I read some topics on database security. Now I have two questions about confidentiality and integrity violation, Thanks anyone who answers me:
1) If we consider knowing the availability of data is a type of confidentiality disclosure?
Yes, knowing the availability of data is a type of confidentiality violation. Example is error message revealing whether a username exists or not in the database.
2) What is the referential integrity problem in database security?
For database elements to be consistently synchronized, multiple tables which segregates data about a single attribute has to be linked properly. In otherwords, no rogue data set should exist.
Suppose I have an application with two database tables user_credentials & user_activity.
user_credentials has columns user_name and user_passwd.
user_activity has user_name & user_lastlogintime.
Referential integrity is the property by which both the tables have exactly all the same values in user_name field. This ensures consistency in accessing or removing the table elements.
3) Can confidentiality violation lead to integrity violation?
It is possible. But both has to be considered separately. Consider a scenario where a broken hashing algorithm with a known collission is used. Knowledge about the broken algorithm can be used to bypass the integrity checks. But from an Information security perspective theintegrity violation happens because of the use of a broken algorithm, though it is a result of confidentiality compromise.
"Can referential integrity discloses availability of data in database and lead to confidential violation"
It is possible. In a simple example, an attempt to delete a customer record may fail if there is an order or payment record belonging to the customer. However this only works if there are circumstances where deletion is allowed. Often data items are never 'hard-deleted' (removed) but are simply marked as 'deleted','archived' or 'inactive'.
In the other direction, the insertion of a payment record may be rejected if the customer doesn't exist. But if the identifiers are arbitrary, then the attacker often worn't be able to try this without already knowing the customer identifier. More likely they'll be able to make estimates of the numbers of employees, customers, invoices etc... in the system.
Uniqueness constraints are more likely to lead to information leakage (eg credit card, phone number or email address is already in the system).
