Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

4. Learn from past mistakes. Poor development practices typically result in security
vulnerabilities. By examining these past development practices and identifying those that
improve or hinder system security, valuable lessons can be obtained and future
implementations improved.
5. Document the operational environment. This is typically done in a document called the
Concept of Operations (CONOPS). It describes the environment in which the system
will operate, the roles and responsibilities of the major players, how the system is
designed to normally operate, and potential contingency modes of operation. The
security environment can be included in the CONOPS as a separate section or included in
its own document (a Security CONOPS.) Elements of this security CONOPS should
include a reiteration of the security requirements, the process used to select all
countermeasures, how defense-in-depth is implemented, how the security mechanisms
will operate, including user impacts, the effectiveness of the implemented
countermeasures, how misuse is prevented or detected, the response mechanisms to a
misuse incident, and the recovery process, if needed.
6. Perform a risk analysis. The risk analysis examines the operational environment to
determine high-value assets, the threats to these assets, their vulnerabilities,
countermeasures needed to reduce the risk for each threat/vulnerability pairing, and
validation of the cost effectiveness of each countermeasure. For airborne environments,
this approach differs from the traditional security engineering process by including safety
as a key factor. It also differs from traditional safety analysis by considering the possible
effects of malicious actions. In more detail, the first step is to determine the high-value
assets to assist in focusing where the limited security dollars should be spent. In placing
a value on each asset, the cost effectiveness of the selected countermeasures can later be
determined. Once the assets are determined, each threat, which is asset- and
environment-dependent, must be ascertained. In conjunction with this, the vulnerabilities
of these assets must also be determined. Once the threats and vulnerabilities are
determined, each threat is matched with the appropriate vulnerability. Any vulnerability
without a threat or vice versa can be ignored. Otherwise, countermeasures are selected to
reduce the threat and the cost of the countermeasures determined. A tradeoff is then
performed between threat and vulnerability matches, countermeasure costs, and protected
asset value.
7. Design the security architecture using the above information. The above risk analysis
will identify the areas requiring protection and the cost-effective countermeasures
requiring implementation. The security design should be consistent with accepted best
practices. One such best practice is the concept of defense-in-depth (discussed in section
3.5). This concept uses the medieval castle as its model. Multiple layers of defense are
implemented so that when one layer is successfully penetrated, other layers of protection
still exist. While it is widely accepted that no security mechanism is foolproof, an
architecture implementing the defense-in-depth concept should sufficiently delay the
attacker to allow for the detection of the attack and to implement an appropriate response.
This assumes that full control life cycles have been implemented to enable attack
detection and response. Other best practices include least privilege, object reuse,
101