STPAThe Satellite Was Fine, but the Service Stopped: Why Space Security and Safety Analysis Should Start from Service Loss

VisualPro Tech Brief

The Satellite Was Fine, but the Service Stopped: Why Space Security and Safety Analysis Should Start from Service Loss

Ground management networks, user terminals and shared dependencies: chaining STPA, FTA and TARA in one VisualPro project

VWAY Tech Brief · October 30, 2026 · About 9 min read

Space securityService lossSTPA-SecFTA common causeTARAGround segment and terminals

01Summary

02The scene: February 24, 2022, and the satellite was untouched

In the early hours of February 24, 2022, tens of thousands of KA-SAT satellite internet terminals across Europe lost their connection at the same moment. According to the account Viasat published on March 30, the attacker entered the ground management network through a misconfigured VPN appliance and, from inside, sent legitimate management commands to a large number of residential modems at once. The commands overwrote key data in the modems' flash memory, and the modems could not rejoin the network. Viasat later shipped about 30,000 replacement modems. Enercon, the German wind turbine maker, said that remote monitoring and control of 5,800 turbines (about 11 GW) that used this network had been cut. The turbines kept running, but they could not be reset remotely.

The satellite itself had no problem in this incident. The damage came from a control path outside the satellite: ground management network, management command, user terminal. The security research team SentinelLabs concluded that a wiper was delivered through the management function and considered Viasat's account incomplete, but both agree that the damage started on the ground management path.

This is what the New Space Economy article means by "the entire service chain". A satellite operator's customers care less about how sophisticated the satellite is than about whether they can receive data and trust it.

03What an asset-first analysis misses

This does not mean asset-based analysis is wrong. TARA is essential for evaluating assets and attack paths in concrete terms. But what counts as an asset is already decided when the scope is set. If the scope is worked backwards from the loss, the management network and the terminals outside the satellite do not drop out.

STPA works in that order from the start. It defines losses, defines the hazardous states that lead to them, draws the control structure, and then asks, for each control action, how it could become an unsafe control action (UCA). It does not ask about failures and attacks separately; it asks how control can go wrong, so security losses fit into the same frame. Young and Leveson proposed this approach under the name STPA-Sec (2014).

04Example 1: STPA, starting from service loss

This is a fictional satellite communication service for education (not any operator's design). It has one geostationary communication satellite, two gateways (A and B, redundant), a satellite control center, and a network management system (NMS) that manages user terminals remotely. Subscribers include homes and businesses as well as remote equipment monitoring and emergency communication users.

Losses

• L-1 Users lose communication service (including remote equipment monitoring and emergency communication)
• L-2 Control of the satellite is lost (including damage to the satellite and creation of orbital debris)

L-1 is the service loss a security incident produces; L-2 is a loss of safety and space sustainability. Both sit in the same analysis.

Hazards

• H-1 Many user terminals become inoperable at the same time (L-1)
• H-2 Both gateways fail to provide service at the same time (L-1)
• H-3 The satellite executes an unauthorized command (L-2)

System-level constraints

• SC-1 Terminal management commands must not be able to make many terminals inoperable at once, and must be reversible
• SC-2 Redundant gateways must not share common dependencies such as admin accounts, configuration or the management network
• SC-3 The satellite must execute only authenticated commands, and command authentication must be separate from ground business network accounts

Five UCAs

A security analysis would have listed UCA-P-1 and UCA-P-5 as threats, while UCA-P-2 and UCA-N-3 are problems of operating procedure and design. Even without an attack, pushing one bad firmware image to every terminal at once causes the same loss. In STPA, all four sit side by side under the same control action.

Five loss scenarios

Six countermeasures

05Example 2: FTA, the shared dependency that defeats redundancy

LS-4 tells you in STPA that a shared dependency exists. How badly it undermines the designed redundancy becomes clear in a fault tree (FTA).

The top event is "total loss of broadband service". Three branches sit under it.

• Both gateways lose function (OR): independent failures of gateway A and B equipment coincide (AND: gateway A equipment failure, gateway B equipment failure), and both gateways are lost together through a shared dependency (OR: shared admin account stolen, faulty shared config template deployed)
• Mass inoperability of user terminals (AND): unauthorized access to the management network, destructive management command applied to all without checks
• Satellite transponder failure

The key is not to mix the shared dependency into the redundancy (AND), but to place it as a separate OR branch directly above the redundancy. If the redundancy tree only says "A fails and B fails", the fact that both gateways use the same account and template never appears in the tree, and every cut set looks like second order. Only when the common cause is drawn as its own branch does the tree carry the logic that this one event stops both gateways.

VisualPro computed five cut sets in total, and the minimal cut sets tab of the results summary shows the three first-order ones. The design document says "redundant gateways", yet besides the satellite transponder there are two more single points of failure that stop the whole service. This is exactly what the article means by "the number of satellites alone does not measure resilience". Even with three gateways, these two lines remain as long as they share the same account and template. Splitting accounts and configuration rollout per gateway with CM-5 removes the shared dependency branch; what is left are each gateway's independent failures, which make second-order or higher cut sets.

Security events are hard to assign probabilities to, as one would a failure rate. This example does not calculate probabilities and looks only at the structure of the cut sets. How easy an attack is gets evaluated in the next step, TARA.

06Example 3: TARA, attack feasibility for the same scenarios

Of the scenarios STPA found, LS-1 and LS-5 involve an attacker. They go into TARA to evaluate attack paths and feasibility.

Both attack paths have a Severe impact rating and are reachable over the network, so VisualPro computed attack feasibility as High, the risk level as 5, the highest, and the cybersecurity assurance level (CAL) as CAL4. In other words, the ground management path alone produces the highest risk level without any direct attack on the satellite.

STPA asks where a loss starts, FTA asks how few events it takes, and TARA asks how easy it is for an attacker. Only when the answers to all three sit in one project under the same names and IDs can the security, reliability and operations teams discuss the same countermeasures.

07Why this flow works in VisualPro

08What to check tomorrow

Satellite and service operations

• Does our loss definition include only "loss of the satellite" and leave out "loss of user service"?
• Which terminal management commands can leave a terminal unrecoverable, and do they go through staged rollout and two-person approval?

Security

• Are the ground management network and remote-access appliances inside the TARA scope?
• Are satellite control accounts separate from the corporate business network account system?

Reliability and systems engineering

• Have the accounts, configuration templates, software and suppliers shared by redundant gateways or satellites been drawn in the FTA as a separate common-cause branch above the redundancy?
• Do any unintended first-order cut sets appear?

09Closing

10Frequently asked questions