Global Connected Aircraft Summit 2019 Welcome to the GLOBAL CONNECTED AIRCAFT SUMMIT FOR 2019

Connected Aircraft allegiant Case Study This is allegiants contribution to the conference which officially is CONNECTED AIRCAFT AN ALLEGIANT CASE STUDY or it could be titled, I picked the wrong time to quit drinking

allegiant Ultra Low Cost Carrier All Airbus Fleet, Mix of A319 and A320 100+ aircraft Airbus fleet MSN range 0700 to 8000, we have aircraft from all over the world and aircraft configuration varies, we are trying to set a fleet standard but that is not always possible., which makes connectivity upgrades a challenge My background, Avionics manager, Consultant DER, Universal Avionics Flight Test and Product manager, Collins BAE and Eastern Airlines US Navy in the industry for almost 40 years GARMAN not GARMIN which I know is what y’all heard, but sorry I can’t get you a discount A note about my Speaking Style

allegiant Connected Aircraft Use Electronic Flight Bags (EFBs), (iPad) Real time and post flight aircraft health monitoring and reporting. (ACARS) (FOMAX) ACARS over IP Wireless Access Point (WAP) for MX, EFB and Cabin Crew Stand alone In Flight Entertainment, (IFE) Some of the projects that Allegiant is working on or implementing are Cell enabled iPad, hundreds of them in service, every crew member, MX FOMAX Flight Operations and MAintenance eXchanger First US operator to have active FOMAX aircraft 3 flying and the 4th is in work, ACARS info for Airbus Skywise 14 airports with out VHF ground station coverage and at least 3 that have poor coverage which casues problems with things like OOOI times W&B we are Trialing ACARS over IP on 4 aircraft, working well One aircraft with a WAP installed, ground testing done, to be used for MX and office in a truck project, contract MX at out stations where we use contract MX manuals, video calling etc Stand alone IFE built in Wi-Fi for passengers only.

Aircraft Level Approvals Type Certificate or Amended TC Supplemental Type Certificate Field Approval (337) allegiant Engineering Order There are 2 types of approvals, airworthiness and operational on the airplane side All pretty standard stuff, TC is Airbus STC could be an Allegiant STC or 3rd party as is the case for the ACARS over IP Could also be done by 337 or Allegiant EO which is a field approval.

The operational side of the approval is the confusing part As a DER I have to take yearly recurrent training and About the time we started this project I took my DER recurrent training and picked Wi-Fi certification It was a eye opening experience

Key Items Policy Statement PS-AIR-21.16-02, Establishment of Special Conditions for Cyber Security AC 119-1, Airworthiness and Operational Authorization of Aircraft Network Security Program (ANSP), Aircraft Systems Information Security Protection (ASISP) DO-355 Information Security Guidance for Continuing Airworthiness DO-356A Airworthiness Security Methods and Considerations 8900.1 CHG 213 volume 3 Chapter 61, Section 1, Safety Assurance System: Evaluate the Operator’s 14 CFR Parts 121, 121/135, 125, and 129 Aircraft Network Security Program AC 43-216, Software Management During Aircraft Maintenance There is a lot of information in this training course the key items for me were that caused us to start a new project or program Policy Statement explains how a cyber security SC is applied and what will cause the FAA to issue the SC A SC is a rulemaking action that is specific to an aircraft make and often concerns the use of new or novel technology that the Code of Federal Regulations does not yet address Some of the reading material that I found useful in understanding what is needed to create an security plan and review, the AC 119 explains the need for Special Conditions and an ANSP AC 43-216 also describes an ANSP and Special conditions but mainly talks about field loadable software control this AC is causing allegiant to completely change the way MX and engineering handles FLS

AC 119-1 What I got out of the training and reading the guidance was that I have a lot to learn but AC 119-1 is a key bit of guidance. The Airbus TCDS is A28NM no Sc for network security The flow chart in appendix A should cause Allegiant to create an ANSP due to the note: because Airbus has issued guidance contained in A320 family and A330/A340 Security Handbook It references AC 119-1 and I believe that we will have to have an ANSP So armed with this wealth of knowledge and freshly trained, I figure it was time to get IT involved and that is where things got complicated I tried to find a way to describe the relationship between IT/InfoSec and engineering

InfoSec vs Engineering IT and Info Sec know their side of the connected aircraft, Network security, VPN tunnels IP address, etc the aircraft engineering group are not network experts, some of us know enough to be dangerous have an idea about how it works, however IT/Info sec does not know anything about the FAA, FARs, the TSO process, DO-178, how the aircraft systems work except what they can find on google. Huge training effort to help them understand how the certification and approval process works and what they can and can’t do on the aircraft and for engineering how network security works, as an example of the differences in the IT world a NIC is a network interface controller, the engineering world a NIC or Navigation Integrity Category is an ADS-B requirement When we started discussing the trial for ACARS over IP the first things they wanted to do is hack an airplane , IT stated that anything connected to their network had to have the corporate anti virus software so we had to load it on the aircraft systems. Also for a connected aircraft project google is not your friend, multiple stories about aircraft being hacked and more

This is what we’ve learned Aircraft Network Security Program (ANSP) Involve your IT and InfoSec groups Engineering understand the network side, IT understand the aircraft side 3rd party STC ensure network security is addressed For new STC projects, expect SC, include aircraft network security in the ICA ANSP should cover all aspects of a connected aircraft Involve your PAI early Establish an Aircraft network security plan even if guidance does not require it You will need an ANSP Get IT/InfoSec involved early and keep them involved, identify an individual or individuals in both groups as the POC and SME for the project Be prepared to not only explain the project but how the system works, certification approval of the project, FAA involvement in the project to the other groups involved. Talk to your PAI early on in the project, even if you are using a 3rd party STC get them involved Make sure you get all of the details of the system and the requirements from the vendors involved, reference ACARS of IP, Teledyne and ARINC

? I know that was quick but are there any questions