A Decade of Cybersecurity Challenges and Solutions for Satellite Systems

Abstract

The expansion of the space industry, coupled with growing reliance on satellite technology, has exposed the space environment to an array of cybersecurity threats. This article examines the evolving landscape of cybersecurity attacks on satellites over the past decade. Satellites are integral to sectors such as telecommunications, navigation, weather forecasting, national security, and scientific research making them attractive targets for malicious actors seeking to disrupt operations, steal data, or gain unauthorized access. This study explores threats and incidents in space, ground, and user segments, offering insights into vulnerabilities and countermeasures.

Introduction

The past decade has witnessed an astonishing transformation in the space industry, driven by advancements in technology, shifting attitudes, and substantial investments dramatically increasing the number of satellites in orbit. However, as the space environment becomes more crowded, the threat landscape for the space industry expands in tandem.

This article delves into the dynamic landscape of cybersecurity attacks on satellites over the last ten years, shedding light on the escalating risks faced by these indispensable space assets. Satellites, playing pivotal roles in sectors ranging from telecommunications and navigation to weather forecasting and national security, have become alluring targets for malicious actors who are intent on disrupting operations, stealing sensitive data, or gaining unauthorized access. This exploration not only highlights the evolving threat landscape but also offers insights into the vulnerabilities and countermeasures that define the contemporary satellite cybersecurity landscape.

Satellite Life Cycle and Architecture

Launch: Satellites are launched into space from a designated facility atop a launch vehicle. Once in position, the launch vehicle deploys shared satellites.

Commissioning: Precise satellite positioning and system checks occur during commissioning. Ground segments monitor and control via TT&C systems, validating subsystem health over about two months.

In-Service: Satellites begin their operational missions, with ground stations ensuring TT&C, maintaining satellite health, and operating payloads.

End of Life: Ground commands shut down the satellite, directing it to a “graveyard” orbit or a lower orbit for atmospheric disposal.

Three key segments compose the space system:

Space Segment: Comprising satellites, this forms the space-based infrastructure.

Ground Segment: On Earth, it includes ground stations and control centers for managing satellite operations and data.

User Segment: End-users benefit from satellite services and data.

Together, these segments create a complete space system architecture, ensuring satellite mission effectiveness.

The space industry has been the victim of several attacks since its inception from a wide range of adversaries and for a multitude of reasons. This section explores the types of attacks that the space industry has faced, the motivation behind them, and the sectors most at risk.[1]

Space Segment

Once in orbit, a satellite has limited physical contact with humans, although that does not mean security threats are not present. Vulnerabilities in the software and hardware in use on the satellite can occur and can impact the satellite’s operation and robustness of security controls. Many of the vulnerabilities and threats mentioned below, such as introducing custom-designed malware, exploiting hidden hardware vulnerabilities, or implanting backdoors, often involve individuals with insider access to the satellite development and launch process.

• Denial of Service: In the case of using Software-Defined Radios (SDRs) and digital signal processing software to provide radio functionality, insufficient checks in radio frame processing and sending malformed data packets could lead to buffer overflows and create denial-of-service conditions to jam communications. This type of jamming is significantly stealthier as it is triggered by sending only a small number of packets and also does not require sending a continuous Radio Frequency (RF) jamming signal.
• Hardware Backdoor: Malicious actors can discover and exploit hidden vulnerabilities in satellite hardware components, gaining unauthorized access or control even after the satellite is operational. Hardware backdoors may not be immediately apparent and can remain undetected for some time.
• Malware: Custom-designed malware can be introduced to a satellite’s software systems before commissioning, compromising security and functionality. Malware that is present before launch can potentially remain active once the satellite is in orbit, and it can be challenging to stop or remove it.
• Privilege Escalation: Attackers may attempt to escalate their privileges within the satellite’s systems post-commissioning. Weaknesses in access controls or software vulnerabilities can be targeted to gain greater control and access over time.
• Hijacking: Unauthorized individuals or entities may attempt to take over control of a satellite’s systems for their own purposes.
• Sensor Manipulation: While manipulating sensors may not be a primary concern once a satellite is in its orbit, it should not be dismissed, as it has the potential to result in inaccurate data if sensor components are tampered with, thereby impacting the satellite’s functionality and mission objectives.

