The Interplay between Safety and Security in Aviation Systems

The Interplay between Safety and Security in Aviation Systems

Speakers: Lillian Ash Baker, Product Security Engineer, The Boeing Company and Wisk Aero

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=nGDTVPnTDOw

Overview

In a critical presentation at DEF CON 32, Lillian Ash Baker, a Product Security Engineer at The Boeing Company and Wisk Aero, delved into the fundamental relationship between safety and security in the development of aviation systems. The talk illuminated the rigorous standards and certification processes that underpin the aerospace industry's commitment to safety, while simultaneously exploring the nascent but rapidly evolving landscape of cybersecurity in this highly specialized domain. Baker emphasized that while aviation safety principles have matured over decades, the integration of cybersecurity into these systems is a comparatively recent, yet equally crucial, endeavor.

The core of Baker's discussion centered on how established safety methodologies, particularly those defined by advisory circulars like AC 25.1309-1A, provide a robust framework for understanding system failures and their probabilities. She then transitioned to the emerging cybersecurity standards, primarily DO-356A, which addresses the unique challenges of protecting increasingly connected aircraft from intentional unauthorized electronic interactions. This article will explore the intricate details of these standards, the historical context of their development, and the critical implications for ensuring the continued airworthiness and resilience of modern aviation platforms.

The importance of this interplay cannot be overstated. As aircraft systems become more integrated, networked, and reliant on high-speed data buses, the traditional boundaries that once separated federated systems are eroding. This technological evolution necessitates a holistic approach where cybersecurity is not an afterthought but an intrinsic component of safety-critical design. Baker's insights are vital for security professionals, aerospace engineers, and regulators alike, offering a comprehensive understanding of how the aviation industry is striving to maintain its unparalleled safety record in an era of escalating cyber threats.

Background

▶ Watch: Introduction to aviation safety and security interplay (0:00)

The foundation of aviation system development is built upon an unwavering commitment to safety, a principle meticulously codified over many decades. Lillian Ash Baker highlighted that the primary source for these safety principles is Advisory Circular 25.1309-1A, a public document first released in 1988. This circular, part of the Code of Federal Regulations (CFRs), establishes a rigorous framework for classifying system failures based on their probability and consequence, a concept that has been refined over nearly 40 years.

At the heart of AC 25.1309-1A are the definitions of failure conditions and their associated probabilities. Baker detailed a graph illustrating the relationship between probability and consequence, delineating an "acceptable" and "unacceptable" region for system faults. The probabilities assigned to different failure classifications are extremely stringent, reflecting the catastrophic potential of aviation incidents:

• Minor: A probable failure condition, occurring on the order of 10^-5 (one in 100,000 flight hours).
• Major: A remote failure condition, with a probability of 10^-7.
• Hazardous: An extremely remote failure condition, also with a probability of 10^-7.
• Catastrophic: An extremely improbable failure condition, with a probability of 10^-9 (one in a billion flight hours) or less.

To put these numbers into perspective, Baker contrasted them with typical IT system uptime requirements, emphasizing that aerospace systems "have to operate and not fail" at an unprecedented level of reliability. These probabilities directly inform the Design Assurance Levels (DALs), which are crucial for the development and certification of aviation systems. A system assigned a DAL C, for instance, indicates a major effect on aircraft operation, a remote possibility of failure, and a failure probability between 10^-5 and 10^-7. DALs provide a direct trace from potential failure conditions and their severities to the functional requirements and development rigor applied to a system.

The industry operationalizes these safety principles through Functional Hazard Assessments (FHAs). These assessments take a functional view of an aircraft system, tracing individual functions throughout their entire operational chain. The FHA process identifies all potential points where a function could be impacted, requiring that every system in that chain incorporates mechanisms to prevent specified failure conditions from occurring. This comprehensive, top-down approach ensures that safety is designed into every layer of an aircraft's architecture.

