Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

This study also recommends that the existing DO-178B assurance processes be applied very
rigorously for higher assurance software (i.e., Level A and Level B software) in networked
environments. The approval process should include the following three specific tests:
• A series of penetration tests should be performed upon the completed software item.
Specifically, the software (including its OS, if any) needs to be subjected to a range of
network attacks described in appendix A. Any problems identified from these attacks
need to be fixed.
• The software should be examined under evaluation to verify that its internal construction
complies with formal models of software construction, such as being modular and
layered in terms of a structured presentation within the implementation itself.
• A rigorous line-by-line code inspection of the software should be conducted to
demonstrate a lack of bugs that can be hostilely attacked. This implies that the approver
has an excellent understanding of how software bugs can be exploited by network attacks
and that the approver stringently examines that code base to identify and fix those
problems.
Software items that do not undergo, or cannot pass, these three additional tests cannot be stated
to be high assurance when deployed in network environments. Therefore, like any other nonhigh-assurance
entity, they can only be deployed within high-assurance environments by means
of an intervening HAG.
This study recommends very stringent application of existing software certification processes for
high-assurance software in networked environments. The line-by-line code inspection
requirement for high-assurance software certification should ensure that high-assurance software
code bases explicitly use formal software techniques and are comparatively small in size (in
terms of number of lines of code). The indeterminate number of bugs that are latently present in
large code bases represent unaddressed attack vulnerabilities in networked environments.
Current software development methods cannot be trusted to produce high-assurance results
unless those results are supplemented with extensive scrutiny. The larger the code base, the
more questionable the quality of the scrutiny. This means that software developers need to
actively consider how to create high-assurance software for network environments so that the
resulting software can be assured to be as bug-free as possible. Until a theoretical solution is
devised that produces guaranteed, high-assurance, bug-free results, high-assurance software
needs to undergo a very thorough (formal) line-by-line code inspection. A possible alternative is
for the software developer to assemble high-assurance software into modules. The integration of
these modules face the same types of integration issues that are addressed in ARP 4754, but this
may potentially result in an approval approach in which only a select subset of the total software
corpus will require a formal line-by-line code inspection.
8. CANDIDATE SAFETY AND SECURITY NETWORK SOLUTION.
The candidate safety and security network solution, which is presented in section 8.3, naturally
follows from the material that has been presented to date. The final remaining explanatory
98