Master Adversary Management.
“The adversary suffers when their plans are known, broken, and turned against them.”
Four days ago the Space Cybersecurity Operations and Resilience department existed on paper; today all three departments work from Kestrel Orbital’s platform model, threat catalogue, attack paths, signatures, and playbooks. To close the week you bring Theo Lindgren, Dana Whitfield, and Maya Reyes to one table: you align decomposition, contextualized threat modeling, converged detection engineering, and exposure management with real-world adversary profiles, taking options away from the adversary. The measures feed NIS2’s continuity, backup, and supply-chain duties and Executive Order 14144’s backup-and-failover requirement for command and control.
DAY 5 START
Today you find the exposure that recurs across the week’s command-path work and build resilience measures that shrink, harden, or remove it before launch. Each department has taken its turn this week; today Theo Lindgren leads for Satellite Operations, because a measure that cannot be flown is not a measure. He sits with Dana Whitfield, who can change the build, and Maya Reyes, whose detections stand watch over whatever the two of them decide. These are the continuity, backup, and supply-chain measures NIS2 requires, and the backup and failover Executive Order 14144 expects for command and control.
Set the context
Before you change a single part, fix what Days 1 through 4 handed you and today's job: the accumulated threats, paths, and detections, and the task of removing the attack surface the adversary keeps relying on.
BUILD THE RESILIENCE MEASURES
Six artifacts on the table. Resilience needs both: operating procedures the crew can run when something goes wrong, and architectural changes that make the failure mode hard or impossible in the first place. So today, for the first time this week, both operating departments are in the room together, each bringing what only it can. The six artifacts below are what you walk together for every measure you enumerate.
Satellite Operations’ playbook for failover, abort, retry, and safe-mode. New measures must fit what the crew can run during a pass.
Satellite Design & Engineering’s current architecture map: what’s hardened, what isn’t, what can be rebuilt this cycle.
What subsystems already have backup paths, and which paths quietly share a single failure point.
Platform behavior when individual subsystems are taken off-line: what the mission can still do, what it can’t.
What architectural changes are already queued vs. proposed; what’s in scope this week vs. next.
Resilience patterns from prior incidents on this platform and peer platforms that worked, or didn’t.
CHECKPOINT
Five questions on what Days 1 through 4 handed you and today's job: the accumulated CONOPS, threats, paths, and detections, and the task of removing recurring attack surface before launch. Answer to confirm the context before you learn the method.
Learn the method
One repeatable way to turn a recurring weakness into a fix: the AN-RES enumeration, each measure anchored through TRE to the element it protects and mapped to one of four objectives, Anticipate, Withstand, Recover, Adapt.
ADVERSARY MANAGEMENT PROCESS
Six steps, fixed order, walked once per measure; the dashed loop repeats until every path worth countering carries one. Constraint: every element carries exactly one TRE element and names its resiliency goal, and it declares the lifecycle of the element it protects and the cadence it holds at, because a measure that cannot be installed is not a control in force.
LAYER = AN, fixed; identifies this as an Analytic Layer element.
A resilience measure is the organization’s own decision about the platform, not a platform part, so the layer is fixed at AN.
DIGITAL TWIN, THE TEST BENCH FOR RESILIENCE
A resilience measure changes a flying platform, so it is validated on the twin before it reaches orbit: design it, develop it, and validate it against a live-behaving model. Click a capability to see what the bench gives you and the week-final measure it is exercised on.
Apply a candidate measure to the twin first and watch the second-order effects on mission capability, duty cycle, downlink margin, and power budget before it reaches the operational platform.
AN:RES:Resilience Measure:00CHECKPOINT
Five questions on the method you just learned: the AN-RES layer and TAG, the TRE anchor, the four resiliency goals, and the digital twin as test bench. Answer before you enumerate.
Enumerate the resilience measures
Work segment by segment, User through Space, writing a measure that shrinks, hardens, or removes each recurring element, or, where the element cannot be changed, a compensating control on the path to it. Every measure is proven on the digital twin before it touches the live platform.
WEEK COMPLETE · 4 RESILIENCE MEASURES
One measure per attack path, written with Satellite Operations and Satellite Design & Engineering. Every element names one platform element via TRE, the same element the threat it counters targets, plus the path it counters, its resiliency goal (Anticipate, Withstand, Recover, Adapt per NIST SP 800-160 v2), and the department that owns it. Each also carries the cadence it actually holds at, because a measure protects an element but cannot always be installed on it: two of these four are in force today, one is phased, and one is next-build with a compensating control on the ground.
GroundAN:RES:Resilience Measure:00
GroundAN:RES:Resilience Measure:01
LinkAN:RES:Resilience Measure:02
SpaceAN:RES:Resilience Measure:03CHECKPOINT
Five questions on the set you just built: its size, how each measure reduces attack surface, and how it completes the five-function week. Answer to close the course's build work.
THE RESILIENCE CATALOGUE
THEORY TO TOOLING
What you built today does not stay in the classroom. The METEORSTORM vocabulary is a published taxonomy, and the moment the shift ends your work ships as machine tags the whole community can read.
TAG THE MEASURES
This is where the week stops describing the adversary and starts taking options away from them. METEORSTORM is what changed: each measure names the element it protects, the path it counters and the goal it serves, in tags a machine reads, so a peer can adopt it without re-deriving your reasoning. One measure carries four things. Click through them.
A measure protects one element, and it is the element the threat named on Day 2, the path pivoted through on Day 3 and the signature watched on Day 4. Four records, four days, one service. That is what lets a peer pull the whole story in a single query instead of reading four documents that never said they were about the same thing.
It is also what makes coverage auditable. Because every measure names the path it counters, any path with no measure against it is visible as an uncovered path with an owner, rather than as an absence nobody notices.
SVC:CP:Control Plane:09, ground command acceptance, the service that decides who may commandAN:ATT:Attack Path:00, Day 3’s routeAN:THR:Threat:00, where the chain opened on Day 2DAY 5 COMPLETE
You built resilience measures across the platform with Theo Lindgren and Dana Whitfield. The week is complete: you carried one platform from decomposition all the way to resilience, and Theo, Dana, and Maya Reyes now describe it the same way, which none of them could do on Monday. The five deliverables together support the organization’s response to Executive Order 14144 and the NIS2 Directive.
DAY 5 COMPLETE · FULL WEEK IN HAND
What you built today. Four AN-RES elements written with Theo Lindgren and Dana Whitfield, feeding the continuity, backup, and supply-chain duties NIS2 assigns and the command-and-control failover EO 14144 expects. 2 GROUND, 1 LINK, 1 SPACE. Every measure names the structural element it protects, the threat or attack path it counters, the resiliency goal (Anticipate / Withstand / Recover / Adapt), and the department(s) who own it, a Satellite Operations procedure, a Satellite Design & Engineering change, or both. Every measure also names the lifecycle of the element it protects and the cadence it holds at: two in force, one phased, one next-build with a ground-side compensating control and a recorded residual risk, because a measure that cannot be installed on a flying vehicle is routed to the next build rather than counted as coverage. End of week. You now hold a working decomposition, an anchored threat set, an attack-path set, a signature + playbook set, and a resilience-measure set against the same reference platform. Every set is written in the same five-field language: the evidence base the two regulators expect, and the substance the organization’s Space ISAC channel carries.
COURSE
COMPLETE.
Five days, five disciplines, one artifact set. You’re the person at your work-center who ties Security Operations, Satellite Operations, and Satellite Design & Engineering together.
Defense went from reacting to attacks to removing what makes them possible. The parts the adversary leaned on most are now cut back or gone, and the platform is described once and defended as one resilient system. Course complete.
