Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

6.1.4 Confidentiality.
Confidentiality is generally not relevant for safety (see appendix B for a discussion to the
contrary). While there are some scenarios where the real-time location of an airplane might
become known to an adversary and conceivably put the plane in jeopardy, this threat has not
become widely accepted within the FAA. The flight paths of commercial airplanes are already
known, and the real-time information would have a short lifespan for an attacker. In this
example, old data is of little value to the attacker in general.
6.1.5 Nonrepudiation.
With regards to digital security, nonrepudiation means that it can be verified that the sender and
the recipient were, in fact, the parties who claimed to send or receive the message, respectively.
Nonrepudiation of origin proves that data has been sent, and nonrepudiation of delivery proves it
has been received. Digital transactions are potentially subject to fraud, such as when computer
systems are broken into or infected with Trojan horses or viruses. Participants can potentially
claim such fraud to attempt to repudiate a transaction. To counteract this, the underlying
processes need to be demonstrably sound so that such claims would not have credence. Logging
of significant events is needed to create accountability. Log files should be protected from being
modified or deleted.
Nonrepudiation should be a required security attribute for all electronic parts distribution
systems (e.g., software distribution). All electronic parts need to be signed in accordance with
the U.S. Federal DSS [81] in accordance with an FAA-approved electronic distribution system.
The source and integrity assurance of an electronic part is a critical element of verifying its
authenticity prior to installation. This signature needs to be checked and verified at the
deployment site before any electronic part can be deployed. The checks verify that the software
has not been modified subsequent to being signed. The identity of the signer needs to be
authenticated and authorized previous to deployment.
In addition, whenever administrators (both device and human) interact with aviation equipment
or administer devices within aircraft, a log of their activity should be kept for analysis,
accountability, and administrative purposes (e.g., fault investigation). The log file needs to
record the specific identity of the human responsible, the time, actions performed, as well as
optionally the location from which the access occurred. This log needs to be protected from
subsequent modification or deletion. If network or host intrusion detection systems (IDS) are
deployed, these log files should be available for those systems to read.
6.2 EXTENDING FAA ORDERS, GUIDANCE, AND PROCESSES INTO VAST NETWORK
SYSTEMS.
Different communities use different terms to refer to the same or similar concepts. For example,
it was previously mentioned that current FAA safety assurance processes for airborne systems
are based on ARP 4754, ARP 4761, and ACs (e.g., AC 25.1309-1A and AC 23.1309-1C);
software assurance is based on DO-178B; and complex electronic hardware design assurance is
based on DO-254. These references reflect common FAA parlance that speaks about the laws,
79