Which statement best describes a covert channel as used in cybersecurity?

• A. A method of communication that is not intended for the purpose it is being used.
• B. A standard, approved communication channel.
• C. A channel that is explicitly documented for management.
• D. A channel that is always encrypted.

Answer: (A)

Covert channels are hidden paths used to transfer information in ways that were not intended by the system’s security design. The essence is that the communication occurs outside the normal, approved channels and for purposes that the policy does not authorize. That’s why the correct statement is about a method of communication being used for a purpose it wasn’t intended for—the transfer itself violates the intended use of the system’s resources.

In practice, covert channels can take a few forms, such as storage channels—where one process writes to a resource in a way another process can observe (for example, using file attributes or shared resources in an unintended manner)—or timing channels—where the timing of events leaks information. The important point is not whether the channel is encrypted; encryption is orthogonal to whether a channel is covert. An officially sanctioned channel can be encrypted and still be legitimate, while a covert channel is any communication path that bypasses the system’s intended information-flow controls.