Trusted Information Sharing, ITAR Exemptions and Lots of Test Beds

Transcript:

John Gilroy: Welcome to Constellations, the podcast from Kratos. My name is John Gilroy and I will be your moderator. During this episode, we’ll explore the cutting edge of space systems cybersecurity with two leaders shaping its future. Erin Miller, Executive Director of the Space Information Sharing and Analysis Center, and Lori Gordon, Systems Director for Space Enterprise Evolution at The Aerospace Corporation. They will break down the significance of ASC‐100, a new voluntary cybersecurity standard that sets the foundation for trusted interoperable space systems and how its real world implementation is being accelerated through test beds and proving grounds now available to ISAC members. From threat‐informed design to cross‐ domain system resilience. You will learn how ASC‐100 has helping both industry and government stakeholders align on a common framework for space cyber defense. Lori, can you explain what ASC‐100 is and why it is a critical step for advancing cybersecurity and resilience and space systems?

Lori Gordon: Absolutely. I’ll give the context and toss it over to Erin. So we stood up ASC‐100, Accelerating Space Capabilities 100 in Space Symposium 39 over a year ago because there was a need to accelerate the deployment of commercial capabilities. So at ASCEND last week, we had a panel on this. We discussed how 12,000 space companies are innovating right now, but how do we bring that capability to orbit because they’re developing, but how do they deploy? So we’re focusing here on the second valley of death, really the deployment piece. And so it’s expensive to test your capability in orbit, so is there an equivalent to flight that we can do on Earth terrestrially here? So also how do we do that. Bridging all of the test beds and proving grounds together in sort of a network, under a governance framework. How do we shared information with acquirers, integrators, insurers, investors, all of those decision makers that will actually invest, ensure to make that capability go to orbit. So that’s here what we’re doing.

John Gilroy: Yeah, Erin, 12,000 companies. My goodness, that’s a lot of innovation, isn’t it?

Erin Miller: It is, yeah. And can you imagine with the complexity of space systems how much testing needs to go on? The ASC‐100 program that we set up is really like a race to get as many test beds as possible, so we think of it as getting at least 100 as a starting place. Test beds and proving grounds will span across national labs, federal labs, commercial and international resources and universities. So if you think of the mission that someone is trying to accomplish and all the testing that needs to get done and backing that with a standard expectation for how we do that testing and proving, getting through the multiple valleys of death, then they can use this catalog to diversify their access to resources to do as many tests as possible. And the importance of this is that that’s how we accelerate and that’s how we move faster. That’s how we really maximize our access to resources.

John Gilroy: Lori, software developers love the word framework, so I got a framework question for you here. ASC‐100 emphasizes common frameworks for cyber‐ informed space system development. So how do you see this enabling interoperability across the commercial and government space sectors?

Lori Gordon: Absolutely. So last week at ASCEND, we brought this on stage in support of Golden Dome, the defense sector, that major initiative as well as NASA’s Moon to Mars initiative. And we have a governance framework that we’ve established that basically has a set of parameters that all of the testbeds and proving grounds will populate. So we have a common shared set of information for all the decision makers to understand. So for example, how does the testbed and proving ground manage IP? How do they manage security, not just of their facility, but also their people? How do they manage access, et cetera. So it’s the same set of information that all the decision makers that are critical to basically pressing go for all these capabilities to deploy will have in common, and so that’s the shared governance framework that’s so critical that has never been done before. And so this marketplace that Space ISAC is hosting on its portal will be able to have that shared set of information that folks will have the trust and confidence to understand what actually was released in the test process, the test plans, the information that is shared and trusted.

John Gilroy: So what role do you envision ASC‐100 playing in aligning cybersecurity approaches across the diverse and increasingly international space supply chain?

