I’m very proud to have been choosen as ethicallyHackingspace(eHs)® h4ck32n4u75™ (Hackernauts) Community Member. Thank’s to William Ferguson for this distinction.
The “h4ck32n4u75™” badge, pronounced “hackernauts,” symbolizes a dedication to evaluating, safeguarding, and pioneering avant-garde solutions for conventional and emerging hashtag#space platforms.
As a proud member of the ethicallyHackingspace(eHs)® Community, this badge underscores a commitment to ethical hacking practices and innovation in space technology.
I’m very proud to officially joined the innovative ethicallyHackingspace(eHs)® community and to become one of the enthusiastic community h4ck32n4u75™ (Hackernauts).
I did an analysis of the Viasat#cyber attack with the MITRE ATT&CK® framework (more here) and I wrote a post mortem investigation. More here
My work about the analysis of the Viasat#Cyber Attack has been quoted and highlighted by Tim Fowler in his presentation at BSIDES St. Louis 2023 hacking education conference (more here).
I was interviewed by The Interstellar Integrity (i2) magazine released by ethicallyHackingspace(eHs)® about my passion for space and cybersecurity. Thank’s to William Ferguson. More here
I followed 2 online Aerospace Cybersecurity workshops given by Angelina Tsuboi :
– Drone & UAV Hacking workshop
– Satellite Hacking class.
I’d like to thank everyone who follows me and supports me. I hope all the information I share with you is interesting and helps you keep up to date and learn more.
Stay tuned because 2024 promises to be just as incredible. See you next year. Until then, take care.
At the beginning of April 2020, I successfully passed the CCSK certification (Certificate of Cloud Security Knowledge). Now, I give you some tips and tricks below so that you can also pass the exam on the first try.
What is CCSK certification ?
The CCSK is a “vendor neutral” certification on Cloud security. It is considered to be the “state of the art” in Cloud security. It was created in 2010 by the CSA (Cloud Security Alliance) an organization that pilots the STAR (Security, Trust & Assurance Registry) program whose objective is to provide and maintain a high standard to enable independent auditing bodies to deliver certification levels to the different Clouds on the market.
The CSA regularly publishes reference documents to promote best practices in Cloud security. The CSA also leads and organizes several working groups and research projects in which member companies can participate to advance the field of Cloud security.
How do I register for the CCSK exam ?
The CCSK is a distance exam (not in an exam centre), online on the web and “open book” (study material available). Unlike most other certifications, the CCSK, in its past version (currently v4), is valid for life. It is not necessary to prove any experience to take the exam. There is also no annual payment or CPE (Continuous Professional Education) to maintain certification.
The cost of the exam is $395 USD and allows for two attempts. If you pass the first attempt, you will be able to use the second attempt when a new version of the CCSK is released. An exam token is valid for two years from the date of purchase.
The current CCSK v4 version exists since December 1, 2017. It underwent an important update compared to the previous version v3 including the latest technologies of the Cloud (micro-service, serverless, container, SDN, Big Data, IOT, etc …).
The exam is composed of 60 questions to be completed in 90 minutes. Questions are of type A/B/C/D/E or True/False. Once the exam is launched, it is not possible to pause it. The minimum score to pass the exam and obtain certification is 80%. The pass rate for the exam is 62%.
You get your result immediately at the end of the exam with your overall score and by domain to identify your areas for improvement. If you pass the exam, you can even download your certificate. However, answers to questions are not provided in order to preserve the integrity of the exam. There is an exam preparation kit and FAQs available for download from the CSA website : https://ccsk.cloudsecurityalliance.org/en/faq
Together, these 3 documents represent the CBK (Common Body of Knowledge) of the CCSK exam. They are:
CSA Security Guidance for Critical Areas of Focus in Cloud Computing v4
CSA Cloud Controls Matrix (CCM)
ENISA (European Network and Information Security Agency) Whitepaper Cloud Computing: Benefits, Risks and Recommendations for Information Security
The 14 areas of the CSA Security Guidance are as follows:
Domaine 01 : Cloud Computing Concepts and Architectures
Domaine 02 : Governance and Enterprise Risk Management
Domaine 03 : Legal Issues, Contracts and Electronic Discovery
Domaine 04 : Compliance and Audit Management
Domaine 05 : Information Governance
Domaine 06 : Management Plane and Business Continuity
Domaine 07 : Infrastructure Security
Domaine 08 : Virtualization and Containers
Domaine 09 : Incident Response
Domaine 10 : Application Security
Domaine 11 : Data Security and Encryption
Domaine 12 : Identity, Entitlement, and Access Management
Domaine 13 : Security as a Service
Domaine 14 : Related Technologies
The important concepts of the ENISA document are as follows:
- Information Security
- Isolation failure
- Economic Denial of Service
- Licensing Risks
- VM hopping
- Five key legal issues common across all scenarios
- Top security risks in ENISA research
- OVF
- Underlying vulnerability in Loss of Governance
- User provisioning vulnerability
- Risk concerns of a cloud provider being acquired
- Security benefits of cloud
- Risks R.1 – R.35 and underlying vulnerabilities
- Data controller versus data processor definitions
- In IaaS, who is responsible for guest systems monitoring
The important elements of the CSA CCM (Cloud Controls Matrix) to be aware of are the following:
By far the most important document is the CSA Security Guidance. It alone accounts for 87% of the questions in the exam. The CSA CCM represents 7% and the ENISA report 6%.
The exact distribution of the number of questions per domain is as follows:
My preparation for the CCSK
My study material
In addition to the official study material, I also used two other documents that helped me a lot:
« CSA Guidance Summary in 6O minutes » : This is a very good 25-page summary of the CSA Security Guidance v4. I printed it for review and had it in PDF during the exam.
« CCSK All-in-One Exam Guide » from Graham Thompson : It is an excellent review guide that I highly recommend and which Peter van Eijk with whom I had the honour of discussing. Peter is also an official trainer for the CSA CCSK and I believe he is involved in the drafting committee for the questions. The book reviews with very good explanations the 14 areas of the CBK but also the ENISA and CCM document. At the end of each chapter, there is a “Chapter Review” which includes the essentials for the review. The book also includes 150 test questions which are very similar to those of the exam in terms of wording and difficulty. And finally, at the end of the book, there is a code to access an online simulator on the TotalSem site which contains 200 additional questions. (link to the book on Amazon)
I’d also like to mention Verisafe’s CCSK e-learning course with Boris Motylewski. I’ve had very good feedback on Boris’s training courses, and he’s very committed to helping you pass your certifications (CISSP, CCSK and soon CCSP). Two videos explain what CCSK is, the benefits of CCSK and how to become CCSK in 30 days. The example slides demonstrate the quality of the course material. They helped me understand the 35 risks identified by ENISA, the 11 major risks, the 23 assets potentially impacted (including those most at risk) and the top 7 vulnerabilities.
My study Plan
My passage of the CCSK certification was done under rather special conditions. Indeed, initially, I had to pass the CCSP (Certified Cloud Security Professional) certification. I had been revising the material for two and a half months when I learned that my exam in early April was postponed due to the Covid-19 pandemic that was circulating in France. In order to make the most of my study and the acquired knowledge, I decided around mid-March to try the CCSK exam which is done online and at home. The lock down period was convenient for the revisions: 1 hour in the morning before starting to telework (replacing travel time), 1 hour during the lunch break and 2 to 3 hours in the late afternoon, after the telework day and in the evening.
In two and a half weeks, I managed to read all the official study material plus additional study material. I tried more than 700 test questions (those in the book but also others on Udemy or found on the internet). I made about 100 Flashcards. I have viewed some videos on Youtube. I mostly took a lot of personal notes. As far as I’m concerned, it’s essential because it allows me to make last minute revisions but it also allows me to better remember everything I learn.
#04 : Write your personal notes (it’s better to memorize)
#05 : Understand well how cloud impact processes
#06 : Understand benefits but also concerns of the cloud for each domain
#07 : Practice test questions to test your understanding and to train to use the material
#08 : Create a study plan and follow it
#09 : Read the question twice, read the answers and read again the question
#10 : Be careful about specific technology answers: They are oftenthe wrong answer
#11 : Identify answers that are not cloud specific : They are often the wrong answer
#12 : Eliminate answers that are not related to the question
#13 : Always answer from a business perspective (Business drives Security)
#14 : Be careful with negative questions with NOT
#15 : Be careful with questions with words like “the MOST”, “the LEAST”, “IS”, “ARE”
#16 : If you don’t know the right answer, try to eliminate the bad anwers
#17 : Identify key words in the question to search within the material
#18 : Use and practice « Advanced Search » function in your PDF reader to search key phrases throughout all the material
#19 : Know the structure of the material to find quickly the relavant domain to each question
#20 : It’s more comfortable to use two screens during the exam
#21 : Use Google Translate (or other) to translate difficult words in your native language
#22 : Test and rehearse your method and logistics for the exam
#23 : If you failed, don’t use your 2nd attempt in the same day or same week
What is the difference between CCSK and CCSP certifications
CCSP is the “Certified Cloud Security Professional”. It is a certification that was created in 2015 jointly by CSA, the organization that created CCSK and (ISC)², the organization that created the very famous and sought-after CISSP certification.
Good luck and good studies to all. Keep in mind the following quote:
“In a journey it’s not the destination that counts but always the road travelled”
It is not the certification itself that is important but the knowledge you will acquire that will make you more competent. Certification is the icing on the cake or proof of the pudding.
Souvent on pense à Twitter pour réaliser sa veille sécu. Mais Linkedin reste une excellente source d’information dans le domaine du cyber. Je vous présente ci-dessous une liste de comptes Linkedin à suivre que j’ai sélectionnée pour la qualité de leurs posts et la pertinence des informations qu’ils diffusent. N’hésitez pas à me signaler en commentaires si vous en connaissez d’autres et qui pourraient compléter cette liste. Je vous invite à la diffuser très largement pour les faire connaitre et participer à votre niveau à la diffusion de l’information et de la culture cyber.
Martial Gervaise est le directeur Cyber Sécurité Adjoint du groupe Orange. C’est un passionné des technologies digitales et de leurs usages. Il publie régulièrement sur Linkedin des informations très pertinentes sur le thème de la cybersécurité et ses posts sont souvent très commentés et republiés.
