Log in / Register
Home arrow Computer Science arrow The InfoSec Handbook
< Prev   CONTENTS   Next >

Correctness of the Updates

Like the completeness of the updates, the correctness of the updates is also important. If a patient has to be operated upon the left knee and the update in the medical record of the patient has been made that the procedure is required for the right knee (e.g., knee replacement operation) by oversight or mistake, it is possible that the patient, very much under general anesthesia, may realize the blunder only after the operation is over. He may have to suffer doubly because he already has a problem on his left knee and now he is additionally operated on the right knee!!

Verification of all critical updates for correctness has to be provided through the application to ensure that no critical update is wrong and that the critical updates are accurate in all respects and not partially.

Preservation of the Integrity of the Data in Storage

This refers to the integrity of the data in the underlying database of any application or data under the custody of any application. It should not be possible for anybody to modify this data directly without the authorized provisions of the application. If anybody can modify the underlying data of any application, then the application and data loses its sanctity. For example, the deposit in the banking account of a particular person is USD 1,000,000. The same is modified, without authorization, directly through back end, by running an unauthorized script, to USD 10,000,000. These types of possibilities seriously impact the credibility of the applications.

There are various mechanisms used by the application developers to avoid such issues. Some of these are record checksums, database checksums, or the system is configured in such a way that data can only be modified through the normal application interfaces and not through backend or through any other script directly, regular integrity check runs throwing up the mistakes, strong logging mechanism which ensures that critical data is checked regularly with the corresponding audit logs / pre-image.

Preservation of the Integrity of the Data while in Transmission

We are now in the highly networked era. Applications may be distributed or databases may be distributed. Data may have to be transmitted from one system to another, may be across the oceans and across the continents, such as ecommerce transactions, and credit card transactions. Such data are prone for Man in the Middle Attacks or Man in the Browser Attacks, and similar attacks which can lead to unauthorized modification of the data being transmitted.

Hence, application security should consider the security of the data while in transmission and ensure secure transmission of critical data through mechanisms like encryption.

Found a mistake? Please highlight the word and press Shift + Enter  
< Prev   CONTENTS   Next >
Business & Finance
Computer Science
Language & Literature
Political science