Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

Protection Detection Reaction / Neutralization Recovery / Reconstitution
- ongoing risk assessments
- technology controls
- security processes
- system log monitoring
- network and host-based
intrusion detection
- warning, escalation to
incident response team
Ongoing Damage
- system recovery begins
(e.g. hardware replaced,
applications and
information restored)
System Assessment
- Is the system recoverable?
- Does the system require
reconstitution?
Successful attacks
Neutralized, Repelled
Detected attacks
Undetected attacks
Figure 16. Control Life Cycle
5.2 DEPARTMENT OF DEFENSE NETWORKING.
The U.S. DoD is currently creating their next-generation network that has similar issues as the
aircraft and NAS integration targets being addressed in this report. Section 6.3 will compare the
DoD confidentiality classifications with the DO-178B software level safety classifications.
Section 7 will propose extending the DO-178B and ARP 4754 safety concepts into networked
environments by using the Biba Integrity Model [51 and 52]. The Biba Integrity Model is a
direct analog of the Bell-LaPadula Confidentiality Model, which is used by the DoD to extend
their confidentiality classifications into large system deployments such as networks. These
proposed changes result in the safety extension approach that is recommended by this study for
civilian aircraft, directly resembling the DoD global information grid (GIG) infrastructure, which
is targeted for military aircraft. Because of this, this section provides a terse overview of how
the DoD is designing their GIG.
The GIG seeks to empower the DoD’s network centric operations and network centric warfare
vision. The GIG comprises the DoD’s internal network of networks, which is similar in concept
to the worldwide civilian Internet infrastructure.
The architecture of the GIG is strongly influenced by DoD communications security (COMSEC)
policies. The Bell-LaPadula Confidentiality Model forms the framework for confidentiality
within U.S. DoD information processing, including the DoD’s COMSEC policy. This model
creates a multilevel security system by means of mandatory access controls, labeling data at a
specific classification level, and providing users’ clearances to a specific classification level.
The controls ensure that users cannot read information classified at a security level higher than
their own classification level, nor write information to a lower classification level, except via the
controlled intervention by a trusted subject (e.g., a high-assurance guard (HAG)).
55