Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

6. RELATING SAFETY AND SECURITY FOR CERTIFICATION.
Daniel Mehan, the former CIO of the FAA, wrote:
“For FAA, information systems security extends beyond the computer
environment to the security of airspace and the national airspace system. The
structural, operating, and procedural foundations of information systems security
provide the mechanisms for achieving FAA’s safety, security, and efficiency
goals.” [18]
Airborne system safety as it relates to software is safeguarded by DO-178B [5] procedures,
processes, and guidance. By contrast, traditional IT security is evaluated in terms of CC
mechanisms [71, 44, 45, and 46]. The DO-178B processes are primarily focused on safety. The
CC processes are primarily focused on security. Carol Taylor, Jim Alves-Foss, and Bob Rinker
contrast the two approaches as follows [72 and 73]:
“DO-178B is intended to certify that software used in aircraft is developed with
“best known” practices and does not contribute to aircraft safety hazards.
Software is not ever certified as a standalone component but only as a part of
aircraft or engine type. Emphasis in DO-178B is in outlining general policies and
procedures to produce safe software in terms of airworthiness requirements and to
produce documentation to substantiate that the development requirements have
been met. Thus, language and content is high-level and abstract leaving a lot of
compliance decisions up to the developer.
The Common Criteria (CC) is intended to specify security requirements that a
system, hardware or software must satisfy in order to achieve a specific level of
assurance. The CC only deals with security functionality of systems and does not
address overall development issues except where they affect security. The CC is
a much more detailed document in terms of specifying how compliance is
achieved for an intended product. Each component of each assurance class has
specific action elements and evidence of compliance for both developers and
evaluators.” [72]
“While the purposes for each certification are clearly different, many of the
requirements and procedures are aimed at insuring that the final design and
implementation meets certain quality standards. In many cases, these standards
are similar, and by modifying or adding to the current procedures in each case, a
single common process can be developed which will satisfy both certifications.
Since each certification process can potentially be quite expensive, a common
process should result in significant cost savings for those systems that must meet
both standards.” [73]
As Dr. Mehan has repeatedly observed [18 and 19], safety and security are related concerns
within the NAS. The U.S. federal government has subsequently studied mechanisms by which
safety and security can be combined into a common, integrated process [13, 40, 41, and 72-77]
73