Space Universities Network & Industry Case Study
This is a Space Universities Network industry case study, one of a series of case studies aimed at providing teaching exercises for UK higher education. This case study has been developed by Space Universities Network in collaboration with GardPass Space and the University of Bristol.
Securing the Final Frontier
An Interactive Investigation into Space Cybersecurity
Mission Background 🌍
Frontier-9 is an Earth-observation satellite that supports environmental monitoring and disaster response by collecting imagery of regions affected by wildfires, flooding, and other natural hazards. The spacecraft is operated through a network of ground stations responsible for receiving telemetry and transmitting commands.
During a routine communication pass, operators detect suspicious activity within the mission environment. Although Frontier-9 appears healthy and continues to communicate normally, mission personnel are concerned that the ground station may have been compromised. At present, there is no evidence that unauthorised commands have reached the spacecraft.
You are a cybersecurity analyst supporting the Frontier-9 mission. The operations team has asked you to investigate the incident, determine what happened, assess the potential impact on mission operations, and recommend appropriate security controls.
- 1. Understanding the Ground Station 📡
- 2. The First Alert 🚨
- 3. Building the Timeline 🕒
- 4. What was Compromised? ⚠️
- 5. Defend the Mission 🛡️
- 6. Incident Response 🕹️
- 7. Mission Impact Assessment 🎯
- Extension: Applying SPARTA 🧩
- Mission Debrief 📋
2. The First Alert 🚨
You begin gathering evidence and interview the operations team.
The operations team reports:
- The satellite is responding normally.
- Telemetry is being received successfully.
- The antenna is tracking correctly.
- Several unauthorised commands appear in the command queue (not yet sent).
- One of these commands could place the satellite into safe mode.
| The source of the commands is unknown. |
|
List of Evidence
Click on a component to see more evidence.
📡 Antenna / RF Front End
Signal quality is normal. No evidence of jamming, interference, or unexpected radio transmissions.
📻 Modem / SDR
Telemetry packets are being decoded correctly. No signal-processing errors are observed.
🔭 TT&C Software
The unauthorised commands were submitted through the normal TT&C interface rather than injected directly into the communications link.
🕹️ Mission Control System (MCS)
A new privileged account named Mission_Admin2 was created overnight.
🖥️ Operator Workstation
An operator opened a phishing email requesting a password reset earlier that morning.
Knowledge Check
1. Based on the available evidence, which explanation can be ruled out most confidently?
Check Answer
2. Which one of the following findings provides the strongest evidence that the incident may involve unauthorised access to the ground station?
Check Answer
3. Building the Timeline 🕒
The operations team believes that the attacker initially gained access using credentials stolen from one of the mission operators. Additional logs were recovered from the Mission Control System (MCS). These follow below:
08:15:22 op_shift03 DOWNLOAD_ARCHIVE mission_telemetry_archive SUCCESS
08:42:09 op_shift03 CREATE_ACCOUNT Mission_Admin2 SUCCESS
08:43:31 op_shift03 ASSIGN_ROLE Mission_Admin2 Command_Admin SUCCESS
08:47:04 Mission_Admin2 MODIFY_QUEUE command_queue SUCCESS
08:49:18 Mission_Admin2 TRANSMIT_COMMAND SAFE_MODE_CMD REJECTED
The operator responsible for the shift states that they did not access the system during this period.
Challenge
Using the evidence collected and recovered logs, arrange the following events into the most likely attack sequence (up to down).
-
Telemetry Access
-
Privilege Escalation
-
Phishing Email
-
Unauthorised Commands
-
Credential Theft
-
Mission Impact
Knowledge Check
1. At which stage could the attack have been stopped most effectively?
Check Answer
2. Which stage would be most difficult for operators to detect?
Check Answer
3. Which stage presents the greatest risk to mission operations?
Check Answer
4. What was Compromised? ⚠️
You have now reconstructed the most likely attack path and its timeline.