Historically, aircraft systems were often federated, meaning multiple single-purpose systems operated largely independently with limited interconnections. This inherent isolation provided a natural barrier against the propagation of security issues. However, modern demands for higher speed, increased functionality, and greater efficiency have driven a shift towards highly integrated systems, which are increasingly networked. Technologies like ARINC 429, a slower, older bus standard, are being replaced by faster, deterministic Ethernet networks. While this integration offers significant operational advantages, it simultaneously erodes the traditional security boundaries, introducing new vectors for potential cyber threats and making the consideration of security an unavoidable and critical component of system design.

Key Findings

▶ Watch: Design Assurance Levels (DALs) explained (2:00)

Lillian Ash Baker's presentation underscored a pivotal finding: while the aviation industry has achieved unparalleled safety through decades of rigorous standards and development practices, its cybersecurity framework is comparatively nascent. The Advisory Circular 25.1309-1A, which defines aviation safety, dates back to 1988, reflecting nearly 40 years of iterative refinement. In stark contrast, the primary cybersecurity development objective document for aircraft systems, DO-356A, was first released in 2014. This significant temporal gap highlights the challenge of integrating contemporary cybersecurity principles into an industry with deeply entrenched safety methodologies.

A central concept introduced by DO-356A is Intentional Unauthorized Electronic Interactions (IUEI). This definition is critical because it explicitly frames cybersecurity threats in aviation as intentional attacks, distinguishing them from accidental failures or malfunctions that are the purview of safety standards. This focus on intentionality requires a different mindset and set of mitigations compared to traditional safety analyses. The standard mandates that system developers must account for malicious intent in their designs and demonstrate how such interactions are prevented or mitigated.

Another key finding is the absolute necessity of traceability in meeting certification objectives for both safety and security. DO-356A, much like its safety counterparts, dictates a stringent development process:

1. Requirements: Cybersecurity objectives must be clearly defined as formal requirements.
2. Code Traceability: These requirements must be traceable directly to the source code implementing them.
3. Compiled Code Traceability: Further traceability is required from the source code to the actual compiled binaries.
4. Testing: Every line of code, and every implemented requirement, must be thoroughly tested, with the tests also traceable back to the original requirements.

This meticulous approach ensures that every aspect of a system's security posture is verified and validated. The culmination of this work takes the form of extensive documentation and deliverables, which serve as proof to regulatory bodies such as the Federal Aviation Administration (FAA) in the US and the European Union Aviation Safety Agency (EASA). Without this demonstrable proof of adherence to design objectives and rigorous testing, certification is impossible.

Ultimately, Baker articulated a fundamental truth for modern aviation: "you can't have a safe system with also having a cyber secure system." This statement encapsulates the core finding that safety and security are no longer distinct disciplines but rather inextricably linked. As aircraft systems become more interconnected and rely on high-speed networks, the traditional isolation that provided inherent security is diminishing. Therefore, cybersecurity must be embedded into the very architecture and design philosophy from the outset, rather than being treated as an add-on, to ensure the overall safety and resilience of future aviation platforms.

Technical Deep Dive

▶ Watch: Introduction to DO-356A: Aviation cybersecurity standards (3:35)

The technical rigor underpinning aviation safety is exceptionally high, primarily guided by Advisory Circular 25.1309-1A, which details the acceptable means of compliance for airworthiness standards related to system design and analysis. This document lays out a comprehensive framework that begins with identifying potential failure conditions and assessing their severity and probability. Baker meticulously explained the industry's approach to quantifying risk, presenting a graph that maps probability against consequence, with a clear dividing line between acceptable and unacceptable risk levels.

The probabilities assigned to different failure classifications are:

• Probable (Minor): Occurs on the order of 10^-5 per flight hour. These are failures that may involve a slight reduction in safety margins or functional capabilities, but where all essential functions continue to operate.
• Remote (Major): Occurs on the order of 10^-7 per flight hour. These failures involve a significant reduction in safety margins, a significant reduction in functional capabilities, or a significant increase in crew workload.
• Extremely Remote (Hazardous): Occurs on the order of 10^-7 per flight hour. These failures involve a large reduction in safety margins, a severe reduction in functional capabilities, or a severe increase in crew workload, potentially leading to serious or fatal injury to a small number of occupants.
• Extremely Improbable (Catastrophic): Occurs on the order of 10^-9 per flight hour or less. These failures result in multiple fatalities, usually with the loss of the aircraft.

