| Information flow control regulates where information is allowed to travel within an information system and between information systems (as opposed to who is allowed to access the information) and without explicit regard to subsequent accesses to that information.
From an application perspective, flow control is established once application data flow modeling has been completed. Data flow modeling can be described as:
the process of identifying, modeling and documenting how data moves around an information system. Data flow modeling examines processes (activities that transform data from one form to another), data stores (the holding areas for data), external entities (what sends data into a system or receives data from a system, and data flows (routes by which data can flow).
Once the application data flows have been identified, corresponding flow controls can be applied at the appropriate points.
Application specific examples of flow control enforcement can be found in information protection software (e.g., guards, proxies, gateways and cross domain solutions) employing rule sets or establishing configuration settings restricting information system services or provide message-filtering capability based on content (e.g., using key word searches or document characteristics).
This is an information flow requirement. Information flow control applies to applications like a CDS. An AS is not a cross domain solution. |
