Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

22. If SWAP considerations permit, an NIDS should be deployed that is associated with the
firewall system. The NIDS should be configured to recognize attack footprints and be
configurable to optionally send alerts to designated crew members or ground systems
alerting them should certain types of attacks occur.
23. The ASBR provides BGP connectivity with the remote air and ground networks with
which the airplane is communicating. The airplane’s ASBR must be configured such that
all packets are sent with an ASBR interface, because the IP destination address must be
dropped unless they use IPsec in transport mode and come from a network management
or IDS device that is local to that airplane.
24. DO-178B should be extended to mitigate network attack vulnerabilities by introducing
specific tests into the development processes (e.g., process maturity models, formally
verify protocols, software fault injection, model checkers, buffer overflow tests, dead
code tests). The software can provide for some self protection, similar to what is
currently done for hardware failures (e.g., however, tests alone do not provide assurance,
they only identify the presence or absence of problems for items contained within the test
suite).
25. For network environments, existing DO-178B assurance processes should include the
following three elements for higher-assurance software:
• A series of penetration tests should be performed upon the completed software
item. Specifically, the software (including its OS, if any) needs to be subjected to
a range of network attacks described in appendix A. Any problems identified
from these attacks need to be fixed.
• Examine the software under evaluation to verify that its internal construction
complies with formal models of software construction such as being modular and
layered in terms of a structured presentation within the implementation itself.
• Conduct a rigorous line-by-line code inspection of the software to demonstrate a
lack of bugs that can be hostilely attacked.
Software items that do not undergo, or cannot pass, these three additional tests cannot be
stated to be high assurance when deployed in network environments
26. Very stringent application of existing software certification processes should be used for
high-assurance software in networked environments. The line-by-line code inspection
requirement for high-assurance software certification should ensure that high-assurance
software code bases explicitly use formal software techniques and are comparatively
small in size (in terms of the number of lines of code). The inspection should actively
seek to identify (and fix) software bugs that can be attacked. The indeterminate number
of bugs that are latently present in large-code bases represent unaddressed attack
vulnerabilities in networked environments. Current software development methods
cannot be trusted to produce high-assurance results unless those results are supplemented
145