Satellite Ground Segment Security: Who Defends What

What “the ground segment” actually means

The ground segment is everything in a satellite system that is not in orbit: the teleport or gateway earth station, the network management system that configures and commands terminals, the remote terminals themselves, and the networks on either side of them.

For a satellite operator, the reference is NIST IR 8401, Satellite Ground Segment: Applying the Cybersecurity Framework to Satellite Command and Control (30 December 2022), which concentrates on commanding satellite buses and payloads. For an enterprise buying capacity, the more useful frame is NIST IR 8441 (25 September 2023), which defines a hybrid satellite network as “an aggregation of independently owned and operated terminals, antennas, satellites, payloads, or other components that comprise a satellite system.”

The load-bearing words are independently owned and operated. IR 8441’s emphasis falls on the interfaces between the participants of the network, because that is where responsibility is handed over — and, in most enterprise deployments, where it is quietly dropped. Nobody writes down who is accountable for the terminal’s management interface, so nobody is.

Five parts are worth separating, because each has a different owner and a different failure mode: the teleport and gateway; the network management system and terminal management plane; the space link itself; the terminal at your site; and your own network or operational technology behind it. The hero diagram at the top of this page shows where the boundary between the last two belongs.

Why the management plane is the highest-value target

Viasat states that the intruder exploited “a misconfiguration in a VPN appliance to gain remote access to the trusted management segment”, then moved laterally to the segment used to operate the network. What followed is the part worth studying:

“used this network access to execute legitimate, targeted management commands on a large number of residential modems simultaneously”
— Viasat, KA-SAT Network cyber attack overview, 30 March 2022

Those commands overwrote key data in flash memory, leaving the modems unable to reach the network. Viasat says it shipped nearly 30,000 modems to distributors to bring customers back online, and that its analysis found no damage to modem hardware, software or firmware images — the modems, it states, can be fully restored via a factory reset. That is an important qualification: the units were recoverable, but recovery required physical access to each one.

Read the sequence as a defender. The destructive step used the management system’s intended function, at its intended privilege level, over its intended channel. Controls that look for malware signatures, exploit traffic or unexpected protocols do not fire, because none of those things is present. What is present is a change in shape: a burst of ordinary configuration or firmware commands, at an unusual hour, fanning out to an unusual number of terminals at once. The detectable quantity is rate and fan-out, not payload.

This pattern now has a name. The Aerospace Corporation’s SPARTA matrix — which the project describes as covering space-system tactics and techniques, “now encompassing both spacecraft and ground segment capabilities” — released version 4.0 on 6 August 2026. That release added eight Impact techniques, IMP-0007 to IMP-0014, among them Native Functionality Abuse, State or Mode Manipulation and Configuration Manipulation; it also introduced a separate Ground Segment Cyber Defenses section, whose guidance is organised into Baseline and Enhanced implementation tiers rather than the Tier I–III scheme used for the spacecraft countermeasure catalogue. Version 4.0.1 became current on 24 August 2026. A threat model that only enumerates exploits is now demonstrably behind the taxonomy.

The academic picture points the same way. A 2026 review in Aerospace covering 189 studies from 2004 to 2025 notes that the ground segment centralises data and exposes management interfaces, which is why it recurs in the tampering cases the authors survey.

The boundary you actually own

Almost none of the ground segment belongs to you. The teleport is the operator’s. The management system is the operator’s. The terminal at your site is operator-managed customer premises equipment with a control path you did not build. Even the link-layer protection is an operator implementation choice: ETSI TR 101 545-4, the DVB-RCS2 lower-layer implementation guidelines, describes three TRANSEC profiles — Consumer, Professional and Government — with materially different authentication and key management, from passphrase-based security enabling, through installed X.509 certificates, up to certificate-based authentication of terminals and hubs. Which profile a given network runs is a procurement question, not a setting you can change.

That leaves three things that are genuinely yours.