Erin Miller: Right, John. Well, as your audience knows, Space ISAC’s mission is to facilitate collaboration across the global space industry and enhance our ability to share timely actionable threat information and raise the overall security posture. So with ASC‐100 then, we do have a number of cybersecurity type tests, pen tests if you will, and red teaming that can happen in our cyber vulnerability lab. We have a couple of companies that have already come in and they’ve started doing work. One of them has built out a cloud‐based infrastructure for red teaming the supply chain of a space system. And then we have another company that’s doing on orbit intrusion detection. And as they do their on orbit intrusion detection, it leads to feeds of information that can be used to analyze the threat and analyze the vulnerabilities. The maturity of the space industry as a result of these capabilities, I believe is going to increase dramatically, but because we’re doing it as an international space community working together across Australia, the new global hub that we stood up in 2024, and then also in 2025, our UK global hub and Space ISAC is working towards having even more global hubs, this international community is collaborating together on these ASC‐100 test beds and proving grounds.

John Gilroy: So Lori, if you go to the Space ISAC website, I’ll bet you’ll find a press release and it mentions new test beds and proving grounds. So what kinds of experiments or use cases are you seeing as top priorities for validating ASC‐aligned architectures, Lori?

Lori Gordon: So interesting, and banking on what Erin just mentioned about the AUKUS security partnership that is providing inroads and integration interoperability between the Australia, UK, US partners that we have not had before. Basically the ITAR exemption is greasing the wheels for increased cooperation, and so we are bridging UK, US, Australian laboratories on things like, how do we test this robotic arm for an ISAM, In‐Space Servicing and Manufacturing initiative? How can we deploy, relative to responsive space, if there is a challenge, a global issue, how can we deploy that very quickly? We can now collaborate very quickly between labs overseas, which has never been done before, and that’s due to the AUKUS ITAR exemption, which is fantastic. Also, aerospace is doing things with AI enabled satellite operations with our edge node capability. So there’s lots of things going on, lots of labs.

John Gilroy: Erin, what use cases do you like to talk about, especially as first priorities go?

Erin Miller: Yeah, we’re planning for the International Aeronautical Congress coming up in Sydney in September of this year, September through the first week of October. And leading up to that, Space ISAC is going to host an ASC‐100 workshop that is going to look at single stage rocket testing for hypersonics. And as Lori says, this is underpinned by the AUKUS exemptions for ITAR. And we will work through the steps to be able to share data, share information that typically is a bit challenging to share because it’s controlled by ITAR, but in this case, we’re using the exemption to be able to share that information and work with US, Australia, and UK companies through this testing process.

John Gilroy: So Lori, you don’t get a press release unless there’s something new, so let’s talk about new here. So how do these proving grounds support both mission assurance and threat emulation in ways that space stakeholders haven’t been able to do before? So what’s new?

Lori Gordon: Absolutely, what’s new? So well really what’s new, and going back to what Erin was mentioning, we have an ASC‐100 paper that we are publishing in Sydney at IAC, so that’s very exciting. So Erin and Aerospace’s CTO Debra Emmons will be presenting that. So we look for everyone to participate, to better understand what that looks like. So really what’s new is we’re moving to digital threads. It’s the whole digital ecosystem. We’ve been very physically focused, and so this is the whole new ecosystem. We’re working across, communications, transport, energy. We’re not just talking about technology also, but the policy behind things. So we’re moving to digital. We’re also moving from technology to policy and thinking through those concepts. We’re also thinking about shared assumptions where that’s part of the ecosystem that’s really important, as part of the future state. Again, we’re looking to Golden Dome and Moon to Mars. We’ve got to keep those two important national level initiatives first and foremost. And so all of this work we’re doing with Testbeds and proving grounds, federating them with the allied community is supporting all of that.

John Gilroy: So Erin, what kind of activities do you see that you’ve not been able to do before this announcement?

Erin Miller: Yeah, with ASC‐100 then, we started looking at future focused technologies and realized some of them are already presently available. In order to do Golden Dome and Moon to Mars, we have to have a shared vision of the future and the shared vision of the future includes quantum applications to space systems. Those are not really fully proven out yet. So this Testbed and proving ground that we just piloted, it’s available through a couple of different companies that are supporting it at Space ISAC, and one of them is a newer start company called SQS, Secure Quantum Solutions. They launched their pilot capability to prove this out just a few months ago. And we have done a couple of workshops, we’ve also generated a lot of interest and understanding of how this is really going to work going forward and when we’re done, we will prove out that quantum applications for space systems is real. It’s not the future, it’s actually something we can do today and we can bring it to real programs. And those mission integrators, mission owners, and those who provide the barriers potentially, because that’s their job, is insurers, investors and others, then they will be able to use this quantum applications testbed to show that it is defensible and worthy of investing in.

