I was wondering if there would be any security vulnerabilities with having insufficient data for different employees in a cluster of systems. If an economic system would have incomplete or null fields, for employees in one system, but would be complete in an HR-system for example.

Could that provide a security vulnerability or other issues within the organization?

  • Technically, that would be an "integrity" risk, and would tangentially apply as "security", but depending on your jurisdiction, other models would apply like "Data Protection" and GDPR. Is this what you mean? – schroeder Feb 1 '19 at 17:21
  • @schroeder yes exactly! I'm doing an assignment, of analyzing a simple data scheme, where some data is missing from some of the columns. – baileyhaldwin Feb 1 '19 at 17:26
  • Missing by design or thru process error? – schroeder Feb 1 '19 at 17:28
  • process error.. though not specified. – baileyhaldwin Feb 1 '19 at 18:08
  • Ah, missing information through process error. I'd be mainly concerned what could be hidden that way. – Maarten Bodewes Feb 2 '19 at 0:58

Sure. This happens all the time at the macro level. I suspect you're imagining something more low-level and technical. But at the macro level there are "identity providers" who know people's userids, passwords, etc. There are various authorisation systems, like the payroll system that knows who can approve changes to payments, etc. or the company file server that stores secret company files, or the employee performance review system where managers record employee performance.

In a company that had all these systems, you routinely have gaps. One expects a manager to have authority to enter feedback about her own employees but not about others. Or she can see the project files in her teams workspaces, but not in other teams. Or she knows the salaries of her own employees but not those on other teams. So the HR system records reporting lines Bob reports to Andrea who reports to Jill. That reporting line concept is completely missing on the fileserver, which has its own group system with its own ideas about what teams Bob and Andrea and Jill are. And the payroll system has its own idea about groups of users.

So it is quite easy, and it happens all the time in real companies, that Andrea moves off of Jill's team and onto Tom's team. HR is updated so that reporting lines are correct. Payroll is updated so that now Tom has access to Andrea's salary, but Jill no longer does. But then the IT team doesn't get notified, so Andrea still has access to files on her old team's workspace that she shouldn't have access to. Depending on your definition of "vulnerabilities", this is going to allow data to be exposed that shouldn't be.

If you're thinking more of a data consistency problem (e.g., we have a 3-node database and 1 of the 3 nodes has out-of-date data), that's not so much an information security problem as a data integrity problem. It won't just cause 'vulnerabilities', it will cause the system to fail in its primary purpose. Some queries will get bad data, and that's a problem generally—not just in some information security sense.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.