Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

separation of roles, need-to-know, secure failure and recovery, input validation, and
training plans.
8. Develop the system. In this step, the design is tested and technologies are selected for
implementation. In most cases, this includes the use of COTS systems and applications
software. However, COTS products with a large installed base are attractive targets for
attackers. As a result, all COTS products should be identified and their suitability for
implementation within specific NAS subsystems determined during risk analysis.
Another potential security concern is the outsourcing of software development. The
problem that must be considered is the potential for the introduction of malicious
software into the developed and delivered product. Steps such as security vetting of the
development company, verifying the company’s development practices (capability
maturity models or ISO certified), and issues such as ownership should be considered.
Next, the developed system should include auditing capabilities and, optionally,
automated alerts to administrative personnel. Only by examining the audits, can misuse
actions be traced to the offending user or program. As a result, these audits should be
organized by individual user, and they should record all user or software interaction with
protected data. Other elements of concern during the development process include the
software languages used (some are inherently insecure), constructs used, how errors are
handled, the use of cryptography and digital signatures and their implementation, the
access control mechanisms selected and implemented, and the proper implementation of
all countermeasures.
9. Test the developed system. In this step, the implemented security countermeasures are
verified. Testing can be as simple as a visual verification or as complex as a full
mathematical proof of correctness. Most testing falls in between the two, relying upon
use and misuse cases to verify correctness. These cases ensure the system properly
protects the high-value assets from malicious insiders and outsiders. The approach taken
is typically documented in a test plan that includes the use and misuse cases. The result
of the testing phase is a report of the tests performed and the verification that all security
functionality has been exercised according to the plan.
10. Operations. Such issues still relevant to the security systems engineering process include
processes for software updates. During the operation of the system, security mechanisms
must be patched and updated. This process should be planned prior to operations.
8.2 APPLYING THE SSE METHODOLOGIES TO AIRBORNE NETWORKS.
Following the SSE process is intended to produce a best current practice security design for a
specific deployment in terms of the specific requirements and needs of that deployment. SSE
was not devised to create generic security designs for generic deployments. This study leverages
SSE to benefit from best current practices rather than invent a novel approach with unproven
results. This application of SSE solely addresses the articulation of current FAA safety policy
(e.g., DO-178B and ARP 4754) in terms of the Biba Integrity Model framework. It does not
address the very important issues and requirements that specific deployments have that extend
beyond this foundational policy framework. For this reason, this study views its resulting
102