1. THE IMPACT OF COTS COMPONENTS ON BUILDING TRUSTWORTHY SYSTEMS Arthur Pyster Deputy Assistant Administrator for Information Services and Deputy Chief Information Officer February 7, 2001

2. 2/7/01 2 The FAA’s Job Each day at 1000 staffed facilities, the FAA manages 30,000 commercial flights, using 40,000 major pieces of equipment, by 48,000 FAA employees, to safely move 2,000,000 passengers.

3. 2/7/01 3 National Airspace System ~ 500 FAA Managed Air Traffic Control Towers ~ 180 Terminal Radar Control Centers 20 Enroute Centers ~ 60 Flight Service Stations ~ 40,000 Radars, VORs, Radios, …

4. 2/7/01 4 CIO’s Security Mission  Establish and lead a comprehensive program to minimize information systems security risks  Ensure critical systems are certified as secure  Ensure all FAA staff and contractors know and do what is required to maintain information systems security  Ensure cyber attacks are detected and repelled and that successful attacks have minimal effect  Maintain effective outreach to industry, government, and academia Protect the FAA’s information infrastructure and help the aviation industry reduce security risks through leadership in innovative information assurance initiatives

5. 2/7/01 5 COTS Use within FAA (Part 1)  >$2B annually in IT acquisitions  Most recent and planned systems are heavily COTS-based; e.g.  FAA Telecommunications Infrastructure  National Airspace Systems Information Management System  Next generation messaging  Rapid movement towards TCP/IP-based networking and Oracle-based DBMS

6. 2/7/01 6 COTS Use within FAA (Part 2)  Even many “custom” air traffic control systems may be used by air traffic control authorities in many countries  CTAS – advise order in which aircraft should land  COTS is key to rapid and affordable deployment of new capabilities  Almost all heavily proprietary systems are old legacy  ARTS – primary system for terminal air traffic control

7. 2/7/01 7 COTS-related System Vulnerabilities (Part 1)  Source code known to many outside FAA, but not to those inside FAA  Knowledge of source code not controlled by FAA  Security often an “afterthought” in commercial systems – security not often a commercial success criteria  New releases of software could introduce new vulnerabilities and invalidate old mitigations  Hackers often go after vulnerabilities in COTS components

8. 2/7/01 8 COTS-related System Vulnerabilities (Part 2)  COTS rely heavily on commercial protocols and standards that are widely known, making it easier to exploit vulnerabilities  Easily available tools and knowledge mean less sophisticated hackers can exploit many vulnerabilities in COTS components  Generality of COTS components makes them more likely to have vulnerabilities and to introduce new vulnerabilities when integrated with other components.  Built-in COTS security features can be widely implemented, reducing vulnerability!

9. 2/7/01 9 Exponential Growth in Security Incidents Recent CERT-CC Experiences

10. 2/7/01 10 FAA’s 5 Layers of System Protection Personnel Security Physical Security Compartmentalization/ Information Systems Security Site Specific Adaptation Redundancy Architecture and Engineering Awareness and Execution

11. 2/7/01 11 … and A Generic ISS Service Perspective Access Control Confidentiality Availability Architecture and Engineering Awareness and Execution Authentication Integrity

12. 2/7/01 12 ISS Certifier Sys Developer or Owner CIO Certification Agent Threat Vulnerabilities Likelihood Impact  Risk Management Plan  VA Report  IS Security Plan  ISS Test Plan & Summary Results  Protection Profile  Certification Statement Prepare SCAP Conduct Risk & Vulnerability Assessments System Certification & Authorization Package (SCAP) Package Certification Statement Authorization Statement Executive Summary C&A Statements to DAA Deploy Comprehensive Certification Process

13. 2/7/01 13 Integrated Facility Security Secure Facility Boundary Personnel and Physical Barrier Shared Networks Service A HOST ManualDARC HOST Service B Service C Electronic Barrier Private Networks Phone lines Electronic Barrier DSR Authenticated & Authorized Traffic

14. 2/7/01 14 Airport Traffic Control Tower and Airport Surface Movement E-IDS WS (Airport Status & Control) SMA TDLS-R WS Wx (Supervisor Workstation) TDW (Air Traffic Display ) Voice Switch ATCT (Local Info. Services and LAN Control) X Target Data from TRACON/STARS to TDW WAN O-D VPN O-D VPN O-D VPN ASDEOther FAA Facs TDWRAWOS/ASOS ITWSACARS DL LocalWx AWOS/ ASOS, ITWS) Software Updates Remote Maintenance AMASS/ASDE ATCT Legend Core INFOSEC Requirements Core INFOSEC Requirements, including Risk-driven INFOSEC Admin & Management Encrypted Interface Plaintext Interface Extranet Server X Removal of Malicious Traffic from NW O-D VPN NAS Ops Data Virtual Private Network Network Access Control NW AC Network Screening Service S Strong Auth of NW Users Common Network Security Interface S NW AC O-D VPN X Current -20022003-2005

15. 2/7/01 15 Selected CTAS Security Measures  Enable basic security measures in operating system  Shut off unused Internet protocols  Audit system use to detect unauthorized access or operation  Banners warn users about penalties for misuse  Virtual Private Network for secure communication

16. 2/7/01 16 Selected FTI Security Requirements  Basic Security Services  Confidentiality, Integrity, Availability  Optional Enhanced Security Services  Strong Authentication, Firewalls, Extranets, VPNs, Enhanced confidentiality and integrity, Closed user groups, Enhanced remote access

17. 2/7/01 17 Oracle8i Security Features  User Authentication  DB, external, OS, network, global, N-Tier  Password Management  Account locking, password aging, history and complexity checking  Fine Grained Access Control  Views, PL/SQL API, Virtual Private Database  Advanced Security Option  Data Privacy, Data Integrity, Authentication and Single Sign On, Authorization

18. 2/7/01 18 Certifying COTS Components  ISO Protection Profiles establish standard security requirements for classes of systems such as firewalls, databases, operating systems, and even for a generic information system  COTS components can be “certified” for compliance with Protection Profiles by an official body such as the National Information Assurance Partnership.  Custom components can use tailored versions of COTS-oriented Protection Profiles.

19. 2/7/01 19 Closing Thoughts  COTS present new security challenges daily, but use of COTS is key to rapidly and affordably delivering new services.  The 5-layers of FAA security implemented through a comprehensive certification process to achieve integrated facility security ensure the National Airspace System remains protected.  Greatest COTS research challenges:  Testing the security characteristics of black-box COTS components  Understanding the security properties of composed COTS components  Architecting COTS-based systems for security