Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

Unless the safety risks of a networked system have been controlled by leveraging the
Biba Integrity Model, any such analysis would be improbable to perform adequately
because of the many items involved and their many possible (potentially very subtle)
interactions. Any such tests would be for the preattack environment and thus would
represent an ideal that may become greatly modified during or after attacks. Many of
these issues are addressed in the control life cycle concepts that are an integral part of the
IATF defense-in-depth approach.
• Issues arise in regard to Section 25.1309 e:
“(e) Each installation whose functioning is required by this subchapter, and
that requires a power supply, is an ‘essential load’ on the power supply. …”
The same logic that Section 25.1309 e explains in regard to power supplies is also needed
in networked environments to be applied to all possible software interactions that could
affect aircraft operation. This includes obvious as well as subtle affects, intended as well
as nonintended, and preattack as well as postattack variants. These of issues are
addressed in the control life cycle concepts that are an integral part of the IATF’s
defense-in-depth approach.
10.4 HOW WILL CONTINUED AIRWORTHINESS AND MAINTENANCE BE
ADDRESSED?
The conclusions (see section 11) and exemplar airborne network architecture (see section 8.3)
addresses how this study recommends that airworthiness be addressed.
Maintenance in networked software environments can potentially differ significantly from
current practice, depending on the actual software design, because authorized maintenance
personnel no longer need to be physically proximate to the airplane to maintain its software
systems. Maintenance in networked environments requires a robust authentication of the
maintainer. This study recommends that maintenance personnel be authenticated by two
factored authentication systems. For example, the administrator’s PKI identity (presuming that
the civil aeronautical community selects PKI for its authentication technology) coupled with
either what he knows (e.g., a pass phrase) or what he is (i.e., biometrics). It is often advisable
that administrative authorizations be restricted in terms of separation of duties with least
privilege. For example, different people are authorized to administer airborne security
configurations than those who are authorized to handle the non-security-related network
management functions, such as downloading software.
It is important that all activities performed by administrators be automatically logged. At a
minimum, the log files should state exactly the actions performed by the maintenance person,
contain the individual identification of the specific maintenance personnel who performed it, as
well as a timestamp and the identification of the networked device from which the administration
occurred. All log records should be protected against modification or erasure. One possible
134