Spec 42: Aviation Industry Standards for Digital Information Security, Revision 2024.1

Description

For many years, the commercial aviation industry has been engaged in a major transition towards the ‘digital aircraft’. With this generation of aircraft, the industry has moved towards the ‘connected aircraft’. This evolution is propelled by the need for increased efficiency and interoperability at reduced overall cost. This generation of aircraft has extensive requirements for external interaction. This is where the greatest data security challenges lie. Whether it is aircraft avionics communicating with a ground station, or a passenger in the aircraft accessing a service using the Internet, great care must be taken to ensure that only legitimate communication or ‘information transfer’ is occurring.

Spec 42 provides recommendations on standardized methods to achieve the appropriate level of security for an application primarily relying on digital identities but in some cases transitioning from an existing manual process over time to a fully functioning automated digital identity-based solution. The intent of this guidance is to support a variety of levels of users and security requirements and guide an organization through that transition process.

The following highlights included changes:>

• Introduced the use case of codesigning certificates issued to devices.
• Updated the ATA Spec 42 Reference Certificate Policy to bring it into alignment with recent changes to other industry standards and CPs.
• Deprecated the Class 4 Software Assurance Certificate Policy.
• Added a new appendix for preliminary guidance pertaining to Post-Quantum Cryptography (PQC) / Quantum-safe Cryptography (QSC)
• Replaced gender-biased terms with gender-neutral terms.

Notes

Members of the ATA e-Business Program have access to this specification and all other ATA e-business specifications for free. To learn more about the cost and benefits of membership or to get involved in the standards development process, go to http://www.ataebiz.org.