Matthieu Garin est Senior Manager et responsable du développement commercial de la ligne de services cybersécurité chez Wavestone. Il conseille depuis plus de 10 ans les CISO sur leurs enjeux de cybersécurité principalement dans le secteur financier. Il a construit l’équipe CERT-W (ex CERT-Solucom) en charge de la réponse aux incidents de sécurité. Il se concentre actuellement sur l’impact des récentes innovations sur la sécurité (machine learning, IA, Blockchain, …) dans un objectif de construire de nouveaux modèles de sécurité. Ses publications sont toujours à la pointe de l’actualité et même souvent premier sur l’information. Matthieu va à l’essentiel avec un résumé pertinent et toujours bien mis en valeur visuellement pour être agréable à lire.
Damien Bancal est un expert en cybersécurité et journaliste spécialisé. Il travaille sur les sujets high-tech, cybercriminalité, cybersécurité depuis les années 90. Il est le fondateur du blog Zataz.com et du protocole d’alerte Zataz qui œuvre depuis des années dans le domaine de la cybersécurité. Il anime également une chronique « cybersécurité » lancée depuis septembre 2019 sur WEO TV, la télévision des Hauts-de-France. Il partage régulièrement des articles de son blog Zataz.com liés à l’actualité cyber dont les thèmes font souvent référence au RGPD, Data Breach, Ransomware, …
Gérôme Billois est associé cybersécurité chez Wavestone. Il est en charge du business et du développement international de l’offre globale de cybersécurité du cabinet. Il est membre du conseil d’administration du CLUSIF et du comité ISO chargé de la normalisation de la sécurité de l’information. Il est co-fondateur du Club27001 dédiée à la promotion de la norme ISO 27001. Il intervient régulièrement dans les médias pour parler de cybersécurité.
Brian Krebs est un professionnel de la sécurité. Il est l’auteur du site KrebsOnSecurity.com sur lequel il écrit quotidiennement des articles sur la sécurité de l’information et la cybercriminalité. Son principale objectif en tant que professionnel est de rendre les questions de sécurité informatique compréhensibles, intéressantes et opportunes auprès de ses lecteurs.
The Cyber Security Hub est un compte d’entreprise Linkedin anglais. Leurs publications sont très fréquentes (plusieurs fois par jour) et sont souvent accès sur des infographies, des guides, des ebook, …. D’après leur propos, ils visent à inciter les échanges et les discussions ainsi qu’à multiplier les conversations sur la cybersécurité afin d’améliorer la culture cyber. Ils visent à augmenter les compétences en sécurité et à élargir le bassin de compétences et de talents.
Les 3 comptes Cyber Security News, GBHackers On Cyber Security et Ethical Hackers Academy semblent être des comptes liés car on y retrouve à très peu de différence près les mêmes informations. GBHackers on Security se définit comme une plateforme en ligne sur la cybersécurité. Elle publie des tuto, des enquêtes, fait des recherches et des tests sur les applications. Cyber Security News se définit comme un canal indépendant de news cyber. Elle publie les dernières nouvelles sur les hackers, la cybercriminalité, les incidents de sécurité, les violations de sécurité, les vulnérabilités, les logiciels malveillants, …
On ne présente plus l’ANSSI, l’Agence Nationale de la Sécurité des Systèmes d’Information. C’est l’autorité nationale chargée d’assurer la sécurité des systèmes d’information de l’État et de contribuer à celle des opérateurs nationaux d’importance vitale (OIV). L’ANSSI apporte également ses conseils, son expertise et son assistance technique pour prévenir la menace et traiter les incidents portant atteinte à la sécurité du numérique. Son objectif est de promouvoir la confiance numérique ainsi que le développement de la filière de cybersécurité. Elle publie régulièrement des informations sur la prévention de la menace des études sur des modes d’attaques, des informations sur des mesures de protection. Ses guides sont largement diffusés auprès des différents publics sur la nécessaire protection des environnements numériques par la promotion de bonnes pratiques de cybersécurité et la diffusion de recommandations techniques et méthodologiques tout en participant au développement de la formation à la sécurité des systèmes d’information.
The Hacker News est la page linkedin du site thehackernews.com. Connu aussi sous le trigramme THN, The Hacker News se définit comme une plateforme d’information sur la cybersécurité réputée auprès des professionnels de la sécurité mais aussi des chercheurs, des hackers, des technologues et d’une façon générale des passionnés. Leurs posts présentent les dernières nouvelles en matière de cybersécurité et une couverture approfondie des tendances actuelles et futures en matière d’infosec.
J’aurais aimé suivre sur Linkedin les comptes ci-dessous mais ceux-ci n’y sont pas activement présents. Il reste Twitter pour les suivre : Korben, x0rz, SwitHack, Bruce Schneier, …
J’ai découvert, il y a un certain temps, le monde merveilleux des MOOCs. J’ai voulu découvrir de quoi il s’agissait en participant à des MOOC liés à la cybersécurité, mon domaine d’activité professionnelle et j’ai été agréablement surpris. J’ai découvert que ce support était très pédagogique et permettait de faire passer des messages clairs et synthétiques auprès du grand publique. Je recommande vivement ce support pour ceux qui veulent s’initier à un domaine, se former ou se tenir informer.
C’est pourquoi, j’ai décidé, à la demande générale (d’un certain Christophe), de créer cet article dans le but de rassembler l’ensemble des MOOCs, des cours et des formations disponibles en ligne dans le domaine de la cybersécurité et de la sécurité de l’information.