John Gilroy: Now Lori, people always say, two assurances are death and taxes, but I think in our world the two assurances, iterations of software and changes in development. So what lessons are emerging from testbed implementations that can inform future iterations or enhancements of ASC‐100?

Lori Gordon: Yeah, absolutely. So I think we’ve been successful in getting the support of the government, so NASA and DoD are both supporting the governance framework, which is fantastic. They see the value in Golden Dome and Moon to Mars. We’re also seeing the value of cyber security and how that can pollinate across all of these test beds and proving grounds. So how does Space ISAC’s CVL, Cyber Vulnerability Lab, do some testing or assure what the other labs are doing in terms of their test outputs and things like that? So we have things like CyberSentry, DarkSky, CAVE Lab, CyberSnap, a lot of these different labs that are providing some cyber security protocols, information assurance, mission assurance to major programs across the government, and we can just improve on those using Space ISAC’s CVL.

John Gilroy: Yeah. So Erin, when you use one of these test beds, you learn new things and that may guide future implementations or enhancements to ASC‐100. So what have you seen come up that might help guide future iterations?

Erin Miller: In my previous experience, I was working with all of these federal labs to figure out how to get their technologies transferred, and it’s a manual process even to date. So making this catalog available and putting labs in a place where those who are spending the money on the mission are able to access them readily, it’s a big game changer. So we’re going to be collecting data from each of the test beds and not just to inform how we use the test beds and the lessons learned, but also to understand more about what the demand is. Where are the demand signals for different types of test beds? Where do we have duplication of resources and need to pivot and innovate and use different technologies. like on orbit testing, there’s going to be much higher demand for that in the future, lunar based testing or simulated environments, there’s going to be a higher demand for that. So we need to measure what that demand is, and we expect to be doing that through this catalog as well and sharing those metrics out, doing analysis. It’ll be quite fun.

John Gilroy: Erin, I want to dive a more into ASC‐100. In this ASC‐100 context, how important is a cyber physical mindset when securing space systems from, I guess from satellite payloads to terrestrial ground systems?

Erin Miller: This is what space systems are, they are cyber physical. Whenever we have a conversation about the space systems’ architecture, then we’re always talking about the interconnectivity with the physical world or even the space‐based environment. Space weather is a really good example, if you don’t do testing that accounts for the space weather environment or what some people would call hardening, then we’re not actually really prepared for that environment. So this ASC‐100 program, the goal is to address as many cyber and physical related issues. All programs that are dual use programs have a huge emphasis on cyber and resilience, especially these days. And we see that across the world. So the EU just passed the EU Space Act, and 50% of that is about sustainability and resilience, and the underpinnings of sustainability and resilience are cybersecurity. So it’s not just a US‐based construct, this is a global construct that we have to have resilient infrastructure. So we’ll be addressing cyber and physical throughout the entirety of this program.

John Gilroy: Erin, I just want to maybe take a look or get some perspective on your members. So Erin, from the space ISAC perspective, how are your members leveraging access to ASC‐100 tools and testbeds to enhance their own capabilities or maybe even their risk posture?

Erin Miller: Giving members value and access and a voice is a huge part of what SPACE ISAC is about. We love it when companies come up with something that’s new to be able to advance the security and resilience of the space industry. So we started doing a series of workshops, and these workshops do focus on bringing a testbed or proving round that a approving ground that a member has created, manages, owns, whatever the case may be, and making it available to the community. So we have all different types of members doing this, the small ones, the multinational corporations, and even the university‐associated type testbeds and proving grounds. And what we like to see is these workshops generating interest. So we did a workshop actually in Toulouse, France, not a bad place to go, and from that workshop, we were able to show interest from the French Space Agency, from French Space Command, from NATO, from a variety of different commercial companies and that has really blossomed as an opportunity for this organization that we were working with to be able to travel even more throughout the EU and discuss what their capability could bring. So we know that every time a member gets involved, then there’s going to be a significant return on their investment.

