72. Alves-Foss, J., R<strong>in</strong>ker, B., and Taylor, C., “Towards Common Criteria Certification for DO-178B Compliant Airborne Software Systems,” January 2002. 73. Taylor, C., Alves-Foss, J., and R<strong>in</strong>ker, B., “Merg<strong>in</strong>g Safety and Assurance: The Process of Dual Certification for Software,” Proc. Software Technology Conference, March 2002. http://www.csds.uidaho.edu/comparison/stc2002.pdf http://gulliver.trb.org/publications/security/dmehan.pdf 74. Payne, C., Froscher, J., and Landwehr, C., “Toward a Comprehensive INFOSEC Certification Methodology,” Proceed<strong>in</strong>gs of the 16 th National Computer Security Conference, Baltimore, MD, September 20-23, 1993, NCSC/MIST, pp. 165-172. 75. Cortellessa, V., Cukic, B., Del Gobbo, D., Mili, A., Napolitano, M., Shereshevsky, M., and Sandhu, H., “Certify<strong>in</strong>g Adaptive Flight Control Software,” Proceed<strong>in</strong>gs of the ISACC2000, The Software Risk Management Conference, Reston, VA, September 24-26, 2000. 76. Ibrahim, L., Jarzombek, J., Ashford, M., Bate, R., Croll, P., Horn, M., LaBruyere, L., and Wells, C., “Safety and Security Extensions for Integrated Capability Maturity Models,” <strong>FAA</strong>, September 2004. 77. Foster, N., “The Application of Software and Safety Eng<strong>in</strong>eer<strong>in</strong>g Techniques to Security Protocol Development,” PhD Dissertation at the University of York Department of Computer Science, September 2002. 78. Roy, A., “Security Strategy for U.S. Air Force to Use Commercial Data L<strong>in</strong>k,” IEEE, 2000. 79. McParland, T. and Patel, V., “Secur<strong>in</strong>g Air-Ground Communications,” Digital Avionics Systems, DASC 20 th Conference, Vol. 2, 2001, pp. 7A7/1-7A7/9. 80. Nguyen, T., Koppen, S., Ely, J., Williams, R., Smith, L., and Salud, M., “Portable Wireless LAN Device and Two-Way Radio Threat Assessment for <strong>Aircraft</strong> VHF Communication Radio Band,” NASA/TM-2004-213010, March 2004. 81. FIPS Pub 186, “Digital Signature Standard,” National Institute of Standards and Technology (NIST), 19 May 1994. http://www.itl.nist.gov/fipspubs/fip186.htm 82. Patel, V. and McParland, T., “Public Key Infrastructure for Air Traffic Management Systems,” Digital Avionics Systems Conference Proceed<strong>in</strong>gs, Daytona Beach, FL, October 14-18, 2001, Piscataway, NJ, IEEE Computer Society, 2001. 83. Harris, S., “All In One CISSP Certification Exam Guide,” McGraw-Hill/Osborne, 2002. 84. Bell, D.E. and LaPadula, L.J., “Secure Computer Systems: Mathematical Foundations and Model,” Technical Report M74-244, The MITRE Corporation, October 1974. (Note: 154
the follow<strong>in</strong>g is a po<strong>in</strong>ter to a related article that Bell and LaPadula wrote <strong>in</strong> 1976 where they cite this reference for their work, as opposed to the more prevalent 1973 reference: http://csrc.nist.gov/publications/history/bell76.pdf) 85. Krutz, R. and V<strong>in</strong>es, R., The CISSP Prep Guide, Wiley Computer Publish<strong>in</strong>g, 2001. 86. Executive Order 12958, “Classified Nation Security Information,” April 17, 1995. http://www.fas.org/sgp/cl<strong>in</strong>ton/eo12958.html 87. Executive Order 13292, “Further Amendment to Executive Order 12958, As amended, Classified National Security Information,” March 25, 2003. http://www.fas.org/sgp/bush/eoamend.html 88. Public Law 100-235 (H.R. 145), “Computer Security Act of 1987,” January 8, 1988. http://www.epic.org/crypto/csa/csa.html 89. Title 22, Chapter 1, Subchapter M, “International Traffic <strong>in</strong> Arms Regulations,” Department of State, Revised April 1, 1992. http://www.epic.org/crypto/export_controls/itar.html 90. MIL-STD 882D, “Department of Defense Standard Practice for System Safety,” 10 February 2000. 