Although the attacker did not gain direct access to Frontier-9, several security weaknesses were exploited throughout the incident.
Cybersecurity incidents can compromise different security properties:
By identifying which of these were affected at each stage of the attack, investigators can better understand the consequences of the incident and the risks posed to mission operations.
Challenge
Your task is to determine which security property was affected at each stage of the attack.
Match each observation to the security property most affected.
Security Property
|
Observation
|
|
Authentication
|
Mission telemetry archive downloaded
|
|
Authorisation
|
Safe mode activation
|
|
Confidentiality
|
Stolen operator credentials
|
|
Integrity
|
Missing or unreliable audit records
|
|
Availability
|
Unauthorised spacecraft commands
|
|
Non-repudiation
|
Privileged account creation
|
|
|
5. Defend the Mission 🛡️
The investigation is complete.
You have concluded that the incident most likely began with a phishing email, which allowed an attacker to gain access to the mission systems using stolen credentials. Although the attack was detected before any commands reached the satellite, the incident has raised concerns about the security of the mission's ground systems.
Following the investigation, the mission director has approved funding for only two cybersecurity improvements this year.
Unfortunately, budget and staffing constraints mean that not every security recommendation can be implemented immediately.
Challenge
Your task is to recommend which two improvements should be prioritised. Choose carefully.
Available Controls:
| Control | Description |
| Multi-Factor Authentication (MFA) | Additional verification during login |
| Command Approval Workflow | Two operators must approve critical commands |
| RF Encryption | Protects communications over the radio link |
| Security Awareness Training | Reduces phishing success |
| Additional Antenna | Improves communications redundancy |
| Digitally Signed Audit Logs | Provides reliable evidence of who performed actions |
Check Answer
MFA addresses the most likely entry point into the system by making stolen credentials significantly more difficult to use.
Command Approval Workflow reduces the operational impact of a compromise by ensuring that critical spacecraft commands require approval from multiple authorised operators.
Together, they provide two complementary layers of defence: Prevent Access + Limit Damage.
This combination addresses both:
- the likely root cause of the incident (stolen credentials)
- the most serious operational consequence (unauthorised spacecraft commands)
It may be argued that phishing was the initial attack vector. This combination focuses on preventing credential compromise through both technical controls, such as MFA, and human-focused controls, such as security awareness training.
Others who prioritise mission assurance may select controls that focus on limiting mission impact and improving accountability.
While this combination may not prevent the initial compromise, it can help reduce the consequences of unauthorised actions and improve post-incident investigation.
6. Incident Response 🕹️
Although the unauthorised command was intercepted, investigators cannot determine whether the attacker still has access to the Mission Control System (MCS).
The next communication pass is scheduled to begin in 15 minutes, providing the next opportunity to communicate with Frontier-9 and receive mission data. The mission team must decide how to balance spacecraft security, mission operations, and ongoing investigation of the incident.
Challenge
You can only perform two actions immediately. Which two actions would you prioritise and why?
| Action |
| Disable the suspicious account |
| Shut down command transmission |
| Reset all operator passwords |
| Monitor the suspicious account |
| Preserve evidence for investigation |
| Continue normal operations |
Check Answer
These actions prioritise protecting the spacecraft by limiting the attacker's ability to access mission systems or transmit additional commands.
These actions attempt to balance security and mission continuity. The suspected attacker loses access, but planned mission activities can continue while the investigation proceeds.
These actions prioritise understanding the attacker's behaviour and collecting evidence before taking action. However, they also increase the risk that the attacker remains active.
7. Mission Impact Assessment 🎯
Suppose the unauthorised command had succeeded.
Then the satellite would:
- Enter safe mode
- Suspend payload operations
- Stop collecting environmental monitoring imagery
- Require operator intervention
Challenge
Which statement best explains why this incident is significant?
| Check Answer |
Extension: Applying SPARTA 🧩
The attack path reconstructed in this exercise resembles a real-world space cyber attack chain.
