SC-31 Covert Channel Analysis

Guidance: nonePolicy clause: noneWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	Organization	3 (0 in a baseline)

Related controls: AC-3, AC-4, SA-8, SI-11

Control statement

a. Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert [Selection (one or more): storage; timing] channels; and
b. Estimate the maximum bandwidth of those channels.

NIST discussion

Developers are in the best position to identify potential areas within systems that might lead to covert channels. Covert channel analysis is a meaningful activity when there is the potential for unauthorized information flows across security domains, such as in the case of systems that contain export-controlled information and have connections to external networks (i.e., networks that are not controlled by organizations). Covert channel analysis is also useful for multilevel secure systems, multiple security level systems, and cross-domain systems.

Control enhancements

SC-31(1) Test Covert Channels for Exploitability

Baselines: Not in a baseline

Test a subset of the identified covert channels to determine the channels that are exploitable.

Discussion and assessment objectives for SC-31(1)

None.

Determine if a subset of the identified covert channels is tested to determine the channels that are exploitable.

Examine: System and communications protection policy; procedures addressing covert channel analysis; system design documentation; system configuration settings and associated documentation; list of covert channels; covert channel analysis documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with covert channel analysis responsibilities.

Test: Organizational process for testing covert channels; mechanisms supporting and/or implementing the testing of covert channel analysis.

SC-31(2) Maximum Bandwidth

Baselines: Not in a baseline

Reduce the maximum bandwidth for identified covert [Selection (one or more): storage; timing] channels to [Assignment: organization-defined values].

Discussion and assessment objectives for SC-31(2)

The complete elimination of covert channels, especially covert timing channels, is usually not possible without significant performance impacts.

Determine if the maximum bandwidth for identified covert [Selection (one or more): storage; timing] channels is reduced to [Assignment: organization-defined values].

Examine: System and communications protection policy; procedures addressing covert channel analysis; acquisition contracts for systems or services; acquisition documentation; system design documentation; system configuration settings and associated documentation; covert channel analysis documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with covert channel analysis responsibilities; system developers/integrators.

Test: Organizational process for conducting covert channel analysis; mechanisms supporting and/or implementing covert channel analysis; mechanisms supporting and/or implementing the capability to reduce the bandwidth of covert channels.

SC-31(3) Measure Bandwidth in Operational Environments

Baselines: Not in a baseline

Measure the bandwidth of [Assignment: organization-defined subset of identified covert channels] in the operational environment of the system.

Discussion and assessment objectives for SC-31(3)

Measuring covert channel bandwidth in specified operational environments helps organizations determine how much information can be covertly leaked before such leakage adversely affects mission or business functions. Covert channel bandwidth may be significantly different when measured in settings that are independent of the specific environments of operation, including laboratories or system development environments.

Determine if the bandwidth of [Assignment: organization-defined subset of identified covert channels] is measured in the operational environment of the system.

Examine: System and communications protection policy; procedures addressing covert channel analysis; system design documentation; system configuration settings and associated documentation; covert channel analysis documentation; system audit records; system security plan; other relevant documents or records.

Assessment objectives (SP 800-53A)

Objectives and methods for SC-31

Determine if:

SC-31a. a covert channel analysis is performed to identify those aspects of communications within the system that are potential avenues for covert [Selection (one or more): storage; timing] channels;
SC-31b. the maximum bandwidth of those channels is estimated.

Examine: System and communications protection policy; procedures addressing covert channel analysis; system design documentation; system configuration settings and associated documentation; covert channel analysis documentation; system audit records; system security plan; other relevant documents or records.

Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.