7.3. Integrity-by-Design Name: Integrity-by-Design Statement: Provide clients with a high degree of trust that the system and its attendant data and information are correct (i.e., precise, accurate and meaningful), valid (created, modified and deleted only by authorized users) and invariant (i.e., consistent an unmodified). Rationale: • Integrity is one of the three central pillars of securing corporate information assets along with confidentiality and availability. Integrity keeps data pure and trustworthy by protecting system and data from intentional or accidental changes. • With data being the primary information asset, integrity provides the assurance that the data is accurate and reliable. Without integrity, the cost of collecting and maintaining the data cannot be justified. Therefore, policies and procedures should support ensuring that data can be trusted. • Mechanisms put in place to ensure the integrity of the system, its data and information should prevent attacks on the storage of that data (contamination) and on its transmission (interference). Data that is altered on the network between the storage and the user's workstation can be as untrustworthy as the attacker altering or deleting the data on the storage media. Protecting data involves both storage and network mechanisms. Implications: • Unauthorized users must be prevented from making modifications to data or programs. • Unauthorized users must be prevented from making improper or unauthorized modifications. • Internal and external consistency of data and programs must be maintained. • Applying encryption to information that will be sent over the Internet or stored on digital media. • Software must be built defensively. • Users should be prevented from inadvertently storing inaccurate or invalid data by incorrect data entry, an incorrect decision made in running programs, or not following procedures. • Users should be prevented from affecting integrity through system configuration errors at their workstations or even by using the wrong programs to access the data. • Users should be taught about devicde and data integrity during their information security awareness training. • The installation of any new software or devices must be prevented except when done by a limited set of authorized people. • Check system integrity against a set of predefined validation policies or standards. References: • Security Architecture Team