SAFECOM Members,

The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) released a joint Cybersecurity Advisory (CSA) to help organizations protect their satellite communication (SATCOM) networks against possible cyber threats to U.S. and international networks, attached.  Critical infrastructure organizations and other organizations that are either SATCOM network providers or customers are strongly encouraged to review and implement the mitigations in this CSA.

Successful intrusions into SATCOM networks could create risk in SATCOM providers' customer environments and this advisory provides several actions that can help strengthen SATCOM network cybersecurity.  The advisory is titled, "Strengthening Cybersecurity of Satellite Communications Network Providers and Customers."

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are aware of possible threats to U.S. and international satellite communication (SATCOM) networks.  Successful intrusions into SATCOM networks could create risk in SATCOM network providers' customer environments.

Given the current geopolitical situation, CISA's Shields Up initiative requests that all organizations significantly lower their threshold for reporting and sharing indications of malicious cyber activity.  To that end, CISA and FBI will update this joint Cybersecurity Advisory (CSA) as new information becomes available so that SATCOM providers and their customers can take additional mitigation steps pertinent to their environments.

CISA and FBI strongly encourages critical infrastructure organizations and other organizations that are either SATCOM network providers or customers to review and implement the mitigations outlined in this CSA to strengthen SATCOM network cybersecurity.

Actions to Take Today:

Use secure methods for authentication.

Enforce principle of least privilege.

Review trust relationships.

Implement encryption.

Ensure robust patching and system configuration audits.

Monitor logs for suspicious activity.

Ensure incident response, resilience, and continuity of operations plans are in place.

All organizations should report incidents and anomalous activity to CISA 24/7 Operations Center at report@cisa.gov or (888) 282-0870 and/or to the FBI via your local FBI field office or the FBI's 24/7 CyWatch at (855) 292-3937 or CyWatch@fbi.gov.

National Security Agency (NSA) Cybersecurity Advisory:  Protecting VSAT Communications

NSA Cybersecurity Technical Report:  Network Infrastructure Security Guidance

Office of the Director of National Intelligence (ODNI):  Annual Threat Assessment of the U.S. Intelligence Community, February 2022

CISA Tip:  Choosing and Protecting Passwords

CISA Capacity Enhancement Guide:  Implementing Strong Authentication

Regards,

Cybersecurity and Infrastructure Security Agency (CISA)
Integrated Operations Division (IOD)  |  CISA Central  |  COMM-ISAC
Office:  (703) 235-5080  |  Fax:  (703) 235-5078  |  NCC@CISA.dhs.gov
SMC (CTR)  |  EM  |  JJO

Copyright © 2003–2022.  All rights reserved.