Transcript:
John Gilroy: Welcome to Constellations, the podcast from Kratos. My name is John Gilroy and I’ll be your moderator. Today, we’re looking at how data centric security and object level encryption are changing the way government and commercial space operators share information, especially as agencies move faster on AI, adopt proliferated architectures, and work to secure data moving across mixed clouds, networks, and constellations. Joining us are Charles Beames, chairman at the SmallSat Alliance and Dr. Angel Smith, executive director at the SmallSat Alliance. They’ll help us explore what these security shifts mean for mission design, interoperability, zero trust in space networks, and the policies that will shape how defense programs protect critical data in the years ahead. So we’re going to start off with Angel. So as agencies push to adopt AI faster, they’re hitting security models that weren’t built for fluid data. How does object level encryption let government work with commercial space operators without weakening security?
Angel Smith: It’s a really, really, really good question, John. A lot of the way that we’ve done business in the past is really a heavy emphasis on network and enclaves, kind of this perimeter security model. But the problem with that is the minute that you see some type of data that leaves outside that boundary, whether it’s a commercial operator, a partner, an AI model, whatever it is, the protection will stay behind in the environment that the data just left in. So what object level encryption allows you the ability to do is flip that narrative. The protection and the access policy stays within every single piece of data. So regardless of where it travels, it stays with that. And so this gives some of the benefits are that governments now can share very specific images, they can share telemetry, they can share a report with a commercial partner, they get to decide who opens it.
And probably one of the most incredible options whenever you start to look at object level encryption is they have the ability to revoke that access later. So you can give someone access and then pull it back. So you can stop asking the question whether or not you trust a network. You can really start asking the question whether or not you trust a specific person or an organization to share data and then you can change your mind a little bit later. It gives you a lot more flexibility in the data sharing world.
John Gilroy: Yeah, I took down the note, share safely. That seems to be an excellent approach to object level. Charles, you’ve worked at the intersection of commercial innovation and national defense. So how does a data centric security model change how government should leverage commercial SmallSat constellations?
Charles Beams: Well, John, first of all, I just want to thank you for spending the time with me and Angel on this. I’m proud to partner with Angel actually with the SmallSat Alliance because the alliance itself has been around for a long time, but a few years ago we all kind of noticed that everything was pivoting from more of a rocket science to more of a data science kind of environment. And the organization needed a real data scientist, someone that’s a true leader in the data world. And we were lucky enough to recruit Angel to help lead all that for us. And so I guess I’m kind of the old school guy in this whole thing. I’m not of the AI data generation, but I’ve been around a long time. And I’ll tell you that one of the things that you notice is that with the advent of data becoming the dominant aspect of space into the future, data scales exponentially.
And so what has to happen is that you have to have your security protocols up be able to scale with that. And just as Angel talked about before, the only way to do that is basically to protect at the data record level. And that allows the commercial innovation to be fully adopted because as we all know, commercial innovation is going at the pace of Moore’s law and all that kind of stuff. The only way to do that is to have a commensurate ability to scale with that. Otherwise, the government systems will lag and lag dramatically. In a sense, I like to think of things in simple terms. And really when we’re thinking about this object level protection, really what we’re talking about is in today’s environment, we have to assume that the network as a going in design concern, assume the network is compromised. It may not be, but you want to assume that it is in order to protect the data.
And that’s exactly what this does and that’s exactly what allows the government to fully adopt all this commercial innovation that is going on. It’s actually essential. The one thing I wanted to point out though in that is that this zero trust architecture that Angel was talking about, it solves a huge issue and allows the scale because attack surfaces are scaling exponentially as well. But the one thing it doesn’t do is it doesn’t solve the physical layers. And so we have to always be mindful of that. We always have to be pushing and we do as an alliance, we push for open standards, we used to call ICDs, interface control documents and stuff like that, so that not only can we bring in lots and lots of different brands if you will, of storage and networks and constellations, but also that there are open standards for which the war fighter can access them.
So anyway, in a sense, that’s really… The government does need to be clear though about when you get into this object level protection, the government does have to be clear about what exactly it wants in the policy protocols, policy access, what it wants protected and why. But frankly, that discipline is way overdue anyway.
