In the history of cybersecurity, first of information and today of cybersecurity, integrity has always been considered the “poor sister.” The result is that our Cinderella, unlike her sisters Genoveffa (privacy) and Anastasia (availability), has never been at the center of concerns regarding data protection.
The reasons are probably twofold: on the one hand, it has often been misunderstood in the strictest sense of the term, and on the other hand, it has always been difficult to understand from which perspective to take it. In fact, what is meant by integrity has been the subject of countless misunderstandings, especially because this particular property does not necessarily concern “truth” and even less the fact that it is “right.” Rather, we speak of a characteristic for which one can be sure that the information reflects its original purpose, or better yet, the respect for the original content of whoever first produces it and possibly of those who then hold control over it. An example that clarifies this concept can be found in the legal field. When a judge issues a sentence, it may be wrong and not reflect the truth of the facts, but its content must be preserved as it is. The reasons seem obvious.
Another issue is identifying which controls are applicable. In the context of availability and privacy, possible countermeasures are intuitive: on the one hand, redundant systems, backups, operational continuity plans, and on the other hand, encryption, perimeter controls, pseudonymization, just as examples. When it comes to integrity, managing privileges is often thought of, and little else, but above all, some controls are perceived as complex, just think of digital signatures in their various declinations. However, compromising data integrity could prove to be much more insidious than one might imagine. Firstly, an organization may realize the problem in a not-so-short time. Understanding how and why wrong decisions are made is never easy. Secondly, when it becomes clear that the data is incorrect, it means their inevitable unavailability.
If currently, we are facing a risk that humans can somehow remedy by appealing to “common sense,” in the future, things could change radically because the systems we will be dealing with will no longer be “computer-based,” at least not in the sense we have understood them until now, i.e., they will no longer concern information management but knowledge management.
What determines the ascent of machines in the data-information-knowledge-wisdom model from the second to the third step is the progressive affirmation of weak artificial intelligences and our ambition to understand Big Data. Moving away from the source, we will increasingly find it difficult to understand if a decision “suggested” by an intelligent algorithm reflects human ability to make a judgment based on common sense. Being aware that weak AI is trained through large databases, it is evident how essential their integrity is, as well as any input submitted to them. It is now established that it is possible to completely alter the functioning of an artificial intelligence by compromising a training dataset through the insertion of misleading inputs, which has already seen a large number of experiments and is known as an adversarial attack. The most famous dates back to 2014 when a group of Google and New York University researchers, by inserting imperceptible disturbances into the photograph of a panda, induced an image recognition algorithm to see a gibbon with a probability of 99.3%. It is clear that the validation of inputs provided cannot simply be a “nice to have.”
A second area where incorrect information could have catastrophic effects is that of the Internet of Things. I will limit myself to an example that is now a classic. The attack known as “false data injection” aims to mislead industrial platforms by falsifying sensor measurements. An improper modification of data coming from thousands of “smart meters” could cause an instant metropolitan blackout. Similarly, it could paralyze the production of entire factories. Once again, the issue is all about the ability to validate data.
It would probably be advisable to explore the potential of blockchain and its primary validation protocol. Of course, to do so, it would be helpful if people stopped imagining it as a synonym for Bitcoin, which is only one of its possible applications and hopefully not the only one.
Market and Data
_old_Become an author
Wallet
