

Challenges of Risk Management Framework for Cyber Security and Trusted Computing in Embedded Computing
Published in Military & Aerospace Electronics
Written by Steve Edwards of Curtiss-Wright and Richard Jaenicke of Green Hills Software
The Risk Management Framework (RMF) is a U.S. federal government policy and set of standards developed by the National Institute of Standards and Technology (NIST) in Gaithersburg, Md., for the assessment and authorization of mission systems.
Given that systems typically are an integration of several products, using component products that meet functional and assurance security requirements, such as Common Criteria (CC) protection profiles, can streamline assessing the integrated system.
Increasingly, U.S. military programs are using RMF to address cyber security and trusted-computing requirements, and for some systems, it is required to get Approval to Operate (ATO). Because RMF is a system-level certification, it is for certifying whole systems -- not just an individual component.
This includes all the hardware and software in that system, and there are some steps that system designers can take for board-level hardware and software components to make RMF certification easier.
Getting started with RMF
The RMF establishes security and privacy controls for systems and organizations. It contains more than 800 controls to select from, many of which don't apply to embedded systems. It is up to the program office or federal agency to go through all the RMF controls and determine which apply. The RMF controls come in a series of NIST and Federal Information Processing Standards (FIPS) documents:
- NIST SP 800-37: Guide for Applying the Risk Management Framework to Federal Information Systems;
- NIST SP 800-53: Security and privacy controls for Federal Information Systems and Organizations; and
- FIPS 199: Standards for Security Categorization of Federal Information and Information Systems.
Trusted Computing for Defense & Aerospace
Curtiss-Wright goes well beyond standard approaches to Trusted Computing to provide truly secure solutions for air, ground, and sea platforms. We keep cybersecurity and physical protection in mind, from design and testing to supply chain and manufacturing. This comprehensive, end-to-end approach creates an effective mesh of protection layers that integrate to ensure reliability of Curtiss-Wright products in the face of attempted compromise.
Green Hills Software and Curtiss-Wright Partnership
Curtiss-Wright and Green Hills Software work closely together to ensure Curtiss-Wright’s computing modules and systems take full advantage of the high assurance real-time operating system capabilities of Green Hills’ INTEGRITY®-178 tuMP™ RTOS. With Green Hills and Curtiss-Wright, customers can take advantage of the multi-core processing power of Intel® x86 and NXP® Power Architecture® processors in industry-standard OpenVPX, VME, XMC, and custom form factors to get their program started quickly.