↓
Credential Theft
↓
Telemetry Access
↓
Privilege Escalation
↓
Unauthorised Commands
↓
Mission Impact*
While this scenario is fictional, the techniques used by the attacker are based on methods that have been observed in real-world cyber incidents. A good example is the 2022 Viasat KA-SAT cyberattack, in which the ground segment was compromised and legitimate commands were executed without authorisation, resulting in service disruption for tens of thousands of customers [1]. Security analysts often use threat frameworks to describe these techniques, understand how attacks progress, and identify appropriate defensive measures.
SPARTA, which stands for Space Attack Research and Tactic Analysis, is a framework developed by The Aerospace Corporation based in the US to help organisations analyse cyber threats to space systems. It contains a catalogue of attack techniques and countermeasures that may be relevant to this scenario. Many of these techniques can affect one or more of the security properties discussed earlier in this exercise.
SPARTA Investigation |
Using SPARTA (⬅️ click for the link), investigate how the attack described in this case study might be represented using real-world space cybersecurity techniques and countermeasures.
There may be multiple valid answers. Focus on selecting techniques and countermeasures that can be reasonably justified using the attack path reconstructed during the investigation.
| 1. | Identify one technique that relates to the attack path. |
| 2. | Identify one SPARTA countermeasure for the technique. |
| 3. |
Explain whether the countermeasure would:
|
| 4. | Identify one additional SPARTA result that could plausibly occur if the attacker continued the intrusion. |
| 5. | Select one of the security properties below that this result would affect. |
Example Answer
| Question | Answer |
| 1 | IA-0007.02 – Malicious Commanding via Valid GS. This relates to the attack path because the attacker uses compromised access to the ground segment to send unauthorised commands that may appear legitimate to the spacecraft. |
| 2 | CM0054 – Two-Person Rule. This requires two authorised people to approve or carry out command-level actions, especially for critical spacecraft commands. |
| 3 | This would mainly prevent the attack. If the attacker only stole one user's credentials, they would still need a second authorised person to approve the command. It could also help detect suspicious activity if an unexpected approval request appeared. it is however unlikely to limit the attack's impact. |
| 4 | EXF-0007 – Compromised Ground System. If the attacker continued the intrusion, they could use access to the ground system to copy telemetry, command logs, procedure records, or mission data. |
| 5 | The main affected security property would be confidentiality, because the attacker could access or extract mission information without authorisation. |
Reference
[1] Viasat, Inc., “KA-SAT Network cyber attack overview,” Viasat, Mar. 30, 2022. [Online]. Available:
https://www.viasat.com/perspectives/corporate/2022/ka-sat-network-cyber-attack-overview/.
[Accessed: Jun. 17, 2026].
Mission Debrief 📋
Throughout this interactive exercise, you investigated suspicious activity affecting the Frontier-9 mission and reconstructed how a cyber attack could progress from a phishing email to potential mission impact.
The attack followed a common pattern:
↓
Credential Theft
↓
Telemetry Access
↓
Privilege Escalation
↓
Unauthorised Commands
↓
Mission Impact
Although the attacker never directly compromised the satellite, they were still able to affect mission operations by targeting the people, software, and systems responsible for operating it.
During the investigation, you:
- Examined the role of key ground station components.
- Analysed evidence collected from multiple systems.
- Reconstructed an attack timeline.
- Analysed how different security properties were affected by a cyber attack.
- Evaluated security controls and mitigation strategies.
- Considered incident response trade-offs.
- Assessed the potential impact on mission success.
- Explored how SPARTA can be used to analyse space cyber threats (if you completed the extension).
A key lesson from this exercise is that cybersecurity in the space domain extends beyond the spacecraft itself. Weaknesses in any part of this chain can ultimately affect mission success. As space systems become increasingly connected and software-driven, cybersecurity is becoming an essential part of mission design, operation, and assurance.
Interested?
Check out the SPARTA User Guide for a more detailed overview of the framework's capabilities.
Prepared by Pok Rui Lai in 2026.