Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

The corporate world also has classification systems. Each company has its own rules for the
protection of information depending upon its sensitivity level to intellectual property, business
strategy, and other similar areas. In many respects, the corporate classification system follows
the federal government system. As an example, there might be three levels of information
control within a corporation where the highest is limited and cannot be released outside of the
company. Proprietary information can be released but only to those individuals and companies
bound by a signed nondisclosure agreement. Finally, any information not covered by the above
can be released outside the company within the restrictions placed by the federal government. In
addition, International Traffic in Arms Regulations [89] controlled information, although
unclassified and nonproprietary, must still be controlled to prevent disclosure to foreign
nationals unless an appropriate export license has been obtained.
6.3.3 Comparison of the Two Policy Systems.
It is clear the FAA and civil aviation are concerned about airplane safety and so they define
airborne software in terms of the possible safety affects of software failure conditions. The
Federal Government, which includes the DoD, is concerned about protection of sensitive
information and programs. It defines its software systems in terms of the impact of that software
upon the protection of sensitive information and programs. Although the focus on what is being
protected against is entirely different between these two policy systems, the intent of the
protection mechanisms are similar. Both enforce restrictions on how software operates within its
system context. Both are also concerned with the impact of protection mechanisms and the
consequences of possible failure affects. Both define their assurance system in terms of the
worst-case affects of failure conditions. Coincidentally, both assurance systems are also
remarkably similar to each other when viewed at a high level of abstraction, as shown in table 2.
Table 2. Comparison of Safety Levels to Security Classifications
Safety
Level A (catastrophic condition)
Level B (hazardous/severe-major condition)
Level C (major condition)
Level D (minor condition)
Level E (no-effect condition)
Security
Top Secret (exceptionally grave damage)
Secret (serious damage)
Confidential (damage)
Sensitive but Unclassified (could adversely
affect)
Unclassified (no effect)
Therefore, although the civil aviation and federal government systems are distinct systems from
each other and are oriented around very different issues, they nevertheless share important
attributes. Additional similarities and differences between the two systems include the
following:
• Only the security side is concerned with confidentiality issues—this issue is briefly
discussed in section 6.1.4.
86