Safety versus Security in Aviation, Comparing DO-178C with Security Standards

Abstract

Software development in safety-critical domains is dictated by software standards, such as "Software Considerations in Airborne Systems and Equipment Certification" (DO-178C). This standard is an acceptable means of compliance for achieving the required level of software safety in aviation. In addition to software safety, the security aspects of cyber-physical systems has become increasingly important in recent years, especially for unmanned aircraft systems with an increasing number of autonomous functions. The importance of this topic has grown with recent updates to security standards in 2018 and new regulations proposed by EASA in 2019. However, in literature, software safety and cybersecurity often get handled completely separate. Since most software engineers in aviation need to consider software safety and the corresponding DO-178C standard in some form, this work offers an introduction to the more recent software security standards. To do this, a brief overview of software standards as well as security standards is presented. The focus of the comparison between software safety and cybersecurity will be on "Airworthiness Security Process Specification" (DO-326A), as well as "Airworthiness Security Methods and Considerations" (DO-356A), since these standards, similar to DO-178C, also handle the initial airworthiness considerations. Additional standards, such as the standard "Information Security Guidance for Continuing Airworthiness" (DO-355) and others will also be introduced.