1

I read some topics on database security. Now I have two questions about confidentiality and integrity violation, Thanks anyone who answers me:

  1. If we consider knowing the availability of data as a type of confidentiality disclosure, what is the referential integrity problem in database security?
  2. Can confidentiality violation lead to integrity violation?
  • Could you link what you have read please? – Aria Nov 12 '16 at 15:56
  • Not a specific page that I link you to read, and these questions in my mind:) @Aria – ThisIsMe Nov 12 '16 at 16:03
  • This smells a lot like homework to me. – Xiong Chiamiov Nov 12 '16 at 17:21
2

1) If we consider knowing the availability of data is a type of confidentiality disclosure?

Yes, knowing the availability of data is a type of confidentiality violation. Example is error message revealing whether a username exists or not in the database.

2) What is the referential integrity problem in database security?

For database elements to be consistently synchronized, multiple tables which segregates data about a single attribute has to be linked properly. In otherwords, no rogue data set should exist.

Suppose I have an application with two database tables user_credentials & user_activity.

user_credentials has columns user_name and user_passwd. user_activity has user_name & user_lastlogintime.

Referential integrity is the property by which both the tables have exactly all the same values in user_name field. This ensures consistency in accessing or removing the table elements.

3) Can confidentiality violation lead to integrity violation?

It is possible. But both has to be considered separately. Consider a scenario where a broken hashing algorithm with a known collission is used. Knowledge about the broken algorithm can be used to bypass the integrity checks. But from an Information security perspective theintegrity violation happens because of the use of a broken algorithm, though it is a result of confidentiality compromise.

  • I have two questions, but you answer three questions! I know what is referential integrity, my mean in question 1 is "referential integrity problem in database security when we know availability of some data" but you just explain "what is referential integrity". – ThisIsMe Nov 12 '16 at 18:22
  • Can you clarify the question? I still am unable to comprehend it. – hax Nov 12 '16 at 18:35
  • i.e. Can referential integrity discloses availability of data in database and lead to confidential violation? – ThisIsMe Nov 12 '16 at 18:43
  • Yes. A referential integrity flaw can lead to information disclosure which is a confidentiality violation – hax Nov 12 '16 at 22:26
  • But how? Can you clarify an example? – ThisIsMe Nov 13 '16 at 9:12
0

"Can referential integrity discloses availability of data in database and lead to confidential violation"

It is possible. In a simple example, an attempt to delete a customer record may fail if there is an order or payment record belonging to the customer. However this only works if there are circumstances where deletion is allowed. Often data items are never 'hard-deleted' (removed) but are simply marked as 'deleted','archived' or 'inactive'.

In the other direction, the insertion of a payment record may be rejected if the customer doesn't exist. But if the identifiers are arbitrary, then the attacker often worn't be able to try this without already knowing the customer identifier. More likely they'll be able to make estimates of the numbers of employees, customers, invoices etc... in the system.

Uniqueness constraints are more likely to lead to information leakage (eg credit card, phone number or email address is already in the system).

  • Tnx for your answer! – ThisIsMe Nov 17 '16 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.