This is an absolute best practice in the software testing field, you should always have to keep all your testing approaches with the results as part of the product documentation. This can help you in the case you have problems with some tasks or components of the software in the future, you can check back your testing and results and see if the system was making the tasks correctly and if anything changed from that environment.

Triple DES encrypts a message three times. This encryption can be accomplished in several ways. The most secure form of triple DES is when the three encryptions are performed with three different keys.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 4: Cryptography
(page 152).

Data should be used only for the purposes for which it was collected, and it should be used only for a reasonable period of time. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 9: Law, Investigation, and Ethics (page 302).

Analyzing resources of a system is one standard for locating covert channels because the basis of a covert channel is a shared resource.
The following properties must hold for a storage channel to exist:
1. Both sending and receiving process must have access to the same attribute of a shared object.
2. The sending process must be able to modify the attribute of the shared object.
3. The receiving process must be able to reference that attribute of the shared object.
4. A mechanism for initiating both processes and properly sequencing their respective accesses to the shared resource must exist.
Note: Similar properties for timing channel can be listed
The following answers are incorrect:
All other answers were not directly related to discovery of Covert Channels.
The following reference(s) were/was used to create this question:
Auerbach Publications, Auerbach Publications (Test Series) - CRC Press LLC, Page No.
225
and
http://www.cs.ucsb.edu/~sherwood/cs290/papers/covert-kemmerer.pdf
and
http://www.cs.utexas.edu/~byoung/cs361/lecture16.pdf
and
http://www.cs.utexas.edu/~byoung/cs361/lecture16.pdf

Project management is an important part of product development and security management is an important part of project management. - Shon Harris All-in-one CISSP Certification Guide pg 732