# Cyber Resilience Limitations in Space Systems Design Process: Insights from Space Designers
## 2 Literature Review
As [PERSON] et al. [51] highlight, law and governance in the space environment present significant challenges due to the absence of clear jurisdictional boundaries that typically inform critical national infrastructure processes on Earth. This jurisdictional ambiguity in space resembles the complexities associated with _\"transcontinental infrastructure\"_ projects, such as oil and gas pipelines. A prime example is China's Belt and Road Initiative (BRI) [52], which illustrates the parallels between space infrastructure protection and complex cross-border critical projects. The primary challenge in anticipating cyber-attacks on space systems is the need for comprehensive datasets documenting historical incidents [53]. The information about most attacks is not readily available in the public domain, with scattered media reports needing more detailed information, making it difficult to understand and characterise the nature and scope of the threat [14]. To address this \"missing-data problem,\" researchers have proposed frameworks that extrapolate missing data to derive attack technique kill chains, providing valuable insights into the increasing sophistication of cyber-attacks against space systems [54]. Furthermore, the need for standardised taxonomies and knowledge-sharing frameworks within the space cybersecurity community has been identified as a barrier to practical threat intelligence and incident response [49]. Efforts to develop standardised ontologies and promote collaboration among stakeholders are crucial in building a more resilient and secure space infrastructure [47]. The rapid growth in the space industry is experiencing the fastest innovation to market, with a record number of private and public organisations involved in space exploration and satellite technology, such as NASA and SpaceX [55]. Previous studies have argued that this growth comes with new challenges in securing the supply chain for space infrastructure [56]. Past studies have shown that space projects involve a vast network of suppliers, manufacturers, and service providers from multiple countries, making the supply chain challenging to monitor and control [57]. Academics examined that the complexity increases the risk of cyber threats such as malware, ransomware, data breaches, and theft of IP, which can compromise the security and reliability of space systems [56]. Another aspect academics emphasise is the measurement and improvement of cybersecurity for space infrastructure [58]. Research shows that the fundamental challenge is the need for comprehensive frameworks and standards for assessing the cybersecurity of space systems [58]. We also note that existing regulations often fail to cover the entire production value chain of space assets, from ground stations to satellites, and the global nature of the space industry also complicates efforts to harmonise cybersecurity practices across jurisdictions [58; 59]. [PERSON] points out that effective cybersecurity measurement demands collaboration between diverse stakeholders such as government agencies, private companies, and international partners [58]. This fosters trust and information sharing across these groups, which is essential for developing a shared understanding of threats and coordinating responses. [PERSON] suggests public-private partnerships can be crucial in developing tailored regulations compatible with existing cyber regimes [60]. The proliferation of commercial off-the-shelf (COTS) components and the trend toward small satellites pose additional challenges. [PERSON] et al. voiced concerns that these systems often lack the cybersecurity features of custom hardware and may contain vulnerabilities that can be exploited by adversaries [61; 62]. Therefore, academics acknowledge that identifying and mitigating these weaknesses requires a proactive, mission-focused approach to testing and secure system design [62; 63]. Several scholars have noted the deficits in existing regulations that often fail to cover the entire production value chain from ground stations to satellites.