Which choice below MOST accurately describes a Covert Storage
Channel?

A.
A process that manipulates observable system resources in a way that affects response time

B.
An information transfer that involves the direct or indirect writing of a storage location by one
process and the direct or indirect reading of the storage location by another process

C.
A communication channel that allows a process to transfer information in a manner that violates
the systems security policy

D.
An information transfer path within a system

Explanation:
A covert storage channel typically involves a finite resource (e.g.,
sectors on a disk) that is shared by two subjects at different security
levels. One way to think of the difference between covert timing
channels and covert storage channels is that covert timing channels
are essentially memoryless, whereas covert storage channels are not.
With a timing channel, the information transmitted from the sender
must be sensed by the receiver immediately, or it will be lost. However,
an error code indicating a full disk which is exploited to create a
storage channel may stay constant for an indefinite amount of time,
so a receiving process is not as constrained by time.
*Answer “A process that manipulates observable system resources in a way that affects response
time” is a partial description of a covert timing channel. A
covert timing channel is a covert channel in which one process signals
information to another by modulating its own use of system
resources (e.g., CPU time) in such a way that this manipulation
affects the real response time observed by the second process.
*Answer “An information transfer path within a system” is a generic definition of a channel. A
channel may also refer to the mechanism by which the path is effected.
*Answer “A communication channel that allows a process to transfer information in a manner that
violates the systems security policy” is a higher-level definition of a covert channel. While a covert
storage channel fits this definition generically.

Source: DoD 5200.28-STD Department of Defense Trusted Computer
System Evaluation Criteria and NCSC-TG-030, A Guide To
Understanding Covert Channel Analysis of Trusted Systems [Light
Pink Book].