Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

As mentioned in section 4.4, the higher assurance integrity entities (e.g., higher software levels)
should not rely upon (human) administrative activity. Specifically, it should not be possible to
misconfigure or mismanage high-assurance devices (including software) or systems.
6.1.2 Availability.
Availability issues directly impact the same three entities that were previously described for
integrity:
• Adequate availability (or spare capacity) is needed for the physical network media that
conveys data communications packets. Network availability can be attacked by causing
the intermediate systems that forward packets to not function correctly or else by
saturating the network so that entities that need to use it cannot do so. The latter is called
a DoS attack, which leverages the fact that network capacity is a finite resource. The first
threat can be reduced by deploying intermediate systems that cannot be misconfigured
(i.e., are high assurance). DoS exploits can be reduced by ensuring that the capacity of
the network exceeds the cumulative network use, either by rate limiting the devices that
connect to the network or else by implementing other QoS techniques. If QoS is used,
higher software levels applications (e.g., Level A and Level B) should preferentially
leverage technology that is implemented so that it cannot be misconfigured.
• Availability of the security controls should be assured for a device that is used within a
distributed system’s defense-in-depth security protections. This requirement can be met
by ensuring that defense-in-depth and control life cycle principals mentioned in section
5.1 are followed. Key system resources should also either have redundancies or else
have fail-safe protections.
• Availability should be assured for the applications that support airborne operations.
These devices need to be designed to be impervious to bad data. They also need to be
designed to withstand repeated and prolonged attempted accesses by rogue processes or
systems (e.g., DoS attacks).
Availability is traditionally addressed by using either real-time systems where information flows
are predetermined and systems are preconfigured to guarantee delivery of critical information, or
by QoS network capabilities. For safety systems, this property must be designed in mechanisms
that must be provided to segregate non-real-time systems from real-time systems and techniques
to assess interactions between systems that must be employed, in accordance with the rules that
are articulated in section 8.2.
77