How meeting Jeff Goldblum in Rome Led Me to Send Thousands of Malware Samples to Space

My recent family trip to Rome was great; getting away from the office for a week, exploring the city, walking through historical sites, enjoying the food, and just being present with my family was exactly what I needed.

One day, while walking through a cool little alley, we stumbled across a pasta-and tiramisu-making class. It looked fun, and as the saying goes, “when in Rome, do as the Romans do.” For a few hours, I replaced malware, cybersecurity, and critical infrastructure with flour, eggs, water, timing, pressure, and patience.

The more I settled into the class, the more I realized that even making pasta is a system. It looks simple from the outside, but if you care about the result, small details matter. Too much water changes the dough. Too much pressure changes the texture. Rush the process, and the result won’t be quite right.

This is true in food, in business, and in cybersecurity.

At the end of the class, something completely unexpected happened; I met Jeff Goldblum.

He was warm, funny, elegant, and very human. Like most people who meet him, I thought about his iconic film roles, the jazz piano, and his unique ability to be famous yet still approachable. That was before my cybersecurity brain took over.

I kept thinking about a scene from the 1996 film Independence Day, where his character David Levinson infects the alien mothership with malware.

Timing matters here. Space feels like it is entering a new boom cycle, moving beyond rockets, NASA, and SpaceX going public.

The broader story is global. Amazon Kuiper is entering the satellite broadband race. Europe is building IRIS² as a secure and sovereign connectivity constellation for government communications, crisis response, critical infrastructure, and encrypted services. China is moving aggressively with large constellation programs such as Thousand Sails and Guowang. India is expanding its space and defense satellite ambitions. Japan is investing more in space security. Operators like Viasat, OneWeb, Planet, Maxar, Intelsat, Iridium, Eutelsat, SKY Perfect JSAT, and others are building communications, imaging, navigation, defense, and data services in orbit.

The conversation is also moving beyond satellites-as-communications infrastructure. Elon Musk has discussed putting AI data centers in orbit, arguing that Earth is power constrained while space has constant sunlight. Last year, Starcloud launched a spacecraft with an Nvidia H100 chip and demonstrated running a version of Google’s Gemini AI model from space. Additionally, Google revealed Project Suncatcher to explore satellite clusters equipped with TPUs and optical links as well as plans to launch prototype satellites in 2027.

That is a very different kind of space economy.

Space is moving from transportation to communication, from communication to data, from data to computation, and from computation to AI. Space is becoming a global digital infrastructure layer involving nation-states, commercial operators, defense agencies, and multinational supply chains.

...and every digital infrastructure layer eventually becomes a cyber target.

Many of the incidents also exposed the limits of relying primarily on traditional firewalls and detection-based security.

In the 2018 NASA JPL breach, attackers compromised an external account and moved laterally through poorly segmented networks. The perimeter defenses were not enough once trust had been established. In the 2022 Viasat KA-SAT attack, attackers reached a trusted management network through a compromised VPN / firewall path and issued legitimate management commands.

Again, the problem was not simply detecting malicious traffic, but the failure to use a unidirectional gateway, which would have enforced one-way data movement by design rather than policy, preventing attackers from reaching critical systems in the first place.

Once we identify the risk and the root causes behind the reported incidents, what do we do about it?

Cybersecurity for space has many of the same root causes as traditional cybersecurity, but it adds two dimensions that change everything—time and environment.

On Earth, if something goes wrong, we assume we can connect, inspect, patch, restore, or send someone onsite. In space, many of those assumptions break down. Communication is slower, more expensive, more limited, and gets harder the farther you move from Earth.

The Moon is close enough that signals take a little over one second each way, but even that creates a round-trip delay of more than two seconds. Mars can be anywhere from about 4 to 24 minutes one way, depending on where Earth and Mars are in their orbits. For deep space missions, the problem becomes even worse. Voyager is so far away that communication can take almost an entire day one way.

That changes the cybersecurity model.

Modern security tools increasingly depend on constant interaction with the cloud: reputation lookups, hash checks, signature updates, AI model updates (a growing dependency as AI-enabled systems move into orbit), sandbox submissions, telemetry uploads, and centralized verdicts. On Earth, this works because connectivity is fast and reliable. In space, it becomes dangerous to assume the same model will work.