John Gilroy: So Lori, question for you. How is Aerospace Corporation supporting the transition from standards to implementation, especially for organizations that might be early in their cybersecurity maturity?

Lori Gordon: Right, absolutely. So we do work with Department of Defense on several programs, the front door, where we’re helping mature companies through their TRL levels. That’s one major area. So that’s TRL. We’re also focusing on how do we improve their CRL, the Capability Readiness Level. And that’s sort of a broader picture that encompasses more integration with other companies, other capabilities, things like this. So that’s sort of something that’s new for the government that we’re embarking on.

John Gilroy: So Erin, what’s next for ASC‐100 in terms of governance, adoption or future expansion? I mean, are there plans to tie it more closely to acquisition policy or maybe mission certification?

Erin Miller: Yeah, this program is absolutely about optimizing access to resources and in the present‐day environment, it makes complete sense that the US government and commercial missions would look at this as a way to do acquisition in a more sustainable way. With the technology that we have at our fingertips, there’s no reason not to do it this way. I think any policy that would direct a company or a mission integrator to look at their resources in a more comprehensive fashion for test beds and previewing gowns before making a decision would just be common sense. So I hope that we can really get that documented in an acquisition policy in the future, or even just encourage the industry through the investors and the insurance providers to make this choice.

John Gilroy: I’ve got this huge monster question, and I’m going to ask both of you this, and so it may take five hours to answer this one, but we’re going to jump in with Erin first and go to Lori. So Erin, let’s look at these emerging capabilities. Everyone knows AI and ML, autonomous operations, software‐defined space assets, so how can they integrate with or challenge ASC‐100 line security frameworks? Where’s it all fit in, Erin?

Erin Miller: This is the hardest part for sure, because we have these novel capabilities for AI/ML and for Quantum and everything that we’re working towards for space, it’s possible to test, and we have the test beds and proving grounds, but coming up with a framework to test against when we haven’t done all the deployments of these technologies yet is a bit more challenging and we need a community‐ based approach. So this is why Space ISAC is a great platform working with the Aerospace Corporation to make this possible because we can really bring together the community to develop the frameworks that we’re testing against and move towards maturity of the space industry. But that maturity word, I use that in interchangeably with speed and agility because if we have a common understanding of what our framework is we’re testing against and we agree upon that, we can move much faster and we can combine test beds, improving grounds, pivot back and forth between them, have data sharing between them, everything really can accelerate space capability.

John Gilroy: Lori, I’m sorry, I stepped on you earlier. You want to expand on this monstrous topic here about AI/ML autonomous operations, software‐defined space assets, so how does AI fit in all this?

Lori Gordon: Yeah, absolutely. So I think writ large, what we’re trying to do here is develop this governance framework that includes AI/ML, all of these sort of emerging technologies. What we’ve done is we’ve reached out to the key stakeholders, the key decision makers, including investors, insurers, the acquirers, the regulators, and we’ve had one‐on‐one discussions with them, technical exchange meetings to get their feedback on what, if you were to assess a capability going through a test bed, what information would you need to know whether that’s an AIL capability, how that functions in the software of that test bed, what do you need to know to have trust and confidence? So we’ve had these individual conversations. I think that’s very important and we’ve done the leg work with the key decision makers for deployment. For all of the 12,000 companies that are deploying to space, we have engaged with the leading acquirers, insurers, investors, integrators, regulators, and researchers to get their perspective and their trust and confidence in the information coming out of the test beds to deploy.

John Gilroy: Well, Erin, Lori, I think you’ve given us so much information, I think anyone listening to this podcast all over the world should go to Constellation’s podcast and download the transcript. I’m trying to take notes and I ran out of ink. There’s so many innovations, so much is going on here. I hope you have a lot of success in Australia, but this is like a big snowball going downhill. There’s so much going on and thousands of new companies and the launch has taking place. It seems like every day is a new launch. I mean, this is an exciting time to be involved with Space and Space ISAC. I’d like to thank our guests, Erin Miller, Executive Director of the Space Information Sharing and Analyst at ISAC, and Lori Gordon, System Director for Space Enterprise Evolution at the Aerospace Corporation.