Satellites are typically equipped with embedded, reliable operating systems to provide substantial security safeguards against memory abuse attacks. Gaining control of a satellite’s systems and/or altering its orbit can be challenging, depending on factors such as system complexity and the presence or absence of security measures. Breaching the Tracking, Telemetry, and Control (TT&C) links, along with exploiting software vulnerabilities and replaying recorded transmissions, can contribute to achieving control over a satellite and requires significant skill and knowledge. Even renowned organizations like NASA and government agencies are not immune to such threats, with instances of satellites falling under the control of malicious actors.

Ground Segment

Compromising the ground station is often the easiest and most common method for taking control of a satellite, as it provides the necessary equipment and software for legitimate satellite control and tracking. Threats to the ground station remain consistent throughout a satellite’s lifecycle and may include:

• Physical Attacks: This involves breaching physical security measures, such as gaining unauthorized access to a ground station or other physical IT assets. Successfully exploiting vulnerabilities through physical attacks can disable the ground station, directly impacting mission operations and services. In some cases, attackers may aim to take over the facility itself to gain control of the spacecraft. An example of this is when the theft of an unencrypted notebook computer resulted in the loss of control algorithms for the International Space Station.
• Computer Network Exploitation (CNE): Attackers may compromise the network to which a ground station is connected. Similar to attacks on enterprise IT networks, these attacks may involve exploiting poorly configured or vulnerable technologies, as well as phishing to gain unauthorized access to ground control stations.
• Cloud Infrastructure: Ground stations increasingly rely on cloud solutions for data storage and processing. For instance, AWS Ground Station is a fully managed service that facilitates satellite communications and data processing. Failures in cloud infrastructure can have catastrophic effects on the ground station, potentially causing denial of service (DoS) for the satellite receiver. Major cloud service providers, including AWS and Google Cloud Platform, have experienced regular outages or disruptions due to both internal and external attacks, which can disrupt satellite-based real-time systems.
• Data Corruption/Modification: This refers to the deliberate or unintentional alteration of data, whether in transit or at rest. Data corruption or modification can lead to software failures, hardware issues, unauthorized software use, or attempts to alter data to render it unusable. A corrupted spacecraft command, for example, could result in significant losses if no action occurs or if the wrong action is taken onboard the spacecraft.
• Supply Chain Attacks: These attacks involve leaking software/tools/data sheets, open-source research, and the use of common components, which can introduce vulnerabilities and exploits into the supply chain.
• Malware: Malicious software can infect ground station systems, compromising security and operations.
• Social Engineering: Attackers may manipulate individuals into divulging sensitive information or granting unauthorized access to systems.
• Hardware Backdoor: Malicious actors may exploit hidden vulnerabilities in ground station hardware to gain unauthorized control.

Communications

Communications with satellites are established through RF waves, typically in the GHz frequency range. TT&C and data communications can be compromised at various points in a satellite’s lifecycle, often requiring attackers to gather additional information and conduct attacks on the ground segment. The primary methods to disrupt data communications are as follows:

• Jamming: Jamming involves overpowering an RF signal with a higher-power signal of the same frequency to disrupt communications between the ground station and satellite, or vice versa. Attackers can transmit a continuous signal to deny legitimate communications, requiring knowledge of the signal frequency and the appropriate power level. Software vulnerabilities can also be exploited for jamming purposes. Notably, advanced jamming infrastructure, such as the Boeing EA-18G Growler air platform, has been developed for electronic warfare.
• Eavesdropping: Eavesdropping entails intercepting data over an RF communication channel. Data sent over RF signals may lack encryption or use low-grade encryption, making them susceptible to interception.
• Hijacking: Satellite hijacking involves repurposing a satellite for alternative purposes, including altering legitimate signals or entirely replacing them. This includes broadcast signal intrusion, where radio, television, or satellite signals are hijacked either by overpowering the original signal at the same frequency or breaking into the transmitter and replacing the signal. An infamous example is the Max Headroom Broadcast Signal Intrusion Incident.
• Spoofing: Spoofing involves transmitting a seemingly legitimate signal with erroneous data for malicious purposes. Spoofing location data in global navigation satellite systems can have significant consequences. For instance, GPS signals have been spoofed using off-the-shelf components, leading to incorrect location reporting on ships.

