NIST-SC-31 Covert Channel Analysis

a. Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert [Selection (one or more of): storage; timing] channels; and b. Estimate the maximum bandwidth of those channels.

Developers are in the best position to identify potential areas within systems that might lead to covert channels. Covert channel analysis is a meaningful activity when there is the potential for unauthorized information flows across security domains, such as in the case of systems that contain export-controlled information and have connections to external networks (i.e., networks that are not controlled by organizations). Covert channel analysis is also useful for multilevel secure systems, multiple security level systems, and cross-domain systems.

• T1041 Exfiltration Over C2 Channel • T1048 Exfiltration Over Alternative Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1071 Application Layer Protocol • T1071.001 Web Protocols • T1071.002 File Transfer Protocols • T1071.003 Mail Protocols • T1071.004 DNS • T1071.005 Publish/Subscribe Protocols • T1567 Exfiltration Over Web Service