Si vous en connaissez d’autres, n’hésitez pas à commenter cet article pour que je puisse les rajouter. Et surtout, n’hésitez pas à partager cet article au plus grand nombre car il est important de rappeler que la sécurité est l’affaire de tous.
PS : tout jeu de mot est indépendant de ma propre volonté (se rapprocher du même Christophe pour en savoir plus)
Les MOOCs en ligne
MOOC de l’ANSSI (FR): Il s’agit d’un MOOC pour se former à la sécurité du numérique. Il rassemble l’ensemble des informations pour s’initier à la cybersécurité ou approfondir ses connaissances. Le MOOC est accessible gratuitement jusqu’au mois d’avril 2021. Le suivi intégral du MOOC vous fera bénéficier d’une attestation de réussite. https://secnumacademie.gouv.fr/
MOOC de la CNIL sur le RGPD (FR): Ce MOOC rassemble l’ensemble des informations pour s’initier au RGPD et comprendre les enjeux de la mise en conformité de son organisme. Le MOOC est gratuit et accessible jusqu’au mois de septembre 2021. En suivant le MOOC, vous pourrez obtenir une attestation. https://atelier-rgpd.cnil.fr/
MOOC de l’INRIA sur Protection de la vie privée dans le monde numérique (FR) : Ce MOOC élaboré par des chercheurs d’Inria, aborde la notion d’identité numérique et les problèmes de vie privée associés à l’usage des outils numériques. Apparemment, ce MOOC est clos depuis le 17 juin 2019. Il faut attendre qu’il soit de nouveau ouvert. https://www.fun-mooc.fr/courses/course-v1:inria+41015+session03/about
MOOC de l’INRIA – Code-Based Cryptography (US) : Il s’agit d’un MOOC élaboré par l’INRIA sur la cryptographie. Il présente l’état de l’art de la cryptographie. Il aborde les différents cryptosystèmes existants (symétrique, asymétrique), la théorie des codes, etc .. Ce MOOC date de 2016 mais il reste ouvert exceptionnellement. https://www.fun-mooc.fr/courses/course-v1:inria+41006+archiveouvert/about
MOOC de l’université de Bretagne – Défis et enjeux de la cybersécurité (FR) : Ce MOOC a pour but d’aborder les principaux aspects, tant sociétaux que techniques, de la cybersécurité. Apparemment, ce MOOC est clos depuis le 17 juin 2019. Il faut attendre qu’il soit de nouveau ouvert. https://www.fun-mooc.fr/courses/course-v1:ubs+160001+session01/about
MOOC du CNAM – Protection des données personnelles – le nouveau droit (FR) : Ce MOOC présente les règles applicables en matière de protection des données et de la vie privée en France et en Europe. Il permet de bénéficier d’une présentation actualisée de la nouvelle réglementation applicable. https://www.fun-mooc.fr/courses/course-v1:CNAM+01032+session02/about
AWS Security Fundamentals (US) : e-learning de 4h disponible gratuitement sur le site d’AWS Training. Ce cours aborde les fondamentaux de la sécurité ainsi que les solutions proposées par AWS afin de respecter les bonnes pratiques de sécurité (Merci Mostefa). https://www.aws.training/Details/Curriculum?id=10795
ENISA Cyber Security Training material (US) : L’ENISA, l’Agence Européenne pour la Cybersécurité, propose des ressources uniques de formation en Cybersécurité. Ce sont des ressources pédagogiques sur des sujets pointus et parfois souvent peu couverts. Ls ressources tournent essentiellement autour du CERT, du CSIRT et du forensic. Ces supports de formation permettent d’approfondir ses connaissances et de rester à la pointe des tendances et des meilleures pratiques en matière de sécurité de l’information. https://www.enisa.europa.eu/topics/training-and-exercises/trainings-for-cybersecurity-specialists/online-training-material
Udemy est une plate-forme d’apprentissage et d’enseignement en ligne qui propose des milliers de cours sur des centaines de thèmes. Udemy propose régulièrement toute l’année des promos sur les cours Cyber (à surveiller). En ce moment, la plupart sur à 10€. Voici le lien vers les cours de cybersécurité https://www.udemy.com/courses/search/?src=ukw&q=cyber%20s%C3%A9curit%C3%A9
Security Symposium
Security Symposium est un ensemble de vidéos sponsorisés par Intel et Red Hat qui couvrent principalmeent les aspects liés à la sécurisation des nouvelles technologies comme le conteneurs, l’automatisation de la sécurisation des plateformes et des tests de conformité, la gestion opérationnelle de la sécurité (patching,…), etc … A découvrir ici : https://www.brighttalk.com/summit/4551-security-symposium/
Fundamentally, Paul Szymanski and Jerry Drew remind us that–more than just simply a clash of weapons–all warfare manifests as a competition between human minds. The same holds true in the battle beyond in outer space.
The contests of space warfare will test the knowledge, experience, fears, beliefs, stamina, and will of the people, their military commanders, and their political leadership like never before.
It is thus essential to prepare for the military implications of wars that extend into space, to root space warfare in the military thought of the past, to adapt it to the needs of the future, and to complete its integration as an essential part of the Western way of war.