These probabilities directly correlate with Design Assurance Levels (DALs), a crucial concept for system development. Each DAL (ranging from A for catastrophic to E for no effect) dictates the level of rigor required for hardware and software development, verification, and validation. For example, a system designated DAL C signifies that it has a major effect on aircraft operation, a remote possibility of failure, and a failure probability between 10^-5 and 10^-7. The higher the DAL, the more extensive and meticulous the development and testing processes must be.

To ensure these stringent safety objectives are met, the industry employs Functional Hazard Assessments (FHAs). An FHA is a systematic process that examines the aircraft's functions and identifies potential failure conditions, their effects, and their associated severities. It takes a holistic, functional look at how systems interact. If a particular function, such as flight control, traverses multiple subsystems—say, a sensor, a processing unit, and an actuator—the FHA will analyze all points in that chain where failure could occur. Each system in the chain must have defined mechanisms to prevent or mitigate these failure conditions, ensuring that the overall function maintains its required DAL.

The transition from safety to security introduces DO-356A, which defines the cybersecurity development objectives for aircraft systems. A cornerstone of this document is the concept of Intentional Unauthorized Electronic Interactions (IUEI). This term specifically addresses malicious activities, distinguishing them from accidental faults. The focus on "intentional unauthorized" activity forces developers to consider threat actors and attack vectors, rather than just random component failures. This requires a shift in mindset from probabilistic safety analysis to adversarial thinking.

DO-356A mandates a rigorous, traceable development process for cybersecurity, mirroring the established safety protocols:

1. Requirements Definition: Cybersecurity requirements must be clearly articulated.
2. Design and Implementation: Systems must be designed and implemented to meet these requirements.
3. Traceability: There must be explicit traceability from requirements down to the source code, and further, to the compiled binary code. This ensures that every security control is intentionally designed and implemented.
4. Verification and Validation: Extensive testing is required to verify that the implemented code meets all security requirements and that the system performs as intended without vulnerabilities. This includes unit testing, integration testing, and system-level testing.

These development objectives are not merely internal guidelines; they are deliverables that must be provided to regulatory bodies like the FAA and EASA. These documents serve as definitive proof that the development work was performed according to the standards and that the system is demonstrably secure against IUEI. If an aircraft operates in both US and European airspace, these documents are shared between the respective authorities for dual certification.

The technical evolution of aircraft architectures further complicates the security landscape. Historically, aircraft relied on federated systems with distinct, isolated functionalities, often communicating via slow, purpose-built buses like ARINC 429. This architecture inherently limited the propagation of faults and security breaches. However, the demand for increased data throughput, real-time connectivity, and reduced weight and complexity has driven a shift towards highly integrated, networked systems utilizing modern, high-speed buses like Ethernet. While Ethernet offers significant performance advantages and allows for more sophisticated system interactions, it simultaneously creates a larger and more complex attack surface. This integration means that security vulnerabilities in one part of the network could potentially impact other, safety-critical functions, emphasizing Baker's point that a safe system is inextricably linked to a cyber-secure system. The deterministic nature of aviation Ethernet, while crucial for safety-critical real-time operations, does not negate the need for robust cybersecurity measures at the architectural level.

Demo / Proof of Concept

▶ Watch: Evolution of aircraft systems and security implications (6:00)

The presentation by Lillian Ash Baker focused on the theoretical and regulatory frameworks governing aviation safety and security. It did not include a live demonstration or a proof of concept for any specific vulnerability or defensive mechanism.

