- [Narrator] It's hard to imagination an information system
that can function in isolation.
Today's complex systems work together
to achieve business objectives
and they must talk to both users and each other
to meet their goals.
Information systems do this
through the use of interfaces
that allow communication between systems.
The most common example of an interface today
is the application programming interface, or API.
Applications expose APIs to allow programmers
to interact directly with the application.
APIs may be used to modify information,
retrieve records, conduct transactions,
and perform almost any other software task imaginable.
Software developers who create APIs
must do so in a way that enforces the security requirements
of the organization.
I'll talk more about APIs
in the final course in this series,
CISSp Software Development Security,
which covers the eighth domain of the CISSP exam.
There are many other interfaces
that systems use to communicate with each other.
Some of these are physical interfaces
such as transmitting data over cables
connected to ports.
Others are virtual interfaces
such as the exchange of flat files over a network.
It's important that security professionals
understand the ways that systems interface
with each other and end users
and know the security controls
present around those interfaces.
Sometimes systems allow inadvertent interfaces
that weren't planned by software developers
but may be exploited by malicious users
to exfiltrate information from a sensitive system
to the outside world.
These unintended interfaces are known
as covert channels.
Covert channels provide a backdoor
for communications into or out of a system.
There are two different types of covert channels.
Covert storage channels work
by placing data in an unexpected location
where it may be read
by another individual or system.
One example of a covert storage channel
resides in the ICMP echo request packet
used to send a ping command between two systems.
The specification for the ICMP echo request
allows the sender to include arbitrary data
in the packet payload.
Usually, this payload is left blank,
but if a network allows the transmission
of outbound ICMP packets, a user could send
modified ping packets to a remote system
and use the echo request payload
to transmit data in an undetected manner.
This is an example of a covert storage channel.
Covert timing channels work by modifying
some system resource in a pattern
that may be detected by remote users.
This may include the use of a network
or it may be more subtle,
such as changing the system's use of electricity
to produce noticeable spikes at predetermined times.
Port knocking is an example of a covert timing channel.
An individual trying to send data
to a remote system surreptitiously
might probe different network ports
on that system in a specific order
to transmit information slowly.
For example, the ports one through 26
might be assigned to letters of the alphabet
from A through Z.
An individual trying to send the message "hello"
to the remote system would then make connection attempts
to ports eight, corresponding to H,
five, corresponding to E,
12, corresponding to L,
12 again for the second L,
and 15, corresponding to O.
The remote system administrator could then
check the firewall logs
and verify the order and number
of ports that were accessed
and use that information to reconstruct the message.
Echo requests and port knocking
are just two examples of covert channels.
Security professionals concerned
about the theft of information
should think carefully about other ways
that a malicious insider might exfiltrate
information from their systems.