Should space be designated as critical infrastructure?

Summary

Podcast Summary: T-Minus Space Daily – "Should Space Be Designated as Critical Infrastructure?"

Episode Details:

• Title: Should Space Be Designated as Critical Infrastructure?
• Host/Author: N2K Networks
• Release Date: March 29, 2025
• Guest: Jake Braun, Executive Director of the Cyber Policy Initiative at the University of Chicago, former White House Principal Deputy National Cyber Director, and Chairman of DEFCON Franklin.

---

Introduction

In this episode of T-Minus Space Daily, host Maria Varmazes engages in a deep and insightful conversation with Jake Braun, a seasoned expert in cyber policy and former White House cyber director. The discussion centers around the critical question: Should space be designated as critical infrastructure? The dialogue explores the increasing reliance on space assets, the existing vulnerabilities, and the geopolitical implications of cyber threats targeting space.

---

The Importance of Designating Space as Critical Infrastructure

Maria Varmazes opens the conversation by highlighting the growing dependency on commercial spacecraft, citing that as of March 5, 2025, there are 11,833 active satellites, over 60% of which are commercial. This reliance underscores the pressing need to consider space as critical infrastructure.

Jake Braun elaborates on the government's role in this designation:

“...so much of our lives are governed by the satellites that are up in space. And the obvious example is GPS, but also a million other things.” ([05:13])

Braun explains that while there has been some opposition from the space industry due to potential increased regulations, the benefits of official designation include greater government support, such as funding for cybersecurity assessments and threat intelligence sharing.

Key Points:

• Government Support: Official designation would enable access to resources like cybersecurity assessments and threat intelligence via agencies like CISA.
• Industry Hesitation: Increased regulation and scrutiny are primary concerns for the space industry.
• Consensus on Importance: Even without formal designation, there is widespread agreement on the critical nature of space infrastructure.

---

Understanding the Attack Surface in Space

Maria probes deeper into whether the threats to space infrastructure are unique or similar to terrestrial threats.

Jake Braun responds emphatically:

“Absolutely not. They don't got it. And that's not their fault, like no one does.” ([09:32])

He draws parallels between cyber threats on Earth and those targeting space assets, emphasizing that traditional cyber attack methods are applicable to satellites and other space-based systems. Braun cites the example of Defcon's Annual Report, where hackers successfully executed a signal injection attack on VSAT modems using software-defined radios from Earth, demonstrating the vulnerability of space communication systems.

Key Points:

• Similarity of Threats: Cyber attacks on space infrastructure mirror those on terrestrial systems, including SQL injections and zero-day exploits.
• Example of Vulnerability: Hackers' ability to manipulate VSAT modems underscores the ease with which space assets can be compromised.
• Nation-State Capabilities: Countries like China, Russia, Iran, and North Korea possess the resources and expertise to exploit vulnerabilities in space infrastructure.

---

The Nature of Cyber Threats in the Space Domain

The conversation delves into the specific nature of cyber threats unique to the space sector.

Jake Braun explains the concept of zero-day vulnerabilities:

“A zero day refers to basically a new vulnerability that nobody knew about before... once we use it or release it, that'll be kind of the first time it was ever used and thus a zero day.” ([15:56])

He warns that nation-state actors meticulously search for and exploit these unknown vulnerabilities to gain unauthorized access to satellite systems, posing significant risks to global security and infrastructure.

Key Points:

• Zero-Day Exploits: Unpatched vulnerabilities can be weaponized by adversaries to disrupt space operations.
• Nation-State Threats: Advanced persistent threats from countries with significant cyber capabilities are a major concern.

---

Mitigating Cyber Risks: Best Practices for Space Companies

Maria raises the issue of how space companies, both large and small, can protect themselves against these cyber threats.

Jake Braun offers actionable advice:

1. Join the Space Information Sharing and Analysis Center (Space ISAC):

   “Even if you're a small company... it's worth it.” ([17:33])

2. Hire a Chief Information Security Officer (CISO):

   “If you don't have a CISO, hire a CISO. That's really important.” ([17:33])

3. Invest in Cyber Workforce Development:

   “Think about how they could bring on folks and do that are maybe not super duper cyber experts... but somebody who they can do on the job training.” ([19:50])

Braun emphasizes the importance of collaboration, information sharing, and developing a robust cybersecurity team to safeguard space assets effectively.

Key Points:

• Information Sharing: Participation in Space ISAC facilitates threat intelligence exchange.
• Leadership in Cybersecurity: A dedicated CISO is crucial for overseeing and implementing security measures.
• Workforce Training: Enhancing the cybersecurity capabilities of existing staff through training and certifications.

