DEF CON 32 - The Interplay between Safety and Security in Aviation Systems - Lillian Ash Baker
Source: YouTube · DEFCONConference · published Oct 16, 2024 · 20:04
Aviation systems integrate safety and cybersecurity through co-designed development practices, with both domains rooted in standardized regulations and shared implementation principles. 2:00
Key Takeaways:
• Failure probabilities are defined in Advisory Circular 25.309D1A, classifying failures by severity (e.g., probable at 10⁻⁵, catastrophic at ≤10⁻⁹) 1:10.
• D-level systems (e.g., D-B) have high operational impact and remote failure risks, requiring stringent safety and security controls 3:00.
• Do 356a introduces "intentional unauthorized electronic interactions" (IUI) as a distinct cyber threat, mandating mitigation levels (Cell 2 and 3) for catastrophic threats 6:50.
• Safety and security share implementation strategies: hashing memory and dual-thread validation (e.g., B and B') prevent both data manipulation and accidental memory errors 14:00.
• System interactions can create non-linear effects (e.g., mode command propagation) that bypass controls, necessitating secure, cross-checked architectures 13:40.
Cybersecurity in aviation is a relatively new domain, with Do 356a introduced in 2014—40 years after foundational safety standards—reflecting the need for integrated, secure, and safe systems in connected aviation. 18:00
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
all right good afternoon everyone I am Lillian ashbaker I'm a product security engineer at the Boeing Company in whisk Arrow today I'll be discussing the most important part of Aviation systems development standards and certification but what you I hope you get out of this is an understanding of how the industry has developed Safe Systems and considers Security in those designs first we need to discuss the safety uh of these systems and I'll make you all aware of what safe actually means in the Aerospace industry I hope you find this as interesting as I have I still can't shut up about it 15 years later so the first principles of safety that we have to talk about are failure conditions and probabilities right all of this information comes out of advisory circular 25 or 23 if you go re for …