1. THE IMPACT OF COTS COMPONENTS ON BUILDING TRUSTWORTHY SYSTEMS
Arthur Pyster
Deputy Assistant Administrator for Information Services and
Deputy Chief Information Officer
February 7, 2001

2. The FAA’s Job
Each day at 1000 staffed facilities, the FAA manages 30,000 commercial flights, using 40,000 major pieces of equipment, by 48,000 FAA employees, to safely move 2,000,000 passengers.

3. National Airspace System
~ 500 FAA Managed Air Traffic Control Towers
~ 180 Terminal Radar Control Centers
20 Enroute Centers
~ 60 Flight Service Stations
~ 40,000 Radars, VORs, Radios, …

4. CIO’s Security Mission
Protect the FAA’s information infrastructure and help the aviation industry reduce security risks through leadership in innovative information assurance initiatives
Establish and lead a comprehensive program to minimize information systems security risks
Ensure critical systems are certified as secure
Ensure all FAA staff and contractors know and do what is required to maintain information systems security
Ensure cyber attacks are detected and repelled and that successful attacks have minimal effect
Maintain effective outreach to industry, government, and academia

5. COTS Use within FAA (Part 1)
>$2B annually in IT acquisitions
Most recent and planned systems are heavily COTS-based; e.g.
FAA Telecommunications Infrastructure
National Airspace Systems Information Management System
Next generation messaging
Rapid movement towards TCP/IP-based networking and Oracle-based DBMS

6. COTS Use within FAA (Part 2)
Even many “custom” air traffic control systems may be used by air traffic control authorities in many countries
CTAS – advise order in which aircraft should land
COTS is key to rapid and affordable deployment of new capabilities
Almost all heavily proprietary systems are old legacy
ARTS – primary system for terminal air traffic control

7. COTS-related System Vulnerabilities (Part 1)
Source code known to many outside FAA, but not to those inside FAA
Knowledge of source code not controlled by FAA
Security often an “afterthought” in commercial systems – security not often a commercial success criteria
New releases of software could introduce new vulnerabilities and invalidate old mitigations
Hackers often go after vulnerabilities in COTS components

8. COTS-related System Vulnerabilities (Part 2)
COTS rely heavily on commercial protocols and standards that are widely known, making it easier to exploit vulnerabilities
Easily available tools and knowledge mean less sophisticated hackers can exploit many vulnerabilities in COTS components
Generality of COTS components makes them more likely to have vulnerabilities and to introduce new vulnerabilities when integrated with other components.
Built-in COTS security features can be widely implemented, reducing vulnerability!

9. Exponential Growth in Security Incidents
Recent CERT-CC Experiences

10. FAA’s 5 Layers of System Protection
Personnel
Security
Physical
Compartmentalization/
Information Systems Security
Site Specific Adaptation
Redundancy
Architecture and Engineering
Awareness and Execution

11. … and A Generic ISS Service Perspective
Access
Control
Confidentiality
Availability
Architecture and Engineering
Awareness and Execution
Authentication
Integrity

12. Comprehensive Certification Process
ISS
Certifier
Sys Developer
or Owner
CIO
Certification
Agent
Threat
Vulnerabilities
Likelihood
Impact
Risk Management Plan
VA Report
IS Security Plan
ISS Test Plan & Summary Results
Protection Profile
Certification Statement
Prepare
SCAP
Conduct Risk &
Vulnerability
Assessments
System Certification
&
Authorization Package
(SCAP)
Package
Authorization Statement
Executive Summary
C&A
Statements to
DAA
Deploy
This process defines the ISS team, the assessment approach and the preparation of the System Certification and Authorization Process.
Note to the DoD members that this is very similar to the DoD DITSCAP process

13. Integrated Facility Security
Secure
Facility
Boundary
Personnel
and Physical
Barrier
Shared Networks
Service A
HOST
Manual
DARC
Service B
Service C
Electronic
Private Networks
Phone lines
DSR
Authenticated
& Authorized
Traffic

14. Airport Traffic Control Tower and Airport Surface Movement
E-IDS WS
(Airport Status
& Control)
SMA
TDLS-R WS Wx
(Supervisor
Workstation)
TDW
(Air Traffic Display )
Voice
Switch
ATCT (Local Info. Services
and LAN Control) X
Target Data from
TRACON/STARS to
WAN
O-D
VPN •
ASDE
•Other FAA
Facs
TDWR
•AWOS/ASOS
ITWS
•ACARS DL
Local
AWOS/
ASOS, ITWS)
Software Updates
Remote
Maintenance
AMASS/ASDE
ATCT
Legend
Core INFOSEC
Requirements
Requirements,
including Risk-driven
INFOSEC
Admin &
Management
Encrypted Interface
Plaintext
Interface
Extranet
Server
Removal of
Malicious
Traffic from NW
NAS Ops Data
Virtual
Private Network
Network Access
Control NW AC
Network
Screening
Service S
Strong
Auth of
NW Users
Common Network Security Interface
Current -2002

15. Selected CTAS Security Measures
Enable basic security measures in operating system
Shut off unused Internet protocols
Audit system use to detect unauthorized access or operation
Banners warn users about penalties for misuse
Virtual Private Network for secure communication

16. Selected FTI Security Requirements
Basic Security Services
Confidentiality, Integrity, Availability
Optional Enhanced Security Services
Strong Authentication, Firewalls, Extranets, VPNs, Enhanced confidentiality and integrity, Closed user groups, Enhanced remote access

17. Oracle8i Security Features
User Authentication
DB, external, OS, network, global, N-Tier
Password Management
Account locking, password aging, history and complexity checking
Fine Grained Access Control
Views, PL/SQL API, Virtual Private Database
Advanced Security Option
Data Privacy, Data Integrity, Authentication and Single Sign On, Authorization

18. Certifying COTS Components
ISO Protection Profiles establish standard security requirements for classes of systems such as firewalls, databases, operating systems, and even for a generic information system
COTS components can be “certified” for compliance with Protection Profiles by an official body such as the National Information Assurance Partnership.
Custom components can use tailored versions of COTS-oriented Protection Profiles.

19. Closing Thoughts
COTS present new security challenges daily, but use of COTS is key to rapidly and affordably delivering new services.
The 5-layers of FAA security implemented through a comprehensive certification process to achieve integrated facility security ensure the National Airspace System remains protected.
Greatest COTS research challenges:
Testing the security characteristics of black-box COTS components
Understanding the security properties of composed COTS components
Architecting COTS-based systems for security