Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

However, the previous paragraph begs an even more fundamental question: Can Internet
protocol-based network systems be certified for high-assurance deployments? That is, most IP
implementations have a large number of possible configuration settings. If all the devices in IP
network X are certified at a certain assurance level or above, does that mean that the network
system itself also operates at that level? The NSA has previously observed this problem during
the Rainbow series. Specifically, they had the Orange book [42] and then found that a secure
collection of computers is not necessarily secure when networked. This resulted in the creation
of the Red book [43]. However, the issue being discussed here is not primarily concerned with
limitations of the Red book, or the resulting evolution to the common criteria (CC) [44-46], but
the fact that security concepts are extended into networked environments by means of
mathematically based security models, and that these models have no provisions for addressing
client-side-attack or configuration-based uncertainties. The latter becomes relevant because the
vast majority of IP devices today can be configured in many different ways. For this reason, this
report states that an attribute of high-assurance implementations is that they cannot be
misconfigured.
In conclusion, COTS devices, when deployed within large networked environments, are
inherently nonsecure in general. These inherent risks can theoretically be mitigated by
appropriate IA security practices. FAA studies, such as reference 47, have discussed possible
mitigation approaches to address COTS vulnerabilities and encourages the mitigation of COTS
vulnerabilities via mechanisms as those discussed in reference 47 and section 5. However, it
simultaneously warns that the viability of these mitigation approaches are suspect to the extent
that they rely upon COTS software and systems for their implementation. This is because COTS
software and systems are not trustworthy, in general, when attacked. It is also because the
efficacy of COTS software and systems are highly reliant upon (human) administrative
oversight.
4.5 INTERNET PROTOCOL FAMILY SECURITY.
The IETF 7 has defined a series of protocols associated with IP, which is known as the IP family
(also known as the transmission control protocol (TCP)/IP family). Table 1 describes an
important subset of these IETF protocols. The table summarizes their security features and key
management configurations. It contains many details that are outside of the scope of this
document. These details are included within this table to provide evidence for the following
generic observations.
7 Internet Engineering Task Force (IETF); see http://www.ietf.org
35