Defensive Implications

▶ Watch: Conclusion: Safety and cybersecurity are inseparable (6:30)

The insights shared by Lillian Ash Baker provide critical guidance for defenders operating within or engaging with the aviation sector. The primary implication is the absolute necessity for a holistic understanding that bridges the historically separate domains of aviation safety and cybersecurity. Defenders must recognize that the stringent probabilistic safety standards, as outlined in AC 25.1309-1A, now have an equally demanding counterpart in cybersecurity, defined by DO-356A.

Firstly, defenders must internalize the concept of Intentional Unauthorized Electronic Interactions (IUEI). This means shifting from a reactive posture focused on patching known vulnerabilities to a proactive, adversarial mindset that anticipates and mitigates intentional attacks. Threat modeling in aviation systems must explicitly account for determined adversaries and their potential motives and capabilities. This requires a deep understanding of aircraft systems, their communication protocols (e.g., ARINC 429 vs. Ethernet), and potential interfaces, both physical and logical.

Secondly, the emphasis on traceability is paramount. Security teams must ensure that cybersecurity requirements are not only defined but are meticulously traced from initial concept through design, code implementation, compiled binaries, and exhaustive testing. This rigorous documentation and verification process is not merely a bureaucratic hurdle but a fundamental mechanism for proving a system's resilience to regulatory bodies like the FAA and EASA. Defenders should advocate for and implement robust change management and configuration control systems that preserve this traceability throughout the system lifecycle.

Thirdly, the ongoing shift from federated systems to highly integrated, networked architectures (especially the adoption of Ethernet) significantly expands the attack surface. Defenders need to understand the implications of this convergence, recognizing that the traditional isolation barriers are diminishing. This necessitates a strong focus on network segmentation, secure boot processes, robust authentication and authorization mechanisms, and integrity monitoring for all connected components. Defense-in-depth strategies become even more critical in these interconnected environments, where a compromise in one system could potentially ripple through safety-critical functions.

Furthermore, given that aircraft cybersecurity is a relatively "young" field (DO-356A released in 2014 compared to AC 25.1309-1A in 1988), defenders must commit to continuous learning and adaptation. This includes staying abreast of evolving standards, emerging threats, and new defensive technologies. Collaboration between traditional safety engineers and cybersecurity specialists is no longer optional but essential. Security teams must integrate seamlessly with safety engineering processes, ensuring that security considerations are embedded "as part of the architecture" from the earliest design phases, rather than being retrofitted. Ultimately, the defensive posture in aviation must reflect the understanding that a truly safe system is inherently a cyber-secure one, requiring a proactive, architecturally integrated approach to mitigate the unique risks of intentional malicious activity.

Key Takeaways

• Aviation safety standards, particularly Advisory Circular 25.1309-1A (from 1988), are highly mature and define extremely stringent failure probabilities, such as 10^-9 (one in a billion) for catastrophic events.
• Aviation cybersecurity standards, primarily DO-356A (released in 2014), are relatively young but crucial for addressing Intentional Unauthorized Electronic Interactions (IUEI) in modern aircraft systems.
• Traceability—from initial requirements to code, compiled binaries, and comprehensive testing—is a fundamental development objective for both safety and security, mandated by regulatory bodies like the FAA and EASA.
• The industry's evolution from highly federated systems using slower buses like ARINC 429 to more integrated, networked architectures leveraging high-speed Ethernet significantly increases the cybersecurity attack surface.
• A truly safe aviation system is inextricably linked to a cyber-secure system; cybersecurity must be an integral part of the architecture and design process, not an afterthought.
• Regulatory certification in aviation demands rigorous proof of work and adherence to these detailed standards, highlighting the importance of thorough documentation and verification.

About the Speaker(s)

Lillian Ash Baker is a Product Security Engineer currently working at The Boeing Company and Wisk Aero. With 15 years of experience in the field, she possesses a deep passion for aviation safety and security, expressing that she "still can't shut up about it." Her expertise lies in understanding and implementing the complex standards and certification processes that govern the development of safe and secure aviation systems. Baker is dedicated to bridging the gap between established safety methodologies and emerging cybersecurity requirements within the aerospace industry.