Page 1 A Guide to the Procurement of Trusted Systems: An ... - csirt

dependent system parameter, and a "receiving" process observes and
interprets this effect as a bit of information.
3.6.1 DETECTION
Covert channels are easy to hypothesize, but difficult to detect, and often
they cannot be totally eliminated. The next-best approach is to try to
identify them, reduce their effectiveness, and provide a measure of control
over them. Execution flow analysis can sometimes detect storage channels,
but no formal methods can detect timing channels at this time.
3.6.2 RATES
High covert channel transfer rates (over 100 bits/sec) are a major concern and
are generally unacceptable. Low transfer rates (under 1 bit/sec) are of less
concern because it would take too long to Communicate significant amounts of
information. (It cannot be forgotten, however, there are situations in which a
single number or name can be highly classified.) Intermediate transfer rates
introduce the need for the ISSO to monitor covert channel activity. This
procedure is done by auditing all known events that may be used to exploit the
covert channel. The Trusted Facility Manual should contain information on what
events are audited and how they should be interpreted.
3.6.3 COVERT CHANNEL ANALYSIS
A covert channel analysis is required for Classes B2, B3, and A1. In
acquisitions requiring these classes, a Statement of Work task should be
included in the RFP that requires the contractor to conduct a covert channel
analysis and the CDRL that lists the development of a Covert Channel Analysis.
This process will require the contractor to deliver a technical report to
the Government that documents the results of the analysis. An assessment of
the report will reveal whether covert channels are sufficient to cause
redesign or can be tolerated by using auditing techniques.
3.7 MAGNETIC REMANENCE
The retentive properties of magnetic storage media and the known risks in
erasing and releasing such media should be considered in all AIS acquisitions.
The correct procedures for clearing and declassifying AS magnetic media must
be included in the design and implementation documentation of ASs.
Contractor and Government personnel must both use NSA-approved standards for
degaussing and overwriting. Degaussing equipment must be evaluated and
approved to meet the standards. Auditing, record-keeping, testing and
control of overwrite software, and the handling of equipment malfunctions
are risk areas that are often neglected.
3.7.1 GUIDELINES
NCSC-TG-025, "A Guide to Understanding Data Remanence in Automated Information
Systems," should be included in all RFP requirements. Another excellent source
document is Defense Intelligence Agency Manual 50-4, "Security of
Compartmented Computer Operations(U)," CONFIDENTIAL.
3.7.2 REQUIREMENTS
Page 48