Integrity

Integrity means information stays accurate and complete — as authorized creators intended — whether stored at rest or moving across a network in transit. Attackers, bugs, bit rot, and careless edits can all break it. The failure mode is silent change: readers and processes trust the bytes because they look like the usual database row or installer. Availability can still be green. Confidentiality can still hold if only authorized accounts can read. Integrity still failed if those authorized eyes are seeing a lie.

Separate view from modify in your mental model. Many confidentiality controls answer "who may read?" Integrity controls answer "who may change, and how do we detect unauthorized change?" A junior analyst might need read access to tickets without permission to edit payroll. A CMS editor might publish posts without permission to replace the homepage theme files. When mapping incidents, ask: was the primary harm disclosure, alteration, or downtime?

Transit integrity matters too. A file that left the vendor correct can still be swapped on a hostile mirror or altered by malware on the download path. That is why you compare against a published digest obtained from a channel you already trust — not from the same sketchy mirror that offered the file. Inside organizations, audit logs and change tickets create a human trail: who was authorized to edit, when, and why. Missing logs after an incident are themselves an integrity problem for investigators. Your personal drill stays small: hash a file you own; never alter shared school or work records "to demonstrate the pillar."

A cryptographic hash is a one-way fingerprint of a file or message. Change one bit of input and the digest should change completely (avalanche). Matching a vendor-published SHA-256 after download supports integrity relative to those published bytes: the file likely was not swapped in transit or on a shady mirror. A mismatch means do not run it. Hashing does not encrypt; anyone can hash. Hashing does not by itself prove who published the digest — you must obtain the expected hash from a channel you trust (official site you typed, signed release notes).

On your own machine you can feel the mechanism safely: create a tiny text file, hash it, change one letter, hash again, watch the digest flip. That is the same idea vendors use when they publish checksums. It is not a license to alter production databases "to see the hash change." Practice files live under $HOME/cyberlium-lab or a temp folder you delete afterward.

Digital signatures add authorship and integrity together: cryptographic proof of who signed a document or update and that it was not altered after signing. OS update systems and some package managers rely on this so a random mirror cannot silently replace a patch. You will not forge signatures in this course. You will prefer signed, official update channels on devices you own and treat unsigned surprise installers as hostile until proven otherwise.

Access controls on write — separate from read — reduce who can introduce unauthorized change. Dual control on money moves and change tickets on production configs are integrity habits in organizations. File Integrity Monitoring (FIM) alerts when critical system files change unexpectedly, turning silent alteration into a detected event. Backups matter here too: a known-good restore is how you recover integrity after tampering, not only how you recover availability after ransomware.

A clean mental test: if unauthorized people only read the data, say Confidentiality. If authorized people cannot use the system, say Availability. If the content itself was altered from what authorized creators intended — balance, blood type, homepage, installer bytes — say Integrity. Ransomware can eventually touch all three; a mismatched download hash is Integrity even when nothing was "stolen." Keep that test for the mapping lesson that closes this module.

You do not need to attack anything. Practice hashing on a harmless text file you create. Delete it when done. Never hash other people's private documents to "audit" them without authorization, and never use hashes as a cover for tampering with shared school or work files.

New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\cyberlium-lab" | Out-Null
"hello cyberlium" | Out-File -Encoding ascii "$env:USERPROFILE\cyberlium-lab\demo.txt"
Get-FileHash "$env:USERPROFILE\cyberlium-lab\demo.txt" -Algorithm SHA256

mkdir -p "$HOME/cyberlium-lab"
echo "hello cyberlium" > "$HOME/cyberlium-lab/demo.txt"
shasum -a 256 "$HOME/cyberlium-lab/demo.txt"

mkdir -p "$HOME/cyberlium-lab"
cd "$HOME/cyberlium-lab"
echo "hello cyberlium" > demo.txt
openssl dgst -sha256 demo.txt

openssl dgst -sha256 demo.txt

New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\cyberlium-lab" | Out-Null
Set-Location "$env:USERPROFILE\cyberlium-lab"

Integrity tells you whether data was tampered with — hashes, signatures, write controls, and monitoring make silent change detectable or harder. Next — Availability — we make sure authorized people can still reach systems when those systems are under stress, flooded, or locked by ransomware.