Title: The DBMS must enforce organization defined limitations on the embedding of data types within other data types.
Vulnerability ID: V-32227
IA Controls: None
Description: Information flow control regulates where information is allowed to travel within an information system and between information systems (as opposed to who is allowed to access the information) and without explicit regard to subsequent accesses to that information.
Information flow enforcement mechanisms compare security attributes on all information (data content and data structure), source and destination objects, and respond appropriately (e.g., block, quarantine, alert administrator) when the mechanisms encounter information flows not explicitly allowed by the information flow policy.
Embedding of data within other data is often used for the surreptitious transfer of data. For example, embedding data within an image file (e.g., .jpg) is referred to as Steganography and is used to circumvent protections in place to protect information. This type of information hiding is made easier in modern database products by the use of binary data objects. Special care should be taken when utilizing large binary data types to avoid the surreptitious transfer of data.
Check Text: Review DBMS settings and custom code to determine whether data of one type is being embedded in other data types against organization defined limitations. If data of one type is being embedded in other data types against organization defined limitations, this is a finding.
Fix Text: Configure DBMS settings and custom code to not embed data of one type into data of another type beyond organization defined limitations.[divider]