In this lesson,
we will learn about integrity risk considerations.
Integrity is the assurance
that data remains accurate and unaltered
and that any unauthorized changes are detectable.
Integrity risk considerations
are actions taken to protect data and systems
from unauthorized modifications
that could compromise their accuracy and trustworthiness.
Integrity risk considerations include interference, hashing,
remote journaling, and anti-tampering.
Let's explore each of the integrity risk considerations
in more detail, and then conduct a demonstration
to see how hashing can detect a small data change
in a group of files.
First, we have interference.
Interference is any unauthorized
modification or disruption of data or systems
which compromise its accuracy and integrity.
Interference can occur through malicious attacks,
accidental changes, or system errors.
To protect against data interference,
organizations should implement strict access controls,
user authentication protocols, and system monitoring
to detect and prevent unauthorized changes.
Additionally, using backup systems and failover strategies
can help recover from interference
and restore systems to their unaltered state.
Second, we have hashing.
Hashing is a cryptographic technique
used to maintain data integrity
by creating a fixed-size fingerprint or hash value
from an input of any size.
Hashing algorithms are considered trap-door algorithms
because they are one-way mathematical functions.
In other words, a hash output cannot be reverse engineered
to discover its original input.
So they're called trap door algorithms
because once you fall through a trap door,
you can't climb up back through it.
Common hashing algorithms include MD5, SHA-1,
SHA-256, and SHA-3.
MD5 and SHA-1 were once widely used.
However, they aren't used much now
due to known hash collisions.
A collision occurs when two unique inputs
result in the same hash output.
When hash collisions occur,
the integrity of data can no longer be confirmed.
These collisions made MD5 and SHA-1 algorithms
unsuitable for ensuring data integrity.
SHA-256 and SHA-3 on the other hand,
produce unique, unpredictable hashes
that make unauthorized data alterations easily detectable.
In a few minutes, we will demonstrate
how hashing can identify a small change in a group of files.
Third, we have remote journaling.
Remote journaling refers to the continuous transmission
of transaction logs to a remote location.
Remote journaling ensures that a secure record
of all system activities
is maintained in real time in a remote location.
Unlike data backups, which involve copying entire data sets,
remote journaling focuses on safeguarding individual logs
that track system changes, transactions,
or other critical events.
In the event of a system failure,
security breach, or disaster, these remotely stored logs
allow organizations to reconstruct recent system activities.
While remote journaling doesn't restore lost data,
it plays a key role
in ensuring the accuracy of system records.
Fourth and last, we have anti-tampering.
Anti-tampering measures are designed to detect or prevent
unauthorized modifications to hardware or software.
Anti-tampering measures
ensure systems remain secure and trustworthy.
These anti-tampering measures
can include physical protections,
such as seals or locks on hardware components,
or software mechanisms,
like checksums and tamper-evident logs.
For example, tamper-evident logging records any attempts
to alter system files or configurations,
alerting administrators to potential security breaches.
Now let's conduct a hashing algorithm demonstration.
I am operating on a Kali Linux virtual machine.
I've created an Integrity_Monitoring folder
with four simple files in it.
The contents of each file are five paragraphs
of Lorem Ipsum text.
My goal during this demonstration
is to identify a compromise of integrity
in one of these files.
Because hashing algorithms can accept any size input,
I could hash a single file or an entire hard drive.
In this case, I will hash each of the files individually,
then hash the individual file hashes as a group
to create a single resulting hash
that represents the contents of all files
in the Integrity_Monitoring folder.
When the hash operations are complete,
I'm going to save that resulting hash
in a file called Hash_Monday.txt.
So I'm going to enter in my hashing command.
As I said, this one's going to end with Hash_Monday.txt.
There we go.
This command generates a SHA-256 hash
for all the files in the Integrity_Monitoring folder,
combines those hashes,
and then computes a final SHA-256 hash
from the individual file hashes.
The resulting hash is saved into the Hash_Monday.txt file.
So if this was Monday's hash
and there was no change in file integrity
between Monday and Tuesday,
then Tuesday's hash result would be the same.
I'll simulate this by running the hashing algorithm again
and sending the output to a file called Hash_Tuesday.txt.
All right, now I'm going to compare the value
between the two files with the diff command.
As you can see, the two files are identical.
Now, let's presume that on Wednesday
the integrity of SimpleFile_2 is compromised
and a single letter in the file is changed.
So I'm going to open up SimpleFile_2.
There it is, and I'm going to delete
the first character in the file and save that file.
Now back in the command line,
I'm going to run a hashing and comparison command again,
but I'm going to do it in one action.
So I'm going to use the and operator
to link the two commands together one after the other.
So this will be SHA-256.
I'm going to hash everything again,
but now it's going to be the Hash_Wednesday file.
And after that, I'm going to find the difference
between the Hash_Tuesday.txt
and the new Hash_Wednesday.txt file.
Ah, there we go.
Now you can see that the hashes
within the Tuesday file and the Wednesday file
are not identical.
So by monitoring the hash values
of the files within a folder,
we were able to detect a single change
in one of those files.
This is the end of the demonstration.
So remember, integrity risk considerations
focus on protecting data and systems
from unauthorized modifications
that could compromise their accuracy and reliability.
These considerations include measures like interference
where unauthorized changes can disrupt data or systems.
Mitigating interference
requires access controls and monitoring
to prevent alterations.
Hashing is a cryptographic process
that generates a unique digital fingerprint
for data of any size.
Hashing ensures that any unauthorized changes
are detectable no matter how small
through comparisons of the original and current hash values.
Next, remote journaling helps maintain
transaction logs off site,
ensuring the availability of logs
in the event of a system failure.
Last, anti-tampering measures detect or prevent
unauthorized modifications to hardware or software
through mechanisms like checksums,
tamper-evident logs, and physical protections.