Motivations for Hacking Satellites and Potential Attackers

• States seeking military advantage: Nations may hack satellites to gain an upper hand in military operations, as space systems are crucial for Command, Control, and Intelligence. They aim to disrupt or control satellite networks for strategic advantage.
• Intelligence Services: Foreign intelligence agencies may target satellites for espionage purposes, aiming to gather sensitive information or intercept communications for national security interests.
• Industry Insiders: Employees or individuals with inside knowledge might hack satellites for financial gain, such as stealing valuable data or selling proprietary information to competitors.
• Organized Crime: Criminal groups may seek financial profit by hacking satellites and demanding ransoms, stealing valuable data, or engaging in cyber-attacks on satellite dependent infrastructure.
• Terrorist/Militant Organizations: These groups may hack satellites to disrupt communications, gain recognition, or even coordinate attacks. Disrupting satellite-dependent services can cause chaos and amplify their message.
• Commercial Competitors: Competing companies may hack satellites to gain a competitive edge, stealing intellectual property, or sabotaging rival services to enhance their market position.
• Individual Hackers: Some hackers may target satellites to showcase their skills, challenge themselves, or even for personal fame and notoriety.
• Political Activists: Activists might hack satellites to draw attention to their causes, disrupt governmental or corporate operations, or reveal sensitive information in pursuit of their agendas.

Satellite System Attacks: A Ten-Year Retrospective (2013-2023)

2013-2014

• 2013: Signal Injection: Attacks by Hamas against Israeli news stations exposed the vulnerability of satellite communications [2],[3],[4].
• 2014: Satellite-to-Satellite Eavesdropping: Russia was accused of launching a “stalker sat,” marking the first publicly acknowledged instance of satellite-to-satellite eavesdropping, intercepting uplink signals from other satellites [5].
• 2014: High-risk vulnerabilities in JPSS ground system: An internal US audit of the Joint Polar Satellite System (JPSS) ground stations revealed over 9000 “high-risk” security issues and many of these vulnerabilities had not been addressed since previous audits [6].

Commercial ground systems were also demonstrated to have severe vulnerabilities, including many hardcoded passwords and backdoors [7],[8].

2015-2017

• 2015: Security Breach: Hackers claimed to have breached the security of the ThurayaSat-1 communication satellite, raising concerns about the security of satellite communication systems.[9]
• 2016: Signal Injection: An Organized Criminal Abuse by the Russian advanced persistent threat (APT) actor known as the “Turla group” was found abusing satellite internet signals to anonymously exfiltrate data from compromised computer systems [10],[11].
• 2017: Ransomware: The Petya/NotPetya ransomware attack affected Ukrainian government networks and spread to satellite and telecommunications sectors, disrupting operations and highlighting the potential impact of ransomware on critical infrastructure.[12]

Attacks on Ground Stations and Control Systems

Sophisticated attacks on ground stations and satellite control systems, often attributed to state actors, have grown over the years.

• 2017: Chinese Espionage: China has been accused of compromising US space control systems in multiple instances between 2011 and 2017. In recent years, NASA faced 12 cyber espionage attacks, while a major Chinese campaign known as “TITAN RAIN” targeted DoD, NASA, aerospace contractors, and research institutes to acquire information on various defense and space-related technologies. This incident highlighted China’s prominence in cyber espionage, but it’s important to note that other unattributed infiltrations have also occurred in top space and aerospace firms. For instance, a group of Romanian hackers stole sensitive data from NASA and the European Space Agency with the intention of selling it on the black market. [13],[14], [15]

2018-2023

• 2018: Cryptographic attack: Real-time inversion attacks on the GMR-2 cipher used in satellite phones were reported [16].
• 2022: Satellite Network attack: On February 24th, Russia invaded Ukraine after launching a cyberattack against Viasat’s KA-SAT geostationary orbit (GEO) satellite network, causing a communication outage in the Ukrainian army and spillover effects in other European countries and the United States. This attack disabled modems that communicate with Viasat Inc’s KA-SAT satellite network, which supplies internet access to tens of thousands of people in Ukraine and Europe. Researchers believe that the attack resulted from a new strain of wiper malware called “AcidRain” designed to remotely erase vulnerable modems and routers. Viasat agreed with this assessment, and in a later statement said they believed the purpose of the attack was to interrupt service rather than to access data or systems. This event sparked a debate about the protection of space systems and services in Europe and the United States.[17],[18]
• 2023: Satellite Network attack. Russian satellite telecom Dozor was hacked, damaging user terminals and causing a network outage. The attackers compromised systems managing customer terminals, raising concerns about the risks of relying on commercial satellite communications [19].

