Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

14. NAS and airborne network architecture and design should follow best common IA
security practices [20, 83, and 85].
15. Approaches to authenticate and authorize network managers be carefully considered.
This study recommends that administrative personnel be authenticated by two factored
authentication systems; e.g., the administrator’s PKI identity coupled with either what he
knows (e.g., pass phrase) or what he is (i.e., biometrics). It is also recommended that
administrative authorizations be restricted in terms of separation of duties with least
privilege. For example, different people must work on airborne security topics than can
work on other airborne administrative topics.
16. All activities performed by administrators upon aircraft software and systems must be
automatically logged. At a minimum, the log files should: state exactly what the
administrator did; contain the individual identification of the specific maintenance
personnel who did it; and provide a timestamp and the identification of the networked
device from which the administration occurred. All log records must be protected against
modification or erasure. One possible approach is to keep the log information both on
the aircraft and on the ground and create an alarm whenever the two copies contain
different information (e.g., produced different hashes).
17. The signals in space (e.g., radio or satellite communications) used for ground-to-air
communications must use transport security cover (i.e., encryption of the wireless signal
in space occurring at the OSI physical layer). This hinders nonauthorized entities from
eavesdropping upon these communications and discourages attempts to potentially inject
false communication signals into the data stream (e.g., possible man-in-the-middle
attacks). However, these links will remain potentially vulnerable to availability attacks
caused by hostile jamming unless mitigation techniques such as AJ waveforms or
LPI/LPD waveforms were also used.
18. Airborne or NAS systems should not be designed using technologies that require
significant policy complexity for all (or a majority of) the networked devices or a high
degree of policy coordination between all of the networked elements (see section 5.7).
19. Aircraft control and the cockpit (pilot) networks or their devices should not be physically
accessible by aircraft passengers. If there is any possibility of passengers physically
accessing the cockpit (pilot) network, then the high-assurance LAN within the cockpit
must be connected to the aircraft control network via the packet filter. Otherwise, the
high-assurance LAN in the cockpit can use the same physical high-assurance LAN as
aircraft control. The noncockpit crew network devices should also not be accessible by
passengers, but the design could accommodate situations in which passengers are not
always physically excluded from the area where those devices are located. If physical
separation is not possible, crew members must be very careful to not leave open
applications running in situations when the crew member is not present (i.e., situations
where passengers may access applications that have been opened with crew member
authentications).
143