John Gilroy: Angel, I got a question for you. Chuck brought up the government here. Defense programs run on a mix of contractor clouds, government clouds, and even coalition environments. So if the data is protected at this object level, what does that change?
Angel Smith: That’s another really good question, John. The thing that it actually does is it empowers the data. And so right now we’ve got these kind of isolated environments that because we’re creating them in isolation, they don’t necessarily have the interoperability that the mission requires. And so if the data starts to protect itself, it really doesn’t matter very much where it sits, whose cloud it is. Every single environment kind of become its own storage and its own transport. And then you can access and decide what the policy is attached to that data, whether or not it’s a coalition, a clearance, some type of a mission role, what’s the releasability of it? You put that at the data layer, it’s no longer isolated by environment. And so I think coalition sharing is probably one of the clearest examples that you could see. Today releasability, it really often means that you have separate copies, you’ve got a lot of manual reviews, you’ve got attribute based access on every single object.
One data set can serve US only or an ally, partner or whatever. I love to tell the story that I heard from someone, it was a British officer who said that he put together an intelligence briefing and by the time it went through this entire process, he couldn’t even read the briefing paper that he put together himself because we overclassified it and restricted it. This really would give you the ability to be able to put that releasability on the data object itself and then removing the bottleneck. Today you’ve got so many different ways that… It’s hand decided and then subjective in so many different ways. You actually start to add some type of a technical control to something so it’s more easily accessible and it’s got way more utility than it did before.
John Gilroy: Charles, when you get important data that’s coming to your organization, your agency, this bottleneck can delay it and there are time sensitive missions like missile warnings or tactical ISR. Data has to move fast. So how feasible is protecting information at the sensor level without slowing down this kill chain?
Charles Beams: Well, it’s a good question, but just as Angel alluded to in your previous question, of course encryption and that kind of thing takes a little bit of time, but not nearly as much as the time sink of what we used to call, Angel was talking about back in the day. In fact, it sounds like things haven’t changed since I deployed back in the ’90s in a lot of these intel centers. We used to call it sneaker net where basically you couldn’t put things on the same network because everybody in the coalition, we all fight in coalitions nowadays, and so we always worry about controlling access to different things. That actually is by far the biggest time sink. Is there a time hit for encrypting sensitive data like missile warning or particular reconnaissance collect stuff like that? Yes, but it’s very, very minor. You’re talking fractions of a second and that easily can be accounted for or accommodated in kill chains.
But what cannot be is the need for controlling in real time the access controls. And that’s the thing that’s sorely needed desperately. In fact, it’s obviously desperately needed in mission operations like missile warning, but even decision making, the proverbial OODA loop, even in the Pentagon, even just for normal routine IT stuff, it’s desperately needed because decisions at that level in the third floor of the Pentagon have to be made very quickly often as well. And it suffers from this same, I hate the word bureaucracy because it’s not really bureaucracy. It’s actually just this coordination cycle that Angel talked about.
John Gilroy: I have questions that I’m going to ask each one of you to respond to, and I’m going to start with Angel here. I’ve known you for a little bit here, Angel, and we know the federal government, they have legacy systems and I usually talk about legacy systems, but I’m going to bring up something different, legacy policy. Legacy policy is often the drag on cybersecurity transformation. So Angel, what changes in acquisition or cyber compliance would speed up secure by design adoption across government and commercial space?
Angel Smith: Yeah, I’ll tell you off the top of my head, I would say one of the things that I think we do wrong is we’ve got authorizations that certify the boundary rather than certifying the data control. I think probably that drives a lot of behavior that, as Chuck brought up a few minutes ago, the foundation of zero trust right now is assume that everything is compromised already. And one of the examples I like to use in regular, when I’m talking to somebody who doesn’t necessarily understand it, I say let’s pretend as if your home, you’ve got a lot of valuables in your house, but you knew that every single day after you leave, some bad guy walks into your front door or walks through your windows and he’s got… Completely goes through your windows because he has complete access over all of the valuables in your house.
How would you treat all of the valuables in your house if you knew that that was actually happening? And we talk about this scenario from a data perspective, but we continue to kind of reinforce we’re going to get better locks. We’re going to get better locks on the windows, better locks on the doors, even though we know that the locks don’t necessarily matter any longer. And I think on a policy side, we have to shift away from that exterior entry dynamic and think about how do we shift policy towards something that is way more focused on what’s actually inside the environment rather than the boundaries that we already agree are insufficient.
