Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

alerted the pilots because the failure was not a flight-critical item, leaving mechanics to
find the discrepancy when downloading the CFDIU at a maintenance stop. With the
OMT, however, ground crews now would be alerted via ACARS and would be ready to
fix the problem at the next stop rather than having to find out about the problem later.
Some military airplanes are designed so that classified mission critical functionality (not flight)
resides on laptop computers. The configuration of these laptop computers must be maintained to
guarantee that they cannot corrupt other computer systems on the airplane network. This report
presumes that EFB functionality must similarly be protected from unauthorized modification that
could compromise the integrity of the data or affect other networked systems. The latter
includes explicit protection against the introduction of viruses, worms, or other types of
malware. Like military laptop computers, the EFB must be controlled through policies and
procedures commensurate to its level of security (safety).
This architecture requires that EFB devices must be certified and deployed in conformance with
the architecture just like any other networked nonpassenger device within the aircraft. Because
these devices are COTS computers, this report states that they cannot themselves be certified at
any higher-assurance level. Specifically, the viability of their security controls directly relies
upon the vicissitudes of administrative configuration and management oversight and they are
directly vulnerable to the problems discussed in sections 4.1 through 4.4. For this reason, any
coupling of EFB devices within higher-assurance environments must occur via HAGs. Since
HAGs are tailored for specific deployment environments, this requirement implies that EFP
functionalities be directly coordinated with specific HAG devices in an FAA-supervised manner.
9.5 UPDATING SECURITY PROTECTION SOFTWARE.
Higher-assurance devices need to be designed so that they cannot be mismanaged or
misconfigured.
By contrast, the security controls of lower-assurance devices have dependencies upon the
vicissitudes of administrative configuration and management oversight. They are also often
directly vulnerable to the problems discussed in sections 4.1 through 4.4. Nevertheless, their
security protection software and update policies and procedures should be assessed as part of the
certification process. That process should directly assess all networked devices in terms of
documented network threats. However, the process also needs to evaluate lower-assurance
devices in terms of their participation within a standard airborne defense-in-depth security
architecture. That security architecture must conform to IATF-recommended and COTS
supported protection mechanisms. These lower-assurance devices must be configured and
managed so that they support the aircraft’s defense-in-depth security design and the certification
process should ensure that this is possible.
The IA security design shall also address life cycle control issues (see section 5.1). The
criticality of assured software update procedures and their potential safety impact must be
considered and acceptable procedures developed. Updates to antivirus software signature files
occur regularly and do not change the executable software on the computer; therefore, the safety
impact of this type of update may be considered low as long as the integrity of the software
127