問66
頻出度★★★
セキュリティ事故の例のうち，原因が物理的脅威に分類されるものはどれか。
平成21年度 秋期 ITパスポート試験 問66
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 66
- ア
正解 Information security threats are broadly divided into three types by the nature of their cause: physical threats, technical threats, and human threats. A physical threat is one that acts in a physical form on the information asset itself or on the environment where it is installed, such as natural disasters like earthquakes, lightning, and floods, as well as fire, destruction or obstruction of equipment, and theft. Choice ア, heavy rain causes water to enter the server room and the equipment stops, is a case where a flood, a natural disaster, made the physical equipment (the server) unusable, which is exactly a typical physical threat. The decisive point is that the direct cause is a physical event on the environment or facility side, not an attack through a network or a program, and not a human operating mistake. Therefore the correct answer is ア.
Incorrectイ
Sending a large volume of data from outside to a public server to bring it down is a DoS attack (denial-of-service attack). It abuses the network, an IT technology, so it is classified as a technical threat. The result, a server that stops, resembles ア, but the cause is not a physical event; it is an attack carried out through communications.
Incorrectウ
An attacker intruding into an in-house server over the network and destroying files is unauthorized access, a representative example of a technical threat. Do not be misled by the word destroy into thinking it is physical. What was destroyed is data, not equipment, and the means is technical, carried out over the network.
Incorrectエ
An employee operating a computer by mistake and destroying data has its cause in human carelessness and error, so it is classified as a human threat. Note that any threat arising from human behavior is treated as a human threat, whether or not there is malicious intent.
ここがポイント
- Memorize information security threats in three categories: physical threats (disasters, destruction, obstruction, theft, and so on), technical threats (unauthorized access, malware, DoS attacks, eavesdropping, and so on), and human threats (operational errors, loss, insider misconduct, social engineering, and so on).
- Classify by the cause or means, not by the result. Even for the same outcome, a server stopping or data being destroyed, a flood makes it physical, a network attack makes it technical, and an operating mistake makes it human.
用語