The European Space Agency Tender

The Traditional Network Perimeter Defence Model Has Been Obsolete For Some Time And A Modern Defence-in-depth Architecture Is A Must For Credible Protection. Zero Trust Architecture (zta) Has Been Recently Consolidated And Places Emphasis On Strong Authentication And Authorisation Within A Perimeter. This Is Considered A Significantly Higher Level Of Security Posture Versus A More Traditional Perimeter Defence Model Which Typically Relies On Ring-fenced Networks And Is No Longer Considered Adequate In The Modern Cyber Threat Environment. Software Architecture Trends Are Leading Towards An Envisaged Migration Of Mission Data Systems To Cloud-native, Micro-services-based Architectures. Such Architectures Are Leveraged To Enforce Highly Automated, Granular Access Control And Security Policy Orchestration And Enforcement, For Example Across A Service Mesh'. Implementing Security (both Policy Enforcement And Encryption And Authentication) At The (micro) Service Level Implements Zta Whereby There Is No Inherent Trust In The Systemand Security Defences May Remain Robust Even With The Assumption That A Network Has Been Compromised. This Activity Shall Build On A Predecessor Study On Micro-services-based Mission Data Systems (t709-709gd), Specifically By Analysing, Developing And Demonstrating A Zta Model, Enforced At The (micro) Service Level. A Strategy Shall Be Defined For Roll Out Of The Architectural Approach,accounting For Potential System Level Impact - For Example A Stepwise Approach Utilising Sidecar Proxies' To Facilitate The Zta Migration For Legacy Systems And Workloads. Other Modern Security Patterns Such As Secure Api Gateways Shall Also Be Assessed. Theresulting Adapted Mission Data System Applications, Architecture And Testbed Shall Be Developed And Deployed And The Main Functions Of The Zta And Security Orchestration Capability Demonstrated. The Result Is Expected To Demonstrate A Step-change In Security Posture For Ground Segment Software Systems And Vastly Increased Efficiency In Terms Of Security Configuration And Automated Policyenforcement.