Space Force provides threat briefing to space industry

By Shane Klestinski, Associate Editor

 

Space Force Tech. Sgt. Jarrett Lybrand, the intelligence section chief for the Assured Access to Space (AATS) Intelligence Office, delivered an unclassified threat briefing to attendees of the Space Mobility Conference and Expo in Orlando, Florida, Jan. 28.

 

Lybrand’s brief provided insights into current and emerging threats in the space domain and emphasized the need for innovation and collaboration to maintain U.S. superiority in meeting future challenges. He began with the importance of space supply chain risk management and noted that, “it’s not just about getting to space but maintaining that presence in space.”

 

Lybrand listed various aspects of supply chain management and logistics that made the operations in the domain possible, as well as potential threats, such as “white labeling.”

 

According to Lybrand, white labeling is a process wherein a company purchases equipment, disassembles it, incorporates it into something else, rebrands it, and sells it as their own product. He cited two companies who were the largest providers of surveillance equipment in China. The Federal Communications Commission banned them because of their ties to the Chinese government and human rights abuses. He explained they could use white labeling to circumvent these bans and find ways into markets to which they weren’t supposed to have access.

 

“White labeling is legal as long as the two companies agree not to infringe on intellectual property or regulations… and the end-state consumer is aware of this process,” Lybrand said. “Where white labeling becomes a concern is that the process can be used in any way, shape or form in the enterprise. Are these electronic components coming from companies that cut corners to either make extra money on the side, or they aren’t worried about any regulations or safety concerns that we’re worried about – especially when it involves national security?”

 

In discussing cyberthreats to space supply chains, he explained that supply chains are typically integrated across a wide array of networks, connecting a variety of entities. Because of the various interconnections among the entities they interface with, adversaries have numerous avenues they can access to burrow their ways into sensitive networks.

 

“This is especially important in the space supply chain, considering that it is all about technological development,” Lybrand said. “Adversaries can get in, steal your data, steal your finances, and whatever hard work you put in, just to cut corners so they can [achieve a goal] before you do.”

 

He specifically addressed some of the more popular cyberattacks methods. “Living off the land” uses legitimate tools and features already present in a target system to avoid detection and execute a cyberattack. “Evil twin phishing” baits unsuspecting users into connecting with unsecured wi-fi hotspots, which adversaries use to “piggyback” onto those users to access their networks. Commercial industry firms that need secure intellectual property should be especially concerned with “man-in-the-middle phishing.” This tactic involves bad actors intercepting and altering a communication chain, effectively becoming the “middleman,” and then controlling the information flow to get sensitive information, or subverting it to halt processes.

 

In discussing technological espionage, Lybrand said that the U.S. economy loses hundreds of billions of dollars annually due to counterfeit goods, pirated software, and the theft of trade secrets. China stands as the world’s leading infringer of intellectual property, and it has sponsored numerous programs to support such endeavors, such as the “1000 Talents” program.

 

“The 1000 Talents program is a state-sponsored program in which [China] goes after Chinese nationals working abroad, who have special placement and access to the industry, whether it’s government, defense, commercial or academia,” Lybrand said. “China uses coercive tactics, such as using their families back home and holding them hostage to do their bidding or offering large sums of money to entice them to turn their loyalty away from their company. While they mostly focus on people of Chinese origin, they’re not above going after anyone who has special access in projects such as nanotech, semiconductor research, defense projects, [or] biomedical research… all they need is one person to allow them access into the network.”

 

He emphasized that 1000 Talents is just one of many active programs in operation, and there could be several more that U.S. authorities have not yet uncovered – in addition to other programs that other countries may be operating.

 

“The big takeaway from this, is that there are plenty of actors going after the industry and trying to get the technology, hard work, money and resources poured into developing that information,” Lybrand said. “It can be stolen at an adversary’s whim to take them up to wherever you [are in your efforts].”

 

Lybrand later discussed countermeasures to mitigate vulnerabilities, such “threat modeling” exercises. This approach uses “red cell” participants to identify vulnerabilities in a network so that organizations can eliminate those weak points before a bad actor finds and exploits them. Practicing “human-in-the-loop” contingencies that actively involve people to ensure certain actions go forward, can help stop cyber attackers from gaining full access and maneuverability in a system. He also cited physical security of access points as another way to guard against cyberthreats because industrial equipment can be spread out across a large area.

 

“These [sites] are not necessarily protected or watched over as securely as they should be, so anyone can just walk up and tap in, and all your hard work for defending your industry is just gone in a second,” Lybrand said.