Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

environments. If the certification of networked nonpassenger airborne devices is trustworthy,
the only security breaches that could directly affect aircraft safety would probably be associated
with either the integrity or availability (or both) of networked airborne systems. Unfortunately,
this also includes the possibility of (accidental) misconfiguring networked devices (e.g.,
misconfiguring the aircraft’s ASBR). The danger from device misconfiguration is a very
significant issue for networked systems in general. For this reason, high-assurance devices
should be used for all network critical functions to the greatest extent possible because highassurance
devices need to be designed so that they cannot be misconfigured.
Because the critical airborne systems are protected within VPN enclaves, any hostile integrity or
availability attack upon those networks or systems would require considerable sophistication on
the part of the attacker (unless the vulnerability was caused by device misconfiguration) and
would directly reflect significant aircraft design or process deficiencies potentially affecting
other aircraft as well. Pilots and crew cannot be assumed to possess the computer and network
knowledge to address these types of potentially sophisticated problems. Rather, pilot or crew
members need aids that enable them to easily determine the nature of the problem (e.g., an error
code or other monitoring status event) so that they can contact experts on the ground to
determine remedial responses, just as they do for mechanical failures. In any case, the
stakeholders need to anticipate this possibility and determine how ground-based entities should
automatically receive and log real-time reports of all airplane safety-related failures. Operational
logs should also be maintained and recorded within the airplane itself (hopefully integrated with
airline maintenance processes), but safety-related incidents should also be reported to the ground
in real time. If the aircraft crashes, there must be adequate information available to determine
the root cause of the failure to prevent it from happening again.
9.7 ACCESS TO AIRCRAFT DATA.
Privacy is one of the elements of security engineering. A secure architecture does not
necessarily guarantee privacy of all information stored on the system; rather, it will identify
those data elements that must be kept confidential and will provide sufficient mechanisms to
protect the data from credible threats. Airplane operators may have information that needs to be
protected for business reasons; however, exposure of that information would not represent a
safety concern for the airplane. The physical location of a plane or some other characteristics of
its control channels may be considered sensitive. A credible threat scenario would generally be
required as part of the safety and security methodology. Lacking a credible threat scenario, no
countermeasures would be recommended. Privacy-enforcing mechanisms may still be warranted
to protect sensitive company information or sensitive privacy information about humans in
conformance to international or local law, but that would likely be outside of the certifier’s scope
unless there was a safety issue involved.
9.8 ADEQUACY OF EXISTING REGULATIONS.
Current certification guidelines focus on safety of flight issues. These are distinct from security
issues that are commonly addressed by a security engineering process. For this report, the focus
was on processes and procedures for identifying those security issues that may impact safety of
flight. The addition of LANs to airplanes and interconnections with external public networks
129