Beginning with the word “war” itself, Szymanski and Drew guide the reader through a comprehensive consideration of the levels of warfare as viewed through the eyes of experienced space warfare practitioners. They make relevant centuries-old terms of art, linking the Napoleonic thought of the past to the network-dependent wars of the future and explaining esoteric disciplines like orbital warfare and electromagnetic operations in a way that will appeal to both novices and veterans of the discipline.
In so doing, they expand upon the existing lexicon of war, instructing the reader on how to fight and win the coming war in space. Rich in symbology, illustrations, and historical examples, this book could not come at a more critical time for the security of the United States and its Allies.
Biographie des auteurs
Paul Szymanski and Jerry Drew – Source : Paul Szymanski’s Linkledin page
Paul Szymanski has 49 years of experience in all fields related to space control: policy, strategy, simulations, surveillance, survivability, threat assessment, long-range strategic planning, and command and control. In addition, he has a comprehensive experience base, having worked directly with multiple services (Air Force, Army, Navy, Marines), civilian agencies (NASA, DARPA, FEMA), and from the Pentagon (Secretary of the Air Force) to systems development (Space and Missile Systems Center – SMC/ASP/XRJ), technology development (Air Force Research Lab) to operational field test (China Lake Naval Test Center).
Jerry Drew is currently the chief of joint space training in the Department of Joint, Interagency, and Multinational Operations at the U.S. Army Command and General Staff College. He holds a Bachelor of Science in art, philosophy, and literature from the U.S. Military Academy and a Master of Science in astronautical engineering from the Naval Postgraduate School where his thesis work focused on applied robotic manipulation using small spacecraft.
In this article, we will explore if we can apply Zero Trust in space domain, for example in satellites or space missions, how and why ?
What is Zero Trust Architecture (ZTA)
The Zero Trust security model, coined by analyst firm Forrester Research, is a holistic approach to network security that mandates no user or machine should be implicitly trusted, either outside or inside of the network. The concept has evolved as a way to minimize cyber threats and data breaches by not granting automatic trust based on network location.
Understanding Zero Trust Principle and Architecture:
Zero Trust operates on the concept “Never Trust, Always Verify”. At its core, it’s designed to protect modern digital environments by leveraging network segmentation, preventing lateral movement, providing Layer 7 threat prevention, and including simplified granular user-access control.
In a Zero Trust architecture, security isn’t treated as a one-size-fits-all model. It aims to eliminate uncontrolled access to resources by assuming that a user, system, or device is potentially compromised, regardless of if they are inside or outside of the security perimeter.
Implementing Zero Trust includes but not limited to: Identify Sensitive Data, Micro-segmentation, Multi-factor Authentication (MFA), Real-time Monitoring and Analytics, User Access Control
Application & Scope:
Zero Trust can be applied to any IT environment, from on-premises data centers to public clouds, and from network to endpoints. This approach is highly effective in protecting users and data in today’s perimeter-less workplaces, where employees, contractors, and partners need to access applications from various locations, networks, and devices.
Importance & Future of Zero Trust:
The increasing complexity and fluidity of modern IT environments make traditional perimeter-based security models obsolete. Evolving security threats, remote workforce, digital transformations, cloud adoptions, and complex supply chains led to an increase in the number of digital touch-points that can serve as entry points for sophisticated cyberattacks.
Zero Trust’s focus on securing every access point draws a promising future for IT security. It emphasizes understanding the behavior of network users and devices, thereby enabling early detection and mitigation of potential threats. It offers greater visibility into network activities, lowers the risks of security breaches, and improves compliance by implementing granular data control.
From organizations looking to secure their remote workforces to businesses wanting to lock down their supply chains, Zero Trust is poised to become the new normal for cybersecurity. As entities come to grips with a ‘trust no one’ model, they will be better positioned to tackle the cybersecurity threats of the future.
Does Zero Trust apply to the space domain?
In theory, the Zero Trust model could feasibly be applied to the space domain. The fundamental principles of identity verification, least privilege access and real-time monitoring that define Zero Trust are universally important for any operational technology, including space missions or satellites.
Security in the space domain is critically important. Satellites and other space technology manage a wide range of sensitive data and information, from global positioning data to confidential national security information.
Why Apply Zero Trust in the Space Domain?
Protecting Sensitive Information: Considering the increasing cost and strategic importance of space systems, as well as the sensitivity of the data they handle, implementing a robust security posture like the Zero Trust model is crucial.
Remote Accessibility: Like many other systems in the digital age, space platforms are remotely accessed. Zero Trust principles don’t inherently trust any request for access, making it harder for an unauthorized user or a potential hostile actor to gain control.
Increased Cyber Threats: As technology advances, so does the sophistication of cyber threats. Applying Zero Trust principles can help protect against potential cyberattacks targeting space assets.
Implementing Zero Trust in Space Domain
For implementing Zero Trust in the space domain, we need to consider several elements:
Authentication: Implement stringent verification measures to corroborate the identities of all users and devices that interact with the system.
Encryption: As data travels from Earth to space and back again, it needs to be encrypted to protect against interception.
Monitoring & Analytics: It’s crucial to monitor network behavior and traffic patterns continuously. Anomalies or irregularities can indicate potential threats that require immediate attention.
Limited trust: Only provide access to systems and data that are absolutely necessary for each user or device.
What are the challenges applying Zero Trust in the Space Domain?
An interesting challenge here is the vast distance of space and the latency it imposes on operations. The implementation of Zero Trust will have to consider the time delay for authentications as well as a secure and efficient key exchange mechanism for encryption.
