Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

• ARP 4761 section 4.4. Common Cause Analysis is unlikely to recognize the gamut of
possibly subtle effects resulting from the postattack actions of a compromised network
device. This is true for all analysis mechanisms: zonal safety analysis, particular risks
analysis, and common mode analysis.
• ARP 4761 section 5 states:
“Where the detection method is identified to be provided by test,
assurance must be provided that the test procedures in fact detect the
latent failures of concern.”
However, “failures of concern” in networked environments include latent software bugs
that may not become visible or known until attacked. This possibility was not considered
by ARP 4761.
• Similarly, the functional hazard assessments (see ARP 4761 Appendix A) also need to
address software integrity issues (including software downloads and updates), network
availability, and network security integrity and availability.
10.2 HOW DOES SECURITY ASSURANCE FIT INTO OVERALL CERTIFICATION
PROCESS?
Security assurance is needed to provide integrity and availability protections to ensure that the
DO-178B and ARP 4754 safety protections remain viable over time. If the Biba Integrity Model
is used to extend ARP 4754 into network environments as this study recommends, then a
mapping between the integrity of security controls and the inherent DO-178B and ARP 4754
safety concepts is needed. The nature of this mapping needs to be further studied, but the current
study recommends that insights from the University of Idaho’s study [72, 73, and 93] be used to
provisionally equate the CC’s EAL 5 with DO-178B Level A (see section 6.5).
10.3 WHAT SHOULD NETWORK SECURITY ASSURANCE PROCESS CONTAIN TO
MEET XX.1309?
This study’s conclusions and recommendations section (see section 11) together with the
exemplar airborne network architecture (see section 8.3) provides the answer to this question.
XX.1309 mentions many practical and important issues that the recommended architecture
directly seeks to address and mitigate. Nevertheless, the current text of XX.1309 contains many
statements and concepts that will be challenging to achieve in airborne network environments:
• The meaning of the word “system” in Section 23.1309 changes significantly within the
context of an airborne environment. For one thing, systems become arbitrarily large in
networked environments and, unless partitioned by VPNs, theoretically include all the
devices and humans that can directly or indirectly access any part of the network. This
creates the potential for danger and risk within airborne network environments in that
equipment, which had no potential safety hazards in nonnetworking environments may
have direct and potentially catastrophic safety effects through their fate sharing
132