 TTPs in here. 44:00.180 --> 44:03.120 How do I know which ones are the ones that I need to worry about the most? 44:03.680 --> 44:05.620 Which ones will impact me the most? 44:05.700 --> 44:10.340 So what we did was we used the threat model that we published two or three years ago. 44:10.340 --> 44:14.120 And we went through and did a risk analysis of every single TTP that we had. 44:14.120 --> 44:16.540 And we rated it on a 5 by 5 risk matrix. 44:16.760 --> 44:27.740 So now you can go into Sparta and you can see if you're basically which ones are high in the red of the top right quadrant of a risk cube and on down the list. 44:28.020 --> 44:32.380 And we based that on the threat model and a bunch of analysis that we did. 44:32.380 --> 44:36.460 So you can go in there, just precursor some of the things. 44:37.200 --> 44:43.480 Jamming, high on the list, supply chain, software, firmware corruption, high on the list, things like that. 44:44.140 --> 44:50.600 If you go there, there's a blog on Medium that talks all about it, so go out there and give that a read if you can. 44:51.060 --> 44:55.320 But with that, I think I'll take a question or two if there's a minute or two. 44:55.320 --> 44:57.740 It looks like there's probably five minutes. 44:57.740 --> 44:59.900 So any questions at this point? 45:01.240 --> 45:01.860 No. 45:08.860 --> 45:12.180 So the question was, are we getting logs or correlations? 45:12.180 --> 45:13.480 No, we're not. 45:13.480 --> 45:16.820 Just like MITRE ATT&CK and stuff like that, we don't get logs or anything. 45:16.820 --> 45:25.720 What we do get is we continually work with partners across the world now that give us references of things. 45:25.720 --> 45:32.760 Like if there's a new experiment that's happened or when Hack Sat 4 is over, we'll analyze all those TTPs and that'll get filled in. 45:32.760 --> 45:38.640 So what you will notice, in every TTP that we have in there, at the bottom there's a thing called references. 45:38.860 --> 45:50.360 So if there's some article, blog, tweet, something that has some level of assurance that's accurate, there'll be a reference in there that says this is kind of where we pulled it from. 45:50.620 --> 45:53.340 So it's not like a real-time log perspective. 45:53.340 --> 45:54.020 Sir? 45:54.240 --> 45:58.750 Do you analyze the data yourself 46:03.190 --> 46:03.750 ? 46:03.970 --> 46:04.810 Oh , okay. 46:04.810 --> 46:12.150 Yeah, so the question is, do we counteranalyze the countermeasures with mission objectives? 46:12.150 --> 46:21.250 So SPARTA and things like that are mostly, it's agnostic of the mission because it's a generic tool, not with context of the mission. 46:21.330 --> 46:30.990 So what you would need to do, which is basically throw your TTPs or get your countermeasure list and then you as the user have to counteract that. 46:30.990 --> 46:36.910 So for instance, something that might be on our list that says you should put onboard intrusion detection on your spacecraft. 46:37.030 --> 46:38.250 Not a lot of people may do that. 46:38.250 --> 46:42.270 They may not have the size, weight, power, compute to do it or the tech to do it. 46:42.270 --> 46:44.170 So you're saying, well, I don't have that tech. 46:44.170 --> 46:44.690 Can't do that. 46:44.690 --> 46:45.970 What's something else I could do? 46:45.970 --> 46:55.550 So what we're trying to do is give you a laundry list of potential countermeasures that could make sense for you and then you have to kind of down select based on your mission profile. 46:55.550 --> 47:04.010 So what we did do though, in that published, the RISC-Q publication, we basically created a three-tier system in there. 47:04.010 --> 47:05.590 It's basically high, medium, low. 47:05.590 --> 47:16.330 So we said if you're a high criticality system, you know, military, intelligence, whatever, or national critical infrastructure, you're in that high category. 47:16.330 --> 47:20.630 Medium category, you're doing weather, civil space, maybe commercial. 47:20.830 --> 47:26.470 Low category is basically academic research, that type of thing. 47:26.470 --> 47:42.250 So what that did was basically create a different bucket structure for like, as an academic researcher, you know, this TTV RISC is at this level for me, but it's going to be different for a critical infrastructure item. 47:42.250 --> 47:51.670 So that's kind of how we're approaching it, and this is our first go at publishing that type of information , and we're going to hopefully get feedback from the community . 47:51.950 --> 47:52.770 Is there another question? 47:52.770 --> 47:54.770 I think there's time for one more maybe. 47:59.000 --> 48:00.500 Screw me, I'll repeat it. 48:07.050 --> 48:07.630 Yeah . 48:11.170 --> 48:16.070 So yeah, the question is any noticeable differences with ISO 27000. 48:16.370 --> 48:18.990 And we put this on the website. 48:18.990 --> 48:25.390 So one of the things we did was, because ISO is a paid standard, there's very limited things you can publish about it, right? 48:25.390 --> 48:35.710 So what we did do, late July , and NIST published an updated translation of NIST 853 -05 to ISO 27000 -2022. 48:35.790 --> 48:43.810 So what we did was use that correlation between NIST and ISO and publish, because we don't want to publish things that we don't own, right? 48:43.810 --> 48:49.370 So what I would say in a generic sense, ISO is a higher level of abstraction than NIST, right? 48:49.370 --> 49:03.190 So there are let's say a thousand NIST controls that are in the 853 database, and I don't know the number, I'm making this up, 200 of those have some sort of translation to ISO. 49:03.190 --> 49:09.710 So that immediately tells you right off the bat, it's like, NIST is a much more thorough analysis of that. 49:09.710 --> 49:14.590 And I said 27000 really meant more so for organizational information security stuff. 49:14.730 --> 49:23.850 I don't think it's really, it's not really meant for space systems, but I think on a European side, I think a lot of their laws or regulation all ties to ISO. 49:23.890 --> 49:36.950 So it was kind of trying to bridge that gap to show, alright, well, how can we use we want to advance the state of practice on the space vehicle, but we only, the only hammer we have is ISO, so let's help them get to that point, was kind of there. 49:37.750 --> 49:38.350 One more. 49:38.350 --> 49:38.910 We're good? 49:38.930 --> 49:39.590 One more. 49:39.870 --> 49:40.410 Okay. 49:40.410 --> 49:40.770 We're good. 49:40.770 --> 49:41.070 Thanks. 49:41.070 --> 49:43.350 I'll be around until Monday. 49:43.510 --> 49:44.410 Come find me. 49:44.530 --> 49:46.210 All my contact info is on the slides. 49:46.210 --> 49:47.290 Go to the Sparta website. 49:47.530 --> 49:48.050 Thanks for coming. 49:48.050 --> 49:48.850 I appreciate it.