Thus, applying the principles of Zero Trust in the space domain offers an exciting opportunity in providing secure and reliable communications. While it presents its unique challenges, given the importance of assets in the space domain, the need for enhanced security measures is undeniable, and a Zero Trust model may be the best way forward.
The Cloud Security Alliance (CSA) is a non-profit organization that focuses on promoting best practices for securing cloud computing environments. It was established in 2008 and has since become a leading authority on cloud security, bringing together industry experts, companies, and government entities to address the challenges and concerns related to security in cloud computing.
The Cloud Security Alliance (CSA) announced the 15th november 2023, the launch of the Certificate of Competence in Zero Trust (CCZT), an authoritative zero-trust training and credential program claimed to be a first in the cybersecurity industry.
In this article, we will describe what the Cloud Security Alliance (CSA) is, then we will go back over the main principles of a Zero Trust Architecture (ZTA) in detail, and finally we will explain what the Certificate of Competence in Zero Trust (CCZT) is.
What is Cloud Security Alliance (CSA)
The primary goals of the Cloud Security Alliance include: Educating and Raising Awareness, Developing Best Practices, Research and Thought Leadership, Certifications and Programs, Collaboration, Advocacy.
The Cloud Security Alliance plays a crucial role in advancing the understanding and implementation of security in cloud computing. By providing resources, best practices, and fostering collaboration, CSA helps organizations navigate the complex landscape of cloud security, ultimately promoting a safer and more secure cloud computing environment for businesses and individuals alike.
What is Zero Trust Architecture (ZTA)
The Zero Trust security model, coined by analyst firm Forrester Research, is a holistic approach to network security that mandates no user or machine should be implicitly trusted, either outside or inside of the network. The concept has evolved as a way to minimize cyber threats and data breaches by not granting automatic trust based on network location.
Zero Trust Maturity Model Pillars from CISA
Understanding Zero Trust Principle and Architecture:
Zero Trust operates on the concept “Never Trust, Always Verify”. At its core, it’s designed to protect modern digital environments by leveraging network segmentation, preventing lateral movement, providing Layer 7 threat prevention, and including simplified granular user-access control.
In a Zero Trust architecture, security isn’t treated as a one-size-fits-all model. It aims to eliminate uncontrolled access to resources by assuming that a user, system, or device is potentially compromised, regardless of if they are inside or outside of the security perimeter.
Implementing Zero Trust includes but not limited to: Identify Sensitive Data, Micro-segmentation, Multi-factor Authentication (MFA), Real-time Monitoring and Analytics, User Access Control
Application & Scope:
Zero Trust can be applied to any IT environment, from on-premises data centers to public clouds, and from network to endpoints. This approach is highly effective in protecting users and data in today’s perimeter-less workplaces, where employees, contractors, and partners need to access applications from various locations, networks, and devices.
Core Zero Trust Logical Components from NIST Special Publication 800-207
Importance & Future of Zero Trust:
The increasing complexity and fluidity of modern IT environments make traditional perimeter-based security models obsolete. Evolving security threats, remote workforce, digital transformations, cloud adoptions, and complex supply chains led to an increase in the number of digital touch-points that can serve as entry points for sophisticated cyberattacks.
Zero Trust’s focus on securing every access point draws a promising future for IT security. It emphasizes understanding the behavior of network users and devices, thereby enabling early detection and mitigation of potential threats. It offers greater visibility into network activities, lowers the risks of security breaches, and improves compliance by implementing granular data control.
From organizations looking to secure their remote workforces to businesses wanting to lock down their supply chains, Zero Trust is poised to become the new normal for cybersecurity. As entities come to grips with a ‘trust no one’ model, they will be better positioned to tackle the cybersecurity threats of the future.
What is Certificate of Competence in Zero Trust (CCZT)
The Certificate of Competence in Zero Trust (CCZT) is the authoritative Zero Trust training and certificate that delivers the knowledge needed to understand the core concepts of Zero Trust. Developed by CSA, the trusted industry leader for cloud security certificates, the CCZT builds knowledge to drive the definition, implementation and management of Zero Trust over time.
Who is CCZT for?
With Zero Trust established as the future of information security, a Zero Trust based approach will inevitably become a requirement for organizations and a required skill for security professionals. Here are just a few examples of those who should prepare for this inevitability with the CCZT:
The C-Suite, managers, and decision makers to build a Zero Trust governance and risk posture
Security engineers, architects, analysts, and administrators to protect devices and build/ automate controls
Compliance managers to identify the key components of the Zero Trust Governance
Framework and how it supports an organization’s risk and compliance programs
What is the CCZT exam structure?
The CCZT is an open-book, online exam with 60 multiple choice questions covering six core areas of Zero Trust knowledge. Testers have two attempts to complete the exam in the allotted 90-minute timeframe and achieve a minimum passing score of 80%.
What does CCZT cover?
The CCZT evaluates an individual’s knowledge and expertise in these six areas of critical Zero Trust knowledge:
Are there required prerequisites?
There are no prerequisites required for the CCZT, however it is helpful to have your Certificate of Cloud Security Knowledge (CCSK) or a basic understanding of security fundamentals. Completing the ZTT is also highly recommended to prepare for the CCZT.
How do I prepare for the CCZT exam?
