1

I read some topics on database security. Now I have two questions about confidentiality and integrity violation, Thanks anyone who answers me:

  1. If we consider knowing the availability of data as a type of confidentiality disclosure, what is the referential integrity problem in database security?
  2. Can confidentiality violation lead to integrity violation?
3
  • Could you link what you have read please?
    – Aria
    Nov 12, 2016 at 15:56
  • Not a specific page that I link you to read, and these questions in my mind:) @Aria
    – ThisIsMe
    Nov 12, 2016 at 16:03
  • This smells a lot like homework to me. Nov 12, 2016 at 17:21

2 Answers 2

2

1) If we consider knowing the availability of data is a type of confidentiality disclosure?

Yes, knowing the availability of data is a type of confidentiality violation. Example is error message revealing whether a username exists or not in the database.

2) What is the referential integrity problem in database security?

For database elements to be consistently synchronized, multiple tables which segregates data about a single attribute has to be linked properly. In otherwords, no rogue data set should exist.

Suppose I have an application with two database tables user_credentials & user_activity.

user_credentials has columns user_name and user_passwd. user_activity has user_name & user_lastlogintime.

Referential integrity is the property by which both the tables have exactly all the same values in user_name field. This ensures consistency in accessing or removing the table elements.

3) Can confidentiality violation lead to integrity violation?

It is possible. But both has to be considered separately. Consider a scenario where a broken hashing algorithm with a known collission is used. Knowledge about the broken algorithm can be used to bypass the integrity checks. But from an Information security perspective theintegrity violation happens because of the use of a broken algorithm, though it is a result of confidentiality compromise.

5
  • I have two questions, but you answer three questions! I know what is referential integrity, my mean in question 1 is "referential integrity problem in database security when we know availability of some data" but you just explain "what is referential integrity".
    – ThisIsMe
    Nov 12, 2016 at 18:22
  • Can you clarify the question? I still am unable to comprehend it.
    – hax
    Nov 12, 2016 at 18:35
  • i.e. Can referential integrity discloses availability of data in database and lead to confidential violation?
    – ThisIsMe
    Nov 12, 2016 at 18:43
  • Yes. A referential integrity flaw can lead to information disclosure which is a confidentiality violation
    – hax
    Nov 12, 2016 at 22:26
  • But how? Can you clarify an example?
    – ThisIsMe
    Nov 13, 2016 at 9:12
0

"Can referential integrity discloses availability of data in database and lead to confidential violation"

It is possible. In a simple example, an attempt to delete a customer record may fail if there is an order or payment record belonging to the customer. However this only works if there are circumstances where deletion is allowed. Often data items are never 'hard-deleted' (removed) but are simply marked as 'deleted','archived' or 'inactive'.

In the other direction, the insertion of a payment record may be rejected if the customer doesn't exist. But if the identifiers are arbitrary, then the attacker often worn't be able to try this without already knowing the customer identifier. More likely they'll be able to make estimates of the numbers of employees, customers, invoices etc... in the system.

Uniqueness constraints are more likely to lead to information leakage (eg credit card, phone number or email address is already in the system).

1
  • Tnx for your answer!
    – ThisIsMe
    Nov 17, 2016 at 19:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .