Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

communications between dissimilar systems. The identity mechanism of each protocol system,
and the mapping between them, must be assured to be consistent, complete, and definitive.
A great many different authentication and authorization systems exist. Should an infrastructure
deploy multiple systems, then each alternative system and the mapping between them need to be
assured to be consistent, complete, and definitive. Without such assurance, a possibility exists
that flaws in these key foundational elements may exist, which can be hostilely leveraged by
attackers. For this reason, the entire worldwide aeronautical infrastructure needs to define
complementary authentication systems, preferably using a single, common authentication
technology. It is helpful if they also use common authorization approaches, and the
authorization system can be integrated into a consistent and coherent network management
solution.
Assuring identity, authentication, authorization, and access control systems is much more of an
art than a science. The task is simplified if a single technology for each system (identity,
authentication, authorization, and access control) is deployed systemwide. For example, PKI has
been proposed to become a common integrated authentication system for aeronautical systems
[82]. PKI can be used for networks supporting many different network protocols. PKI is also
used within the DoD (i.e., DoD PKI) to serve as the authentication system used by the military,
including military aircraft. Regardless, a common technology should be identified as a common
approach to standardize upon.
However, it is not always possible to ubiquitously deploy only a single technology solution
system-wide. Because of this, some have proposed various mechanisms’ cooperating systems
that can be used to devise common policies that are
“… expressed simply and in high level terms, but refined in many dimensions to
map to specific infrastructures, organizational or individual needs and world
events.” [49]
Regardless of the specific mechanism used, whenever different security administrations or
technologies are joined together in a cooperative manner (e.g., aircraft and ground systems), it is
important and challenging to define the interfaces between the systems in such a way that the
security posture for the combined system as a whole is not diminished.
5. NETWORK SECURITY DEFENSES.
This section discusses traditional mechanisms to try to mitigate those risks. However, it also
contains sections that introduce specific concepts and technologies that provide important
background information needed to understand important elements within the subsequent sections
of this document.
5.1 DEFENSE-IN-DEPTH.
Networks traditionally attempt to mitigate the risks mentioned in section 4 and in appendix A,
and, indeed, any possible network risk, by strategically deploying security controls in a defense-
52