2 cissp ® Official Study Guide Eighth Edition

Steganography 
Steganography
is the practice of embedding a message within a fi le. For example, individuals 
can modify bits within a picture fi le to embed a message. The change is imperceptible to some-
one looking at the picture, but if other people know to look for the message, they can extract it. 
It is possible to detect steganography attempts if you have the original fi le and a fi le 
you suspect has a hidden message. If you use a hashing algorithm such as Secure Hash 
Algorithm 3 (SHA-3), you can create a hash of both fi les. If the hashes are the same, the fi le 
does not have a hidden message. However, if the hashes are different, it indicates the second 
fi le has been modifi ed. Forensic analysis techniques might be able to retrieve the message. 
In the context of egress monitoring, an organization can periodically capture hashes of 
internal fi les that rarely change. For example, graphics fi les such as JPEG and GIF fi les gen-
erally stay the same. If security experts suspect that a malicious insider is embedding addi-
tional data within these fi les and emailing them outside the organization, they can compare 
the original hashes with the hashes of the fi les the malicious insider sent out. If the hashes 
are different, it indicates the fi les are different and may contain hidden messages.
Watermarking 
Watermarking
is the practice of embedding an image or pattern in paper that isn’t readily 
perceivable. It is often used with currency to thwart counterfeiting attempts. Similarly, orga-
nizations often use watermarking in documents. For example, authors of sensitive documents 
can mark them with the appropriate classifi cation such as “Confi dential” or “Proprietary.” 
Anyone working with the fi le or a printed copy of the fi le will easily see the classifi cation. 
From the perspective of egress monitoring, DLP systems can detect the watermark in 
unencrypted fi les. When a DLP system identifi es sensitive data from these watermarks, it 
can block the transmission and raise an alert for security personnel. This prevents trans-
mission of the fi les outside the organization. 
An advanced implementation of watermarking is digital watermarking. A digital water-
mark is a secretly embedded marker in a digital fi le. For example, some movie studios 
digitally mark copies of movies sent to different distributors. Each copy has a different 
mark and the studios track which distributor received which copy. If any of the distributors 
release pirated copies of the movie, the studio can identify which distributor did so.