Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

either the user or the trusted software and may not be imitated by other software.
… This section argues that without operating system support for mandatory
security and trusted path, application-space mechanisms for access control and
cryptography cannot be implemented securely.” (Quoted from Section 2 of
reference 32.)
“A secure operating system is an important and necessary piece to the total
system security puzzle, but it is not the only piece. A highly secure operating
system would be insufficient without application-specific security built upon it.
Certain problems are actually better addressed by security implemented above the
operating system. One such example is an electronic commerce system that
requires a digital signature on each transaction.” (Quoted from Section 5 of
reference 32.)
Additionally, although not mentioned in the NSA paper, a secure system also needs to leverage
secured communications protocols (see section 4.5).
Modern COTS OSs lack the controls that permit them to be secured in a high-assurance manner.
Because of this, the applications that they host do not provide the provisions to permit them to
have high-assurance properties either. For example, their access control and cryptographic
functions cannot be implemented in a demonstrably secure manner today. These effects escalate,
impacting the effectiveness of their data communications protocols and interdevice relationships,
cumulatively potentially affecting the many devices populating the networked environment.
Another factor directly affecting the viability of COTS security in networked environments is the
very high reliance that COTS devices have upon correct configuration and management practice.
COTS devices usually have many possible configuration settings that must be properly set in a
coordinated manner with the settings of other devices within the networked system if the
cumulative protections of that networked system can be effective. The relative competency of
system administrators and network administrators to correctly configure these devices is,
therefore, an essential issue affecting the security of these systems. Because network security
currently has such high operational reliance, it is not possible to certify the vast majority of
COTS-based network environments today except at the lowest assurance levels.
While these observations about the security vulnerabilities of COTS devices in networked
systems are sobering, it is important to recognize that these issues are not localized to avionics
systems but rather are universally common to both industry and government worldwide.
Network systems are potentially vast collections of entities directly or indirectly cooperating
together. The relative security profile of networked COTS devices is based upon each of the
following dependencies working correctly and in harmony:
• Potentially complex device settings effectively coordinated among the devices networkwide.
For COTS system elements, this traditionally equates to a high dependence upon
the competency of system and network administrative personnel to correctly configure
and manage networked devices over time.
33