---

Geopolitical Context: The New Great Game

In his closing remarks, Jake Braun draws a parallel between historical geopolitical struggles and the current cyber and space domain conflicts:

“We're in the middle of a new great game... it's over the Internet and really it's between authoritarian countries... and democracies and space is clearly one of the main parts of the terrain...” ([21:06])

He underscores that the battle for cyberspace and space is a defining conflict of our time, with implications for global security and the free and secure functioning of societies.

Key Points:

• Historical Parallel: The struggle mirrors the "Great Game" between Russia and Britain, now transferred to the cyber and space arenas.
• Authoritarian vs. Democracies: The conflict is framed as a battle between authoritarian regimes and democratic nations over control and security in cyberspace and space.
• Long-Term Implications: This geopolitical tension is expected to shape international relations and security strategies for the foreseeable future.

---

Conclusion

The episode concludes with Maria Varmazes thanking Jake Braun for his valuable insights. Braun reiterates the importance of collective action in protecting space infrastructure from cyber threats and urges listeners to recognize their role in this ongoing geopolitical struggle.

---

Notable Quotes

• Jake Braun on Space as Critical Infrastructure:

  “So much of our lives are governed by the satellites that are up in space. And the obvious example is GPS, but also a million other things.” ([05:13])

• Jake Braun on Cyber Threats:

  “Absolutely not. They don't got it. And that's not their fault, like no one does.” ([09:32])

• Jake Braun Explaining Zero-Day Vulnerabilities:

  “A zero day refers to basically a new vulnerability that nobody knew about before... once we use it or release it, that'll be kind of the first time it was ever used and thus a zero day.” ([15:56])

• Jake Braun on Mitigation Strategies:

  “If you don't have a CISO, hire a CISO. That's really important.” ([17:33])

• Jake Braun on the New Great Game:

  “We're in the middle of a new great game... it's over the Internet and really it's between authoritarian countries... and democracies and space is clearly one of the main parts of the terrain...” ([21:06])

---

Final Thoughts

This episode of T-Minus Space Daily provides a comprehensive analysis of the critical intersection between space infrastructure and cybersecurity. Jake Braun's expertise sheds light on the vulnerabilities that underpin our reliance on space-based assets and the strategic measures necessary to mitigate these risks. As space becomes increasingly integral to global infrastructure, the conversation emphasizes the urgent need for collaborative defense mechanisms and robust cybersecurity frameworks to safeguard our celestial assets.

---

For more information and to listen to the episode, visit N2K Networks.

Transcript

[Maria Varmazes]

You're listening to the N2K space network.

[Dave]

Looking for a career where innovation meets impact? Vanguard's technology team is shaping the future of financial services by solving complex challenges with cutting edge solutions. Whether you're passionate about AI, cybersecurity or cloud computing, Vanguard offers a dynamic and collaborative environment where your ideas drive change. With career growth opportunities and a focus on work life balance, you'll have the flexibility to thrive both professionally and personally. Explore open cybersecurity and technology roles [e-mail].

[Maria Varmazes]

As of March 5, 2025 using the satellite tracking website orbiting now, there are 11,833 active satellites in various earth orbits. Over 60% of them are commercial spacecraft. And increasingly we're becoming reliant on their support for everyday occurrences. Given that reliance, should space be designated as critical infrastructure? Are we doing enough to protect our space based assets? Welcome to T Minus deep space from N2K Networks. I'm Maria Varmazes. Our guest today is Jake Braun, Executive Director of the Cyber Policy Initiative at the University of Chicago. And Jake is the former White House Principal Deputy National Cyber Director and Chairman of DEFCON Franklin. And I wanted to ask his opinion on designating space as critical infrastructure and get an overview of its attack surface.

[Jake Braun]

My name is Jake Braun. I am currently the Executive Director of the Cyber Policy Initiative at the University of Chicago. But maybe more relevant for this conversation, I was most recently, as of about six months ago, eight months ago, the acting Principal Deputy National Cyber Director in the White House, which essentially means I was the COO of, of this new cyber office they set up in the White House that was actually created in the Trump administration, but it was so new they hadn't hired any people into the office until Biden. And the first employee I think was hired in 21. And by the time I left we were up to about 100 people. So running a startup is interesting. Running a startup in government is particularly unique and then running a startup in the White House is something that I have a lot of scars from, but I would have never given up for the world.

[Maria Varmazes]

Wow. Yeah. So I want to hear more about that. Not the scars to you obviously, but the work that you were doing in the White House. Please tell me a bit more about the efforts that you are working on.

