A covert channel is a communication path that moves information in a way the system was never designed to permit, sidestepping security policy by abusing shared resources. A covert storage channel passes data by altering the contents or existence of a storage object, while a covert timing channel signals through the timing of operations that an outside observer can measure.
These channels matter most in high-assurance systems that must keep classification levels strictly separated. A low-privilege process might learn secrets simply by watching how long a high-privilege process takes to respond, leaking data without ever reading it directly. The sobering point candidates should absorb is that covert channels can be narrowed and monitored but never fully eliminated in a general-purpose system. Design effort goes toward reducing bandwidth and raising the cost of exploitation, not toward a promise of total prevention.
How are covert channels tested on the CISSP?
Covert channels appear in Domain 3: Security Architecture and Engineering within trusted system design and security models. Candidates should recognize storage versus timing channels and explain why complete elimination is not realistic. Questions often pair covert channels with the Bell-LaPadula model and multilevel security.