ISO27001 for ground segment security

Abstract

This paper presents an overview of application of the ISO27001 standard for securing ground segment which is crucial for spacecraft operations. The purpose of this paper is to provide guidance for successful alignment of space business processes with ISO27001 standard and to present solutions for typical space industry problems in implementing risk mitigation measures. The scope of this paper is limited to the ground segment security only, space segment security is considered out of scope. Each space mission varies with security requirements and in-orbit duration depending on its mission objectives, but all missions of an organization use some common ground segment infrastructure which is shared across several missions for cost efficiency. Risk mitigation measures and strategies that protect each mission's assets whilst benefitting from using shared infrastructure are presented in this paper. The solution allows missions with High, Medium or Low security requirements to co-exist and interoperate without compromising security. In order to assign qualitative values to Confidentiality, Integrity and Availability requirements of the ground segment assets, a risk assessment methodology must be designed with security primitives based on mission operations. Such a methodology that suits space industry is developed. Problems related to patch management, certificate & key management, event correlation, malware and business continuity & disaster recovery are addressed. Based on the experiences of the author in security standardization efforts, solutions provided in this paper would help ongoing and future security improvement activities in space organizations. © 2012 by the American Institute of Aeronautics and Astronautics, Inc. All rights reserved.