safemode.space
← All techniques
EXF-0005
ST0008Exfiltration

Proximity Operations

Description

A nearby vehicle serves as the collection platform for unintended emissions and other proximate signals, effectively a mobile TEMPEST/EMSEC sensor. From close range, the adversary measures near-field RF, conducted/structure-borne emissions, optical/IR signatures, or leaked crosslink traffic correlated with on-board activity, then decodes or models those signals to recover information (keys, tables, procedure execution, payload content). Proximity also enables directional gain and repeated sampling passes, turning weak side channels into usable exfiltration without engaging the victim’s logical interfaces.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(e)
    addresses
    high
    direct

    Proximity TEMPEST/EMSEC collection of near-field RF, optical/IR, and conducted emissions defeats confidentiality (2)(e) requires; the 'state of the art mechanisms, and by using other technical means' clause directly contemplates emanation control as a confidentiality measure.

  • craAnnex I, Part I, (2)(k)
    addresses
    high
    direct

    TEMPEST-grade enclosure, harness routing, optical baffling, and emission shaping are exploitation-mitigation mechanisms (2)(k) places on the manufacturer at design and production phases.

  • craAnnex I, Part II, (3)
    addresses
    moderate
    direct

    Proximity-operations TEMPEST/EMSEC exfiltration (primary mapping: Annex I, Part I, (2)(k)) requires regular EMSEC validation under (3) — proximity attack vectors evolve with sensor capabilities, demanding ongoing testing.

  • eu-space-actArt. 85(1)
    addresses
    moderate
    direct

    Proximity TEMPEST/EMSEC collection of near-field RF, optical/IR, and conducted emissions defeats confidentiality — 85(1)'s cryptographic concept must include constant-time, masked, and emanation-resistant implementations.

  • eu-space-actArt. 85(2)
    addresses
    moderate
    direct

    Proximity TEMPEST/EMSEC exfiltration (primary: Art. 85(1)) cascades to 85(2) — key lifecycle discipline limits exposure window from proximity capture.

  • nis2Art. 21(2)(h)
    addresses
    moderate
    inferred

    Art. 21(2)(h) crypto policy does not interdict proximate collection of unintended emissions; the operative mitigation is physical EMSEC, shielding and emission control. Addresses (domain relevance).

  • nis2-implAnnex 13.2.1
    addresses
    moderate
    derived

    Proximity-operations exfiltration captures unintentional emissions (near-field RF, conducted/structure-borne, optical/IR signatures) of the entity's spacecraft; protection-against-physical-and-environmental-threats obligations cover emission-management and shielding measures that resist this collection class.

  • nis2-implAnnex 6.7.1
    addresses
    moderate
    derived

    Network-security obligations cover protection of crosslink and inter-vehicle traffic that a proximate adversary can observe; link-encryption and source authentication on those flows resist exfiltration value.

ENISA controls

  • ENISA-STL-2025-03-sD.21-i06
    addresses
    moderate

    Hardware-level power-system noise injection masks emissions correlated with on-board activity, raising the cost of proximity-based side-channel exfiltration.

  • ENISA-STL-2025-03-sD.23-i13
    addresses
    moderate

    Power masking is the canonical control against partial-key inference from electromagnetic leakage at close range — exactly the proximity-collected emanations EXF-0005 measures.

  • ENISA-STL-2025-03-sD.29-i08
    addresses
    moderate

    Space-based RF mapping detects emissions from a co-orbiting collection platform attempting to gather proximity emanations.

  • ENISA-STL-2025-03-sD.35-i01
    addresses
    moderate

    Manoeuvrability is relevant to proximity operations because changing orbital geometry can deny an adversary collection platform sustained near-field access.

Cross-reference controls

  • mitre-attack-enterpriseT1011Exfiltration Over Other Network Medium
    addresses
    moderate

    Proximity operations exfiltration uses a co-orbital/proximate vehicle as a TEMPEST/EMSEC sensor capturing emanations and weak crosslink leakage — this is exfiltration via a non-primary network medium (the proximity-RF channel). T1011 'Exfiltration Over Other Network Medium' covers the conceptual pattern; cross-domain moderate honors that MITRE's typical example is Bluetooth-style enterprise alternate links.

  • mitre-attack-icsT0887Wireless Sniffing
    addresses
    moderate

    Proximity operations exfiltration uses a co-orbital/proximate vehicle as a TEMPEST/EMSEC sensor capturing emanations and weak crosslink leakage; T0887 'Wireless Sniffing' covers the passive-RF-capture activity at cross-tactic and cross-domain level (orbital sensing platform vs enterprise wireless interception).

  • nist-80053-rev5AC-17Remote Access
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17(1)Monitoring and Control
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17(10)Authenticate Remote Commands
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17(2)Protection of Confidentiality and Integrity Using Encryption
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-18Wireless Access
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-18(1)Authentication and Encryption
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-2(11)Usage Conditions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3(10)Audited Override of Access Control Mechanisms
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-3Information Exchange
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-13Alternative Security Mechanisms
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-4(9)Attribute Maintenance and Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-5Authenticator Management
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-5(7)No Embedded Unencrypted Static Authenticators
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-7Cryptographic Module Authentication
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-18Location of System Components
    relates to
    moderate

    Referenced in: sparta-data, csf-2-0

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-19Information Leakage
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-19(1)National Emissions Policies and Procedures
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-21Electromagnetic Pulse Protection
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-9Power Equipment and Cabling
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8Security and Privacy Architectures
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8(1)Defense in Depth
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(18)Trusted Communications Channels
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(19)Continuous Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-9(6)Organization-controlled Cryptographic Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-10Network Disconnect
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12Cryptographic Key Establishment and Management
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(1)Availability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(2)Symmetric Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(3)Asymmetric Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(6)Physical Control of Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-13Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-16(3)Cryptographic Binding
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-28(1)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-28(3)Cryptographic Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-30Concealment and Misdirection
    addresses
    moderate

    SC-30 mitigates EXF-0005 by concealing operational signatures exploitable from proximity vantage.

  • nist-80053-rev5SC-7Boundary Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(10)Prevent Exfiltration
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(11)Restrict Incoming Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(18)Fail Secure
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(5)Deny by Default — Allow by Exception
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-8Transmission Confidentiality and Integrity
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-8(1)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-8(3)Cryptographic Protection for Message Externals
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10Information Input Validation
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(3)Predictable Behavior
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(5)Restrict Inputs to Trusted Sources and Approved Formats
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(6)Injection Prevention
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-19(4)Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3(8)Detect Unauthorized Commands
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(15)Wireless to Wireline Communications
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • space-shieldT2035Side-channel exfiltration
    addresses
    high

    T2035 'Side-channel exfiltration' is the SPACE-SHIELD exfiltration-tactic technique covering side-channel data extraction — direct match to EXF-0005 Proximity Operations (proximity-based collection of unintended emissions and side channels).

SPARTA countermeasures

Cite as SafeMode Space, EXF-0005 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.