Explain the concept and effects of data modification or data damage?

Answer 1

Information security has two positive ideals for this area: Integrity and Availability. For data these ideas relate to the right quality of data at the right time requested. An opposite of data Integrity is unwanted data alteration. An opposite of data availability is unwanted data destruction.

Unwanted data alteration damages the useful quality of the information. Unwanted data destruction prevents timely access to use of the information. The methods of achieving unwanted data modification or damage may vary.

Generally, basic software quality assurance can detect programming flaws that alter or destroy useful data. But, attacks on software by viruses or other programs can alter programs correct operation -- resulting in a kind of hijacked software processing that can alter and/or destroy data.

Various methods, agendas and motives exist for these kinds of attacks. SQL Client Brute force login attempts, SQL Injection/alteration and Buffer Overflow attacks can trick database software into giving up privileged access, account passwords or even directly re-write software running on a system. In most cases, the initial objective is to gain unauthorized access rights. Using new found unauthorized privilege, follow up avenues of attack can be extended in scope and, if undetected, continue over an extended time period.

The complexity of these attacks can blur the line between data and software. For software itself is a kind of specialized data that instructs a computer to perform actions. Maliciously crafted data may be mistaken as computer software and run by a computer. If so, authorized control over a computer will likely be lost; alteration or destruction of data can occur as either a deliberate or accidental side effect of an attack.

Motives for data alteration or destruction attacks vary considerably. At some level, mixes of intangible benefit or profit combine to motivate an attack. Motive combined with technical opportunity can be very effective. Motives of such people vary from sabotaging the opposition (a rival business competitor or political party in an election) to gaining confidential and classified information for blackmailing and extortion. Revenge motives by offended, departing or terminated employees should also be considered.

Databases often run with elevated system privileges, support remote access, contain valuable data, use tool accounts and are sometimes awkward to patch. This can make such software a preferential target.