5. An accountant in an organization is allowed access to a company's human resources database only to adjust the number of hours that the organization's employees have worked in a fiscal year. However, the accountant modifies an employee's personal information. Which part of the Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privileges (STRIDE) model describes this situation?
Answer: B
Tampering
This situation is best described as tampering, as the accountant altered an employee's personal information without authorization, which constitutes unauthorized modification of data.
A) Elevation of privilege
Elevation of privilege occurs when a user gains access to resources or functionality beyond their intended permissions. In this case, the accountant did not gain higher-level access but instead misused existing access, making this option incorrect.
B) Tampering
Tampering accurately describes the act of unauthorized modification of data. The accountant's actions directly involved changing an employee's personal information, which is a clear violation of data integrity and falls under the definition of tampering.
C) Denial of service
Denial of service refers to actions that disrupt the normal functioning of a service, making it unavailable to users. The accountant's modification of data does not cause service disruption, thus this option is not applicable.
D) Spoofing
Spoofing involves impersonating another user or system to gain unauthorized access or information. In this scenario, the accountant did not impersonate anyone but misused their own legitimate access, making this option incorrect.
Conclusion
Tampering is the definitive correct answer, as it directly relates to unauthorized changes made to employee data by the accountant. All other options fail to accurately represent the actions taken in this scenario, as they involve different types of security breaches that do not align with the specific modification of personal information.