Data Tampering and Integrity Protection, Explained

UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 8.4 Free with a free account

Data Tampering and Integrity Protection

Ethics in Technology · Chapter 8: Guarding the Data Vault: Database Protection, Cloud Risks, and Intrusion DetectionSection 8.4 · lesson 38 of 11614 min · free with a free account

← Database Roles and AccountabilityNext lesson: The Cloud Security Model →

Earn 3 college credits for Ethics in TechnologyRecommended for credit by NCCRS · Computer Science 195 · self-paced · one payment, lifetime access
Enroll in Ethics in Technology · $250 →Download the syllabus (PDF)

In this lesson

Detecting false records, preserving evidence, and restoring trustworthy information.

  • Explain unauthorized changes and their continuing consequences
  • Compare outsider and insider paths and historical examples
  • Distinguish checksums, hashes, keyed authentication, signatures, and logs
  • Combine prevention, detection, and careful recovery

Free study notes

Get this lesson's notes by email

The key points and 4 practice questions with answers, in your inbox. One email, free.

One email. Unsubscribe in one click.

Transcript

Everything said in the video, section by section (1,786 words). Read along, or search it.

Chapter 8

Data Tampering and Integrity Protection

Data tampering changes, adds, or deletes information without appropriate authorization. It attacks integrity, while theft concerns confidentiality and service disruption concerns availability. A false refund, grade, payment destination, or medication record may continue to influence real decisions. The system can appear to work normally while people rely on the wrong information. We compare outsider and insider paths, including two historical financial examples. Then we examine checksums, cryptographic hashes, keyed message authentication, digital signatures, and protected logs. Each supplies a different kind of assurance, and each has conditions and limits. A hash needs a trustworthy baseline; a key-based check needs properly protected key material. Protected logs also need suitable storage, a trusted reference, and checks for missing evidence. Finally, we combine prevention, detection, and recovery from a suitably verified state. The aim is trustworthy information and fair investigation, rather than assuming one matching fingerprint proves every record is correct.

Integrity

False Information Can Keep Causing Harm While the System Appears to Work

Tampering is an unauthorized alteration, insertion, or deletion of information. Integrity concerns accuracy and completeness, including whether changes follow appropriate authorization. It is the integrity element of confidentiality, integrity, and availability. A larger refund, altered grade, changed supplier account, or false medication record can create continuing harm. People may keep acting on that false information until the problem is identified. Tampering can therefore be more harmful than theft in a particular situation. It is not universally quieter or more dangerous; context and consequences determine the comparison. Relevant locations include information in transit, database records, recovery copies, and audit trails. Both outsiders and insiders may affect those locations where their access permits. An intruder may also try to conceal evidence by changing logs or other records. That does not guarantee every trace disappears, so protected independent evidence and active review remain important.

Actors and Examples

Accepted Credentials Can Hide Unauthorized Activity by Outsiders or Insiders

An outsider may reach information through a compromised account, malware, or a system weakness. An insider may already have technical reach through a legitimate work account. Possible motives include fraud, sabotage, false information, concealment, revenge, and helping another person. Technical permission does not make every change appropriate to the person's duties. At Société Générale, fictitious transactions concealed unauthorized trading exposures associated with Jérôme Kerviel. The bank announced a closeout loss of about four point nine billion euros in January two thousand eight. At Bangladesh Bank, about eighty-one million dollars was stolen through fraudulent payment instructions in two thousand sixteen. A United States complaint described malware designed to conceal records and confirmations in local banking systems. That is different from a compromise of SWIFT's core network, which SWIFT distinguished from the local malware. Both cases illustrate false information and concealment, rather than one universal method used by every attacker. Accepted credentials and apparently normal records therefore still require appropriate limits and independent checks.

Cryptographic Hashes

A Small Input Change Normally Produces a Very Different Digest

A cryptographic hash produces a digest from the exact input bytes. The same bytes produce the same output, making comparison deterministic. A small input change typically changes many output bits, known as the avalanche effect. The payment examples differ in one digit, producing very different SHA two hundred fifty-six digests. Only prefixes are displayed to keep the illustration readable; real checks use the appropriate full values. A suitable cryptographic hash makes finding collisions or preimages computationally difficult under the relevant assumptions. Collisions remain mathematically possible, so avoid saying every possible change must always produce a different result. Compare the current digest with a protected, trustworthy baseline. A mismatch identifies changed bytes, while a match supports consistency with that baseline. Neither result by itself establishes factual accuracy, authorization, harmlessness, or the human author. Predictable inputs can also be guessed; an ordinary fast hash alone is not an appropriate password-storage design.

