InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Comprehensive guide to the integrity principle of the CIA Triad, covering hash functions, digital signatures, checksums, database integrity, and techniques to detect and prevent unauthorized data modification.
Understanding Integrity
Integrity in information security ensures that data remains accurate, complete, and trustworthy throughout its lifecycle. It guarantees that information has not been altered, corrupted, or tampered with by unauthorized parties or processes.
Integrity addresses two critical questions:
- Has this data been modified since it was created or last validated?
- Can I trust that this data accurately represents what it claims to?
Types of Integrity
Data Integrity
Ensures that stored data has not been altered without authorization.
| Type | Description | Example |
|---|---|---|
| Physical Integrity | Protection from physical damage | RAID arrays, UPS systems |
| Logical Integrity | Correctness of data values | Database constraints, validation rules |
| Entity Integrity | Unique identification of records | Primary keys, no null identifiers |
| Referential Integrity | Consistency between related records | Foreign key constraints |
| Domain Integrity | Valid values within allowed ranges | Data type checks, range validation |
System Integrity
Ensures that systems operate correctly and have not been tampered with.
System Integrity Verification Flow
=====================================
Boot Process
BIOS/UEFI → Secure Boot → Bootloader → Kernel → OS
| | | | |
v v v v v
[Verify] [Verify] [Verify] [Verify] [Verify]
Firmware Signatures Hash Modules Configs
If ANY step fails → HALT (integrity compromised)
Technical Mechanisms for Integrity
1. Hash Functions
Hash functions produce a fixed-length fingerprint of data. Any change to the input, no matter how small, produces a completely different hash.
Example
import hashlib
import hmac
class IntegrityVerifier:
"""Verify data integrity using various hashing methods."""
def __init__(self, secret_key=b"shared_secret_key"):
self.secret_key = secret_key
def compute_hash(self, data: str, algorithm: str = "sha256") -> str:
"""Compute hash digest of data."""
hash_func = hashlib.new(algorithm)
hash_func.update(data.encode())
return hash_func.hexdigest()
def compute_hmac(self, data: str) -> str:
"""Compute HMAC for authenticated integrity verification."""
return hmac.new(
self.secret_key,
data.encode(),
hashlib.sha256
).hexdigest()
def verify_integrity(self, data: str, expected_hash: str,
algorithm: str = "sha256") -> bool:
"""Verify data has not been tampered with."""
current_hash = self.compute_hash(data, algorithm)
return hmac.compare_digest(current_hash, expected_hash)
def demonstrate_avalanche_effect(self, original: str, modified: str):
"""Show how a tiny change produces completely different hash."""
hash1 = self.compute_hash(original)
hash2 = self.compute_hash(modified)
# Count differing bits
diff_bits = bin(int(hash1, 16) ^ int(hash2, 16)).count('1')
total_bits = len(hash1) * 4 # Each hex char = 4 bits
return {
"original_hash": hash1,
"modified_hash": hash2,
"bits_different": diff_bits,
"total_bits": total_bits,
"percentage_changed": f"{(diff_bits/total_bits)*100:.1f}%"
}
# Demonstration
verifier = IntegrityVerifier()
# Show avalanche effect - changing one character
original = "Transfer $1000 to account #12345"
modified = "Transfer $9000 to account #12345"
result = verifier.demonstrate_avalanche_effect(original, modified)
print(f"Original: \"{original}\"")
print(f"Modified: \"{modified}\"")
print(f"Original hash: {result['original_hash']}")
print(f"Modified hash: {result['modified_hash']}")
print(f"Bits changed: {result['bits_different']}/{result['total_bits']} ({result['percentage_changed']})")
Hash Algorithm Comparison
| Algorithm | Output Size | Speed | Security Status | Use Case |
|---|---|---|---|---|
| MD5 | 128 bits | Very Fast | BROKEN (collision attacks) | Legacy checksums only |
| SHA-1 | 160 bits | Fast | DEPRECATED (collision found 2017) | Git (legacy) |
| SHA-256 | 256 bits | Medium | Secure | General purpose, blockchain |
| SHA-3 | Variable | Medium | Secure | Alternative to SHA-2 |
| BLAKE2 | Variable | Very Fast | Secure | High-performance applications |
2. Digital Signatures
Digital signatures provide both integrity and non-repudiation:
Digital Signature Process
============================
Signing (Sender)
Document → [Hash Function] → Hash Digest
|
v
Private Key → [Sign] → Digital Signature
|
v
Document + Signature → Sent to Recipient
Verification (Recipient)
Received Document → [Hash Function] → Computed Hash
|
Received Signature → [Verify with |
Public Key] → Extracted Hash
|
Compare ←-------+
|
Match? → Integrity Confirmed
No Match? → Document TAMPERED
Example
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa, padding
def digital_signature_demo():
"""Demonstrate integrity verification using digital signatures."""
