Brandon Karpf (10:17)

And now a brief message from our sponsor, dropzone AI. Is your SOC drowning in alerts with legitimate threats sitting in queues for hours or even days? The latest SANS SOC survey report reveals alert fatigue and limited automation are SOC team's greatest barriers. Dropzone AI, recognized by Gartner as a cool vendor, directly addresses these challenges through autonomous recursive reasoning investigations, quickly eliminating false positives, enriching context, and enabling analysts to prioritize real incidents faster. Take control of your alerts and investigations with dropzone AI.

Maria Varmazes (11:09)

Today's guest is Brandon Karpf, NTK Editor Emeritus and creator of T Minus, by the way. And while he is working on other ventures, he is still very much in our orbit and we'll be hearing from him regularly, especially on all things space cybersecurity. Here's a bit from our recent conversation.

Brandon Karpf (11:31)

DOD released a memo and policies around modern software acquisition reform where they identified this this pathway called the Software Acquisition Pathways, which is really meant to implement agile processes in how the DoD acquires, implements, fields software. Traditionally, software has been seen just like every other DoD program, regardless of if it's an aircraft or a ship or a ground system for a satellite communications network, has all been approached exactly the same. Obviously that doesn't work well for software. Software you have to test, you have to iterate, you have to move quickly. And so this memo that just came out last week is directing the acquisitions community to come up with an implementation plan for this much more rapid, iterative agile approach to software acquisitions.

Maria Varmazes (12:29)

So when we say rapid.

Brandon Karpf (12:31)

Yes.

Maria Varmazes (12:32)

How rapid are we talking?

Brandon Karpf (12:34)

Right. Well, so similarly, and actually the same day that this memo came out, Space Systems Command released a case study around satellite communications. And I think this was intentionally timed. It was literally the same day. And this case study is fantastic. It's about the Evolve strategic satellite communications program and specifically their implementation of a new agile software acquisitions technique for this program and specifically for the ground segment. The ground segment software for this program. Now, before this program, they admitted, and I cannot believe they publicly admitted this, they admitted that it historically takes them 12 years to field new software to.

Maria Varmazes (13:19)

Field, not even to get it up and running, just to approve, just to sign the contract.

Brandon Karpf (13:25)

Right? 12 years, which is insane, under this program that they implemented, their new time horizon is six years. Doesn't sound a lot better. But I mean they literally cut it in half. I think that's proof of concept as they move forward with it's what they're calling the Griffin program G R I F F O N. It seems like they'll get faster and faster. And basically the pressy here is they implemented the Agile process. They started with customer discovery, they brought in a bunch of potential vendors to do requirements development. Those vendors went away, took those requirements, developed a minimum viable product, they presented that minimum viable product in a bake off. The Air Force, their space systems command selected the winner from that bake off and that allowed the winner to implement their own software development process and iterate on that and get it to the point where they could start deploying and testing this new ground resilient system for the satellite communications network.

Maria Varmazes (14:30)

Sounds great. I'm asking a question I know the answer to admittedly, but the cyber angle to this, let's walk that in because there's a big one here, right?

Brandon Karpf (14:39)

And so, you know, as we're kind of moving into this brave new world of software defined warfare, and my claim has always been the government, especially DoD is the primary buyer for pretty much the entire space economy, has been mostly on telecoms, you know, certainly Earth observation as well. But to me those are the two legitimate viable markets for this industry. They are all vulnerable to cyber attack and all those systems are cyber enabled, software enabled. So we're moving to a point of software defined warfare. Software defined warfare being that's where the threats are, that's where the opportunities are. We've certainly in this industry heard about the viasat attack in early Ukraine. What most people haven't talked about is since then there's been 124 more validated cyber attacks against space systems in Eastern Europe since viasat. So obviously a huge threat vector and a huge target. What we haven't talked about so much is the opportunities of how the space segment can actually, especially software defined space segment could improve security and especially when we're talking about telecommunications. So what I kind of want to, what I want to pitch to this community and talk about is how this more rapid software development lifecycle, software acquisitions reform, could help the space industry implement highly effective secure telecommunications infrastructure. Leveraging the space segment.

Maria Varmazes (16:16)

Yeah, get in. I was going to say, yes, that, let's, let's get into that. So I mean admittedly if you're not in the umbrella that may be directly affected by this, you might be going, well, how does this apply? But I think there are a lot of lessons here. So, okay, so that is the pitch that it'll, that's the opportunity. What does that look like on the ground?

Brandon Karpf (16:34)

Right. So you know, on the ground, step number one, what the DOD is doing is saying that they're going to do is they're going to accept more risk up front by rapidly implementing new software, by trying to implement this agile process with software acquisitions, they're basically saying we are going to accept early risk, understanding that that allows software to be iterated upon, to be improved and to be developed in a way that ultimately will decrease risk and cost in the long run. And so certainly there are initial risks implemented there by accepting minimum viable software products. So that's kind of an interesting framing of them saying we're going to accept. Historically they've said we're going to accept zero risk, which is why it takes 12 years to test and field anything. But what that ends up doing is it ends up locking them into these old systems. So now how does this industry implement this? I'm going to specifically talk about telecom because that's where I think the biggest opportunities are for improving the cyber posture and cyber defense of of the west, certainly.