There are currently three options to prepare for the exam. Comprehensive CCZT Study Guides are included with the purchase of all CCZT exam tokens.
Study on your own. Use the free prep-kit to facilitate your independent learning style. The kit includes a CCZT knowledge guide, this FAQ, overview presentation, and authoritative sources to help you prepare.
Self-paced training online. If you need training flexible enough for your schedule and budget, self-paced online training may be a good fit. The CCZT is based on CSA’s Zero Trust Training (ZTT), an online course that delivers the fundamentals needed to understand the core concepts of Zero Trust covered in the exam.
Instructor-led training online. This option is good for organizations with tight travel budgets or individuals who prefer a more personal instruction. Learn remotely while still being able to interact with your instructor. Look for a course that fits your schedule.
What is the cost?
The CCZT exam, including study guides, costs $175 and is valid for two years from time of purchase. CCZT instructor-led training with exam and study guides is $1895. The ZTT online course, exam and study guides bundle can be purchased for $455. All listed pricing is confirmed for 2023 only. CSA corporate members qualify for special CCZT pricing and discounts are also available for group training.
Is a digital badge available?
Yes. A CCZT digital badge is issued upon successful completion of the exam. Leverage the CCZT digital badge on your social media channels and resume to showcase your knowledge and validate your expertise.
I’m pleased to announce that I have obtained a new certification: Kelley School of Business Executive Education Space Cybersecurity from Indiana University – Kelley School of Business !
I’m very proud to took part of this program dedicated to cybersecurity of space systems provided by the top-ranked Indiana University – Kelley School of Business.
I took part in this program on my own time and as an evening course.
As a cybersecurity professional and space passionate, my wish was to develop my knowledge and skills in order to better understand cybersecurity for space systems.
It was a 10-week synchronous teaching and interactive webinar series that will provide participants with in-depth understanding of the cyber threats to space systems and the tools to develop and implement effective strategies for managing cyber risks to space-based infrastructure.
The Kelley Space-Cybersecurity program is one of the first program in the United States, and indeed globally, to offer specialized focus on protecting the cybersecurity of space assets.
At the end of this program, I have now the capability to develop and implement effective strategies for managing cyber risks to space-based infrastructure. I also gained in-depth understanding of cyber threats, and how to manage related issues including supply chain security.
It was a great opportunity for me to explore cybersecurity challenges specific to space systems.
I would like to thank for creating this program:
Scott Shackelford JD, PhD as the JD Executive Director in the IU Center for Applied Cybersecurity Research; and Provost Professor in the Kelley School of Business – IU
Eytan Tepper as Visiting Assistant Professor & Director, Space Governance Lab at Indiana University Bloomington
I would like also to thank for their contribution and presentation:
Gregory Falco, LEED AP, Professor at the Cornell University
Henry Danielson, Professor at the California Polytechnic State University-San Luis Obispo
Brandon Bailey, cybersecurity senior project leader at The Aerospace Corporation
Nick Saunders, Chief Cybersecurity and Data Officer, Government Systems at Viasat
Scott Nelson, Senior Advisor Space-Cyber Nexus
Michael Campanelli, Aerospace Practice Manager – Worldwide Public Sector
In this paper, I choose to investigate the Viasat cyber attack that occurred on 24 February, 2022. First, I will summarize the chronology of events (Chapter 1). Then, I will try to critique the organization’s response to the cyber attack (Chapter 2). After that, I will suggest additional steps that could have been taken to further mitigate the impact moving forward (Chapter 3). Finally, I will think about what the attacked organization could have done beforehand to prevent the attack (Chapter 4).
Disclaimer, details and references
To do this analysis of the Viasat cyber attack, I used 3 articles, documents or papers detailed below:
First, I used the open-source intelligence (1) of the team composed by Nicolò Boschetti (Cornell University), Nathaniel Gordon (Johns Hopkins University) and Gregory Falco (Cornell University). In their open-source intelligence, they reconstructed the lifecycle of the attack. They specified that however, without first-hand knowledge of ViaSat’s systems, they cannot be certain about their hypothesis.
Viasat’s statement (2) on Wednesday, March 30th, 2022 provides a somewhat plausible but incomplete description of the attack. In a statement disseminated to journalists (3), Viasat confirmed the use of the AcidRain wiper in the February 24th attack against their modems.
At the DefCon 31, Mark Colaluca and Nick Saunders from Viasat presented a talk named Defending KA-SAT. During this talk, they argued not to believe everything that you can read on the internet. It’s often simply inaccurate. They told that there is no evidence or proof of the claims. There is no evidence of any compromise or tampering with Viasat modem software or firmware images and no evidence of any supply-chain interference. Regarding, the possibility that wiper-malware was deployed and erased the hard drives of the modems, they answered that modems don’t have hard drives.
1. Summary of chronology of events
The Ukrainian conflict shown the potential and temptation of targeting space assets during an armed conflict between two states. Telecommunications satellites are vital to both national security and the economy. But unfortunately, they are also increasingly vulnerable to cyber-attacks and increasingly targeted by malicious actors.
Regarding the Ukrainian conflict, one example is the cyber-attack on the Viasat satellite company.
The Viasat attack was a cyberattack on American communications company Viasat affecting their KA-SAT network, on 24 February, 2022. Thousands of Viasat modems got hacked by a deliberate cyber event. Thousands of customers in Europe, especially in Ukraine, have been without internet for a month since.
