An employee in accounting changes a few numbers in the monthly balance sheet — out of personal frustration following a promotion decision she felt was unfair. The changes are small enough to pass routine inspection. In the annual accounts, the deviations sum to a distorted business result that influences the share price and investor decisions.
Manipulation of information is the targeted falsification of data — whether digital or on paper. The BSI lists this threat as G 0.22.
What’s behind it?
Integrity means: data is complete, correct and unaltered. G 0.22 describes the threat that an attacker (or an insider) violates this integrity through targeted changes. The manipulation can be applied at any point in data processing — on capture, during transmission, in storage or on retrieval.
Forms of manipulation
- Input manipulation — deliberately false data is entered into a system. Particularly critical in systems without plausibility checks or a four-eyes principle.
- Database manipulation — direct modification of field content in the database, bypassing the application layer. Requires database access, which can be obtained via compromised credentials or SQL injection.
- Document manipulation — alteration of contracts, invoices, certificates or reports — digital or on paper.
- Manipulation in transit — man-in-the-middle attacks alter data during transmission. Without integrity protection (e.g. TLS), the recipient does not notice the change.
- Archive manipulation — archived documents are altered. Since archive data is often only reviewed years later, the manipulation can remain undetected for an extremely long time.
Impact
Manipulated data can directly disrupt business processes: false stock levels lead to production outages, manipulated financial data to wrong decisions, forged configurations to system failures. Particularly serious: when the manipulation remains undetected, every downstream decision is made on the basis of false information. The damage propagation can be enormous.
Practical examples
SQL injection against a web application. An attacker discovers an SQL injection vulnerability in an online shop. Through manipulated input fields they alter product prices in the database — initially only minimally to avoid attention. In the next wave of orders, goods sell at a fraction of their price. The damage only becomes obvious when matched against the accounting figures.
Manipulated payslip. An employee in the HR department alters their own payslip data in the HR system — they raise the variable compensation component by a small amount. Since no automated plausibility check runs between the contract and the payslip, the manipulation goes undetected for over a year.
Forged supplier data in order processing. An attacker compromises a supplier’s email account and sends a notice about an alleged change of bank details. The change is taken into the creditor database. All subsequent payments to that supplier flow to the attacker’s account.
Relevant controls
The following ISO 27001 controls mitigate this threat. (You’ll find the complete list of 52 mapped controls below in the section “ISO 27001 Controls Covering This Threat”.)
Prevention:
- A.8.3 — Information access restriction: Minimal access rights limit the circle of people who can modify data.
- A.8.5 — Secure authentication: Strong authentication prevents unauthorised access to data and systems.
- A.8.9 — Configuration management: Versioned, controlled configurations reveal unwanted changes.
- A.8.25 — Secure development life cycle: Input validation and parameterised queries prevent SQL injection.
- A.5.15 — Access control: Policies for granting and revoking access rights.
Detection:
- A.8.15 — Logging: Complete recording of all data changes with timestamp and user identifier.
- A.8.16 — Monitoring activities: Detection of unusual data changes (volume, timing, pattern).
Response:
- A.5.24 — Information security incident management planning and preparation: Prepared response processes for detected data manipulations.
- A.8.13 — Information backup: Backups enable the restoration of the correct data state.
- A.8.14 — Redundancy of information processing facilities: Redundant systems provide a reference point for detecting deviations.
BSI IT-Grundschutz
The BSI IT-Grundschutz catalogue links G 0.22 to numerous modules, including:
- APP.3.6 (DNS servers) — protection against manipulations of DNS records (DNS spoofing, cache poisoning).
- OPS.1.1.5 (Logging) — requirements for the recording of data changes.
- CON.1 (Crypto concept) — cryptographic integrity protection through signatures and message authentication codes.
- DER.2.3 (Remediation of far-reaching security incidents) — processing and data recovery after detected manipulation.
Sources
- BSI IT-Grundschutz: Elementary Threats, G 0.22 — original description of the elementary threat
- ISO/IEC 27002:2022 Section 8.3 — implementation guidance on information access restriction
- BSI: OWASP Top 10 and Secure Web Development — recommendations on avoiding injection vulnerabilities