MON-15: Covert Channel Analysis
Mechanisms exist to conduct covert channel analysis to identify aspects of communications that are potential avenues for covert channels.
Control Question: Does the organization conduct covert channel analysis to identify aspects of communications that are potential avenues for covert channels?
General (7)
| Framework | Mapping Values |
|---|---|
| MITRE ATT&CK 10 | T1041, T1048, T1048.002, T1048.003, T1071, T1071.001, T1071.002, T1071.003, T1071.004, T1567 |
| NIST 800-53 R4 | SC-31 |
| NIST 800-53 R5 (source) | SC-31 |
| NIST 800-53 R5 (NOC) (source) | SC-31 |
| PCI DSS 4.0.1 (source) | 11.5.1.1 |
| PCI DSS 4.0.1 SAQ D Service Provider (source) | 11.5.1.1 |
| SCF CORE Mergers, Acquisitions & Divestitures (MA&D) | MON-15 |
US (1)
| Framework | Mapping Values |
|---|---|
| US HIPAA HICP Large Practice | 8.L.F |
EMEA (1)
| Framework | Mapping Values |
|---|---|
| EMEA Israel CDMO 1.0 | 21.10 |
Capability Maturity Model
Level 0 — Not Performed
There is no evidence of a capability to conduct covert channel analysis to identify aspects of communications that are potential avenues for covert channels.
Level 1 — Performed Informally
C|P-CMM1 is N/A, since a structured process is required to conduct covert channel analysis to identify aspects of communications that are potential avenues for covert channels.
Level 2 — Planned & Tracked
C|P-CMM2 is N/A, since a well-defined process is required to conduct covert channel analysis to identify aspects of communications that are potential avenues for covert channels.
Level 3 — Well Defined
Continuous Monitoring (MON) efforts are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist: o Governs asset management that ensures compliance with requirements for asset management. o Leverages a Configuration Management Database (CMDB), or similar tool, as the authoritative source of IT assets. o Centrally collects logs and is protected according to the manufacturer’s security guidelines to protect the integrity of the event logs with cryptographic mechanisms. o Monitors the organization for Indicators of Compromise (IoC) and provides 24x7x365 near real-time alerting capability. o Is configured to alert incident response personnel of detected suspicious events such that incident responders can look to terminate suspicious events.
- An IT Asset Management (ITAM) function, or similar function:
- A Security Incident Event Manager (SIEM), or similar automated tool:
- Both inbound and outbound network traffic is monitored for unauthorized activities to identify prohibited activities and assist incident handlers with identifying potentially compromised systems.
Level 4 — Quantitatively Controlled
See C|P-CMM3. There are no defined C|P-CMM4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to conduct covert channel analysis to identify aspects of communications that are potential avenues for covert channels.
Level 5 — Continuously Improving
See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to conduct covert channel analysis to identify aspects of communications that are potential avenues for covert channels.
Assessment Objectives
- MON-15_A01 a covert channel analysis is performed to identify those aspects of communications within the system that are potential avenues for covert channels (e.g., storage and/or timing).
- MON-15_A02 the maximum bandwidth of those channels is estimated.
Technology Recommendations
Micro/Small
- Managed Security Services Provider (MSSP)
Small
- Security Incident Event Manager (SIEM)
- Managed Security Services Provider (MSSP)
Medium
- Security Incident Event Manager (SIEM)
- Extended Detection and Response (XDR)
- Managed Security Services Provider (MSSP)
Large
- Security Incident Event Manager (SIEM)
- Extended Detection and Response (XDR)
- Managed Security Services Provider (MSSP)
Enterprise
- Security Incident Event Manager (SIEM)
- Extended Detection and Response (XDR)
- Managed Security Services Provider (MSSP)