Ensuring Data Integrity

Introduction

Welcome to the very first lesson of the " Creating a Secure App following OWASP Top 10 Risks (Part 2) " course! In this lesson, we will explore the fundamentals of data integrity, a crucial aspect of secure data handling. Data integrity ensures that information remains accurate, consistent, and reliable throughout its lifecycle. By the end of this lesson, you'll understand the importance of data integrity and how to implement it in your applications. Let's dive in! 🚀

Understanding Data Integrity

As we discussed earlier, if an attacker already has access to some endpoints or the network, it is still important to limit their capabilities. Previously, we focused on securing specific types of data that attackers can target, such as user credentials and tokens. Now, let's consider a more generalized approach, focusing on the integrity of ANY DATA within the application. Data integrity is the assurance that data is accurate, consistent, and reliable. It plays a vital role in maintaining the trustworthiness of information, especially in applications where data is frequently accessed and modified. There are three main types of data integrity : Physical Integrity : Ensures that data is stored and retrieved without corruption due to hardware failures or environmental factors. Logical Integrity : Maintains the correctness and validity of data within a database, ensuring that it adheres to predefined rules and constraints. Referential Integrity : Ensures that relationships between data in different tables remain consistent, preventing orphaned records or invalid references. Understanding these types helps us appreciate the various ways data integrity can be compromised and the importance of safeguarding it. In this lesson, we primarily focus on logical and referential integrity. To better understand how logical and referential integrity apply in real-world Java web applications, consider a case where multiple related entities (e.g., users and their posts) exist in a database. Logical integrity ensures that a user's email follows a proper format and is unique, while referential integrity ensures that every post references a valid user ID. If a user is deleted, cascading deletes or foreign key constraints are often used to maintain referential integrity. These constraints are typically enforced at the database level (e.g., PostgreSQL, MySQL).

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Location	Security Value	Purpose
Server-Side	✅ REQUIRED - Actual security enforcement	This is your trust boundary. Attackers can bypass anything client-side.
Client-Side	⚠️ OPTIONAL - UX only, provides NO security	Early feedback to users, reduces unnecessary API calls.

Mechanism	Use Case	Provides	When to Use
Hash (SHA-256)	Data integrity verification	Integrity only	When you need to verify data hasn't been tampered with, but authenticity isn't critical. Example: Verifying file downloads haven't been corrupted.
HMAC	Authenticated data integrity	Integrity + Authenticity	When you need to verify both that data is intact AND that it came from a trusted source. Both parties share a secret key. Example: API request verification between services.
Digital Signature	Non-repudiable authentication	Integrity + Authenticity + Non-repudiation	When you need the highest level of security, including proof that a specific party signed the data. Uses public/private key pairs. Example: Admin actions, financial transactions, legal documents.

Scenario	Severity	Immediate Action	Follow-up
Single failure, legitimate user	🟡 Low	Log + Return error	Monitor for patterns
Multiple failures, same user	🟠 Medium	Log + Temporary account lock	Manual review
Multiple failures, multiple users, same resource	🔴 High	Log + Disable resource + Alert admins	Data corruption investigation
Multiple failures, multiple resources, same IP	🔴 Critical	Log + Block IP + Alert security team	Potential attack investigation

Introduction

Understanding Data Integrity

Join the 1M+ learners on CodeSignal

The Vulnerable Code

Where Should Integrity Checks Be Performed?

The Trust Boundary Principle

Core Security Principle: Never Trust the Client

Implementing Data Hashing

Retrieving and Verifying the Snippet

Implementing HMAC Verification

Implementing Digital Signature Verification

Choosing the Right Integrity Mechanism

Handling Integrity Check Failures

The Complete Incident Response Workflow

Response Decision Matrix

Monitoring and Alerting

Data Recovery Procedures

Key Principles for Incident Response

Conclusion and Next Steps