A flexible and robust framework for the secure systems engineering of space missions
Résumé
Modern society has become more reliant on space systems than ever before. Critical infrastructure, emergency services, weather forecasting, scientific study, communication, and decision making rely heavily on space systems and spacebased data. As society's reliance on space systems continues to grow, so too does their attractiveness as potential targets to adversaries. There is an abundance of secure systems engineering standards, methodologies, and processes that guide the secure engineering process of terrestrial IT systems. However, such standards and methodologies that systematically guide the end-to-end secure engineering process of space systems, which are highly complex and multidisciplinary by nature, are scarce. This paper presents a potential solution to this problem in the form of a software framework titled Secure Systems Engineering for Space (SSE4Space). This paper presents one framework currently under development in response to a tendering action initiated under the European Space Agency's General Support Technology Programme (GSTP). It aims to bridge the gap between top-level security governance and secure space systems engineering practices. This includes: identifying and extending applicable threat and risk assessment and secure systems engineering methodologies; defining consistent vocabulary to be used throughout the framework; building software tooling to guide users through the end-to-end secure systems engineering process; and defining and generating reusable products such as security requirements catalogues, test reports and risk assessment reports among others. To achieve this, SSE4Space identifies the gaps present in the current ECSS standards by comparison with the other existing state-of-the-art international Secure Systems Engineering (SSE) standards. Based on that, it creates a complete end-to-end process catalog, consisting of the standard ECSS tasks reinforced with security tasks prescribed in the SSE standards. It then develops a software framework that encodes this process catalog and guides the user throughout the course of a project indicating the security tasks to be performed and feeding the security artifacts properly and at the right time in the process. This ensures that the adequate level of security has not only been achieved on the completion of the project but is maintained throughout its course. This also helps in developing a certification methodology to verify how closely the process has been followed and to what extent the desired level of security has been ensured.