ISC2 CISSP (Certified Information Systems Security Professional)Security Assessment and TestingHard
A security team is performing a penetration test against a new web application. They discover that the application allows users to upload profile pictures, but it does not properly validate the file type or content, leading to the successful upload and execution of a malicious script. This vulnerability represents a failure in which aspect of the CIA triad?
- AIntegrity
- BConfidentiality
- CAvailability
- DAuthenticity
Show answer & explanationAnswer & explanation
Correct answer: A. Integrity
The successful upload and execution of a malicious script indicates that the application's data (the uploaded file) was modified in an unauthorized way and that the system's expected behavior was altered. This directly violates the principle of Integrity, which ensures that data is accurate, consistent, and trustworthy, and that systems operate as intended.
Why the other options are wrong
- B. Confidentiality relates to preventing unauthorized disclosure of information. While a malicious script might later lead to disclosure, the immediate vulnerability is about unauthorized modification and system compromise.
- C. Availability refers to ensuring that systems and data are accessible when needed. While a malicious script could eventually lead to DoS, the primary failure described is not about access but about unauthorized modification/execution.
- D. Authenticity relates to verifying the identity of a user or the genuineness of data. While the malicious script might be disguised, the core failure is the lack of validation allowing unauthorized content to be processed, impacting integrity.
CIA Triad (Integrity)
Integrity ensures that information is accurate, consistent, and trustworthy, and that systems operate as intended, preventing unauthorized modification or destruction of data.
- Protects against unauthorized data alteration.
- Ensures data is reliable and uncorrupted.
- Compromised by malicious code, unauthorized changes, or system failures.
Memory trick: CIA: CONFIDENTIALITY keeps secrets, INTEGRITY keeps it true, AVAILABILITY keeps it working.