Satellite Infrastructure - Complete PASTA Walkthrough

This case study demonstrates threat modeling applied to space satellite infrastructure. This walkthrough addresses a fundamentally different domain with unique constraints: systems you cannot physically access after deployment, extreme latency considerations, radio frequency vulnerabilities, and nation-state threat actors.

Satellite systems make fascinating threat modeling subjects because the consequences of getting security wrong are severe and often irreversible. You cannot SSH into a satellite to patch it. You cannot reboot the ground station while customers are mid-flight over the Atlantic. The attack surface spans from terrestrial facilities to orbital assets to user terminals scattered across the globe.

The System: OrbitLink Satellite Communications Network

OrbitLink operates a commercial low Earth orbit (LEO) satellite constellation providing broadband connectivity to maritime, aviation, and remote enterprise customers. Here’s the system at a glance:

The network handles commercial traffic but also serves as backup communications for emergency services and includes some government contracts. A compromise could disrupt maritime safety communications, expose confidential business data, or enable tracking of sensitive government movements.

Let’s threat model it.

Stage 1: Define Business Objectives

Satellite communications is a capital-intensive business with long planning horizons. A single satellite costs $5-15M to build and $50-80M to launch. The constellation represents over $3B in deployed assets that cannot be physically serviced. Business context matters enormously because security investments must be weighed against the irreversible nature of space infrastructure decisions.

Business Drivers

OrbitLink exists to provide reliable connectivity where terrestrial infrastructure doesn’t reach. Ships in the middle of the Pacific, aircraft over polar routes, oil rigs hundreds of miles offshore, and rural communities beyond fiber reach all depend on satellite connectivity. For many customers, OrbitLink isn’t a convenience—it’s their only option.

Revenue concentration creates specific business risks. The top 20 customers (major shipping lines, airlines, and government agencies) represent 65% of revenue. Losing a major airline contract due to a security incident would be catastrophic. Government customers have explicit security requirements in their contracts.

Competitive dynamics are intensifying. SpaceX’s Starlink and Amazon’s Project Kuiper are deploying massive constellations. Differentiation increasingly depends on service reliability and security posture, particularly for enterprise and government customers who won’t trust their data to the lowest bidder.

Security Objectives

Consequence of Failure

The consequences of security failures in satellite systems range from expensive to existential.

Command and Control Compromise

If an attacker gains control of satellite command systems, potential outcomes include:

The Kessler syndrome scenario (cascading debris collisions) is unlikely from a single satellite but represents existential risk to the space industry. Regulators and insurers are increasingly focused on debris mitigation.

Service Disruption

Maritime customers rely on OrbitLink for GMDSS (Global Maritime Distress and Safety System) backup. Aviation customers depend on it for oceanic position reporting. Prolonged outages could result in regulatory action and, in worst cases, contribute to safety incidents.

Data Breach

Customer traffic includes:

• Corporate communications (mergers, legal matters, competitive intelligence)
• Personal data of passengers and crew
• Government communications (some classified at CUI level)
• Maritime cargo manifests and routing

Total Potential Exposure Summary

Risk Appetite

The organization accepts that some risks cannot be fully eliminated given the nature of space operations. However, any credible path to command and control compromise requires immediate mitigation regardless of cost.

Key Stakeholders

Stage 2: Define Technical Scope

Satellite systems have three distinct segments, each with unique security considerations: the space segment (satellites themselves), the ground segment (control and gateway infrastructure), and the user segment (customer terminals). Attackers can target any segment or the links between them.

System Architecture

Space Segment

The 180-satellite constellation operates in six orbital planes at approximately 550km altitude. Each satellite includes:

Satellites run custom firmware that cannot be fully updated after launch. Security patches must work within severe constraints: limited uplink bandwidth, tight timing windows, and zero tolerance for bricking a $60M asset.

