Space cyber risk
Exposure of space systems (spacecraft, ground segment, links) to a cyberattack capable of interrupting service without any physical damage to the spacecraft.
February 24, 2022: a cyberattack on Viasat's KA-SAT network knocks out tens of thousands of modems across Europe, and with them remote monitoring of 5,800 Enercon wind turbines in Germany. The satellite itself is never touched. Space cyber risk is this exposure of space systems (the spacecraft, its ground control segment, user terminals) to an attack that interrupts service with no physical damage in orbit. The ground segment is often less hardened than the satellite and plugged into conventional terrestrial networks, which makes it a favored attack surface. Compromising control stations or customer modems can cut a service without any physical space loss being recorded, and then the question is which cover responds. An attack can also target command links. Unauthorized takeover of a satellite remains a theoretical and rare scenario, but military and government operators take it seriously. For insurers, space cyber risk shifts the analysis from physical damage toward business interruption and liability. It also raises an accumulation problem similar to terrestrial cyber: a software vulnerability shared across one ground segment or one terminal manufacturer can hit thousands of customers at once, spread across a wide territory.
On February 24, 2022, a cyberattack using AcidRain wiper malware crippled modems on Viasat's KA-SAT satellite network across Europe, cutting access for tens of thousands of users and disrupting remote monitoring of thousands of German wind turbines along the way, without any satellite being physically affected.
space cyber risk, satellite cyberattack, ground segment attack
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.