[Jake Braun]

Sure. So Congress created this office essentially because there were, while there's a bunch of offices around the federal government that do cyber, there wasn't one that was at a level, meaning White House level, that could kind of compel other agencies to implement government wide Policies and programs in cyber. And so this group in Congress, the Cyberspace Solarium Commission, created this. And our first task that was assigned to us by the President was to write or really update the National Cyber Strategy, which the first one was written in Bush, the second term of W. Bush, and then it's been updated. We did the fourth iteration of it. So our office rewrote or updated the National Cyber Strategy, and then I was brought in to oversee implementation across the federal government of that strategy. And space was a key component of it, as well as a whole host of other things, including AI and mundane things like workforce and sexy things like cybercrime and cartels and stuff like that. But it ran the gamut.

[Maria Varmazes]

Yeah. Given what I often focus on, I'm clearly biased. I really want to hear more about the space side of things because as I mentioned before we started recording, I have a number of conversations with people in various parts of the space industry where we talk about space as critical infrastructure, what that means and what that would affect. And I don't think this is a very well understood thing. So I'd love to hear a bit more about your thoughts on that and sort of why the effort to get space designated as critical infrastructure is so important.

[Jake Braun]

Sure. So actually, our role in that conversation, the role of my office in the White House, the Office of National Cyber Director, was actually not kind of a foregone conclusion. Initially, the Space Council and the National Security Council were going to work to decide how things should unfold as it relates to space as critical infrastructure and kind of key recommendations on security of space infrastructure and so on. However, we kind of rose our hand as kind of the new kid on the block and said, hey, cyber's kind of a key component of all this. We should really be at the table. And after some hemming and hawing and typical government turf battles and everything else, folks agreed that not having the Cyber Office involved in this conversation was a big missed opportunity. And so we had a great team of folks who worked on this for me and the director. And it kind of boiled down to the fact that so much of our lives are governed by the satellites that are up in space. And the obvious example is gps, but also a million other things. Over time, you know, we made a strong push, as did others, to designate space as critical infrastructure officially. I know that, you know, there's been some disagreement on. On that designation, but I think in practice, people have largely kind of come to agree that that space is critical infrastructure, regardless of of its designated formal designation by the government. As such.

[Maria Varmazes]

Yeah, I, and that's a really good point. I think you're right that I think unofficially a lot of people are thinking way, would there be a really super big material difference if it was more officially designated? I mean, I know there is, but how, how big a difference would that really make at this point?

[Jake Braun]

Well, part of the reason I think the space industry was, was somewhat less excited about it was that it. It can. Doesn't always, but can come with increased regulations and scrutiny from government, which of course industry generally doesn't like for obvious reasons. That being said, also, more resources often come with it. So the government will often fund the way it does with other industries, information sharing groups to share threat intelligence. They'll often fund via CISA and other entities, folks that will go out and do free cybersecurity assessments. CISA does this on a whole host of entities like state and local governments in the energy sector and water and so on, other parts of critical infrastructure. And so those types of resources would be available. Generally we try not to subsidize major corporations who have the financial wherewithal to do it themselves. Like CIS is not out there doing free cyber assessments for JP Morgan or Bank of America, which are also critical infrastructure designated formally as such. But you know, you could certainly envision that being applicable to many of the smaller companies in space. And so, you know, there's a little bit of a yin and a yang here. You may get more regulation, but you also get more resources and so on. So that's kind of the push and pull as to why, you know, industry may want or not want something designated officially as. As critical infrastructure.

[Maria Varmazes]

Absolutely, yeah. I think some of the tenor of the conversations I've had also have been, we're fine, we're good, we've got this. But my question is often the follow up, do you actually have it? Are you actually fine? Is the nature of the threat really fully understood? I'm not an expert here. I don't know. I often wonder though, do people quite understand what threats look like in the realm of space? Is it even all that special and all that different from the threats that we see terrestrially? I'm just so curious your thoughts on sort of the nature of what's going on in the space domain.