Viasat is an American communications company based in Carlsbad, California, with additional operations across the United States and worldwide. Viasat is a provider of high-speed satellite broadband services and secure networking systems covering military and commercial markets.
This attack began approximately one hour before Russia launched its major invasion of Ukraine. UK and US intelligence assesses that Russia was almost certainly responsible for the attack.
According to Viasat, the attacker used a poorly configured virtual private network appliance to gain access via internet to the trusted management part of the KA-SAT network.
The vulnerability used by the attackers is CVE-2018-13379, corresponding to a vulnerability in the Fortinet firewall discovered in 2019.
Once on the trusted management segment of the KA-SAT network, the attackers issued commands to select specific beam spots and then signal to the modems.
They overwrote part of the flash memory in modems, making them unable to access the network, but not permanently damaged. The satellite itself and its ground infrastructure were not directly affected.
With their open-source intelligence, the team [1] (Nicolò Boschetti, Nathaniel Gordon and Gregory Falco) schematized the entire attack lifecycle in the diagram below.
Figure 1 : The anatomy of the ViaSat attack broken into seven levels of escalation. From : Nicolò Boschetti (Cornell University) and Gregory Falco (Cornell University) – 2022
2. Criticism of the organization’s response to the cyber attack
ViaSat seems to be a company with dual-use satellites – satellites that can serve both civil and military. Presumably, Viasat was not prepared to be a military target in. I think that dual-use commercial space companies must be aware and prepared to be a military target in.
Viasat also appears to be a geographically dispersed organization. The ground segment of Viasat is called KA-SAT Network. Launched and owned by Eutelsat, the KA-SAT network was acquired by ViaSat in 2020. During the acquisition transition period, the management of the ground segment was still in the hands of the Eutelsat subsidiary Skylogic. Each subsidiary is responsible for different elements of the KA-SAT infrastructure.
This organizational complexity makes challenging to have homogenous security controls and the geographic dispersion of the organizations and their integration through corporate acquisition did not help with the managerial coordination of the attack response. When responding to the attack, there was an apparent lack of coordination of ViaSat, Eutelsat, and Skylogic.
3. Additional suggestions that could have been taken to further mitigate the impact moving forward
As additional steps that I can suggest is the need for an agile and software-enabled strategy to quickly respond to attacks. Indeed, the AcidRain wiper malware resulted in the development of a lot of inoperable modems. Shipping tens of thousands of modems is undoubtedly time-intensive and costly.
Given the critical nature of the satellite communication system, it is unacceptable for such a delay. Viasat need to deploy a better agile response to attack like the possibility to deploy a software update that was developed to restore access for users.
4. What the attacked organization could have done beforehand to prevent the attack
This attack is a concrete example of malicious operations carried out by a group of adversaries during a space-cyber war.
To combat cyber-attacks on space systems, states should adopt national policies to defend against threats to space-based assets and applications. This won’t prevent space-cyber hostilities, but it could provide protections against space-cyber threats.
Verification and Validation before launch are also very important. Space systems, once launched and deployed, are subject to limitations around structural modifications. For example, Terminals, Modems or End User Equipment are not easily replaced or modified.
Viasat should also do penetration testing in order to test robustness before deploying their equipment. They also need to ensure there equipment are hardening as the good security level.
Viasat need to do threat modelling for Space Systems. Threat modelling plays a crucial role in risk mitigation. Threat modelling helps to identify the security requirements of a system or process and is far more cost-effective than reacting to a breach or attack
Viasat need also to do security risk analysis. Risk analysis allows to identify risk and their likelihood and impact on a system. Risk analysis allows also to identify mitigation plan to reduce risks.
Viasat as satellite providers must be concerned about its supply chains and vendor ecosystems. Given the critical nature of the satellite communication system, Viasat need to monitor its supply chain. Supply chain has been identify by ENISA, the European Union Agency for Cybersecurity, as the mainly attack threat vector in 2021. Viasat should engage in supply chain security best practices such as conducting extensive vendor cybersecurity evaluations.
Finally, Viasat should establish a strong patch management program in order to maintain a regular security update.
What an incredible start to 2024.
I've had some incredible opportunities and I've been able to do some really interesting things.
I continue my role as...
I’m very proud to receive the following certificate of completion for having successfully completed the training course : « Introduction to Cybersecurity in Space...
Introduction
In this article, I will show how I used the MITRE EMB3D™ Threat Model to identify vulnerabilities in SIEMENS PLCs that were exploited by...
Collaborative framework provides common understanding to mitigate cyber threats to critical infrastructure
MCLEAN, Va. & BEDFORD, Mass., May 13, 2024--(BUSINESS WIRE)--The EMB3D Threat Model is...
In March of 2022, Network battalion 65 (NB65), a hacktivist affiliate of Anonymous, publicly asserted its successful breach of ROSCOSMOS’s satellite imaging capabilities in...
Avec l'aimable autorisation de Martial Le Guédard, nous reproduisons ci-dessous sa cartographie au sujet des différents acteurs étatiques évoluant dans le domaine du Cyber...
KYPO is a Cyber Range Platform (KYPO CRP) developed by Masaryk University since 2013. KYPO CRP is entirely based on state-of-the-art approaches such as...
