Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

elationship with other equipment in networked environments. Attackers could
potentially leverage the lower-assurance items to attack the higher-assurance items by
hostilely changing the environment in which the higher-assurance items operate. The
goal of the network security assurance process, which adds security controls within a
Biba Integrity Model-based architecture, is to address and mitigate these dangers.
• Issues arise in regard to Section 23.1309 B 3:
“Warning information must be provided to alert the crew to unsafe system
operating conditions and enable them to take appropriate corrective action.”
It may be challenging to warn against unintended or nonanticipated interactions resulting
from other network-resident items that have no functional relationship to the system in
question. Also, the attack vectors of crackers (hostile human attackers) are difficult to
predict because the attacks are constantly evolving. Given this, it is unlikely that many
dangers may not be discerned until it is too late.
• Issues arise in regard to Section 23.1309 B 4:
“Compliance with the requirements of … may be shown by analysis and,
where necessary, by appropriate ground, flight, or simulator tests.”
Analysis is unlikely to address or recognize the gamut of possible subtle effects resulting
from the postattack actions of a compromised network device. Similarly, preattack
system interactions that these types of tests would address may have little relationship to
the modified system interactions that occur during or after attacks.
• Issues arise in regard to Section 25.1309 b:
“(b) The airplane systems and associated components, considered separately
and in relation to other systems, must be designed so that – (1) the
occurrence of any failure condition which would prevent the continued safe
flight and landing of the airplane is extremely improbable, …”
This goal is difficult to achieve for networked software for fly-by-wire designs unless
flight critical systems are partitioned by VPNs (or by an equivalently appropriate
partitioning approach for networks) to limit and constrain unintended interactions that
may occur during or after the system has been attacked.
• Issues arise in regard to Section 25.1309 d:
“(d) Compliance with the requirements of paragraph (b) of this section must
be shown by analysis, and where necessary, by appropriate ground, flight, or
simulator tests.”
133