Navigate

SC-31

SC-31: Covert Channel Analysis

The organization:

SC-31a.: Performs a covert channel analysis to identify those aspects of communications within the information system that are potential avenues for covert [Selection (one or more): storage; timing] channels; and

SC-31b.: Estimates the maximum bandwidth of those channels.

Supplemental

Developers are in the best position to identify potential areas within systems that might lead to covert channels. Covert channel analysis is a meaningful activity when there is the potential for unauthorized information flows across security domains, for example, in the case of information systems containing export-controlled information and having connections to external networks (i.e., networks not controlled by organizations). Covert channel analysis is also meaningful for multilevel secure (MLS) information systems, multiple security level (MSL) systems, and cross-domain systems.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
Cross Domain (Multilevel), Cross Domain (Transfer), NC3

Related Controls

The controls below (if any) were marked by NIST as being related to SC-31.

Control	Description
AC-3	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-4	The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Assignment: organization-defined information flow control policies].
PL-2	The organization: PL-2a.: Develops a security plan for the information system that: PL-2a.1.: Is consistent with the organization�s enterprise architecture; PL-2a.2.: Explicitly defines the authorization boundary for the system; PL-2a.3.: Describes the operational context of the information system in terms of missions and business processes; PL-2a.4.: Provides the security categorization of the information system including supporting rationale; PL-2a.5.: Describes the operational environment for the information system and relationships with or connections to other information systems; PL-2a.6.: Provides an overview of the security requirements for the system; PL-2a.7.: Identifies any relevant overlays, if applicable; PL-2a.8.: Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and PL-2a.9.: Is reviewed and approved by the authorizing official or designated representative prior to plan implementation; PL-2b.: Distributes copies of the security plan and communicates subsequent changes to the plan to [Assignment: organization-defined personnel or roles]; PL-2c.: Reviews the security plan for the information system [Assignment: organization-defined frequency]; PL-2d.: Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and PL-2e.: Protects the security plan from unauthorized disclosure and modification.

Enhancements

The controls below (if any) add on to the requirements of SC-31.

Control	Description
SC-31 (1)	The organization tests a subset of the identified covert channels to determine which channels are exploitable.
SC-31 (2)	The organization reduces the maximum bandwidth for identified covert [Selection (one or more); storage; timing] channels to [Assignment: organization-defined values].
SC-31 (3)	The organization measures the bandwidth of [Assignment: organization-defined subset of identified covert channels] in the operational environment of the information system.

Related CCIs

The CCIs below are tied to SC-31.

CCI	Definition
CCI-002498	The organization performs a covert channel analysis to identify those aspects of communications within the information system that are potential avenues for covert storage and/or timing channels.
CCI-002499	The organization estimates the maximum bandwidth of the covert storage and timing channels.