# Generate key pair
private_key = rsa.generate_private_key(
public_exponent=65537,
key_size=2048,
)
public_key = private_key.public_key()
# Original message
message = b"Transfer $5000 from Account A to Account B"
# Sign the message (ensures integrity + non-repudiation)
signature = private_key.sign(
message,
padding.PSS(
mgf=padding.MGF1(hashes.SHA256()),
salt_length=padding.PSS.MAX_LENGTH
),
hashes.SHA256()
)
print(f"Message: {message.decode()}")
print(f"Signature: {signature[:32].hex()}...")
# Verify integrity
try:
public_key.verify(
signature,
message,
padding.PSS(
mgf=padding.MGF1(hashes.SHA256()),
salt_length=padding.PSS.MAX_LENGTH
),
hashes.SHA256()
)
print("\n✓ Integrity VERIFIED: Message has not been tampered with")
except Exception:
print("\n✗ Integrity FAILED: Message has been altered!")
# Attempt to verify tampered message
tampered_message = b"Transfer $50000 from Account A to Account B"
try:
public_key.verify(
signature,
tampered_message,
padding.PSS(
mgf=padding.MGF1(hashes.SHA256()),
salt_length=padding.PSS.MAX_LENGTH
),
hashes.SHA256()
)
print("\n✓ Integrity verified")
except Exception:
print("\n✗ TAMPERED: Message integrity check FAILED!")
digital_signature_demo()
3. Message Authentication Codes (MAC)
MACs provide integrity verification using a shared secret key:
python example
import hmac
import hashlib
def create_mac(message: str, key: bytes) -> str:
"""Create a Message Authentication Code."""
return hmac.new(key, message.encode(), hashlib.sha256).hexdigest()
def verify_mac(message: str, key: bytes, expected_mac: str) -> bool:
"""Verify message integrity using MAC."""
computed_mac = hmac.new(key, message.encode(), hashlib.sha256).hexdigest()
return hmac.compare_digest(computed_mac, expected_mac)
# Shared secret between sender and receiver
shared_key = b"super_secret_shared_key_2024"
# Sender creates message with MAC
message = "Payment of $500 approved for order #789"
mac = create_mac(message, shared_key)
print(f"Message: {message}")
print(f"MAC: {mac}")
# Receiver verifies integrity
is_valid = verify_mac(message, shared_key, mac)
print(f"\nIntegrity verified: {is_valid}")
# Attacker modifies message
tampered = "Payment of $5000 approved for order #789"
is_valid = verify_mac(tampered, shared_key, mac)
print(f"Tampered message verification: {is_valid}") # False!Database Integrity Controls
sql example
-- Entity Integrity: Primary key constraint
CREATE TABLE transactions (
transaction_id SERIAL PRIMARY KEY,
account_id INTEGER NOT NULL,
amount DECIMAL(10,2) NOT NULL,
timestamp TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
checksum VARCHAR(64)
);
-- Referential Integrity: Foreign key constraint
ALTER TABLE transactions
ADD CONSTRAINT fk_account
FOREIGN KEY (account_id)
REFERENCES accounts(account_id);
-- Domain Integrity: Check constraints
ALTER TABLE transactions
ADD CONSTRAINT chk_amount
CHECK (amount > 0 AND amount < 1000000);
-- Trigger for integrity audit
CREATE TRIGGER audit_transaction_changes
BEFORE UPDATE ON transactions
FOR EACH ROW
EXECUTE FUNCTION log_modification();Real-World Integrity Attack: SolarWinds (2020)
Attack overview: Russian state hackers compromised the build system for SolarWinds Orion software, injecting malicious code that was distributed to 18,000+ organizations through legitimate software updates.
Integrity failure analysis:
- Build system integrity was not verified
- Code signing used compromised build pipeline
- Update verification trusted the compromised certificate
- No independent hash verification of builds
Lessons learned:
- Implement reproducible builds
- Use multiple independent signing authorities
- Verify build integrity with out-of-band checksums
- Monitor for unexpected code changes in CI/CD pipeline
Integrity Monitoring with File Integrity Monitoring (FIM)
Example
import hashlib
import os
import json
from datetime import datetime
class FileIntegrityMonitor:
"""Monitor file system for unauthorized changes."""
def __init__(self, baseline_path="integrity_baseline.json"):
self.baseline_path = baseline_path
self.baseline = {}
def create_baseline(self, directory: str):
"""Create integrity baseline for all files in directory."""
