Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

“With the rise of client-side attacks, a flaw emerges in the old [security] model;
despite avoiding a direct connection to the outside, users might still be attacked
by the very services that they’ve requested.” [24]
“A new attack vector has been created in which users are transformed into a
platform to attack internal resources without their consent or even their
awareness. Users are no longer passive participants in the security model;
they’ve become the very service by which entrance is gained into the protected
interior of the network.” [16]
There are many published examples of successful client-side attacks, including the following:
“The Oregon Department of Revenue has been contacting some 2,300 taxpayers
this week to notify them that their names, addresses or Social Security numbers
may have been stolen by a Trojan horse program downloaded accidentally by a
former worker who was surfing pornographic sites while at work in January
[2006].
An investigation by agency security personnel and the Oregon State Police
found that the malicious program was designed to capture keystrokes on the
former employee’s computer … The employee was an entry-level worker who
was assigned to enter taxpayer name and address changes, as well as some
social security numbers. ‘We know that the information that the Trojan
gathered up was transmitted outside of the agency’ to an unrelated Web site.
The incident is still under investigation.” [25]
Therefore, attacks against networked entities may occur from outsiders, from corrupted insiders,
as well as from client-side attacks (see figure 9). The effect of outsider attacks is to emphasize
perimeter defense protections (e.g., firewalls, VPNs). The effect of corrupted insiders is that
network security is no longer primarily a function of establishing adequate perimeter defense
controls; it now must also include viable access control within the network itself. The effect of
client-side attacks is that network security is no longer solely a function of the total control
protections established on devices within the network. It is now also reliant upon the appropriate
activities of every human using those network resources. While filtering services located at the
perimeter, defense firewalls can and do combat client-side attacks; however, new attacks are
continually being devised that perimeter defense filtering systems must be updated to identify
and eliminate. Consequently, there is often a vulnerability window between when a new attack
type has been devised and when the protections against that new attack have been deployed. For
this reason, defense against client-side attacks heavily relies upon end-user education—and can
be circumvented by end-user mistakes.
25