[Jake Braun]

So first off, just to answer your question, absolutely not. They don't got it. And that's not their fault, like no one does. I mean, you know, if you've got a nation state actor after you, just remember Stuxnet, right? Stuxnet was us and Israeli attacks on the Iranian nuclear program. The Iranians put their centrifuges in concrete vaults in the desert, buried underground, zero connection to the Internet or anything else. And we were still able to hack into those centrifuges and shut them down and make them break in a whole bunch of creative ways and so on and so forth. And so if somebody can get into your, your infrastructure that's not connected to the Internet, that's buried underground in the desert in a concrete vault, then they absolutely, a nation state of similar capability like China or Russia or Iran or whoever could get into your satellite, which by definition is connected to networks all over the planet. And by the way, in fact, I'll give you an example. So in my current capacity at the University of Chicago, we've partnered with defcon, the largest and longest running hacker conference in the world, to put out an annual report on the top findings at defcon. One of those findings this year was Around Space. And since this is a little bit more technical than I am, I'm just going to kind of read it off to you. So a group of hackers figured out that they could reverse engineer efforts to exploit VSAT satellite modems from Earth. And they focused on the Newtek MDM 2200 from iDirect. So as far as they could tell, this was the first successful demonstration of a signal injection attack on a VSAT modem using software defined radios from Earth. And so essentially they were able to attack VSAC modems from Earth with these software defined radios. That's pretty. I mean, these hackers are doing this on a shoestring budget. I mean, they're spending hundreds or single digit thousands of dollars just messing around. Now granted these are brilliant people, so they're messing around is a lot more advanced than most people's messing around. But nonetheless, if they can do it on a shoestring budget, imagine what China, Russia, Iran or some other bad actor could do when they have millions or billions of dollars to throw at it. And considering that China itself has said that we're going to be at war over Taiwan in 2027, which hopefully that doesn't happen, and hopefully that's all bluster and everything. But as we know from the Ukraine war, the first shot across the bow was against satellites. And we would presume the first shot fired in a war with China would be in space at our satellite infrastructure.

[Maria Varmazes]

We'll be right back.

[Dave]

Is your AppSec program actually reducing risk? Developers and AppSec teams drown in critical alerts, yet 95% of fixes don't reduce real risk. Why? Traditional tools use generic prioritization and lack the ability to filter real threats from noise. High impact threats slip through and surface in production, costing 10 times more to fix. AUX Security helps you focus on the 5% of issues that truly matter before they reach the cloud. Find out what risks deserve your attention in 2025. Download the application security benchmark from AUX Security. And now a brief message from our sponsor, Dropzone AI. Is your SOC drowning in alerts with legitimate threats sitting in queues for hours or even days? The latest SANS SOC survey report reveals alert fatigue and limited automation are SOC team's greatest barriers. Dropzone AI, recognized by Gartner as a cool vendor, directly addresses these challenges through autonomous recursive reasoning investigations, quickly eliminating false positives, enriching context and enabling analysts to prioritize real incidents faster. Take control of your alerts and investigations with Dropzone AI.

[Maria Varmazes]

I'm just curious, can you give me a sense of what kind of attacks are, are sort of typical for the space domain?

[Jake Braun]

Sure, I think that it is. To your point you made earlier, it's nothing new. You know, you know, folks are even doing, you know, very basic attacks. You know, what these guys did against the modems is, is pretty standard, I think. You look at, you know, your typical network attacks that are used against other computer systems are normal. I mean, you know, even basic things like SQL injections and so on, depending on the, depending on the attack surface that we're talking about, you know, are even applicable here. And that's like the most mundane, you know, lowest grade attack. But you know, folks should know that the folks in China and Iran and Russia and so on, and I guess North Korea for that matter, they spend all day, every day looking for zero days in this infrastructure. I don't know how much your listeners are familiar with this type of stuff, but they know what a zero day is. Do I need to explain that?

[Maria Varmazes]

Yeah, if you want to explain a zero day, that would be great. Yeah.

[Jake Braun]

Okay, so a zero day refers to basically a new vulnerability that nobody knew about before. Often when they talk about patches, they'll say, oh well, this was, you know, seven days since we, you know, was patched. Seven days since we found the vulnerability. In this case they're saying, well, there's, there's no patch, no one knows about this vulnerability. So it's a zero day. Like where this is, you know, we may have found it six months ago, but nobody knows about it. And so once we use it or release it, that'll be kind of the first time it was ever used and thus a zero day. And so these nation states stockpile these zero days and we can all be sure that they are absolutely doing that for space infrastructure.

[Maria Varmazes]

So if I'm a space company, large or small, I'm sure if I'm a large company, I have a good, I would hope a good understanding of some of the things that I would need to do. But I mean, no company can deal with this alone. I mean nobody can deal with it in a vacuum. Collaboration is key. Threat information sharing is key. What needs to be done? I mean what I know there are some efforts underway. I'm thinking of the Space ISAC is one of them in terms of sharing threat intel in the space industry and the space domain. But you know, if there's something going on, if there's a threat, that's if something is underway, how do people in this space domain share that information with each other in a meaningful way?

