Enhanced VSAT Security through Security Baselines

satellites blogOver the past couple of years, there has been an increased attention paid to the security and trustworthiness of the products and services from the Satellite Communications (SATCOM) industry.  This focus has been driven by customer needs, increased scrutiny from security researchers, and concerns raised by regulatory bodies.

In response to these concerns, the Global VSAT Forum (GVF) created a Cyber-Security Task Force in 2014 to bring together experts from across the industry to tackle the security challenge across the sector.  The task force continues to drive enhanced security for Very Small Aperture Terminal (VSAT) systems through a series of specifications that are being adopted by numerous organizations.

Understanding the changing threat

VSAT’s rapid evolution in recent years means that previously isolated VSAT networks are now largely based on TCP/IP (Transmission Control Protocol/Internet Protocol), and are therefore now exposed to the types of threats that exist on the Internet, even when those networks are not directly connected to the Internet.

At the same time, customers also have increased needs for security and compliance – PCI, ISO 27001 − and other standards − have forced customers to revisit security at every business level.

The threat actors have also evolved, including criminal syndicates or state-level actors with considerable resources.  News of large, substantial breaches against businesses and governments alike make the headlines with disturbing regularity.  Many of these organizations, of course, rely upon satellite connectivity.

GVF leads cybersecurity transformation of the satellite communication industry

The GVF Cybersecurity Task Force, in response to increased scrutiny of satellite infrastructure by independent security researchers, called upon experts across the satellite industry, and created the VSAT Product Security Baseline (PSB) and the Satellite Service Provider Security (SSPSec) specifications.   Both of these voluntary specifications apply the best practices of the Internet security community to the satellite industry.

The PSB recommends that hardware and software developers of the infrastructure components of the end-to-end VSAT solution create products that are secured by default. Further, those vendors are recommended to have established processes for handling reports of suspected security incidents and vulnerabilities.  The goal here is to ensure that network operators are capable of creating secure solutions based on components that are secured and trustworthy.

Complementary to the PSB, the the SSPSec recommends what satellite network providers can do to secure their infrastructure, and increase their resiliency and capacity to deal with an attack.  Addressing security at a policy, process, and technical level, the SSPSec defines minimum criteria for resiliency and availability to the benefit of every customer of the service provider.

More than words – action is needed

Security specifications are nice, but true security arises from a holistic approach involving all network-security stakeholders.  Effective security across the VSAT community is a key goal of the GVF, and to that end we are collaborating with the cyber-security stakeholder community to ensure the broadest industry consensus around security.

Customers ultimately vote with their budgets.  By asking the tough questions, and choosing solutions that provide effective threat mitigation in today’s environment will ensure that the industry continues to champion leading-edge security today and into the future.

Rakesh Bharania

rakesh

Rakesh Bharania (@densaer) is the chair of the GVF Cybersecurity Task Force, a cross functional organization that aims to bring together stakeholders across the industry to improve VSAT security and resilience. Additionally, he is a team lead for Cisco Tactical Operations, the humanitarian and emergency response team from Cisco. He is responsible for the design and implementation of emergency networks to support first responders, NGOs, government, and critical infrastructure restoration. He represents Cisco’s emergency response team at several international forums including FEMA and the United Nations.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: