Model-Based Avionics Cybersecurity Framework for Identification of Risk and Evaluation

This paper presents a python-based framework which we use to minimize manual work of conducting Security Risk Assessment (SRA) on complex systems in compliance to aviation standards RTCA DO-326 and DO-356. Security Risk Assessment is a mandatory process, to verify that a design fulfills cyber-security requirements. While frameworks and guidelines for conducting SRA manually, like the NIST Risk Management Framework or the aviation standards exist, there is no software framework which automatically or semi-automatically conducts SRA. We demonstrate MACSFIRE with an exemplary use case of an Electronic Flight Bag (EFB). We explain the methodology of modeling that use case, and how it correlates with the methodologies and principles presented in the RTCA DO-326 and DO-356. To contextualize the use case: An EFB serves as a platform for hosting various critical applications essential for pilots, such as the Quick Reference Handbook (QRH) and flight planning software. In the context of our example, the complexity increases significantly based on the number of assessed failure conditions as well as the modelled system under investigation. Considering six different applications, modelling the EFB's op-erating system as well as the EFB's connection to the aircraft the complexity results in the identification of hundreds of possible attack paths for each threat scenario. The effort to describe such an amount of threat scenarios manually underscores the necessity of automating security risk assessments. Conclusively, we will discuss the output of the SRA done by MACSFIRE and evaluate to what extent the tool is already capable of concluding SRA in compliance to the standards. The novelty of MACSFIRE lies within the automated security assessment of arbitrary systems based on a model-based description. The tool is capable of minimizing manual repetitive work and exhibits interfaces for the connection to vulnerability or threat databases as well as to existing system models. As evidence of the analysis, the tool produces human-readable artifacts compliant to the RTCA DO-326 and DO-356 standards.