The Boeing Dreamliner "Security": Page 2

If Boeing heeds the FAA’s warnings, it’s likely that we’ll see a software barrier between the passenger data and the flight control systems. Software security practitioners will be quick to tell you that we can’t test security into a system. We can’t measure its level of security and validate it to be 100%. There will always be unknowns. There will always be human mistakes.

Is any one of us willing to accept that, when we were warned of the problem and should have known better? I didn’t think so.

I’ve heard it argued that the network design may have come from weight limitations. Well, to that argument, I say that many airlines are currently deploying Wi-Fi networks in their aircraft, and to my knowledge, they’re doing it without any connectivity between the passenger and flight control networks.

From my safe, distant vantage point, I can only say I wouldn’t trust anything short of the best firewall in the world, the “air gap.” That is, complete separation between the flight control and passenger data.

And there’s the lesson that we can all take away from this issue, even if we’re not designing ultra-high tech passenger jets. There’s no software firewall product that will ever provide the level of protection of a complete air gap. When we look at our own data centers, we should judiciously (but still carefully) separate our own administrative and management data from our customers’ production data.

VLANs, firewalls, and all those other shiny little security boxes we all seem to like so much are fine and well. But when we absolutely require data separation, I have yet to meet the data packet that can safely cross the air gap. And I’m not talking wireless here.

I just shudder to think of the human tragedy that could come from a software failure in this system. Add to that the dollar amount in the out-of-court settlement that will no doubt happen just as the FAA warning is read during the inevitable lawsuit, and it’s not a pretty situation.

Let’s just hope Boeing makes the right decision. As for me, for once I’m not just content, but ecstatically happy that the airline I spend far too much time on—and whose 747-400 I’m currently strapped to while typing this—hasn’t even ordered any of these new Dreamliners yet. That’s one firewall for which I’ll prefer to wait for version 1.1.