Ground Segment

SIMULATION / DEMO DATA ACTIVE
Scenario:

Ground Segment & Infrastructure Security

Part 3 — Earth Operations Security

Ground Stations, Workstations, Mission Control Servers, Telecommand APIs, Identity Providers, & CI/CD Pipelines

Ground Assets:8 Systems Monitored
Identity & SSO
2
1 Active Warning
Mission Control Servers
2
MCC-ALPHA-01 & Telecommand API
Ground Stations
2
Svalbard High-Gain Array
Network & Exposure
3
Cloud & Gateway Endpoints

Ground Infrastructure & Operator Directory

Cmdr. Sarah Vance (Flight Director)
Owner: Space Operations Command
warning
Type: operator_identity
Exposure: internal
Crit: high
Trust: verified
Vuln: Session Token Reuse Vulnerability
DevSecOps Deployment Workstation
Owner: Ground Systems Dev
nominal
Type: admin_account
Exposure: restricted_cloud
Crit: medium
Trust: restricted
Ground Identity Provider (SSO-OIDC)
Owner: Cyber Security Ops
warning
Type: identity_provider
Exposure: restricted_cloud
Crit: critical
Trust: high_trust
Vuln: OIDC Token Signature Bypass Attempt
Mission Control Secure VPN Gateway
Owner: Network Operations
nominal
Type: vpn_gateway
Exposure: public_exposed
Crit: high
Trust: restricted
Mission Control Center (MCC-ALPHA-01)
Owner: Space Operations Command
warning
Type: mission_control_server
Exposure: internal
Crit: critical
Trust: high_trust
Telecommand Dispatch API (CMD-API-01)
Owner: Flight Software Team
warning
Type: command_api
Exposure: internal
Crit: critical
Trust: high_trust
Vuln: Command Sequence Buffer Overflow Risk
Svalbard Ground Station (GS-SVALBARD-01)
Owner: Earth Terminal Network
warning
Type: ground_station
Exposure: internal
Crit: high
Trust: verified
High-Gain Tracking Antenna 4
Owner: Earth Terminal Network
nominal
Type: antenna
Exposure: internal
Crit: high
Trust: verified

Ground Segment Security Alerts

Suspicious Multi-Location Login on Operator Identityhigh

Operator Sarah Vance account initiated telecommand token request from IP 194.26.29.41 while concurrently active at Svalbard station console.

EVIDENCE:
• Concurrent IP origin: 194.26.29.41 (Oslo, Norway) vs 78.91.12.0 (Svalbard)
• Unusual token refresh request timing (3 retries in 2 seconds)
ALERT → ASSET → IMPACT
Anomalous Telecommand API Payload Burstcritical

Telecommand API (CMD-API-01) received a sequence of 48 payload execution parameters without associated flight plan authorization header.

EVIDENCE:
• Missing Flight Plan Token ID #FP-8812
• API request origin: MCC-ALPHA-01 internal daemon thread #441
ALERT → ASSET → IMPACT