Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

IP networks are organized in terms of ASs, which are the unit of policy (e.g., security policy,
QoS policy) within IP networks (see section 5.3). The router-to-router protocols of IP networks
are subdivided into two distinct systems:
• An interior gateway protocol (IGP) is used between routers within a common AS.
Example IGP protocols in IP systems include OSPF (see RFC 2328) and IS-IS (see RFC
1195).
• An exterior gateway protocol (EGP) is used between routers located in different ASs
from each other. The prevalent IP EGP is the border gateway protocol (BGP, see RFC
1771).
Both of these router protocol systems are subject to attack. Attacks against routing protocols are
a subset of the possible attacks against the network system itself.
Appendix A contains technical details about historic attack mechanisms and tools to identify and
exploit latent bugs within COTS computing and network systems [32-39]. These mechanisms
are not fully explained for nonsecurity personnel—a complete explanation of those details is
outside of the scope of this document. Rather, those details are described in the appendix to
provide partial evidence of the fact that the vast majority of modern computing equipment
deployed within IP networks today cannot be trusted to be secure in general. Their security
provisions, including their trusted paths and security controls, have repeatedly been
demonstrated to not be viable when attacked. This point is discussed in section 4.4. However,
to prepare the reader for that discussion, it is necessary to alert the reader about the myriad of
vulnerabilities that are currently latent in today’s COTS devices, vulnerabilities that can be
exploited by (remote) attackers to attack the security, and possibly the safety, of networked
systems. Readers who are unfamiliar with these vulnerabilities are encouraged to read appendix
A before proceeding.
4.4 MIXING EMBEDDED SYSTEMS AND GENERIC OPERATING SYSTEMS.
Embedded systems can be successfully designed for high-assurance environments. For example,
DO-178B defines processes so that Level A systems can have a very high degree of safety
assurance. What is unknown, however, is whether these same systems will maintain their high
level of assurance should they be deployed in a network environment for which they were not
originally designed or approved. Embedded systems can be potentially stressed by localized
attacks in ways that were not anticipated by their developers or certifiers, potentially creating
unexpected results. For example, a latency-sensitive real-time application that is deployed
within a networked environment should be evaluated with a view towards the effects that may
occur should its supporting network experience an availability attack (see appendix A, section
A.3). Therefore, each of the items that will be deployed within a generic network environment
need to be evaluated for the entire gamut of network threats discussed in appendix A.
31