Checksum Example

A Simple Digit Sum Misses Reordering and an Unprotected Replacement

The source uses a deliberately simple checksum that adds the digits in a record. The original account and payment digits add to twenty. A typing error changing the payment from five hundred to six hundred changes that sum to twenty-one. The mismatch identifies an error relative to the stored value. Reordering the payment digits leaves the sum unchanged, so this checksum misses that change. In the final example, both the record and its stored checksum are replaced. The new payment and the new checksum agree, despite the unauthorized change. Different checksum algorithms have different accidental-error properties, but they are not designed for deliberate forgery. A stronger unkeyed hash still has a related problem if its comparison value can also be replaced. Protect the baseline, use appropriate keyed authentication, or verify a valid signature. The essential question is who can alter the information and the value being trusted to check it.

Keyed Authentication

A Secret Key Changes Who Can Produce an Accepted Message Tag

HMAC is a defined hash-based message authentication construction using a shared secret key. It is not simply a homemade recipe that appends a secret to an ordinary hash. A suitable tag lets key holders check integrity and message authentication under the relevant assumptions. Someone without the key should not be able to forge an accepted tag for altered content. However, any participant holding the shared key may be able to generate valid tags. The tag therefore does not uniquely identify one participant among those key holders. Key theft or unsafe implementation can undermine the protection. The surrounding protocol also needs appropriate context and protection against replay of an old valid message. A valid tag does not prove that a payment or other business statement is true or properly approved. HMAC does not encrypt the message, so confidentiality needs its own appropriate protection. Key management, application rules, and evidence must support the message check rather than being replaced by it.

Digital Signatures

Public Verification Depends on Trusted Keys and the Signed Content

A digital signature uses a private signing key and a corresponding public verification key. The signing algorithm processes the relevant message representation with the private key. The verifier checks the signature and message using the public key. The public key must be connected to a trusted identity and appropriate authority. Its validity, relevant context, and any compromise information also matter. A valid signature supports integrity and authentication tied to that signing key. It can supply evidence supporting non-repudiation, rather than making every human dispute impossible. Theft, compromise, coercion, or disagreement about meaning can still require investigation. Signatures protect software updates, documents, transactions, and aspects of web authentication. They do not encrypt the data, guarantee factual accuracy, or establish that signed software is safe. Real algorithms need not literally encrypt a hash with the private key; use their defined procedures and assumptions.

Protected Logs

A Hash Chain Is Tamper-Evident Only Against a Trusted Reference

Logs are valuable evidence, so they are also an important target for concealment. An appropriate independent collection system can limit an observed administrator's ability to alter the trail. Write-once, read-many arrangements can restrict changes or deletion for a configured protection period. Check the actual settings and privileged paths, rather than trusting the storage label alone. A hash chain incorporates the preceding digest into each later entry. Changed content alters its digest, which affects the later dependent digests. A person able to replace the whole chain may also recompute those values. A trusted authenticated checkpoint outside that replaceable chain can expose the resulting inconsistency. Hash chaining is therefore tamper-evident under conditions, rather than automatically immutable. It does not alone prevent deletion, truncation, missing events, or every privileged override. Preserve completeness, protect reference values, and perform verification so the chain can support meaningful investigation.

Prevention

Limit Changes and Protect the Paths Before Checking Their Effects

Prevention makes inappropriate changes harder before an integrity check discovers their effects. Least privilege limits the records and settings each account can change. Separation of duties divides sensitive entry, approval, and reconciliation. Two-person approval can add an independent check for high-risk payment destinations or powerful key changes. The second check must be meaningful, rather than a routine approval without scrutiny. Appropriate authenticated encryption in transit protects communications against alteration and interception. Strong authentication reduces dependence on stolen passwords, although the applicable strength and implementation still matter. Protected versioned copies preserve separated recoverable states, including older information when appropriate. Cryptographic checks cannot stop every accepted account from entering false business information. Authorization, purpose, accuracy, and independent confirmation still need suitable application and organizational controls. Prevention and protected evidence work together, so an inappropriate change can be resisted and later investigated fairly.

Detection

Compare Protected Evidence and Independent Business Sources

File integrity monitoring compares important files with protected baseline digests. An alert identifies changed bytes, which may reflect an approved update, an error, or unauthorized activity. Database auditing records relevant changes, actors, times, and outcomes with proportionate protected detail. Recording every old and new sensitive value is not automatically justified for every system. Reconciliation compares information with independent statements, authorized requests, or other trustworthy sources. Anomaly monitoring flags unusual hours, volumes, or edits to rarely changed records. In the source's nightly example, the supplier bank-details file has a different displayed digest prefix. The payroll configuration and login page show unchanged prefixes in that illustration. Real checks should compare the appropriate full values, rather than relying on short display prefixes. Review the change request and independently confirm the payment details before deciding what the alert means. Combine the methods, because a consistent record and hash can still describe a false business transaction.

