Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.

learn more… | top users | synonyms

2
votes
1answer
102 views

TLS WG Charter and Security Goals

I was looking at the TLS Working Group Charter. I noticed that confidentiality and integrity of messages for those who desire it are not goals for the group. Naively, I believe confidentiality and ...
0
votes
1answer
39 views

Downloading Text from Articles [on hold]

Is there any security measures that I should take when downloading article text from the web as far as file integrity? For example, I've written a bot that retrieves article text from a user's blog ...
2
votes
0answers
27 views

How do I verify a GPG symmetrically encrypted file? [migrated]

I created an encrypted file with symmetric encryption. gpg -c 50GBfile Now I want to delete the original. Before I delete the original, I want to verify the integrity of the encrypted file. Does ...
0
votes
1answer
26 views

Does ASP.NET guarantee the integrity of a page's controls on a post back?

Say you have an ASP.NET page that lists the prices for certain items in labels. I know it's cringe-worthy, but say you took the price of the item from the label on the page to determine what the user ...
2
votes
1answer
44 views

JavaScript code authenticity when loaded from 3rd party website

Background A discussion about not sourcing JavaScript files from other websites (http://www.reddit.com/r/netsec/comments/29hfhz/please_dont_use_externally_hosted_javascript/) got me thinking. ...
1
vote
2answers
39 views

Purpose of integrity checking in installers

There are many programs available (like NSIS) that generate installers from a collection of files. One thing that I have noticed is, the installers produced by these programs have some kind of ...
5
votes
1answer
151 views

What prevents the Intel TXT boot loader from being maliciously altered?

From my understanding of Intel TXT, the technology can be used to put the processor in a trusted state where measurements can be performed. My understanding looks something like this, where I believe ...
1
vote
0answers
52 views

Is the digital declaration just an obscure proposal?

One professor from my university proposed me and some colleagues to work on a paper about the digital declaration (which is supposed to be better than the digital signature) for passing the subject. ...
5
votes
1answer
163 views

Is the SD card write protection hard-wired or optional?

According to Wikipedia, the SD card reader recognizes if the little tab on the left of the SD card is in the "lock" position or not. Thus, a SD card reader can still write on the SD card even if the ...
1
vote
2answers
77 views

How to prove the integrity of a digital file if certificates are not an option

Certificates are a fantastic way to prove the integrity of a file - provided that they have been signed from the beginning. This methodology can prove the files authenticity, in addition proving it's ...
4
votes
4answers
201 views

Contact person by phone, when their phone might have malware

I have a problem setting where I want to contact a user by phone, and where I need to protect the integrity of the phone call as much as possible. I'm wondering about how to design the interaction in ...
3
votes
1answer
805 views

Who is the creator of the CIA triad?

The Information Security goals - Confidentiality, Integrity and Availability (CIA) - are often referenced to as the CIA triad. As I am writing on my master thesis, I am wondering to which resource I ...
1
vote
2answers
72 views

How to detect changes to client

I am developing a Java game and money is involved. As such, I want to prevent people from modifying the client if at all possible (I'm a game designer, not a security expert). I know that it is ...
4
votes
2answers
118 views

Data integrity of malicious content in the database

From a data integrity standpoint, if I persist the following code into my database: <script> alert('hi'); </script> should I sanitize it before persistence, for instance making ...
0
votes
3answers
181 views

Security goals vs ITU-T security services

I am doing a course on cryptography, and there I learned that the major security goals are Confidentiality Integrity Availability Also I Learned that ITU-T provides 5 different security services ...
1
vote
2answers
781 views

How can I check the integrity of the downloaded files?

I know we use hash functions to check for the integrity of the files etc... but my question is how can we check for the integrity of the files being downloaded from some server?
2
votes
1answer
318 views

What extra protection is added to an REST API over HTTPS by the use of some kind of HMAC?

I'm designing a RESTFUL API that will always be used over HTTPS, what security advantages over the use of HTTP Basic Auth could be brought to my system by using such kind of message authentication ...
1
vote
2answers
423 views

Prevent my site to be sniffed and changed by man-in-the-middle-attacks

I want to secure site which is locally used for Prepaid Services, the site has been hacked many times, for the first step, I implemented SSL and its now working fine, however, I want to be sure that ...
3
votes
1answer
377 views

Is Torrent safe for sharing legitimate files (file verification)? Does it use SHA1 or SHA256?

Let's assume that a legitimate torrent file has been safely and successfully downloaded over HTTPS and perhaps even OpenPGP verification was used to verify the integrity of the torrent file. How good ...
16
votes
1answer
537 views

Is there a way to verify a binary against the sources?

It seems like there is no practical way to verify the full integrity path of precompiled and packaged software? I can check the downloaded package itself by hashes, but I have no verification if the ...
0
votes
2answers
133 views

Check integrity of GnuPG inside of GPGTools?

Is it possible to check the integrity of the GnuPG files inside of the downloaded installation package of GPGTools? I know how to check the integrity of the .dmg file (compare the SHA1 hash), but I ...
0
votes
2answers
116 views

Allow or Deny Access to a Network Based on Client Hardware [duplicate]

We have to build a product that will have a network. Users will be able to connect to this network by downloading a client. However, before allowing them to access the network we want to check if ...
1
vote
1answer
73 views

How to protect integrity of resource files in a white-box attack context?

In a white-box attack context (e.g. PC, tablet, smartphone), there is no trusted entity, which can be used to guarantee some reasonable security. TPM is not considered a solution because it is not ...
1
vote
2answers
220 views

Recommended authenticated stream cipher for minimum overhead?