John Gilroy: Yeah, those are basic zero trust principles. Charles, what about the legacy policy? What are your opinions on preventing progress and innovation?
Charles Beams: I think, well, as we talked about earlier, scalability becomes super important and you have to scale it. Software is the only thing that really scales in the way that we need to do it. And the old school idea of hardware encryption methods, it’s got to go away. The other thing that I wanted to add in here is that we need resilience and resilience comes in… Think of depths. It’s not that if you have valuables, it’s not that you don’t want to lock your front door, but you want to have multiple things. Maybe you have neighborhood watch, so you have people that are driving around, that’s old school kind of thing. Then you have locked doors, then maybe you have all your valuables, they’re etched, or some of them even have some kind of an RFID tag so you can find them if somebody walks off with them.
We have to think about this stuff in terms of resilience. And by the way, I know today’s event is about data and that is central, but we need to think about resilience also in these hardware layers as well. We can’t just think of just one network because one network, if there’s only one, the data might be secure, but if the network itself is taken down, then there’s no network and then you still don’t get your data. So we have to be thinking more holistically, and I’m so excited that we’re finally as a country getting serious about zero trust and we have lots of great companies. In fact, most of us that work on the SmallSat Alliance, most of us are, this is a part-time passion for us in leading and doing this work. I can tell you that Angel, she truly is an industry leader in this particular area and the country and all 50 member companies of the Alliance are lucky to have her leading the Alliance at a time when this is by far and away, it’s the biggest vulnerability to the whole space architecture.
I know the attacks on satellites is top fold stuff in the Washington Post, physical kinetic attacks, but the reality is General Whiting even called the soft data, cybersecurity is a soft underbelly of the Space Force. It’s high time to get serious about zero trust and doing exactly this object level protection and access control that it also helps with spoofing, by the way, that Angel talks about.
John Gilroy: Yeah. So Angel, I’m going to ask you to reach into your desk and pull out your crystal ball here and tell me, so looking ahead, so what’s the next big turning point on how the defense space community protects mission data and what does securing a whole mission ecosystem of satellites, ground nodes, AI agents and industry partners, what does this all look like?
Angel Smith: I will tell you, I honestly believe that the turning point is actually going to be whenever we can really make a strong pivot towards understanding the relevance and the focus on data specific or the object level security. Chuck just talked about having different tags on different types of things, that’s all an object focus. We all know that it needs to happen. We all know that it’s necessary. The problem is that it requires such a completely different thought process. But when you think about it from the ecosystem, everything unblocks when you start looking at data and all of these objects as an individual rather than something within a specific kind of network. When you start looking at it from that vantage point, you start to realize that everything transforms. It speeds up mission data for war fighters, it speeds up policy, it speeds up everything. Everything really does start to transform.
John Gilroy: Charles, is your crystal ball still functioning?
Charles Beams: Well, it is. I’ll say actually, and I’m very proud of the alliance, so I keep bringing it up, but it was a SmallSat Alliance that actually originated the very concept of what’s now called a hybrid space architecture. This idea that we can have one synthetic architecture that integrates commercial with government. And that’s not just a constellation, that’s at data levels, everything else. And that concept, that idea came actually from the Alliance and the full manifestation of it will occur with this zero trust object level control because now it doesn’t really matter. As long as the data’s validated, we know it’s validated in terms of it’s not spoofed data or something like that, which by the way, the same Estate access controls solve, then we can realize the full potential of the commercial industry for national security. And that is how we’re going to win the second space race.
That’s always how America wins, is by leveraging our, that’s how we won World War II, that’s how we win everything. We won the space race, the first space race. We leveraged the full might of America’s economic infrastructure and we’re getting there. We’ve come a long, long way, but we have much further to go. And frankly, this is a key step in that process. So I’m very excited about it.
John Gilroy: Yeah. Charles and Angel, I think you’ve given our listeners a better understanding of securing data and defense space missions. I’d like to thank our guests, Charles Beames, chairman of the SmallSat Alliance and Dr. Angel Smith, Executive Director of the SmallSat Alliance.
Angel Smith: Thank you, John.
Charles Beams: Thanks a lot, John.