Recovery

Restore a Trusted State, Rather Than Automatically Choosing the Newest Copy

Recovery begins by assessing an integrity failure, alert, or reconciliation mismatch. Contain further harmful changes while preserving evidence and addressing essential service needs. Scope the affected records, timing, access paths, and sources that can still be trusted. Then select a suitably verified clean state and carefully reapply legitimate later work. Recent copies may already contain false entries if tampering began before discovery. Several dated, protected versions can help locate a state from before the inappropriate changes. A matching backup digest establishes consistency with its protected baseline, not the truth of the original records. Validate restored information against trustworthy sources and check the restoration process itself. Correct compromised access and other contributing weaknesses before returning to ordinary operation. Review controls and communicate or report as required for the particular incident. Keep the evidence needed for fair investigation, while avoiding unnecessary expansion of sensitive-data exposure.

Control Comparison and Review

Ask What Each Check Establishes, and What It Still Cannot Prove

A checksum detects specified accidental errors, but is not designed to resist deliberate forgery. A protected cryptographic hash supports consistency with a trusted baseline, without identifying the author or proving truth. HMAC supports integrity and message authentication among holders of a shared key. A signature supplies evidence tied to a signing key, with human attribution and authority requiring context. A protected, anchored log chain can reveal covered sequence changes when its assumptions remain valid. Storage protection, trusted references, completeness, and active review determine whether that evidence is useful. Changing a record and its unprotected checksum defeats the simple comparison in the worked example. Recomputing a replaceable chain explains why an external trusted reference matters. Keeping several dated copies helps when false records were already present in the latest backup. Restore testing and independent validation establish whether the recovered state is usable and appropriately trustworthy. Review the paths, motives, examples, controls, prevention, detection, and recovery as complementary protection for information integrity.

About Ethics in Technology at UPI Study

Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses

Compare: Cybersecurity vs Ethics in Technology · Which ethics course?

Why take it here

Why students take Ethics in Technology with UPI Study

The right and wrong of the digital worldEthics in Technology looks at the choices technology forces on people and organizations: security and privacy, surveillance and the law, big data, hacking and cyber warfare, malware and breaches, intellectual property, cybercrime, encryption, artificial intelligence and responsible digital citizenship. It suits computer science, information technology and business degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About Data Tampering and Integrity Protection

What is data tampering?
Data tampering is the unauthorized change, insertion or deletion of information, an attack on integrity in the confidentiality, integrity and availability triad. A falsified refund, grade, supplier bank account or medication record can keep causing harm while the system appears to work normally. In 2016 attackers stole about $81 million from Bangladesh Bank with fraudulent payment instructions and malware that hid records and confirmations in the bank's local systems.
How does a cryptographic hash detect changes to data?
A cryptographic hash such as SHA-256 turns the exact input bytes into a fixed-length digest, and changing even one character produces a very different digest, called the avalanche effect. Comparing a current digest with a trusted baseline shows whether the bytes changed. The baseline itself must be protected, since an attacker who replaces both data and digest defeats the check. A match shows consistency, not that the data is true or authorized.
What is the difference between HMAC and a digital signature?
HMAC uses a shared secret key, so anyone holding that key can create or verify a valid tag, and the tag cannot single out which key holder produced it. A digital signature uses a private key to sign and a public key to verify, tying the evidence to one signing key and supporting non-repudiation. Neither one encrypts the data or proves that a payment or statement is accurate or properly approved.
How can audit logs be protected from tampering?
Audit logs can be protected by sending them to an independent collection system the observed administrator cannot change, using write-once, read-many storage, and hash-chaining entries so each record includes the previous digest. Because someone who controls the whole chain could recompute it, a trusted checkpoint stored outside the chain is needed to expose changes. Hash chains show tampering rather than prevent it, and alone they cannot stop deletion or truncation or reveal events never logged.

About the Ethics in Technology course

How many college credits is Ethics in Technology?
Ethics in Technology (Computer Science 195) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does Ethics in Technology cost and what is included?
$250, paid once, with lifetime access: all 116 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. It is sold on its own and is not part of UPI Study PRO.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does Ethics in Technology take?
It is self-paced with no deadlines. The 116 lessons total about 28 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in Ethics in Technology.

116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in Ethics in Technology →Download the syllabus
Ethics in Technology
3 credits · NCCRSEnroll →