THE IMPACT OF COTS COMPONENTS ON BUILDING TRUSTWORTHY SYSTEMS Arthur Pyster Deputy Assistant Administrator for Information Services and Deputy Chief Information Officer February 7, 2001

The FAA’s Job Each day at 1000 staffed facilities, the FAA manages 30,000 commercial flights, using 40,000 major pieces of equipment, by 48,000 FAA employees, to safely move 2,000,000 passengers.

National Airspace System ~ 500 FAA Managed Air Traffic Control Towers ~ 180 Terminal Radar Control Centers 20 Enroute Centers ~ 60 Flight Service Stations ~ 40,000 Radars, VORs, Radios, …

CIO’s Security Mission Protect the FAA’s information infrastructure and help the aviation industry reduce security risks through leadership in innovative information assurance initiatives Establish and lead a comprehensive program to minimize information systems security risks Ensure critical systems are certified as secure Ensure all FAA staff and contractors know and do what is required to maintain information systems security Ensure cyber attacks are detected and repelled and that successful attacks have minimal effect Maintain effective outreach to industry, government, and academia

COTS Use within FAA (Part 1) >$2B annually in IT acquisitions Most recent and planned systems are heavily COTS-based; e.g. FAA Telecommunications Infrastructure National Airspace Systems Information Management System Next generation messaging Rapid movement towards TCP/IP-based networking and Oracle-based DBMS

COTS Use within FAA (Part 2) Even many “custom” air traffic control systems may be used by air traffic control authorities in many countries CTAS – advise order in which aircraft should land COTS is key to rapid and affordable deployment of new capabilities Almost all heavily proprietary systems are old legacy ARTS – primary system for terminal air traffic control

COTS-related System Vulnerabilities (Part 1) Source code known to many outside FAA, but not to those inside FAA Knowledge of source code not controlled by FAA Security often an “afterthought” in commercial systems – security not often a commercial success criteria New releases of software could introduce new vulnerabilities and invalidate old mitigations Hackers often go after vulnerabilities in COTS components

COTS-related System Vulnerabilities (Part 2) COTS rely heavily on commercial protocols and standards that are widely known, making it easier to exploit vulnerabilities Easily available tools and knowledge mean less sophisticated hackers can exploit many vulnerabilities in COTS components Generality of COTS components makes them more likely to have vulnerabilities and to introduce new vulnerabilities when integrated with other components. Built-in COTS security features can be widely implemented, reducing vulnerability!

Exponential Growth in Security Incidents Recent CERT-CC Experiences

FAA’s 5 Layers of System Protection Personnel Security Physical Compartmentalization/ Information Systems Security Site Specific Adaptation Redundancy Architecture and Engineering Awareness and Execution

… and A Generic ISS Service Perspective Access Control Confidentiality Availability Architecture and Engineering Awareness and Execution Authentication Integrity

Comprehensive Certification Process ISS Certifier Sys Developer or Owner CIO Certification Agent Threat Vulnerabilities Likelihood Impact Risk Management Plan VA Report IS Security Plan ISS Test Plan & Summary Results Protection Profile Certification Statement Prepare SCAP Conduct Risk & Vulnerability Assessments System Certification & Authorization Package (SCAP) Package Authorization Statement Executive Summary C&A Statements to DAA Deploy This process defines the ISS team, the assessment approach and the preparation of the System Certification and Authorization Process. Note to the DoD members that this is very similar to the DoD DITSCAP process

Integrated Facility Security Secure Facility Boundary Personnel and Physical Barrier Shared Networks Service A HOST Manual DARC Service B Service C Electronic Private Networks Phone lines DSR Authenticated & Authorized Traffic

Airport Traffic Control Tower and Airport Surface Movement E-IDS WS (Airport Status & Control) SMA TDLS-R WS Wx (Supervisor Workstation) TDW (Air Traffic Display ) Voice Switch ATCT (Local Info. Services and LAN Control) X Target Data from TRACON/STARS to WAN O-D VPN • ASDE •Other FAA Facs TDWR •AWOS/ASOS ITWS •ACARS DL Local AWOS/ ASOS, ITWS) Software Updates Remote Maintenance AMASS/ASDE ATCT Legend Core INFOSEC Requirements Requirements, including Risk-driven INFOSEC Admin & Management Encrypted Interface Plaintext Interface Extranet Server Removal of Malicious Traffic from NW NAS Ops Data Virtual Private Network Network Access Control NW AC Network Screening Service S Strong Auth of NW Users Common Network Security Interface Current -2002 2003-2005

Selected CTAS Security Measures Enable basic security measures in operating system Shut off unused Internet protocols Audit system use to detect unauthorized access or operation Banners warn users about penalties for misuse Virtual Private Network for secure communication

Selected FTI Security Requirements Basic Security Services Confidentiality, Integrity, Availability Optional Enhanced Security Services Strong Authentication, Firewalls, Extranets, VPNs, Enhanced confidentiality and integrity, Closed user groups, Enhanced remote access

Oracle8i Security Features User Authentication DB, external, OS, network, global, N-Tier Password Management Account locking, password aging, history and complexity checking Fine Grained Access Control Views, PL/SQL API, Virtual Private Database Advanced Security Option Data Privacy, Data Integrity, Authentication and Single Sign On, Authorization

Certifying COTS Components ISO Protection Profiles establish standard security requirements for classes of systems such as firewalls, databases, operating systems, and even for a generic information system COTS components can be “certified” for compliance with Protection Profiles by an official body such as the National Information Assurance Partnership. Custom components can use tailored versions of COTS-oriented Protection Profiles.

Closing Thoughts COTS present new security challenges daily, but use of COTS is key to rapidly and affordably delivering new services. The 5-layers of FAA security implemented through a comprehensive certification process to achieve integrated facility security ensure the National Airspace System remains protected. Greatest COTS research challenges: Testing the security characteristics of black-box COTS components Understanding the security properties of composed COTS components Architecting COTS-based systems for security