YOU'VE BEEN HIRED.
Before the room, you read the orientation: how the team thinks, why space is no longer a sanctuary, and the shared language that holds the rest of the work together. The Pentagon of Pain itself opens day one, in the room, from the instructor's slides.
Before you begin: a two-minute survey on where you’re starting from▶Begin Orientation · METEORSTORM OverviewThe mindset the framework is deployed to serve, with the doctrine it is drawn from named chapter by chapter. It carries no course scenario, so it reads on its own.
Download the Pentagon of Pain guideRead it onlineWebWork the question setPDF · student editionYour first five days on the job. One function each day, in order, applying the METEORSTORM cyber resilience framework end to end on the platform. Each function's deliverable supports the organization's work to meet Executive Order 14144 and the NIS2 Directive, and the taxonomy you stand up on Day 1 is what the Space ISAC sharing mandate exchanges.
The 30 taxonomic elements you enumerate in this course become typed Maltego entities, so your platform decomposition is a graph with enforced parent relationships rather than a diagram. Four right-click transforms traverse it upward, from asset to service to segment to environment, and a fifth returns live satellite passes from the n2yo public API. It ships with a worked satellite communications (SATCOM) scenario built from the Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) joint advisory AA22-076A: the threats are real and each one quotes the advisory, and the platform is representative and names no operator.
Needs Maltego Community Edition 4.11 and Python 3.10. Source available under PolyForm Shield 1.0.0: free to use, run and modify, not to resell. Published as a pilot, and asking for feedback.
Before the organization puts you on the floor, it verifies your command of the framework. Twenty-five questions, drawn at random across the five functions you just applied. This is the only written exam in the course; the five missions ahead are scored in the simulation platform. Score 80% or better to pass. Retakes are unlimited and your best score stands. Your results include a topic breakdown and a question-by-question review showing exactly what to revisit.
With the digital twin deployed, you run five exercises against a simulation of the platform you defend, one mission each day, from standing up the team to running a full incident response. Each mission builds the organizational reflexes the mandates demand: detect, report, and recover as Executive Order 14144 requires, within the deadlines the NIS2 Directive sets.
About this courseThe mission, the three mandates, the framework, the mindset, the schedule and the team
A fictional operator, invented for this course. Every identifier, count and record this week comes from its inventory.
| The fleet | Geostationary, a continuous link at a fixed look angle, and medium Earth orbit, contacted in a single-station window |
|---|---|
| The sites | Mission operations in Reston, Virginia. The northern ground station in Kiruna, Sweden |
| Three departments | Security Operations Center. Satellite Operations Center. Satellite Design and Engineering |
| Three people | Maya Reyes, analyst lead. Theo Lindgren, senior controller. Dana Whitfield, systems engineer |
| Your job | Stand up SCOR, Space Cybersecurity Operations and Resilience, and chair every meeting this week |
You are joining Kestrel Orbital to establish the Space Cybersecurity Operations and Resilience (SCOR) department, driving organizational transformation through the Pentagon of Pain mindset, equipped with the METEORSTORM Resilient Cyber Operations (RCO) Framework: five functions running on one machine-readable data model, where every threat, attack path, detection, and resilience measure normalizes into standardized enumerated elements. MITRE ATT&CK, SPARTA, D3FEND, NIST and the rest stop being a dozen disconnected catalogues, because each one enters as enumerated elements anchored to your own platform. What accumulates is the analytics catalog, your own intelligence and normalized peer-framework content in one lens, curated once and portable everywhere, including machine to machine with the Space Information Sharing and Analysis Center. Your department will bridge the Security Operations Center, the Satellite Operations Center, and Satellite Design & Engineering for Resilient Cyber Operations.