Ground Segment

The SOC is the crown jewel. It houses the command and control systems that can upload commands to any satellite in the constellation. Physical security includes biometric access, mantrap entry, and 24/7 security staff.

User Segment

User terminals are managed devices but operate in environments OrbitLink doesn’t control. A compromised terminal could potentially be used to attack the network or other customers.

Component Inventory

Third-Party Dependencies

Data Classification

Network Boundaries

Stage 3: Application Decomposition

Stage 3 creates detailed data flows and identifies trust boundaries specific to satellite operations.

Primary Data Flows

Trust Boundary Analysis

Seven critical trust boundaries require focused analysis:

RF Link Security Deep Dive

The RF links are unique attack surfaces that don’t exist in traditional IT systems. Understanding them is critical for satellite threat modeling.

Uplink Threats (Ground → Space)

Downlink Threats (Space → Ground)

Inter-Satellite Link Threats

Asset Inventory

Stage 4: Threat Analysis

Stage 4 identifies threats using industry intelligence, STRIDE analysis, and attacker personas. Satellite systems face a unique threat landscape including nation-state actors with anti-satellite weapons (ASAT) capabilities.

Industry Threat Intelligence

Space systems are increasingly targeted as critical infrastructure and military assets.

The Viasat attack is particularly instructive. Attackers used VPN misconfiguration to access the management network, then pushed destructive firmware to customer terminals. The attack:

• Disabled ~30,000 terminals
• Disrupted Ukrainian military communications at invasion start
• Affected wind turbine operations in Germany (collateral damage)
• Recovery required physical terminal replacement in many cases

This demonstrated that attacks on space systems don’t require space capabilities. Ground segment and user segment attacks can be devastating.

STRIDE Analysis: Satellite TT&C Subsystem

Spoofing

Attackers could attempt to impersonate ground stations to send unauthorized commands. The TT&C link uses spread-spectrum modulation and encryption, but vulnerabilities in the cryptographic implementation or key management could enable spoofing. Historical incidents include the 1998 ROSAT incident where attackers reportedly took control of a German satellite.

Threats identified:

• THR-001: Ground station impersonation via compromised TT&C encryption keys
• THR-002: Replay of captured command sequences with insufficient nonce protection
• THR-003: Rogue ground station with stolen credentials

Tampering

Satellite firmware cannot be easily modified after launch, but the configuration can be updated. An attacker with command access could alter frequency allocations, power levels, or routing tables.

Threats identified:

• THR-004: Malicious firmware update bricking satellite
• THR-005: Configuration tampering to cause harmful interference
• THR-006: Thruster command injection for deorbit or collision course

Repudiation

Command logging occurs at the ground station, but an attacker who compromises the SOC could potentially modify logs to hide their activity.

Threats identified:

• THR-007: SOC log tampering to conceal unauthorized commands
• THR-008: Insufficient satellite-side command logging

Information Disclosure

Telemetry reveals operational details including orbit parameters, fuel status, and subsystem health. This information could inform further attacks or provide intelligence value.

Threats identified:

• THR-009: Telemetry interception revealing operational status
• THR-010: Orbit determination data exposure enabling tracking
• THR-011: Key extraction from captured telemetry

Denial of Service

Satellites have limited redundancy. Exhausting thrusters, damaging solar panels via attitude manipulation, or disrupting communications equipment would end the satellite’s useful life.

Threats identified:

• THR-012: Thruster exhaustion through repeated unnecessary maneuvers
• THR-013: RF jamming of TT&C link
• THR-014: Attitude manipulation damaging solar arrays
• THR-015: Commanding safe mode to disable customer payload

Elevation of Privilege

The satellite’s flight computer runs constrained software, but bugs could allow privilege escalation from payload operations to flight control.

Threats identified:

• THR-016: Payload-to-bus escape via flight software vulnerability
• THR-017: ISL compromise propagating to flight systems

STRIDE Analysis: Ground Station Systems

Spoofing

Ground stations authenticate to the SOC and to satellites. Compromising either authentication path enables attack escalation.