[Jake Braun]

Right, so first off, your initial point is the exact right one, join the Space isac. Even if you're a small company, I forget exactly what their fee structure is like, but usually the little guys and gals get a join for free or very reduced rate and it's worth it. Secondly, particularly if you're a startup and you don't have a ciso, hire a ciso. That's really important.

[Maria Varmazes]

Chief Information Security Officer.

[Jake Braun]

Chief Information Security Officer. Yes. And look, that's important not just for your security, but it's also important for your valuations and so on. I mean a lot of these folks in China and elsewhere will look at what companies most recently got major investments from private equity firms or venture capital firms or, or whoever else, and then those will be the ones they target. In fact, we found several years ago at Homeland Security or Homeland Security found several years ago that attacks from China on IP were directly correlated to press releases of $20 million of investment or more. And so yeah, like we could see that within weeks or, or whatever, after press release saying they got 20 million in investment, they were getting hacked and their IP was getting, you know, pulled out the back door. So it's not just that you should do this for the good of the security of our space infrastructure, it's also for the good of the security of your company's ip. So number one, join the Space isac. Number two, if you don't have a ciso, hire a ciso. And then number three, you know, if you have a ciso, they're going to know most of the things that you need to the basics that you need to do. But a huge challenge in cyber that often prohibits folks from, from hiring cyber staff is how expensive they are. And you know, if you want somebody with a master's or even a bachelor's, you know, in computer science with a, with a focus on cyber, you know, they, they're incredibly expensive. However, if you've already got a ciso, you probably don't need people at that level. And one of the things we really pushed for in the national cyber strategy was for companies to think about how they could bring on folks and do that are maybe not super duper cyber Experts with a PhD in cyber or whatever, but somebody who they can do on the job training. There's a lot of certifications, online classes and so on where you could plus up your cyber workforce, meaning you could do more cybersecurity if you were to bring on people who maybe have less qualifications from a degree perspective, but could quickly gain the hands on knowledge they would need from working with your ciso, taking some online classes, getting a certification here or there, or by the way, attending defcon, who we partner with on the Hackers Almanac, that again, I encourage everybody to Google and read because it's.

[Maria Varmazes]

I will definitely be doing that because I've gone to Def Con a bunch of times and I'm hoping to go again this year. I have always learned a ton and I am very much not a technical expert, but I learn a great deal just from going. And I think it's a very, as you said, it's a very educational in ways you may not expect very educational place to be.

[Jake Braun]

Yes.

[Maria Varmazes]

Well, Jake, I've learned a ton from you and I really appreciate you taking the time. So thank you for joining me today. If there's anything you want to leave the audience with, please, the floor is yours.

[Jake Braun]

I'll go back to my shameless plug of the Hacker's Almanac and the intro which I wrote. I talk about the fact that we're in the middle of a new great game. And so what you may remember from your History 101 in college class, the Great game was a struggle between Russia and the British over Central Asia. And many of us believe that we're in a similar struggle today. But instead of a conflict over Central Asia, it's over the Internet and really it's between authoritarian countries like Russia, China, Iran, North Korea and so on. And democracies and space is clearly one of the main parts of the terrain or so on that we're dealing with here. And everybody who's listening to this call or reading about this should know that they are, they are all players in this new great game, whether you know it or like it or not. And we are either going to protect our infrastructure to, to ward off authoritarian states and so on, who are trying to make the Internet and our lives not free, fair and secure. And that's kind of where we're going to find ourselves for probably the next 20 years is in the middle of this conflict between authoritarian states and the democracies of the world over cyberspace, to include cyberspace and outer space.

[Maria Varmazes]

That's it for T minus deep space. Brought to you by N2K CyberWire. We'd love to know what you think of this podcast. You can email [e-mail] or submit the survey in the show notes. Your feedback ensures that we deliver the information that keeps you a step ahead in the rapidly changing space industry. N2K Senior Producer is Alice Carruth. Our producer is Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester with original mutual music by Elliot Peltzman. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I am your host, Maria Varmazes. Thanks for listening. See you next time.

[Dave]

Hey, everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers, so I decided to try Deleteme. I have to say, Deleteme is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Deleteme's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Deleteme now at a special discount for our listeners today. Get 20% off your DeleteMe plan when you go to JoinDeleteMe.com n2k and use promo code n2k at checkout. The only way to get 20% off is to go to JoinDeleteMe.com N2K and enter code N2K at checkout. That's JoinDeleteMe.com N2k code N2K.