T 5.85 Loss of integrity of information that should be protected

Integrity is a requirement stating that information must remain uncorrupted. This means that undesired changes cannot be made to the information. Integrity, in addition to confidentiality and availability, is one of the basic values of information security.

When the integrity of data is violated, a number of problems can arise:

In the simplest case, it may just be impossible to read the data, which means it cannot be processed either.

• Data can be accidentally or deliberately falsified and lead to the disclosure of incorrect information. As a result of this, electronic bank transfers may contain the wrong amount, be sent to the wrong recipient, the sender address of emails could be manipulated, or many other kinds of problems could arise.
  If the integrity of encrypted or compressed records is lost - and this only takes a change to a single bit - it may be impossible to decrypt or unpack the records under certain circumstances.
• The same also applies to cryptographic keys, i.e. changing just one bit of a key makes the key unusable. In turn, this could then make it impossible to decrypt the data or check its authenticity.
• Documents stored in electronic archives are not considered conclusive evidence when the integrity of the documents cannot be verified.

Losses of integrity can occur in various ways:

• Information can be lost due to the ageing of the data media.

• Transmission errors can occur when transmitting data.

• Malicious software can be used to change or destroy entire databases.

• Entering the wrong data can trigger unwanted transactions, which often go unnoticed for a long time.
• Attackers can attempt to manipulate data for other purposes, e.g. to gain access to other IT systems or databases.
• Manipulation of the index database of an electronic archive can cause it to archive the wrong documents or to archive or retrieve falsified documents.