# Cyber Resilience Limitations in Space Systems Design Process: Insights from Space Designers
## 5 Discussions  
Our study's findings highlight several critical areas within cyber resilience in space engineering that warrant further investigation. Our interviews with experts from the space industry provide a thorough snapshot of current practices and challenges. However, these insights underline the complexities and evolving nature of cyber resilience in space systems and point to significant implications for future research and practical applications. Incorporating cybersecurity and resilience considerations into the engineering design process emerged as a critical theme. Our findings indicate a strong consensus among experts on embedding security measures from the earliest stages of system design. Future research should explore the development of specific framework and guidelines that facilitate the practical implementation of principles known as security by design alongside zero-trust architecture. Additionally, investigating the effectiveness of these approaches in real-world scenarios will provide valuable insights into their applicability and impact. The mind map in Figure 5 outlines new indicative codes from the interviews. Key concerns include controls application, firewall resilience, physical security, and the zero-trust model. Organisational and technical challenges, such as technical skill shortages, cross-departmental collaboration, and life-cycle adaptability, are also highlighted. Furthermore, the codes further emphasise the importance of design framework flexibility, late security incorporation, and agile flexibility to improve resilience in space systems design. Therefore, the insights provide fresh perspectives for addressing cybersecurity challenges. Our study also highlights the ongoing debate between principles-based standards and compliance-based approaches. While principles-based standards offer flexibility and focus on desired outcomes, they can lead to consistent implementation with proper guidance. Future research is needed to develop hybrid models that combine the strengths of both approaches, ensuring robust and adaptable cybersecurity practices. The challenges posed by insider threats and the complexities of testing and validating cyber resilience were prominent in our discussions. Insider threats, due to the legitimate access and deep knowledge insiders possess, represent a significant risk. Advanced detection techniques, such as behavioural analytics, were identified as necessary for effective mitigation. Future research should focus on developing and refining these techniques and exploring how they can be integrated into existing security frameworks. Moreover, the intricate nature of space systems, with their numerous interdependent components, calls for continuous and rigorous testing. Research efforts should aim to create comprehensive testing protocols that can effectively assess the resilience of these complex systems. We spotlight the ongoing debate between principles-based standards and compliance-based approaches. Although principles-based standards offer flexibility and focus on outcomes, they can lead to consistent implementation with proper guidance. Contrarily, although compliance-based approaches provide clear, rigid measures, they may need to be sufficiently adaptive to evolving threats. Our finding underscores the need for a balanced approach that leverages the strengths of both methods to maintain robust cybersecurity. Another critical area highlighted by our study is the need for improved stakeholder understanding and alignment regarding cybersecurity. Effective communication and collaboration among all stakeholders are essential for prioritising and implementing cyber resilience measures. Additionally, addressing budget constraints through innovative funding models and resource allocation strategies will enable organisations to invest in the necessary technologies and training. Future research should investigate strategies for enhancing stakeholder engagement and fostering a culture of cybersecurity awareness within organisations.