問53
頻出度★★★
情報セキュリティにおける “完全性” が損なわれる行為はどれか。
平成22年度 秋期 ITパスポート試験 問53
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 53
Incorrectア
A DoS attack (denial-of-service attack) overloads a server or network with a flood of requests and leaves legitimate users unable to use the service. The content of the information itself is not rewritten, so what is impaired is “availability,” not integrity.
- イ
正解 Among the three elements of information security, “integrity” means that information has not been destroyed, tampered with, or erased and is kept accurate and complete. Choice イ, “Tampering with a web page,” is an act in which the content of published information is rewritten in a way the legitimate administrator did not intend, so the accuracy and completeness of the information are directly lost. Therefore, the act that impairs integrity is イ.
Incorrectウ
Sequentially accessing each port of a server is a port scan, which is preliminary reconnaissance (information gathering) carried out before an intrusion to find out which services are running. At this stage the content of the information is not rewritten, so it cannot be called an act that impairs integrity.
Incorrectエ
Eavesdropping on data flowing over the network (sniffing) is an act in which a third party secretly views the content of communications. The data is only read and not rewritten, so what is impaired is “confidentiality,” not integrity.
ここがポイント
- The three elements of information security (CIA): confidentiality = only authorized people can access it; integrity = information is not tampered with or destroyed and stays accurate and complete; availability = it can be used whenever it is needed.
- A standard way to map acts onto the three elements: eavesdropping and leakage → confidentiality; tampering and data destruction → integrity; DoS attacks and system failures → availability. A port scan is preliminary reconnaissance before an intrusion.
用語