Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

of linking aircraft-resident systems over a common data bus needs to be considered within the
larger context of the network-centric evolution of air-to-air, air-to-ground, and ground-to-ground
communications within the airspace as a whole.
However, with these advantages come risks associated with increased exposure of previously
isolated components. Aircraft vendors, operators, and regulators need to understand the impact
that interconnected systems may have upon flight safety. Design, test, validation, and
verification techniques should consider the impact of unanticipated interactions between
previously isolated systems. In addition, the effects of intentional failures caused by malicious
software or persons need to be considered. Existing evaluation techniques, where individual
systems have been evaluated in isolation, should be updated to address safety concerns
introduced by future interconnected systems.
FAA Order 1370.82 “Information Systems Security Program” requires “the FAA must ensure
that all information systems are protected from threats to integrity, availability, and
confidentiality” [13]. Section 4.1 of this report explains that networks potentially expose
software to larger populations of attack threats. As John Knight explains, “unless a system is
entirely self contained, any external digital interface represents an opportunity for an adversary
to attack the system” [7]. Section 4.4 explains that COTS computing devices, when deployed
within networked environments, have an indeterminate number of latent security vulnerabilities
that can be attacked and potentially exploited. COTS systems, therefore, have very questionable
assurance characteristics in networked environments. Even though aircraft may not deploy
COTS software within their airborne LANs, they nevertheless can benefit from the extensive
experience gained to date from deploying COTS systems within networks and they may
communicate with ground-based networks that widely deploy COTS systems. Airborne
software and devices, unless they have been specifically assured for use in networked
environments, may or may not manifest similar problems, depending on the number and type of
bugs present in networked airborne software. This is because latent security vulnerabilities,
when combined with the increased exposure of networked systems, can result in security
problems that have direct safety implications. Vulnerabilities include:
• Modification or replacement of authentic aviation software by an alternative variant
introduced by an attacker. For example, if an attacker could thwart onboard security
procedures to download corrupted software of their own choosing, then a safety hazard
can arise if that corrupted software, for example, causes the pilots—and the navigation
systems they rely upon—to believe that their current altitude is 2000 feet higher than it
actually is.
• Attacks to network system elements that either hinder correct software operation or else
modify the reported results of correct software operation. For example, if an attacker
takes control of an onboard device and uses it to continuously flood the onboard network
with spurious transmissions, a safety hazard may arise should that denial of service attack
on the network actually succeed in disrupting latency-sensitive real-time transmissions
between distributed avionics components and, by so doing, induce incorrect computation
results that affect critical onboard systems.
5