A Wake-up Call for SATCOM Security:

Satellite Communications (SATCOM) are crucial for global telecommunications. IO Active assessed the security of widely used Inmarsat and Iridium SATCOM terminals and discovered vulnerabilities, including potential backdoors, hardcoded credentials, insecure protocols, and weak encryption. They also identified risky features in the devices. This serves as a warning for both SATCOM vendors and users about security issues in current technology. [20]

Mitigating Future Risks

Mitigating the Risks

To enhance satellite cybersecurity and safeguard space infrastructure, the following measures should be considered:

• Encryption and Authentication: Implement strong encryption and authentication protocols for all satellite communications. Encrypt data transmissions and require robust authentication methods to prevent unauthorized access. • Managing cryptographic keys for large satellite constellations is a complex challenge. Ground stations, satellites, and different mission components may require separate keys, and the sheer scale of some constellations makes this task daunting.• Furthermore, the dynamics of satellites entering and leaving a constellation complicate key management. Ensuring secure key distribution and revocation mechanisms is crucial.
• Secure Protocols: Satellite communication protocols are often designed to be lightweight to conserve power and memory and increase transmission speed. However, adding security to these protocols introduces overhead, increasing power consumption and memory usage. Depending on the mission, this overhead may not be acceptable, so security needs must be weighed carefully in the design process.
• Network Segmentation: Isolate critical systems within ground stations and control centers from less secure networks. Segmentation can prevent the lateral movement of attackers within the network.
• Routing and Distributed Control: Satellite routing security is crucial for safe and reliable satellite communication networks. Efficient routing in large satellite constellations involves decisions about static or dynamic routes, impacting both operations and security. Distributed control of constellations presents additional challenges, especially when coordinating across multiple sites.Security focuses on UP and Down Links (UDLs), boundary, and Inter-Satellite Links (ISLs) routing. Mitigation strategies should include encryption, secure routing protocols, authentication, access control, network monitoring, single-layer and multi-layer SINs (Space Information Networks) routing technologies. Furthermore, modern methods involve machine learning-driven routing algorithms, anomaly detection for dynamic networks, and the implementation of blockchain applications for enhanced routing and network security.[21]
• Authentication and access control: Implement MFA for all personnel accessing sensitive satellite systems. Require multiple forms of authentication, such as passwords and biometrics, to enhance access security. Additionally, enforce strict access control policies, limiting access only to those with a legitimate need, and regularly review and update access permissions to minimize the risk of unauthorized actions.
• Redundancy and Backup Systems: Establish redundancy and backup systems for ground stations and satellite control. Redundancy can help maintain operations in the event of an attack or system failure, reducing the impact of disruptions
• Timely Security Updates: Ensure that high-risk security issues are promptly addressed through regular software updates and patches. Keep both ground station and satellite software up-to-date to mitigate known vulnerabilities.
• Denial-of-Service (DoS) Mitigation: Implement robust rate limiting and authentication mechanisms to protect against DoS-related connection attempts on satellites. This includes monitoring and controlling the volume of incoming traffic to prevent overload.
• Signal Manipulation: RF communication can be manipulated using devices like GPS jammers and spoofers, which disrupt satellite communications. Optical communications are also vulnerable to manipulation. Techniques such as spread-spectrum and frequency hopping are employed to counter these threats.
• Anomaly Detection and Intrusion Prevention: Satellites need intrusion detection and prevention systems to monitor and respond to on-board threats and to monitor network traffic for signs of unauthorized access or suspicious behaviour. IDS can provide early detection of cyber threats.
• Zero Trust Architecture: Implement a Zero Trust model that verifies every user and device attempting to access satellite systems, regardless of their location. Trust should not be assumed, even for internal users.
