Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

12. COTS computer systems cannot be adequately secured within large network
environments, in general, because their security controls cannot be trusted to perform as
intended when attacked. These devices contain potential vulnerabilities potentially
affecting security and safety of other networked entities whenever they are deployed
within large networks. COTS computer systems, and the applications they support,
cannot be high assurance.
The following are the recommendations of this study (see section 8.3 for a generic safety and
security design implementing these recommendations and safety requirements).
1. Existing ARP 4574, ARP 4761, DO-178B, and DO-254 assurance guidance processes be
extended into network environments by using the Biba Integrity Model framework to
define network safety and security assurance concepts.
2. The Biba Integrity Model be implemented solely within the context of existing FAA
safety processes. This results in airborne network systems being organized into networks
that operate at specific safety integrity levels (e.g., the DO-178B software levels).
3. ARP 4754 and FAA policy be extended to address attack prevention and mitigation by
using security controls. IA controls need to comply with best common IA practice,
which is defined by the NSA’s IATF [50]. These controls need to be implemented in
accordance with best current defense-in-depth practices.
4. Aircraft be defined as Mobile ASs, which have embedded VPN network enclave
partitions, each of which operates at a specific assurance level.
5. The aircraft should be configured as a mobile AS that moves in reference to other ASs
within the larger worldwide aeronautical system. In this approach, each individual
networked entity within aircraft is IP addressed and the network topology changes that
occur as the aircraft moves are handled by the BGP protocol that links the aircraft to
other ASs. IP addressing issues may arise with this model depending on whether the
aircraft’s IP addresses are associated with a specific service provider (e.g., CIDR; see
RFC 1517) or not.
6. DO-178B and ARP 4754 processes be extended to include security vulnerability
penetration tests of the integrated airborne network, systems, and each of its constituent
items prior to initial certification and deployment. This includes examining their actual
vulnerability to attacks as shown in appendix A (e.g., network mapping, vulnerability
scanning, penetration testing, password cracking, etc.).
7. Devices operating at specific criticality levels (i.e., failure condition categories, ARP
4754 system development assurance levels, DO-178B software levels, DO-254 Hardware
Design Assurance Levels) should be organized into specific network partitions (VPN
network enclaves) that operate at a specific assurance level in a manner parallel to the
DoD classification levels. Network enclaves for IP networks should be established by
141