An incident response playbook for satellite operations on AWS (Part-1): Detection and forensic readiness

This article presents a framework for detecting threats and ensuring forensic readiness in satellite ground segment operations using AWS security services, addressing the unique constraints of satellite incident response.

• Satellite contact windows last only 5-10 minutes with 82+ minute gaps between detection and action, requiring pre-positioned response capabilities
• Downlink bandwidth constraints prioritize mission-critical data over forensic collection, necessitating efficient logging architecture
• Distinguish cyber intrusions from natural phenomena (radiation, thermal stress, RF interference) using space weather and orbital mechanics correlation
• Implement dual-plane architecture: control plane captures AWS Ground Station API activity via CloudTrail; data plane collects VPC Flow Logs and telemetry metrics
• Use Amazon GuardDuty, CloudWatch anomaly detection, and Amazon Detective to surface threats and correlate forensic evidence
• Apply four-step decision tree to discriminate adversarial activity from environmental events using environmental data, CloudTrail logs, threat intelligence, and constellation-wide patterns
• Configure immutable S3 Object Lock for CloudTrail logs and stream VPC Flow Logs through Firehose to OpenSearch for investigation

The framework enables satellite operators to detect compromises before damage occurs and preserve evidence for investigation while respecting the operational constraints of space systems.