Cleared for Takeoff - Debunking Uncertifiable Cybersecurity

The speaker opens by asking why security tools that protect ground systems are rarely deployed on safety-critical aircraft. Her answer is that the obstacle is not whether the tools work but whether they can produce the objective evidence aviation certification requires. She contrasts the DO-178C assurance model, built when airborne software was largely isolated, with today's connected avionics, satellite links, and AI-accelerated exploit development.

The core of the talk is a case study on load-time function randomization, which shuffles a program's function layout each time it loads. The randomness comes from a seed, so once the seed is fixed the layout is deterministic. That lets the team frame certification around showing that each transformation preserves the program's intended behavior. The work traced a system-level requirement down through high-level and low-level requirements to code and tests, removed dead code and unused features, and completed structural coverage analysis.

The lessons are that certification is a systems problem tied to the software it protects, that passing tests is not the same as certification evidence, and that every unused line adds to the burden. Deterministic, well-specified security functions fit the process more easily than adaptive detection or AI-driven components, which make the assurance argument harder. The takeaway is that existing security tools can become certifiable when their purpose is defined, traced, and verified.