Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

7.1 EXTENDING ARP 4754 INTO NETWORKED ENVIRONMENTS.
The primary differences between networked airborne environments and the highly integrated or
complex aircraft systems for which ARP 4754 was designed is:
• The inadvertent integration between all networked entities, including possibly subtle fate
sharing relationships.
• Networks are inherently hostile environments where any software bug may be attacked
and potentially leveraged to corrupt or compromise that item. If compromised, the item
may potentially be used to attack other networked items or their common network
environment.
There are two primary changes that are needed to extend ARP 4754 to address the challenges
that occur within networked environments:
• ARP 4754 itself needs to become enhanced by the application of a security model so that
the current ARP 4754 concepts could be assured to be extended in a mathematically
viable manner into networked environments. This study recommends that ARP 4754
become extended by leveraging the Biba Integrity Model.
• Strategic security controls need to become introduced into an ARP 4754 deployment to
provide IA protections that mitigate or reduce the efficacy of networked attacks,
including restricting access to unauthorized humans and devices. As previously stated,
these IA controls need to comply with best common IA practice, which is defined by the
NSA’s IATF [50]. These controls need to be implemented in accordance with defensein-depth
practices, which were discussed in section 5.1. Section 8.2 will apply best
current SSE practices to the combination of current FAA safety assurance policies and
Biba Integrity Model concepts to define the rules and relationships that underlie this
study’s recommended exemplar airborne network architecture, which is presented in
section 8.3. Section 8.3, therefore, will discuss each of a minimal subset of security
controls that are needed in airborne networked environments, including their
recommended configurations to achieve a minimal set of defense-in-depth protections.
These two primary changes produce at least two secondary effects, which are also a component
part of extending safety policy for networked environments. The first of these secondary effects
is the need to require viable software life cycle integrity protections as an ARP 4754 system
requirement. There are two constituent aspects for creating software integrity:
• Loading software onto aircraft needs to occur within a secure FAA-approved software
download system. (Please see FAA Order 8110.49 chapters of field-loadable software.)
This system needs to ensure that only the correct versions of the correct software are
loaded into aircraft. This implies that a reliable mechanism of creating software and
software updates is defined that includes a mechanism to securely store software within
an authoritative ground-based software storage facility. Assured software versioning
mechanisms and processes need to be established that provide nonrepudiation assurances
94