On 6/29/12 5:45 PM, Willy Santos wrote:
CCI-000029 requires enforcing org-defined limitations on embedding of
data within other data types. This mapping is open to discussion and change.
SRG-OS-000013 CCI-000029 The operating system must enforce
organization-defined limitations on the embedding of data types within
other data types. Embedding of data within other data is often used for
the clandestine transfer of data. Embedding of data within other data
can circumvent protections in place to protect information and systems.
unmet_impractical_guidance - Creating prose to do this is beyond the
scope of a general security guide. And there's no requirement in NIST
800-53 that actually says to do this.
and unmet_impractical_product - I don't see this being technically
feasible at an operating system level. That is what 3rd party ISVs are for.