for root, dirs, files in os.walk(directory):
for filename in files:
filepath = os.path.join(root, filename)
file_hash = self._hash_file(filepath)
file_stat = os.stat(filepath)
self.baseline[filepath] = {
"hash": file_hash,
"size": file_stat.st_size,
"modified": file_stat.st_mtime,
"permissions": oct(file_stat.st_mode),
"baselined_at": datetime.now().isoformat()
}
with open(self.baseline_path, 'w') as f:
json.dump(self.baseline, f, indent=2)
print(f"Baseline created: {len(self.baseline)} files tracked")
def check_integrity(self, directory: str) -> dict:
"""Check current state against baseline."""
violations = {"modified": [], "added": [], "deleted": []}
current_files = set()
for root, dirs, files in os.walk(directory):
for filename in files:
filepath = os.path.join(root, filename)
current_files.add(filepath)
current_hash = self._hash_file(filepath)
if filepath in self.baseline:
if current_hash != self.baseline[filepath]["hash"]:
violations["modified"].append({
"file": filepath,
"old_hash": self.baseline[filepath]["hash"][:16],
"new_hash": current_hash[:16],
"severity": "HIGH"
})
else:
violations["added"].append(filepath)
# Check for deleted files
for filepath in self.baseline:
if filepath not in current_files:
violations["deleted"].append(filepath)
return violations
def _hash_file(self, filepath: str) -> str:
"""Calculate SHA-256 hash of a file."""
sha256 = hashlib.sha256()
with open(filepath, 'rb') as f:
for block in iter(lambda: f.read(4096), b""):
sha256.update(block)
return sha256.hexdigest()
Interview Questions
- What is the difference between integrity and authentication?
- Integrity ensures data has not been modified (answers "has this changed?"), while authentication verifies the identity of a user or system (answers "who are you?"). Digital signatures provide both — they verify the signer's identity AND that the data hasn't been altered.
- Explain the avalanche effect and why it's important for hash functions.
- The avalanche effect means that a tiny change in input (even one bit) produces a drastically different hash output (approximately 50% of bits change). This is crucial because it makes it impossible to predict how a change will affect the hash, making tampering detectable.
- What is the difference between a hash function and a MAC?
- A hash function takes only data as input and produces a digest — anyone can compute it. A MAC (Message Authentication Code) additionally requires a secret key, so only parties who know the key can create or verify the MAC. MACs prevent an attacker from forging a valid integrity check.
- How would you implement integrity controls for a financial transaction system?
- Use digital signatures on all transactions, implement database constraints and triggers, maintain audit logs with tamper-evident logging, use checksums for data in transit, implement File Integrity Monitoring on critical systems, and use blockchain or append-only databases for transaction records.
- What is a collision in hash functions and why does it compromise integrity?
- A collision occurs when two different inputs produce the same hash output. This compromises integrity because an attacker could substitute a malicious file that produces the same hash as the legitimate one, passing integrity checks. This is why MD5 and SHA-1 (where collisions were found) are deprecated.
Summary
Integrity is the silent guardian of trustworthy information systems. While confidentiality breaches make headlines, integrity failures can be far more dangerous — undetected data manipulation can lead to incorrect decisions, financial fraud, and safety hazards. Implementing robust integrity controls through hashing, digital signatures, access controls, and monitoring is essential for maintaining trust in information systems.
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for Integrity in Information Security.
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this Information Security topic.
Search Terms
information-security, information security, information, security, fundamentals, integrity, integrity in information security
Related Information Security Topics
Continue learning this concept
Security FundamentalsAccountability in Information SecurityUnderstanding accountability principles in information security including audit trails, logging, monitoring, non-repudiation mechanisms, and how to establish responsibility for security actions.Security FundamentalsAuthentication in Information SecurityComplete guide to authentication mechanisms including passwords, multi-factor authentication, biometrics, tokens, and modern passwordless approaches for verifying user identity.Security FundamentalsAuthorization in Information SecurityUnderstanding authorization mechanisms, access control models, permission systems, and the principle of least privilege for controlling what authenticated users can do within systems.Security FundamentalsAvailability in Information SecurityUnderstanding the availability principle of the CIA Triad, including redundancy strategies, disaster recovery, DDoS protection, and ensuring systems remain accessible to authorized users when needed.Security FundamentalsConfidentiality in Information SecurityDeep dive into the confidentiality principle of the CIA Triad, exploring encryption methods, access controls, data classification, and practical implementations to protect sensitive information from unauthorized disclosure.Security FundamentalsNon-Repudiation in Information SecurityUnderstanding non-repudiation as a security service that provides undeniable proof of origin, delivery, or action, covering digital signatures, timestamps, and legal frameworks.