• Secure Supply Chain Management and Third-Party Vendor Assessment: Maintain rigorous control over the supply chain to prevent compromised hardware or software components. Verify component integrity and conduct security assessments. Additionally, assess the cybersecurity practices of third-party vendors supplying components or services for satellite systems to ensure alignment with industry standards.
• Regular Audits and Testing: Conduct frequent security audits and comprehensive vulnerability assessments for both ground stations and satellite control systems. Identifying and addressing weaknesses promptly is crucial to maintaining security. Proactively identify vulnerabilities by conducting penetration testing and ethical hacking exercises. Swiftly address any weaknesses uncovered during these assessments. Additionally, include rigorous software testing for satellites to ensure the resilience of onboard systems.
• Incident Reporting and Response: Establish clear channels for reporting cybersecurity incidents within the satellite industry, enabling timely alerts to emerging threats. Develop and regularly update comprehensive incident response plans to swiftly and effectively address breaches, encompassing procedures for identification, mitigation, and recovery.By implementing a combination of these measures and fostering a culture of cybersecurity awareness, the satellite industry can enhance its resilience against evolving cyber threats.
• User Education: Educate satellite users and operators about cybersecurity best practices. Promote awareness of potential threats and encourage responsible behavior to minimize risks.• In recent years, there has been a growing focus on enhancing the cybersecurity of satellite systems. Notably, in 2020, the US Air Force organized an online event known as the “HackA-Sat” competition. This competition had a specific objective: to familiarize cybersecurity professionals with the intricacies of satellite cybersecurity and to actively identify vulnerabilities within actual space systems.[22]• Similarly, in 2020, DEFCON hosted its first “aerospace village,” a sub-conference that included a briefing track focused exclusively on space systems security.[23]
• Regular Security Training: Provide ongoing cybersecurity training for staff members involved in satellite operations. Ensure they are well-versed in recognizing and responding to potential threats.
• Secure Design Principles and Standards in Spacecraft Design:The design of spacecraft involves more than just the physical and engineering aspects; it extends into the realm of cybersecurity. As space missions become increasingly reliant on complex computer systems and digital communication, integrating secure design principles and adhering to established standards is essential to safeguarding the integrity, confidentiality, and availability of critical systems and data in the hostile environment of space.17.1 Standardization: Standardization in spacecraft design is crucial for interoperability, reliability, and safety. Organizations like NASA, ESA (European Space Agency), and ISO (International Organization for Standardization) have established stringent standards for spacecraft design and operation. Adherence to these standards ensures that spacecraft are built to industryaccepted best practices.17.2 Data Security and Communication: Secure design principles extend to data security and communication protocols. In space missions, sensitive data is transmitted between spacecraft and mission control. The implementation of secure encryption and authentication mechanisms as mentioned above in detail, is essential to protect against data breaches, unauthorized access, or interference by external parties17.3 Physical Security: Protect physical access to satellite facilities, ground stations, and satellite hardware. Securely store and transport satellite components to prevent tampering or theft.17.4 International Collaboration: Foster international cooperation and information sharing to collectively combat cyber threats targeting satellite systems. Collaboration between governments, space agencies, and private entities is essential to enhancing overall security. Adherence to common standards fosters cooperation and minimizes compatibility issues, streamlining mission planning and execution.17.5 Cost Efficiency: Secure design principles, when applied from the outset, can lead to cost efficiencies over the lifecycle of a spacecraft. Ensuring robustness and reliability can reduce the need for costly repairs or replacements down the line.Precautions must also be implemented to address challenges such as safeguarding against space hazards, fortifying resilience to malfunctions, mitigating space debris risks, and establishing backup systems in case of unforeseen events.

