id: "SC-08(04)" title: "Conceal or Randomize Communications" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-08.04" priority: "P1" implementation_level: "system" parent: "SC-08" enhancement: True
Statement
Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by {{ insert: param, sc-08.04_odp }}.
Guidance
Concealing or randomizing communication patterns addresses protection from unauthorized disclosure of information. Communication patterns include frequency, periods, predictability, and amount. Changes to communications patterns can reveal information with intelligence value, especially when combined with other available information related to the mission and business functions of the organization. Concealing or randomizing communications prevents the derivation of intelligence based on communications patterns and applies to both internal and external networks or links that may be visible to individuals who are not authorized users. Encrypting the links and transmitting in continuous, fixed, or random patterns prevents the derivation of intelligence from the system communications patterns. Alternative physical controls include protected distribution systems.
Assessment Objective
cryptographic mechanisms are implemented to conceal or randomize communication patterns unless otherwise protected by {{ insert: param, sc-08.04_odp }}.
System and communications protection policy
procedures addressing transmission confidentiality and integrity
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
system developer
Cryptographic mechanisms supporting and/or implementing concealment or randomization of communication patterns
mechanisms supporting and/or implementing alternative physical safeguards
organizational processes for defining and implementing alternative physical safeguards