Maria Varmazes (17:41)

Largest perimeter too, right? If you want to think of it that way.

Brandon Karpf (17:44)

Exactly. Largest perimeter. It's also globally targetable. So let's think about the space segment of the telecom infrastructure is providing backbone services. Now we have, you know, Leo constellations, we have Geo constellations that can provide backbone connectivity for packetized networks, for data Networks, for Internet, etc. Those systems are globally targeted, right? You can reach those from anywhere in the globe. So any adversary will, whether it's Volt Typhoon who proved that they're interested in the telecom infrastructure in the US and Canada and has found their way into those systems, they're going to be targeting those systems. However, when you think about the space architecture, it actually can be a little harder to target. So when you think about the kill chain, the first step of the kill chain is reconnaissance. First step of reconnaissance is figuring out where your target's infrastructure is, where their target points are, where their selectors like IP addresses, servers, et cetera, are located, and maneuvering through a network to find them and finding your way onto hot points. If we are leveraging intelligently, I'm not saying that you can necessarily do this off the bat, but think about how we can implement this rapid software implementation for the network layer, for the network and transport layer of the Internet and use the space segment to obfuscate our points of presence. So what does it mean by that? Think about each satellite as a point of presence, an adversary. I don't even as a user know which satellite my data's directly going to. Because they're moving, they're rapidly moving. It's a moving target defense so if we can obfuscate your point of presence to get into networks as a user of telecoms infrastructure and leverage the space segment to create moving target, essentially maneuver warfare in the telecommunications network layer that immediately makes it more difficult for the adversaries to target because they can't do reconnaissance as well.

Maria Varmazes (19:47)

So it's like the. Okay, so I'm thinking in the classic on the defender side, you wanted to know what all your assets are so you can defend them. Because there's always assets that get forgotten or lost. In this case we're saying security through obscurity. We want the moving target. That's a fascinating opportunity that really only space provides.

Brandon Karpf (20:05)

Exactly, yeah, pretty much space or high altitude balloons or drones potentially for creating these relays for communications. But if you think about how you can leverage, and you know, my call is to the DoD and any users of globalized telecom infrastructure, think about how you can use this space segment to obfuscate your communications. Relay your points of presence in a rapid fashion to essentially make them ephemeral. So when Volt Typhoon's going after your telecom infrastructure, they have a hard time finding where you even are and where your network even is.

Maria Varmazes (20:53)

We'll be right back.

Brandon Karpf (21:00)

Tired of investigation tools that only do one thing at a time? Spending more time juggling contracts with data vendors than actually investigating Maltego changes that for good. Get one investigation platform, one bill to pay, and all the data you need in one place. It comes with curated data and a full suite of tools to handle any digital investigation. Connect the dots so fast cybercriminals won't even have time to Google what Maltego is. See the platform in action@maltego.

Maria Varmazes (21:44)

Welcome back. It's a successful mission complete for Firefly Aerospace's Blue Ghost lunar lander after 14 days of lunar surface operations. After Blue Ghost landing, downlinking 119gigs of data, including 51gigs of science and technology data for NASA exclusively. Firefly says that they completed 100% of their mission objectives. And five hours into the start of lunar night, it was time to say goodnight to this historic moon mission. Just before Blue Ghost completed its mission and shut down, it shared this one last message, which I'll read for you. Mission mode change detected. Now in monument mode. Good night, friends. After exchanging our final bits of data, I will hold vigil on this spot in Mare Chrisium to watch humanity's continued journey to the stars. Here I will outlast your mightiest rivers, your tallest mountains, and perhaps even your species as we know it. But it is remarkable that a species might be outlasted by its own ingenuity. Here lies Blue Ghost, a testament to the team who, with the loving support of their families and friends, built and operated this machine and its payloads to push the capabilities and knowledge of humanity one small step further. Per Aspera ad Astra. Love Blue Ghost. A job well done, Blue Ghost. Rest well and thank you for the science. And congratulations to to the entire team at Firefly. That's it for T minus for March 17, 2025 brought to you by N2K CyberWire for additional resources from today's report, check out our show notes@spare.n2k.com we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing space industry. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to space2k.com we're privileged that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector. From the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies, N2K makes it easy for companies to optimize your biggest investment your people. We make you smarter about your teams while making your teams smarter. Learn how@n2k.com N2K's senior producer is Alice Carruth. Our producer is Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester, with original music by Elliot Peltzman. Our executive producer is Jennifer Ivan. Peter Kielke is our publisher and I am your host, Maria Ramazas. Thanks for listening. We will see you tomorrow.

Brandon Karpf (24:54)

T minus.

Brandon Karpf (25:08)

Cyber threats are evolving every second, and staying ahead is more than just a challenge, it's a necessity. That's why we're thrilled to partner with ThreatLocker, the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit threatlocker.com today to see how a default deny approach can keep your company safe and compliant.