On 6/29/12 5:45 PM, Willy Santos wrote:
CCI-000029 requires enforcing org-defined limitations on embedding of data within other data types. This mapping is open to discussion and change.

SRG-OS-000013 CCI-000029 The operating system must enforce organization-defined limitations on the embedding of data types within other data types. Embedding of data within other data is often used for the clandestine transfer of data. Embedding of data within other data can circumvent protections in place to protect information and systems.

unmet_impractical_guidance - Creating prose to do this is beyond the scope of a general security guide. And there's no requirement in NIST 800-53 that actually says to do this.

and unmet_impractical_product - I don't see this being technically feasible at an operating system level. That is what 3rd party ISVs are for.