On the Moon, some of this is still technically possible, but it is not something you should depend on. Every cloud lookup adds delay. Every sandbox submission must travel to Earth and back. Every remote desktop session becomes slower. Every large forensic upload competes with mission bandwidth. If the Earth link is congested, degraded, jammed, or unavailable, cloud-based security becomes unreliable.

If this is already difficult on the Moon, it becomes dramatically harder on Mars, and impossible to do in real time in deep space.

The same is true for patching. If you run a space mission for many years, you cannot assume you can patch your infrastructure like you can a laptop, a server, or a cloud workload. A spacecraft may be operating with old hardware, limited memory, radiation-hardened processors, constrained bandwidth, limited power, and a very small communication window.

If the update is wrong, if the command is malformed, or if the software behaves differently in flight than it did in simulation, recovery may be difficult or worse; it becomes impossible.

Voyager is a perfect example. NASA launched Voyager 1 and Voyager 2 in 1977, and the team is still maintaining them nearly five decades later. Updating or correcting software on a spacecraft that old and that far away takes incredible engineering. But it also proves the point that patching a spacecraft is slow, risky, and nothing like patching systems on Earth.

Galileo is another useful example. After it launched, Galileo’s high-gain antenna failed to fully deploy, which meant the spacecraft could not use its planned high-speed communication link. NASA and JPL still recovered major scientific findings through compression, software changes, and careful mission planning. That proved a key point: in space, communication limitations define missions.

The cybersecurity question is simple; what do you do when you cannot rely on fast communication, constant visibility, cloud-based response, or sending someone onsite? I suggest three strategies.

Detection is still useful, especially on ground systems, terminals, and enterprise environments around the mission, but it assumes you can see the attack, and then quickly analyze, respond, and recover. In space, that assumption is weak because visibility may be limited, communication may be delayed, compute may be constrained, and recovery may be slow or impossible. By the time you detect the problem, the mission could already be in jeopardy.

That is why the strategy must be preventionbefore trust.

Every file, software update, AI model, payload package, command package, and removable media device should be treated as untrusted until it is inspected, validated, sanitized, and approved. Use multiscanning, sandboxing, content disarm and reconstruction (CDR), schema validation, signed updates, allowlists, command validation, and audit trails before anything reaches the mission environment.

Don’t treat mission control like normal enterprise IT nor let engineering systems freely touch operational systems. Ensure supplier access is narrow, temporary, logged, and isolated, and aggressively separate ground stations, command paths, software update systems, test environments, and collaboration tools.

Not a single compromised laptop, stolen credential, infected file, bad update, or supplier breach should be able to move into mission operations.

Firewalls are important, but in the most sensitive mission paths, I would not trust a firewall alone. Firewalls are software controlled, meaning they can be misconfigured, bypassed, or compromised. A data diode or unidirectional gateway is the better model because it enforces one-way data movement by design, not just by policy.

Launching a MetaDefender Kiosk Mini was our first space mission, not a marketing stunt. To me, the Kiosk Mini mission represents what I believe is the foundation of cybersecurity in space: independent computation, prevention before trust, deterministic file security, and hardware that can keep working in harsh environments.

First, it is an independent system. Although we sent it to an extreme altitude, it was not cloud-connected during the mission. It used local computation and operated in an air-gapped model. We plan to include a unidirectional data gateway or data diode in a future mission.

Second, the Kiosk used Deep CDR™ Technology technology to process thousands of malware samples from a USB drive during the mission in a controlled and isolated test environment. Deep CDR™ Technology is deterministic, meaning it does not need to guess whether a file is malicious. It assumes the file may be malicious, removes risky active content, and regenerates a clean version. If you lock the process down properly, it does not require frequent signature updates to prevent many unknown file-based threats, because the Kiosk rebuilds the file before trusting it.

Lastly, we tested the hardware in a harsh environment. The Kiosk Mini had to deal with extreme temperature, low pressure, violent motion, the balloon bursting, high G forces during descent, spinning, falling, and even landing in a river. It kept working for a while after all that. This matters because space cybersecurity is a software and hardware problem.