Overview
Integrity is the second pillar of the CIA triad. It means information is accurate, complete, and unaltered except by authorized actions. Where confidentiality asks "who can read this?", integrity asks "can I trust that this data is correct and has not been tampered with?"
Learning objectives
- Define data integrity and system integrity.
- Explain how hashing and checksums detect tampering.
- Recognize attacks that target integrity.
Core concept
Integrity protects against unauthorized or accidental modification of data. A bank balance, a software update, a legal contract, and a log file are all worthless if they can be silently changed. Integrity covers two levels:
- Data integrity — the content itself is correct and unmodified.
- System integrity — the system behaves as intended and its configuration/code has not been tampered with.
How it works
The core technical tool is the cryptographic hash function (for example SHA-256). A hash takes any input and produces a fixed-length "fingerprint." Change a single byte of the input and the fingerprint changes completely. This lets you detect tampering:
- Checksums and hashes verify that a downloaded file matches what the publisher produced.
- Digital signatures combine a hash with cryptography to prove both that data is unaltered and who produced it.
- Access controls and audit logs limit who can change data and record who changed what.
- Version control and backups let you detect and recover from unauthorized changes.
Practical example
When you download an operating system image, the publisher lists a SHA-256 hash. You compute the hash of your downloaded file and compare. If they match, the file is intact; if they differ, it was corrupted or tampered with in transit. This is a pure integrity check — it says nothing about confidentiality.
Cybersecurity relevance
Integrity attacks can be more dangerous than theft: silently altering a financial record, poisoning a software supply chain, or editing logs to hide an intrusion. Detection and response (the SOC & Blue Team path) depends heavily on trustworthy, tamper-evident logs.
Common mistakes
- Assuming a hash provides confidentiality. A hash detects change; it does not hide data.
- Trusting a hash sent over the same channel as the file. If an attacker can alter the file, they can alter an unsigned hash too — which is why digital signatures (tied to a trusted key) matter.
- Ignoring log integrity, letting attackers erase their tracks.
Key takeaways
- Integrity means data and systems are accurate and unaltered except by authorized changes.
- Hashes detect modification; digital signatures add proof of origin.
- Tamper-evident logs and access control are essential to trust an environment.
Check your understanding
- Why does changing one character in a file completely change its SHA-256 hash, and why is that useful?
- Give an example of an integrity attack that involves no data theft at all.