[论文解读] NATOs Mission-Critical Space Capabilities under Threat: Cybersecurity Gaps in the Military Space Asset Supply Chain

Berenike Vollmer|arXiv (Cornell University)|Feb 18, 2021

Cybersecurity and Cyber Warfare Studies被引用 5

一句话总结

本文识别出北约军事太空资产供应链（SASC）中的关键网络安全漏洞，主要源于老旧系统、商用现成（COTS）技术以及治理薄弱。通过与北约、产业界和学术界进行的19场高层访谈，本文提出两项关键解决方案：提升系统性认知意识，以及建立标准化监管框架，以增强SASC中的透明度、问责制和早期威胁检测能力。

ABSTRACT

The North Atlantic Treaty Organizations (NATO) public-private Space Asset Supply Chain (SASC) currently exhibits significant cybersecurity gaps. It is well-established that data obtained from space assets is fundamental to NATO, as they allow for the facilitation of its missions, self-defence and effective deterrence of its adversaries. Any hostile cyber operation, suspending control over a space asset, severely impacts both NATO missions and allied Member States national security. This threat is exacerbated by NATOs mostly unregulated cyber SASC. Hence, this thesis answers a twofold research question: a) What are current cybersecurity gaps along NATOs global SASC; and b) How can NATO and its allied Member States gain greater control over such gaps to safeguard the supply of NATO mission-critical information? An ontological field study is carried out by conducting nineteen semi-structured interviews with high-level representatives from relevant public, private and academic organizations. This research was undertaken in collaboration with the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn, Estonia. This thesis concludes that current cybersecurity gaps along NATOs SASC are caused by cyber vulnerabilities such as legacy systems or the use of Commercial-Off-the-Shelf (COTS) technology. Inadequate cyber SASC management is caused by hindrances such as misaligned classification levels and significant understaffing. On this basis, NATO should consider two major collaboration initiatives: a) Raising Awareness throughout the whole of the NATO system, and b) Pushing forward the creation of regulation through a standardized security framework on SASC cybersecurity. Doing so would enable NATO and its Member States to recognise cyberthreats to mission-critical data early on along its cyber SASC, and thus increase transparency, responsibility, and liability.

研究动机与目标

• 分析北约公共-私营军事太空资产供应链（SASC）当前的网络安全漏洞。
• 识别SASC治理中的系统性弱点，包括分类级别不一致和人力不足。
• 评估对太空资产的网络威胁如何直接影响北约任务、威慑力以及盟国国家安全。
• 提出可操作的建议，以增强SASC中各环节的控制力与韧性。
• 支持北约及其成员国在太空网络安全领域实现更高的透明度、责任意识与责任追究。

提出的方法

• 对北约、盟国成员、私营太空企业及学术机构的高级代表进行了19场半结构化访谈。
• 采用本体论田野研究方法，绘制全球SASC中的网络风险与治理挑战图谱。
• 与位于爱沙尼亚塔林的北约合作网络防御中心（CCDCOE）合作，确保政策相关性。
• 分析访谈数据，识别出反复出现的网络安全漏洞，包括对老旧系统和COTS技术的依赖。
• 将研究发现整合为两项战略建议：开展认知宣传运动与推动监管标准化。
• 运用定性数据分析，提炼出关于改善SASC治理与威胁检测能力的可操作洞察。

实验结果

研究问题

• RQ1 北约全球军事太空资产供应链（SASC）中的主要网络安全漏洞是什么？
• RQ2 老旧系统与COTS技术如何加剧SASC中的脆弱性？
• RQ3 哪些制度与操作障碍阻碍了北约在SASC中实现有效的网络管理？
• RQ4 北约及其盟国成员如何提升对关键任务太空数据的控制力与韧性？
• RQ5 标准化安全框架与认知提升举措在保障SASC安全方面可发挥何种作用？

主要发现

• 北约SASC中的网络安全漏洞主要源于过时的老旧系统和商用现成（COTS）技术的广泛使用。
• SASC管理不善源于北约与合作组织之间分类级别不一致，以及严重的人力资源短缺。
• SASC缺乏监管导致信息不透明，降低了透明度、问责制与网络事件的责任追究能力。
• 对太空资产的威胁（如失去控制）会直接损害北约任务执行、集体自卫能力与威慑姿态。
• 建立SASC网络安全的标准化安全框架至关重要，可统一标准、提升风险识别能力，并实现协同响应。
• 在北约整个组织架构中提升系统性认知意识，对于在太空作战中培育网络韧性文化至关重要。