Satellite communications - ITSAP.80.029

Very small aperture terminal (VSAT)

VSAT is a technology that refers to a two-way satellite ground station that uses small dish antennas (generally less than 3 meters) to transmit and receive signals over a satellite communications network. VSAT systems are commonly used for point-of-sale credit card transactions in retail, to transmit banking transactions between head office and branches, to relay telemetry from OT systems, and to provide Internet access in remote regions. VSATs are easily deployable as they require little infrastructure to set up and operate.

Check out the National Security Agency’s (NSA) publication on Protecting VSAT Communications

SATCOM network providers must protect their deployed satellite equipment while in orbit from physical damage caused by unintentional or malicious threats. In addition, the following mitigation measures can reduce the risk of compromise to the satellite communications ecosystem:

• Monitor network activity for anomalous traffic at ingress and egress points. Unauthorized traffic and security incidents should be promptly investigated by qualified security operations centre (SOC) personnel. This enables quick response to contain the spread of compromise to the rest of the network.
• Ensure that all management, control, and user planes communications are physically or logically separated. They should also be isolated, encrypted, and authenticated within the network and when transmitted over satellite links.
• Implement physical security measures to protect the satellite core infrastructure and ground stations from malicious attacks, equipment failures, or natural disasters. Some examples include the use of surveillance cameras, physical locks, access controls, and fire or flood protection. This can prevent unauthorized access, loss of management access to critical core network equipment, or diminished capacity of the network operations centre (NOC).
• Avoid unnecessary connectivity to the Internet or public networks for SATCOM devices. But if required, implement network protections such as firewalls and virtual private networks (VPN) to limit access to only trusted communications.
• Use spot beams and frequency hopping methods to reduce signal interference and avoid interception. Spot beams concentrate satellite signals to cover limited geographic areas on Earth. Frequency-hopping is the rapid switching of the carrier frequency during transmission.
• Ensure the satellite core network infrastructure is designed and built with robustness and redundancy. For example, implement hot, warm, or cold back-up sites, disk mirroring, or storage replication. Use appropriate protocols and policies to minimize instability in the core Internet routing table. These measures can keep data flowing in the event of a failure or prevent complete loss of subscriber authentication platform.

Operators of critical infrastructure, enterprises and organizations can help protect the SATCOM ecosystem by implementing the following measures:

• Leverage the use of tools with transmission security protections to conceal traffic volumes, mask traffic sources and destinations, as well as validate that remote terminal access sessions are authorized.
• Install filtering devices on antennas to mitigate localized interference from non-malicious (unintentional) ground jamming from other wireless devices.
• Work with satellite operators or network providers to understand possible data leakage scenarios and mitigate risk of exposed geolocation information.
• Configure Internet exposed SATCOM and mobile communications devices with non-descriptive naming conventions and identifiers. This can make it harder for threat actors to identify the devices on the network and which ones may have existing vulnerabilities that can be exploited.
• Ensure SATCOM equipment and software developers use secure software development practices (e.g. avoid the use of hardcoded backdoors or of weak encryption and authentication mechanisms).

• Enforce the principle of least privilege, where users are given only the set of privileges they need to perform authorized tasks.
• Enable automatic updates of IT equipment and patch known exploited vulnerabilities as soon as possible.
• Use intrusion detection systems to monitor and identify unwanted traffic (e.g. port scans) on the network. Vulnerability assessment services or tools should be used to scan the network for vulnerabilities.
• Segment the corporate IT network from operational technology (OT) and Internet of Things (IoT) networks to minimize compromise of sensitive information in the event of a security breach.
• Secure satellite connected communications devices by changing vendor-supplied default credentials, using multi-factor authentication, and encrypting data generated from them.
• Develop an IT recovery plan as part of an overall business continuity strategy in the event that satellite communications services become unavailable.
• Establish a robust supply chain risk management strategy to reduce the chance of acquiring and deploying potentially vulnerable products into the satellite communications ecosystem. This should include applying security clauses in procurement contracts and purchasing telecommunications equipment and services from trusted vendors.