91. Department of Defense Instruction (DoDI) 8500.2, “Information Assurance (IA) Implementation,” ASD(C3I), 102 Pages 92. OMB Circular A-130, “Management of Federal Information Resources, Transmittal 4,” November 30, 2000. 93. Alves-Foss, J., R<strong>in</strong>ker, B., and Taylor, C., “Towards Common Criteria Certification for DO-178B Compliant Airborne Software Systems,” Center for Secure and Dependable Systems, University of Idaho, January 2002. http://www.esds.uidaho.edu/papers/Taylor02d.pdf 94. http://sourceforge.net/projects/tripwire/ 95. Ghosh, A., O’Connor, T., and McGraw, G., “An Automated Approach for Identify<strong>in</strong>g Potential Vulnerabilities <strong>in</strong> Software,” DARPA contract F30602-95-C-0282, Proceed<strong>in</strong>gs of the 1998 IEEE Symposium on Security and Privacy, IEEE Computer Society, May 1998, pp. 104-114. http://www.cigital.com/papers/download/ieees_p98_2col.pdf 96. Cowan, C., Pu, C., Maier, D., H<strong>in</strong>ton, H., Walpole, J., Bakke, P., Beattie, S., Grier, A., Wagle, P., and Zhang, Q., “StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks,” DARPA Contract F30602-96-1-0331 and F30602-96-1- 155
- Page 1 and 2:
DOT/FAA/AR-08/31 Air Traffic Organi
- Page 3 and 4:
1. Report No. DOT/FAA/AR-08/31 4. T
- Page 5 and 6:
5.4.2 Aircraft as a Node (MIP and M
- Page 7 and 8:
11.1 Findings and Recommendations 1
- Page 9 and 10:
22 Customer’s L3VPN Protocol Stac
- Page 11 and 12:
LIST OF ACRONYMS AND ABBREVIATIONS
- Page 13 and 14:
PBN PC PE PEP PFS PIB PIM-DM PIM-SM
- Page 15 and 16:
This report states that the primary
- Page 17 and 18:
1. INTRODUCTION. This is the final
- Page 19 and 20:
protocol (IP)-based communications.
- Page 21 and 22:
of linking aircraft-resident system
- Page 23 and 24:
Industry and governments are extrem
- Page 25 and 26:
2.1 NOTIONAL NETWORKED AIRCRAFT ARC
- Page 27 and 28:
Other Control Sites Controller ATC
- Page 29 and 30:
• The security viability of curre
- Page 31 and 32:
alternative requires that parallel
- Page 33 and 34:
Aircraft network security is a syst
- Page 35 and 36:
4. NETWORK RISKS. This section spec
- Page 37 and 38:
General Threat Identifiers FAILURE
- Page 39 and 40:
esources so that the required real-
- Page 41 and 42:
“With the rise of client-side att
- Page 43 and 44:
• During an 11-month period (Apri
- Page 45 and 46:
attempt the theft of passwords. Non
- Page 47 and 48:
IP networks are organized in terms
- Page 49 and 50:
either the user or the trusted soft
- Page 51 and 52:
However, the previous paragraph beg
- Page 53 and 54:
Table 1. Internet Engineering Task
- Page 55 and 56:
Table 1. Internet Engineering Task
- Page 57 and 58:
Table 1. Internet Engineering Task
- Page 59 and 60:
• Lightweight directory access pr
- Page 61 and 62:
mechanism to overcome the key distr
- Page 63 and 64:
Deployments that need to support mu
- Page 65 and 66:
Today’s Reality: Islands of Commu
- Page 67 and 68:
Simultaneously, IP addresses are al
- Page 69 and 70:
in-depth manner. Defense-in-depth m
- Page 71 and 72:
Protection Detection Reaction / Neu
- Page 73 and 74:
encrypted and then encapsulated wit
- Page 75 and 76:
Internet (grouping of autonomous sy
- Page 77 and 78:
via that same IP address. Specifica
- Page 79 and 80:
deployments. Regional flights that
- Page 81 and 82:
neighbor as a next hop after “Hol
- Page 83 and 84:
Interface Interface Customer Site S
- Page 85 and 86:
Interface Customer’s Application
- Page 87 and 88:
Although the vast majority of PBN s
- Page 89 and 90:
6. RELATING SAFETY AND SECURITY FOR
- Page 91 and 92:
6.1.1 Integrity. As section 4.3 ind
- Page 93 and 94:
As mentioned in section 4.4, the hi
- Page 95 and 96:
6.1.4 Confidentiality. Confidential
- Page 97 and 98:
their own classification level nor
- Page 99 and 100:
integrity is not permitted to obser
- Page 101 and 102:
software has been confirmed as leve
- Page 103 and 104:
• Both safety and security are co
- Page 105 and 106:
Device at Safety level X Device at
- Page 107 and 108:
in a Biba Integrity Model environme
- Page 109 and 110:
Common Criteria Classes ACM—Confi
- Page 111 and 112:
(see section 9.10). A secure mechan
- Page 113 and 114:
employed in security-critical appli
- Page 115 and 116:
concept, which is needed to create
- Page 117 and 118:
4. Learn from past mistakes. Poor d
- Page 119 and 120: exemplar airborne network architect
- Page 121 and 122: • Requirement 8: Biba Integrity M
- Page 123 and 124: Figure 31 shows how the recommended
- Page 125 and 126: to-live (TTL) field in the IP heade
- Page 127 and 128: using the traditional dual router i
- Page 129 and 130: mechanism relies upon the controlle
- Page 131 and 132: HAGs are high-assurance devices tha
- Page 133 and 134: 8.3.5 Firewall. The firewall needs
- Page 135 and 136: (AJ) or low probability of intercep
- Page 137 and 138: design decisions that need to be de
- Page 139 and 140: 9.2 INTEGRATED MODULAR AVIONICS IMP
- Page 141 and 142: 9.3 USING PUBLIC IPs. The model and
- Page 143 and 144: alerted the pilots because the fail
- Page 145 and 146: environments. If the certification
- Page 147 and 148: DSS (FIPS 186 [81]). Code signing i
- Page 149 and 150: elationship with other equipment in
- Page 151 and 152: approach is to keep the log informa
- Page 153 and 154: 11. SUMMARY. Current civilian aircr
- Page 155 and 156: environments should be extended to
- Page 157 and 158: 12. COTS computer systems cannot be
- Page 159 and 160: 14. NAS and airborne network archit
- Page 161 and 162: 22. If SWAP considerations permit,
- Page 163 and 164: 11.2 TOPICS NEEDING FURTHER STUDY.
- Page 165 and 166: 9. Lee, Y., Rachlin, E., and Scandu
- Page 167 and 168: 32. Loscocco, P., Smalley, S., Muck
- Page 169: 59. Raisinghani, V. and Sridhar, I.
- Page 173 and 174: Department of Defense Instruction N
- Page 175 and 176: Information Assurance—The Departm
- Page 177 and 178: Threat source—Either (1) intent a
- Page 179 and 180: information found within these data
- Page 181 and 182: (HTTP) traffic (port 80), port scan
- Page 183 and 184: The simple network management proto
- Page 185 and 186: opportunities to crack the hosting
- Page 187 and 188: authorized to perform. 13 However,
- Page 189 and 190: sniffers, log-cleaning scripts, and
- Page 191 and 192: A.3.1 DENIAL OF SERVICE ATTACKS. Th
- Page 193 and 194: • Disclosure: Disclosure of routi
- Page 195 and 196: affected by the signal intermittenc
- Page 197 and 198: A-15. Barbir, A., Murphy, S., and Y
- Page 199 and 200: Survey Question What is the primary
- Page 201 and 202: Survey Question What is the primary
- Page 203 and 204: should be emphasized that there is