Put your enforcement boundary behind the terminal

Treat the modem as untrusted equipment inside your perimeter, not as part of your network. Your own router or firewall terminates your trust; the terminal does not.

Encrypt at your own layer

Whatever the operator’s TRANSEC profile provides, protection you control end to end across the link is protection that survives a change of operator, a change of profile, or a compromise upstream of you.

Plan for terminal-fleet-down, not just link-degraded

This is the under-discussed one. Most continuity plans model satellite outage as rain fade or congestion: minutes to hours, self-healing. KA-SAT demonstrated a different mode, in which terminals need replacement or an on-site reset. At a camp several days’ travel from the nearest depot, “restore by factory reset” is a logistics plan, not a runbook step, and the spares holding that makes it survivable is a decision someone has to take before the event.

A reference card: who defends what, and what to watch

The two tables below are the practical artifact. Fill the first in for your own service — the column that usually comes back blank is the third one — and use the second to decide what your operations centre should be correlating.

Table A — Responsibility map

Table B — What to watch at your own demarcation

The first five days

• Day one. Draw the demarcation on one page and name an owner for every element in Table A.
• Day two. Move your enforcement point behind the terminal, so your trust starts at equipment you control.
• Day three. Turn on end-to-end encryption at your own layer, independent of the operator’s TRANSEC profile.
• Day four. Start correlating site outages centrally, so simultaneity becomes visible as a signal rather than a coincidence.
• Day five. Add “terminal fleet unusable” to the continuity plan as a distinct scenario, with a stated spares holding and travel-time assumption.

What this looks like at a remote site in the Gulf

For operators of critical national infrastructure in Saudi Arabia this is not only good practice. The National Cybersecurity Authority’s Operational Technology Cybersecurity Controls (OTCC-1:2022) — 4 main domains, 23 subdomains, 47 main controls and 122 subcontrols, developed as an extension of the NCA’s Essential Cybersecurity Controls — apply to industrial control systems in facilities deemed critical and owned or operated by government organisations, and to private-sector organisations owning, operating or hosting Critical National Infrastructure, whether inside the Kingdom or abroad.

Four of its controls land directly on the satellite case. Control 2-4-1-1 requires that the “OT/ICS environment must be segmented logically or physically from other environments or networks”. Control 2-4-1-9 requires that direct communication between the corporate zone and OT/ICS zones be prevented, with required connections routed through a dedicated, secured and hardened jump host in a DMZ. Control 2-4-1-12 requires dedicated gateways between the OT/ICS networks and the corporate zone. Control 2-2-1-7 requires that remote OT access be restricted, over a trusted, multi-factor-authenticated and encrypted channel for a defined period with limited privilege, and that the session be monitored and recorded.

The awkward reading is the useful one. Your satellite terminal is remote-access infrastructure with a control path the operator holds and you do not. Nothing in the OTCC relaxes 2-4-1-1 because the transport happens to be satellite, which means the segmentation boundary belongs on your side of the terminal, and the terminal sits outside your OT zone by definition. NIST SP 800-82r3, Guide to Operational Technology (OT) Security (28 September 2023), is the reference for doing that zone work properly.

The logic transfers with the vertical. On an upstream oil and gas site, the OT behind the link is why the segmentation matters. For a mining operation, fleet-down is a logistics problem measured in days of travel. For a humanitarian deployment, the terminals are often the only connectivity for hundreds of kilometres, so spares holding is a programme decision rather than an IT one.

What we don’t know yet

Where that leaves you

The KA-SAT incident is not an argument that satellite links are inherently less safe than terrestrial ones. It is an argument that a shared management plane is a shared risk, and that the risk sits above your firewall whether or not you have accounted for it.

The work that follows is unglamorous: draw the boundary, enforce behind it, correlate your outages, and hold a position on what happens if the terminals themselves stop working. None of it requires the operator’s cooperation, which is precisely why it is worth doing first.