Covert Channel
What is Covert Channel?
A communication path that was not designed for information transfer but can be exploited to secretly transmit data in violation of security policies.
Frameworks that govern covert channel
What the standards actually require on covert channel
Requirements naming covert channel across 4 standards, quoted from the control text.
Test a subset of the identified covert channels to determine the channels that are exploitable.
NIST800-SC-31(1) · SC-31(1) Covert Channel Analysis | Test Covert Channels for Exploitability →The organisation performs a covert channel analysis to identify potential covert storage and, or, timing channels in system communications and estimates their maximum bandwidth. 3 enhancements.
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-31 · SC-31 Covert channel analysis →The bank obtains a certificate or written confirmation from the developer or vendor that the application is free of known vulnerabilities, malware and covert channels, and again on every material change (significant code changes affecting functionality, securi...
rbi-cybersecurity-framework-for-banks::92 · Para 92: vendor certificate that code is free of known vulnerabilities, malware and covert channels →Service providers must apply intrusion-detection and/or intrusion-prevention methods that find the covert channels malware uses to communicate, raise alerts on them or block them, and deal with them, such as DNS tunneling to command-and-control servers.
11.5.1.1 · 11.5.1.1 Service providers detect covert malware channels →Questions people ask about covert channel
What is Covert Channel?
Why is Covert Channel important for compliance?
Which compliance frameworks address Covert Channel?
Where can I learn more about Covert Channel?
See how Covert Channel applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.