Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

11. SUMMARY.
Current civilian aircraft certification safety assurance processes for airborne systems and
equipment are based on ARP 4754, ARP 4761, and various certification authority advisory
material (e.g., AC 25.1309-1A) and aircraft manufacturer standards. Civil airborne system
software assurance is based on DO-178B, which defines a structured, rigorous development and
verification processes for assurance of the embedded software, and other various certification
authority and industry policies and standards. ARP 4754 provides guidance for the system
development processes to address the safety issues that arise from highly integrated or complex
airborne system relationships. It provides guidance for conducting system safety assessments,
and references ARP 4761, which defines methods and approaches for conducting safety analysis
techniques, such as functional hazard analysis, fault tree analysis, and failure modes and effects
analysis.
Approving networked airborne systems should be recognized as being a significant extension to
ARP 4754. Networked systems differ from the current ARP 4754 environment in several
significant ways. Networked elements are systems that include all of the networks and their
constituent elements and users to which the network is directly or indirectly attached. Networks
are, therefore, arbitrarily huge, and the many interrelationships of the system items are often too
subtle to discern. Networks are inherently complex systems in which every item in the network
is inadvertently integrated, regardless of whether those items share any common functional goal.
Approval of networked entities must now also address possible network interactions that occur
during, and result from, network attacks. The various networked elements potentially have a
fate-sharing relationship with each other because any compromised network entity can
theoretically be used to attack other networked items or their shared network environment.
Embedding airborne software within network systems represents an extension of the ARP 4754
environment to networked items that share limited common functional relationships with each
other. This is because entities or components of a system are connected into a common network
environment regardless of the original functional intent of the system design (e.g., multiple
aircraft domains can be connected by a common network system).
Networks are inherently hostile environments because every network user, which includes both
devices (and their software) and humans, are potential threats to that environment. Networked
environments and the entities that comprise them need to be protected from three specific classes
of threat agents: (1) the corrupted or careless insider, (2) the hostile outsider, and (3) client-side
attacks. Because of these dangers, ARP 4754 needs to be extended for networked environments
by ensuring network security protection and function/component availability and integrity. This,
in turn, implies the need to strategically deploy IA security controls within network airborne
systems.
Safety and security have, therefore, become intertwined concepts within networked airborne
environments. Security engineering addresses the potential for failure of security controls
caused by malicious actions or other means. Safety analysis focuses on the effects of failure
modes. The two concepts (safety and security) are, therefore, directly related through failure
effects. A shortcoming of either a safety process or a security process may cause a failure in a
137