Conclusion

The last decade has witnessed a significant increase in cyberattacks targeting satellites and related systems. These attacks pose a considerable threat to national security, critical infrastructure, and global communication networks. Addressing these challenges requires a collaborative effort involving governments, satellite operators, and the cybersecurity community to fortify the defense of space infrastructure and protect against evolving cyber threats.

References

1. Manulis, M. et al. (2020) Cyber security in New Space – International Journal of Information Security, SpringerLink. Available https://link.springer.com/article/10.1007/s10207-020-00503-w
2. BBC Monitoring World Media. Hamas” Hacks into” Satellite Transmission of Israeli Channel 10 TV. London: 2014.
3. Egea L. Playing in a Satellite Environment 1.2. 2010. Black Hat http://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo/BlackHat-DC-2010-Nve-Playingwith-SAT-1.2-wp.pdf.
4. Moore C. Spread Spectrum Satcom Hacking: Attacking The Globstar Simplex Data Service. 2015. Black Hat https://www.blackhat.com/docs/us-15/materials/us-15-Moore-Spread-Spectrum-SatcomHacking-Attacking-The-GlobalStar-Simplex-Data-Service-wp.pdf.
5. Forester C. Russia” Eavesdropping” on Satellite Operations. East Sussex: Inside Satellite TV, 2015. https://advanced-television.com/2015/11/10/russia-eavesdropping-on-satellite-operations/.
6. Crawley A. Expedited efforts needed to remediate high-risk vulnerabilities in JPSS ground system. Technical report. US Department of Commerce Office of the Inspector General, 2014. https://www.oig.doc.gov/OIGPublications/OIG-14-027-M.pdf.
7. Santamarta R. Last Call for SATCOM Security. Seattle, WA: IOActive, 2018. https://i.blackhat.com/us-18/Thu-August-9/us-18-Santamarta-Last-Call-For-Satcom-Security-wp.pdf.
8. Santamarta R. SATCOM Terminals: Hacking by Air, Sea, and Land. Las Vegas, NV: BlackHat Whitepaper, 2014.https://www.blackhat.com/docs/us-14/materials/us-14-Santamarta-SATCOMTerminals-Hacking-By-Air-Sea-And-Land-WP.pdf
9. Even in the desert with a sat phone, you’re getting hacked (2012) VICE. Available at: https://www.vice.com/en/article/satellite-telephony-is-unsafe/
10. Tanase S, Satellite Turla: APT Command and Control in the Sky. Securelist by Kaspersky 2015. https://securelist.com/satellite-turla-apt-command-and-control-in-the-sky/72081/.
11. Pavur J. Whispers Among the Stars. Las Vegas, NV: Black Hat, 2020. https://www.youtube.com/watch?v=ku0Q_Wey4K0
12. Petya Ransomware: CISA (no date) Cybersecurity and Infrastructure Security Agency CISA. Available at: https://www.cisa.gov/news-events/alerts/2017/07/01/petya-ransomware.
13. Symantec, Thrip: Espionage Group Hits Satellite, Telecoms, and Defense Companies. Tempe, AZ. 2017.https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defensetargets.
14. Flaherty M, Samenow J, Rein L, Chinese Hack U.S. Weather Systems, Satellite Network. Washington Post 2014. https://www.washingtonpost.com/local/chinese-hack-us-weather-systemssatellite-network/2014/11/12/bef1206a-68e9-11e4-b053-65cea7903f2e_story.html.
15. BBC. Hackers Controlled Nasa Computers. London: BBC News, 2012. https://www.bbc.com/news/technology-17231695.
16. Hu J, Li R, Tang C. A real-time inversion attack on the GMR-2 cipher used in the satellite phones. Sci Chin Inf Sci. 2018;61:032113. https://link.springer.com/article/10.1007/s11432-017-9230-8
17. Jacobs, Bas. “A Comparative Study of EU and US Regulatory Approaches to Cybersecurity in Space.” Air & space law 48. Issue 4 /5 (2023): 477–492. Web.
18. Case study: Viasat attack: CyberPeace Institute Viasat Attack | CyberPeace Institute. Available at: https://cyberconflicts.cyberpeaceinstitute.org/law-and-policy/cases/viasat (Accessed: 03 October 2023).
19. Russian Satellite Telecom Dozor hit by Hackers | Cybernews. Available at: https://cybernews.com/cyber-war/dozor-russian-satellite-telecom-hacked/
20. IOActive – Research-fueled security services. Available at: https://ioactive.com/pdfs/IOActive_SATCOM_Security_WhitePaper.pdf
21. Zhuo, M., Liu, L., Zhou, S. et al. Survey on security issues of routing and anomaly detection for space information networks. Sci Rep 11, 22261 (2021) Available at: https://www.nature.com/articles/s41598-021-01638-z#Sec14.
22. Defense Digital Service, Hackasat. Arlington, VA. 2020. https://www.hackasat.com.
23. Aerospace Village, Securing the Skies and Beyond. 2020. https://aerospacevillage.org/.
24. Steinberger, Jessica A., “A Survey of Satellite Communications System Vulnerabilities” (2008). Theses and Dissertations. 2729. https://scholar.afit.edu/etd/2729