Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

with common certification results. It has specifically studied mechanisms for integrating CC
security evaluations and DO-178B safety processes, including:
• Common Certification of Airborne Software Systems [72]
• Dual Certification for Software [73]
• Common Security Testing and Evaluation [41]
• Integrated Capability Maturity Models [76]
As a result, a growing body of work exists to guide the government and industry for how to
create processes to design, test, evaluate, and certify airborne and NAS system elements for
safety and security.
However, the optimum mechanism by which to relate safety and security in airborne systems has
remained elusive. Resolving this issue forms one of the primary goals of this study. This issue
is directly addressed in this section. This study has significantly diverged from previous studies
by concluding that the primary issue, as it relates to network airborne safety, is not how to
correlate DO-178B safety and CC security concepts and processes, as was presumed by previous
studies, because such comparisons produce ad hoc results. They are ad hoc because while safety
and security have become intertwined concerns in airborne environments, they are nevertheless
distinct concepts from each other. Rather, this report states that the primary issue impacting
network airborne safety is how to extend existing safety policies for airborne system, hardware,
and software into networked environments in a mathematically viable manner. This section
recommends that this can be accomplished by using the Biba Integrity Model. This approach
preserves current safety assurance processes and extends them into networked environments.
Section 6.2 begins the explanation of the relevant issues. However, before that can be done,
section 6.1 will discuss the derived security requirements of networked safety environments.
6.1 SECURITY REQUIREMENTS OF AIRBORNE NETWORKED ENVIRONMENTS.
The information presented in this section has previously been discussed in many studies.
Readers interested in additional information about these concepts are encouraged to read
references 9, 17, 20, and 78-80.
Section 4 and appendix A mention a great many specific security risks that can occur within
networked environments. Due to the target-rich nature of this situation, it is not possible to
enumerate all possible security risks that may conceivably occur within airborne network
environments. This section will consider the security requirements at a high-level of abstraction
in terms of traditional IA concepts (see glossary). It is important to reiterate that the primary
requirement of all airborne environments, including networked environments, is safety. The
security requirements articulated in this section are derived from the need to mitigate the known
security threats that occur in networked environments so that these security threats will not
create software failure states that could impact safety. These security requirements presume
traditional IA best current practices that were previously described in section 5.1.
74