Cybersecurity Controls for Connected Aircraft Systems that Support Safety Services

This paper summarizes research, conducted by the Federal Aviation Administration (FAA) NextGen office, to explore and evaluate cybersecurity risk and mitigation strategies for future cloud-centric services enabled through Connected Aircraft concepts that can support Air Traffic Management (ATM) functions. The current research leverages cloud-based applications and hardware-agnostic solutions to enable and enhance ATM services. The outcome of this research project is a recommended set of tailorable Connected Aircraft Security Controls (CASC) that will assist the FAA and Connected Aircraft system component and software application developers in identifying security control requirements and in tailoring their security baseline needs based on an aircraft-specific architecture. The result of this project, its findings, and recommendations should be of interest to aircraft and Air Traffic Management (ATM) system developers to assist in the introduction of Connected Aircraft-enabled services that can safely and securely access the National Air Space (NAS) communications infrastructure using commercial internet protocol (IP) air-to-ground datalinks. As a next step, further validation and refinement of the security control recommendations by applying them to development projects is recommended before wider adoption.