Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

environments should be extended to address network attack risks. The concept of highassurance
software in networked environments should therefore mean that items and systems
will behave in the same manner before, during, and after network attacks, i.e., be immune to
potential network-based threats. Exploits in network environments leverage latent software
blemishes so that software items are subject to misbehavior, corruption, or compromise, possibly
including being used as a launching pad to attack other systems and items. Current DO-178B
processes do not currently include mechanisms to identify and fix well-known network attack
vectors. This study identifies specific additional tests to perform that function. Unfortunately,
software testing alone cannot result in high-assurance software. This is because tests only
identify the flaws for which the tests are designed to identify, they cannot guarentee the absence
of other flaws that were not addressed by the test suite. There is no existing security theory or
process that can be leveraged to produce warranteed high-assurance results for networked
environments. This is a very significant certification issue. Until a solution for this problem is
found, this study recommends that the FAA ensure that high-assurance software complies with
formal models and receives a rigorous line-by-line code inspection to demonstrate weaknesses
that can be hostilely attacked. Software will also need to be verified when integrated in
reapproved network environments.
11.1 FINDINGS AND RECOMMENDATIONS.
The following are the findings of this report:
1. The primary issue impacting network airborne system safety is how to extend existing
ARP 4574, ARP 4761, DO-178B, and DO-254 assurance guidance processes into
networked systems and environments in a mathematically viable manner.
2. Security models exist (e.g., Bell-LaPadula Confidentiality Model, Biba Integrity Model,
Clark-Wilson Integrity Model) that are directly applicable for extending security or
safety policies and processes into arbitrarily large and complex networked environments.
The models map the policy goals to information system terms by specifying explicit data
structures and the techniques necessary to enforce the policy and processes.
3. An attribute of high-assurance systems is that they cannot be misconfigured.
4. VPNs are viable mechanisms to partition network systems in accordance with ARP 4754
Section 5.4.1.1.
5. Airborne network environments are inherently complex integrated systems. Every entity
in a network is potentially integrated via fate sharing unless explicitly separated by
network partitions (i.e., VPNs). (Note: even though VPNs provide secure network
partitions, this study recommends that VPN techniques be applied within a larger
defense-in-depth context.)
6. Safety and security are intertwined concepts in airborne networked environments.
Security controls (primarily for integrity and availability) need to be introduced if safety
integrity is to be preserved within airborne networked environments. The following is
139