Cybersecurity Risks in Satellite Ground-Segment Infrastructure: Threat Profiling and Analysis

Satellite systems are integral to telecommunications, navigation, Earth observation, defense, and other critical infrastructures. A satellite system comprises space, ground, and communication-link segments, with the ground segment providing command, control, telemetry, and data-processing functions. This paper examines cybersecurity risks within satellite ground-segment infrastructure through structured threat profiling and risk analysis. Despite growing attention to satellite security, existing literature often addresses space and ground segments together, making it difficult to isolate ground-specific threats, actors, and consequences. To address this gap, this study develops a threat-profiling framework based on six dimensions: threat actors, attack vectors, targeted assets, vulnerabilities, attack objectives, and potential impact. It maps major ground-segment assets including Mission Operations Centers, ground stations, TT&C systems, and cloud platforms, and analyzes how conventional cyberattacks can propagate into mission-critical environments. Using a qualitative risk model of Risk = Likelihood × Impact, the paper prioritizes threats and classifies them into Low, Moderate, High, and Critical levels. Credential compromise, malware/ransomware, and command/data manipulation are identified as critical risks due to high likelihood and potential to disrupt satellite operations. The study concludes that protecting ground-segment infrastructure requires a layered, defense-in-depth approach aligned with NIST cybersecurity principles, encompassing identity management, network segmentation, supply-chain controls, and incident response. The findings provide a threat-oriented foundation for developing more resilient cybersecurity measures for satellite ground operations.