Threats identified:

• THR-018: SOC impersonation to ground station
• THR-019: Ground station credential theft enabling unauthorized command transmission
• THR-020: Insider with valid credentials performing unauthorized operations

Tampering

Ground station software processes customer traffic and generates commands. Tampering could affect either stream.

Threats identified:

• THR-021: Malicious command injection via compromised ground station software
• THR-022: Customer traffic manipulation at ground station
• THR-023: RF equipment misconfiguration causing interference

Repudiation

Ground stations are geographically distributed, some operated by third parties. Audit trail integrity varies.

Threats identified:

• THR-024: Insufficient logging at leased teleport facilities
• THR-025: Log integrity attacks at remote ground stations

Information Disclosure

Ground stations handle customer traffic in clear text during baseband processing before encryption for satellite uplink.

Threats identified:

• THR-026: Customer traffic interception at ground station
• THR-027: TT&C key exposure from ground station compromise
• THR-028: Network topology disclosure via ground station reconnaissance

Denial of Service

Ground stations are single points of failure for their coverage areas.

Threats identified:

• THR-029: Physical destruction of ground station antenna
• THR-030: DDoS against ground station network connectivity
• THR-031: RF jamming of ground station uplink
• THR-032: Power grid attack affecting ground station

Elevation of Privilege

Ground station compromise could enable escalation to satellite control.

Threats identified:

• THR-033: Ground station to SOC lateral movement
• THR-034: Ground station operator privilege escalation

STRIDE Analysis: User Terminals

Spoofing

Terminals authenticate to the network. A spoofed terminal could gain free service or attack the network.

Threats identified:

• THR-035: Cloned terminal credentials for unauthorized access
• THR-036: Rogue terminal performing network reconnaissance

Tampering

Terminals in customer environments may be physically accessible to attackers.

Threats identified:

• THR-037: Malicious terminal firmware installation
• THR-038: Terminal hardware modification (wiretapping, backdoor)
• THR-039: Supply chain attack on terminal manufacturing

Repudiation

Terminal usage attribution enables billing and abuse tracking.

Threats identified:

• THR-040: Terminal identity spoofing for abuse attribution evasion

Information Disclosure

Terminals process customer traffic and may store credentials.

Threats identified:

• THR-041: Customer traffic interception via terminal compromise
• THR-042: Credential extraction from terminal storage
• THR-043: RF emissions analysis revealing traffic patterns

Denial of Service

Terminals could be attacked to disrupt customer connectivity or as part of broader attacks.

Threats identified:

• THR-044: Mass terminal disabling via firmware attack (Viasat-style)
• THR-045: Terminal RF jamming
• THR-046: Terminal resource exhaustion via malformed traffic

Elevation of Privilege

A compromised terminal could attack the broader network.

Threats identified:

• THR-047: Terminal to satellite attack (unlikely but considered)
• THR-048: Terminal as pivot point to customer network

Attacker Persona Analysis

Satellite systems face a broader range of threat actors than typical IT systems.

The nation-state kinetic threat is unique to space systems. While traditional cybersecurity cannot defend against missiles, threat modeling should acknowledge this threat class and consider:

• Redundancy and constellation resilience
• Geopolitical risk assessment for orbit selection
• Integration with space domain awareness

Threat Summary (Top 25 by Risk Score)

Additional Documented Threats (THR-055 through THR-075):

The complete threat model documents 75 threats across categories:

Stage 5: Vulnerability and Weakness Analysis

Stage 5 maps concrete weaknesses to identified threats.

Space Segment Weaknesses

The satellite flight software was designed in 2018 and cannot be substantially redesigned. Security improvements must work within existing software architecture constraints.

Ground Segment Weaknesses

The Viasat attack exploited exactly this type of ground segment weakness—VPN misconfiguration that allowed lateral movement to terminal management systems.

