Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

(see section 9.10). A secure mechanism to associate software versions with appropriate
target devices within aircraft also needs to be established that has viable integrity and
nonrepudiation attributes. The software that is stored within the authoritative storage
facility needs to be digitally signed in accordance with the U.S. Federal DSS (FIPS
Publication 186) by an individual authorized to sign aircraft software. The secure
software download system also includes provisions to ensure that mandatory onboard
aircraft procedures verify that the received software has been signed by an authorized
individual and that the software has not been modified subsequent to signing (i.e.,
software integrity and authorization protections) as a prerequisite for deploying the
software within aircraft.
• Software, after it has been securely installed upon aircraft, must undergo frequent (e.g.,
potentially several times an hour) integrity verification checks to verify that the currently
installed software is what it purports to be and that it has not been clandestinely replaced
by a Trojan horse or other unauthorized software variant. There are a number of
mechanisms by which such tests may be accomplished, including Tripwire mechanisms
[94]. It is important that the onboard integrity verification procedures themselves be
designed to be as impervious as possible to compromise from network attacks.
The second secondary effect is to supplement the current certification policy by introducing a
wide range of penetration tests upon the actual completed airborne system. These tests should
systematically address the capabilities of the network airborne deployment system under
evaluation, which includes its security controls, to withstand the range of attack vectors that are
described in appendix A. These tests will hopefully identify latent vulnerabilities within the
proposed networked system itself that need to be fixed as a condition for becoming approved.
While such testing cannot provide assurance guarantees, it can identify specific areas needing
additional attention.
“Operational system security testing should be integrated into an organization’s
security program. The primary reason for testing an operational system is to
identify potential vulnerabilities and repair them prior to going operational. The
following types of testing are described: network mapping, vulnerability
scanning, penetration testing, password cracking, log review, integrity and
configuration checkers, malicious code detection, and modem security. …
Attacks, countermeasures, and test tools tend to change rapidly and often
dramatically. Current information should always be sought.” [41]
A related topic is that the worldwide civil aviation community needs to identify common
solutions for identity (section 4.8), IP addressing (sections 5.3 and 5.4), naming, 30 routing
(section 5.5), protocol security (section 4.5), and authentication (section 4.9) subsystems. These
common approaches need to be realized by consistent technology and configuration choices that
produce a coherent worldwide civil aviation network infrastructure. These important technical
30
Because airborne naming issues are common to naming issues present elsewhere in the Internet, this study did
not specifically discuss naming. Readers who are unfamiliar with Internet naming are encouraged to learn about
the DNS protocol (see RFC 2535).
95