An application does encrypt the data using a secrete key before the data is being written to the database to prevent the disclosure attack. However how do we verify the integrity of such data when application retrieve data from database and decrypt it? what if a privileged user (DB admin) update the encrypted data in the database directly ?
Usually an algorithm in application code trying to decrypt the tampered data would through an exception .A modified or tampered encrypted data fails to decrypt always ? if so this would give a hit that data integrity has lost.Is this control reliable ? or do we need to sign the data along with encryption before storing into the database and verify the hash when data is retrieved from database ?