User Segment Weaknesses

Configuration Issues

Penetration Testing Results

Weakness-to-Threat Mapping

Stage 6: Attack Modeling

Stage 6 creates detailed attack trees showing how adversaries could achieve high-value goals.

Attack Tree 1: Satellite Constellation Control Compromise

Goal: Gain ability to send commands to any satellite in the constellation

Path A Deep Dive: SOC Network Compromise

Critical Chokepoint Analysis:

Network segmentation between corporate and TT&C systems appears in multiple attack paths. Properly implementing this segmentation would disrupt paths A, C (partially), and E.

Command validation requiring two-person integrity would disrupt paths A, C, and D. Even with TT&C access, an attacker would need to compromise two separate accounts.

Attack Tree 2: Mass Terminal Disabling (Viasat-Style Attack)

Goal: Disable thousands of customer terminals simultaneously

Disruption Controls:

The Viasat attack demonstrated that execution-phase controls were insufficient. Rate limiting and staged rollouts would have limited blast radius even after initial compromise.

Attack Tree 3: Ransomware Attack on Ground Operations

Goal: Encrypt SOC and ground station systems, demand ransom

Impact Analysis:

If attackers command satellites to safe mode before encrypting ground systems, recovery becomes more complex because safe mode commands may need ground infrastructure to reverse.

Kill Chain Disruption Priority

Stage 7: Risk and Impact Analysis

Stage 7 prioritizes threats and creates an actionable remediation plan.

Risk Priority Summary

Business Impact Quantification

THR-044 (Mass Terminal Attack)

The Viasat attack provides a real-world benchmark. Assuming similar scope:

• 50% of terminals affected: ~125,000 terminals
• Replacement cost per terminal: $2,000 (including logistics)
• Terminal replacement: $250M
• Service outage (2 weeks average): $32M revenue loss
• SLA penalties: $15M
• Customer churn (government contracts): $50M+ annually
• Total: $350M+ immediate, ongoing revenue impact

THR-050 (SOC Ransomware)

THR-001/006 (Satellite Control Compromise)

Worst-case: attacker commands satellites into collision courses, generating debris.

Even partial control compromise leading to a single satellite loss would cost ~$120M (satellite + launch) plus insurance and regulatory implications.

Mitigation Plan

Immediate Actions (Week 1-2)

30-Day Actions

90-Day Actions

Long-Term Actions (Year 1-2)

Risk Treatment Decisions

Risk Acceptance: Nation-State Kinetic Attack

OrbitLink cannot defend against ASAT weapons. This risk is accepted with the following conditions:

• Constellation design allows continued service with 20% satellite loss
• Geographic distribution of ground stations limits single-point vulnerability
• Integration with Space Force space domain awareness for warning
• Review trigger: geopolitical situation changes significantly

Residual Risk Assessment

Summary: Critical threat count drops from 8 to 2. High threat count drops from 18 to 7. Remaining critical risks relate to highly sophisticated nation-state attacks and physical threats where full mitigation is impractical.

Budget Summary

ROI Analysis:

A mass terminal attack (Viasat-style) would cost $350M+. The terminal security mitigations cost $500K immediate plus ongoing costs. ROI is clear even at low attack probability.

SOC ransomware would cost $70-120M. The mitigation investment of $2.5M over 90 days provides strong protection. Even a 5% annual attack probability justifies the investment.

Total security investment of $27M over two years protects against potential losses of $500M+ for the most likely attack scenarios.

Key Findings Summary

Unique Satellite Considerations

This threat model highlighted several concerns unique to space systems:

Appendix: Comparison with Healthcare Threat Model

Both threat models use PASTA methodology but highlight how domain context shapes threat analysis. The healthcare model focuses heavily on data protection and privacy. The satellite model focuses on command integrity and availability because the consequences of losing satellite control are more severe and irreversible than data breach.

Part 3b Complete | Satellite Infrastructure Threat Model