Page 1439 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

not readable at a lower classification level.

Errors in storage access controls become particularly

dangerous in cloud computing environments, where a single
misconfiguration can publicly expose sensitive information on the
web. Organizations leveraging cloud storage systems, such as

Amazon’s Simple Storage Service (S3), should take particular care
to set strong default security settings that restrict public access and
then to carefully monitor any changes to that policy that allow
public access.

Covert channel attacks pose the second primary threat against data
storage resources. Covert storage channels allow the transmission of
sensitive data between classification levels through the direct or
indirect manipulation of shared storage media. This may be as simple

as writing sensitive data to an inadvertently shared portion of memory
or physical storage. More complex covert storage channels might be
used to manipulate the amount of free space available on a disk or the
size of a file to covertly convey information between security levels.
For more information on covert channel analysis, see Chapter 8,
“Principles of Security Models, Design, and Capabilities.”