Subject: [weirds] Security Requirements: Data Integrity

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 15 Oct 2012 14:07:23 +0000

Data integrity ("The property that data has not been changed, destroyed, or lost in an unauthorized or accidental manner") is another security service for which I haven't been able to find specific protocol requirements. There's a lot of discussion of needs for data accuracy, but I don't think that's a protocol issue. Are there any data integrity requirements?

Scott

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 20 Oct 2012 21:13:33 -0700

> Data integrity ("The property that data has not been changed, destroyed, or lost in an unauthorized or accidental manner") is another security service for which I haven't been able to find specific…

Could this be the same as, or related to, ICANN's vague "validation"
requirement?

-MSK

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 22 Oct 2012 11:18:24 +0000

> -----Original Message-----
> From: Murray S. Kucherawy [mailto:[email-masked]]
> Sent: Sunday, October 21, 2012 12:14 AM
> To: Hollenbeck, Scott
> Cc: [email-masked]
> Subject: Re: [weirds] Security Requirements: Data Integrity
> 
> > Data integrity ("The property that data has not been changed,
> destroyed, or lost in an unauthorized or accidental manner") is another
> security service for which I haven't been able to find specific
> protocol requirements. There's a lot of discussion of needs for data
> accuracy, but I don't think that's a protocol issue. Are there any data
> integrity requirements?
> 

I think people will conflate the two, but that's not really what I'm getting it. I'm approaching the integrity question from the perspective of protecting the client-server data exchange. I'm having a hard time figuring out how to cast the data validation thing as a security requirement. It sounds like more of a policy or data use requirement/need to me.

Scott