I'm running my TCP/IP protocol secured by encrypting each packet with AES128/CBC, bundling a SHA256 HMAC over that packet. This causes quite a bit of space overhead for small packets, so at first I ...
4
votes
1answer
305 views

In the Clark Wilson models, why can't the TPs be executed in parallel?

I am studying the Clark-Wilson model, I can't exactly understand why the TPs must be executed in serial, is there a way to execute them in parallel? What would happen if I did execute them in ...
4
votes
3answers
1k views

Using MD5 for file integrity checks?

General Always check the MD5 hashes of the .NET Framework assemblies to prevent the possibility of rootkits in the framework. Altered assemblies are possible and simple to produce. Checking ...
5
votes
1answer
125 views

Integrity check against package repository?

I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates. From time to time I want to boot from a clean boot ...
6
votes
4answers
1k views

Safest way for multiple users post to a single social networking account

Suppose I have a team or organization managing a single twitter account and a single facebook page. Different users need to be able to post content to the same account. How can I minimize the risk of ...
3
votes
3answers
266 views

How do I transfer the HMAC?

I have a file I'd like to encrypt with a symmetric key using AES-256 and then use an HMAC for integrity. So I don't "roll my own" scheme which I know is a big mistake, what are the standards for using ...
5
votes
1answer
113 views

Authentication by Signing or MAC?

I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send ...
3
votes
2answers
218 views

Confidentiality and integrity for web session

When the client authenticates with our service, he is issued an opaque "token". This token includes the information, that identifies the client and some other information about the client ("payload"). ...
5
votes
2answers
950 views

What security standards and regulations are in place for bank ATM?

Are there any international or US mandated standards and regulations that apply to communications between automatic teller machines and bank's central office? Are banks or ATM operators subjected to ...
4
votes
2answers
493 views

How to correctly implement AES in a backup application

I am writing a back-up application which should have the feature of encrypting the back-up. It must encrypt file data, paths and filenames. The application is being written in C# (.NET). Target is ...
1
vote
1answer
97 views

Ciphertext for email vs Ciphertext for database

Let's say Bob wants to send a message to Alice. This communication requires to achieve confidentiality, integrity, proof of origin, non-repudiation. Therefore we can use this cipher-text: ciphertext ...
0
votes
3answers
730 views

Why is it necessary to match the checksum of a download with another file provided by the same server? [duplicate]

Possible Duplicate: Does hashing a file from an unsigned website give a false sense of security? On many servers providing files for download, there is a file on which checksums are ...
3
votes
2answers
215 views

What's the point of using multiple checksum algorithm with “aide”?

In aide the author offers more than one hash algorithm to do the check-sum, why is that? Aren't a single one, i.e sha512 enough for determining file changes? I believe these algorithms are all ...
0
votes
1answer
80 views

how to stop write downs

Consider a scenario with two security levels, Alice and Bob. Bob is Alice's boss. Bob must be able to read Alice's documents but not write anything to her documents. I am using encryption keys to ...
0
votes
2answers
453 views

Access control matrix and integrity

Can access control matrix in addition to confidentiality provide the integrity of the objects to which access is being controlled?
2
votes
1answer
209 views

Password checking in the context of symmetric encryption

It is my understanding that block ciphers like AES don't have any built-in mechanisms to verify data integrity upon decryption, although some modes of operation might provide that. I played around ...
0
votes
2answers
106 views

API - How can I make sure data sent by the user is only sent to my application?

I have an API and a web application where users can login through another system and then post text messages to my application, for example. How can I assure that when this data is only posted to my ...
0
votes
5answers
627 views

How can I prevent forwarding a manipulated email?

How can I prevent someone from modifying the contents of an email they received and then forwarding it to others? Some employees cheat managers by changing the content of emails and forwarding the ...
2
votes
2answers
732 views

How to make a simple file integrity checker

I've seen many PHP file checker on the net. Basically they computes the sha hash of a requested file. Your PC queries periodically the script and alerts you if the returned hash changes. The problem ...
2
votes
3answers
728 views

Is SSL Tamper Detectable?

I know how SSL provides security against people reading your messages - by encryting the message with a SYMMETRIC KEY, which was exchanged during SSL Handshake with the help of ASYMMETRIC KEYS. But I ...
23
votes
4answers
5k views

Why aren't application downloads routinely done over HTTPS?

We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits: Encryption: The data can't be read by a middle-man while in transit. ...
1
vote
2answers
628 views

Signed request vs HTTP digest auth for API authentication?

By signed request I mean something like this (simplified example): Client creates a sig in his request: $sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
4
votes
2answers
541 views

Detect changes in /boot when using full disk encryption

When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
2
votes
3answers
231 views

Find changes and modifications made to system by application or virus,

I would like to use either Hyper-V or Vmware to take a Clean Base snapshot and a snapshot after an application or virus has made changes so I can then see what was changed between the two images. ...
4
votes
1answer
297 views

Does deliberately wrong information from a DNS server violate standards generally accepted good practices?

For certain host names my DNS gives me a wrong ip address (the ip address of a transparent proxy) for which inverse DNS look up does not give me back the host I originally looked up. This is related ...
5
votes
4answers
1k views

What are the most common files to check with File integrity monitoring software?

I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server. Is there a ...
2
votes
2answers
110 views

Domain and IP scoring

What kind of things would you check in a domain and IP scoring system? Which things are the most important? If I have a web site or web service, I would like to figure out a score for my visitor. If ...