Revision To NIST Security Controls Catalog Addresses Steganography Threat

PRESS RELEASE

Fairmont, WV (PRWEB) April 30, 2013

The National Institute of Standards and Technology (NIST) has announced the final release of Special Publication (SP) 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations. The document is available at http://dx.doi.org/10.6028/NIST.SP.800-53r4.

Although developed primarily for federal government agencies, private sector organizations are encouraged to use the guidelines to protect their information systems and the sensitive information contained therein.

Revision 4 to SP 800-53 is the most comprehensive update to the security controls catalog since it was first released in 2005.

For the very first time, the catalog contains explicit references to steganography in three separate security controls--tacit acknowledgement of the threat represented by steganography in an ever expanding threat space.

Steganography is an information hiding technique dating back to the days of Ancient Greece that has evolved in the Internet era into a form of digital information hiding.

As an indication of the level of interest in hiding information, a Google search using the keywords "information hiding" will return over 70,000,000 links. Many of the links lead to web sites where easy to use steganography applications can be found.

The Boundary Protection control in SP 800-53 addresses steganography in the context of preventing unauthorized exfiltration of information across managed interfaces to include the external boundary and key internal boundaries.

The Malicious Code Protection control states that malicious code can be hidden in files using steganography and, therefore, calls for real-time scans at the network entry point of files from external sources.

An aspect of the Information System Monitoring control involves analyzing traffic for covert exfiltration of information. Steganography represents a covert means that can be used for the unauthorized exfiltration of organizational information.

Backbone's Steganography Analysis and Research Center (SARC) has developed the only commercially available product capable of supporting implementation of the security controls that include real-time scanning of network traffic to detect the presence or use of a steganography application.

The Steganography Analyzer Real-Time Scanner (StegAlyzerRTS) was developed in Backbone Security's Steganography Analysis and Research Center (SARC) as a countermeasure to the threat from use of digital steganography to steal sensitive information.

The latest generation of StegAlyzerRTS is capable of operating on networks with throughput of up to 1Gbps and detects insiders downloading any of the 1,150 digital steganography applications currently in the SARC's archives.

For more information about StegAlyzerRTS and how Backbone Security can help agencies implement steganography security controls, please visit http://www.sarc-wv.com.

------------------------

About the SARC

The SARC is a Center of Excellence in digital steganography research and development within Backbone Security. The SARC has established the world's largest commercially available repository of digital steganography applications, fingerprints, and signatures and has developed industry leading computer forensics and network security steganalysis tools for detecting and extracting information hidden with digital steganography applications.

About Backbone Security

In addition to being the leading provider of digital steganalysis tools, Backbone is a Payment Card Industry Data Security Standard (PCI-DSS) Approved Scanning Vendor (ASV) that conducts automated PCI-DSS compliance assessments with their industry leading 1 Stop PCI Scan service. Backbone also provides real-time intrusion monitoring, vulnerability assessment, penetration testing, and business continuity and disaster recovery planning services.