Air Force Test Center Avionics Cyber Range (ACR) Mark Erickson 46 TS/OGE 26 January 2017 DISTRIBUTION STATEMENT A: Approved for public release: distribution is unlimited. 96TW-2017-0005 1
What is the Avionics Cyber Range DoD test facility(s) capable of conducting cyber testing compatible with unique interfaces & signal types of aircraft avionics & airborne systems Connected with National Cyber Range and other aircraft & weapons cyber test facilities End state infrastructure will be automated, repeatable, continuous, scalable and responsive to system and threat evolution Facilities will support virtual systems, interfaces to physical LRUs, remote connectivity to Special Facilities/SILs and Multi-Level Security Capabilities will support full spectrum T&E of aircraft and munitions 2
Operations Maintenance Example Aircraft Test Scenario The aircraft s internal communication bus is compromised by malware injected through the maintainer equipment On-Aircraft Expanding Focus Beyond Potential Vulnerabilities Within System Boundary Must Consider All Interactions and Impact on Mission Assurance 3
6-Step RMF 6 Phase CST&E AF DT&E & OT&E Process DoD 5000.02 Program Phases Integrated AF T&E Model MDD A Development RFP Release Decision CDD Validation B C FRP or FDD Decision FDD Decision for Incrementally Deployed Software Materiel Solution Analysis PDD Technology Maturation & Risk Reduction PDR Engineering and Manufacturing Development CDR LRIP Proceed to Initial OT Production & Deployment FRP Operations & Support Early Tester Involvement Planning Provisioning Execution Air Force DT&E Closeout Planning Air Force OT&E E x e c u t i o n Closeout 1. Understand Cybersecurity Requirements 2. Characterize Cyber Attack Surface 3. Cooperative Vulnerability Identification 4. Adversarial Cybersecurity DT&E 5. Vulnerability & Pen Assessment 6. Adversarial Assessment 1. Categorize System 2. Select Security Controls 3. Implement Security Controls 4. Assess Security Controls 5. Authorize IATT System ATO 6. Monitor AF Controls Cyber survivability & resiliency assessments inform key acquisition decisions starting at TMRR 4
5 Vision: Create the Cyber Test and Evaluation Infrastructure (CT&EI) Avionics Cyber Range The CT&EI is composed of existing non-kinetic Cyber test capabilities integrated with representations of kinetic and C2 systems (e.g., hardware-in-the-loop (HWIL) facilities, system integration labs (SILs), and software-in-the-loop (SWIL) facilities) via network connectivity, enabling testing those systems in a realistic combat, including cyber and interoperability, environment. We have to integrate these existing facilities in a cyber environment with low risk of damage.
ACR T&E Range 6
Avionics Cyber Range Requirements 1. Ability to stimulate avionics components to put them in flight modes 2. Ability to provide standard interfaces for avionics busses, radars, data links, radios, mission planning systems, software loaders, maintenance systems, weapons, IR/UV sensors, etc. 3. Ability to work with actual aircraft/weapons, real subsystems, emulations, or re-hosted software (requires flight line access) 4. Ability to stimulate sensors through direct injection, or through system apertures (requires anechoic chamber) 5. Test tools capable of penetrating avionics components and returning them to pre-test conditions 6. Realistic threat emulation 7. Multi-level security environment 8. Mobile test tools/procedures for testing in other HITLs 9. Available to support experimentation, development and test 7
Avionics Cyber Range Maintenance/Support Equipment Anechoic Chamber Physical Systems Flightline Access Supports full-spectrum Cyber T&E Includes: Virtualized and physical components & subsystems Hardware-in-the-Loop testing Real-time distributed testing Weapons Integration Avionics Components Strategic C2 Tactical C2 Logistics/Support Systems 8
Test Resource Management Center (TRMC) Coordination Incorporate CTEIP-like milestones, to include recurring coordination requirements with TRMC as project matures Near-term tasks: Forming the multi-disciplinary team Drafting Test Capabilities Requirements Document (TCRD) Drafting Program Management Plan (PMP) Kickoff meeting with TRMC March, 2017 New Start Briefing Review initial draft TCRD, including CONOPS, Use cases, Key performance parameters, Initial requirements Review initial draft Program Management Plan (PMP) Will not duplicate tools or capabilities currently being developed under TRMC T&E investment programs, including the National Cyber Range 9
Questions/Discussion? 10