問80
頻出度★★★
情報セキュリティにおける“可用性”の説明として, 適切なものはどれか。
平成23年度 秋期 ITパスポート試験 問80
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 80
Incorrectア
“The system's operation and output results are as intended” describes reliability, not availability. Reliability is the property of consistently obtaining the intended behavior and results; in JIS Q 27000 it is one of the additional properties (authenticity, accountability, non-repudiation, and reliability) that supplement confidentiality, integrity, and availability. Its viewpoint differs from that of availability, which asks whether something can actually be used at the time you want to use it.
Incorrectイ
“Information is accurate and has not been tampered with or destroyed” describes integrity. Integrity is the property of maintaining the accuracy and completeness of information, and it is ensured by means such as detecting tampering with digital signatures or hash values and controlling updates through access rights. It concerns whether information is correct, which is a different element from availability, which concerns whether information can be used when it is needed.
- ウ
正解 The correct answer is ウ. Among the three key elements of information security (CIA), availability is the property of keeping information and information systems usable without interruption whenever authorized users need them. JIS Q 27000 defines it as “the property of being accessible and usable on demand by an authorized entity.” Choice ウ, “Authorized users can access information when they need it,” is a plain-language restatement of that definition, so it is an appropriate explanation of availability. In practice, typical measures that raise availability include server duplication (redundant configuration), installing a UPS (uninterruptible power supply), regular backups, load balancing, and countermeasures against DoS attacks.
Incorrectエ
“Keeping information undisclosed to unauthorized processes” describes confidentiality. Confidentiality is the property of not letting unauthorized individuals, entities, or processes use information and of not disclosing it to them, and it is ensured by access control and encryption. Its aim is to keep information from being seen, which is the opposite direction from availability, which guarantees that authorized users can use it.
ここがポイント
- The three key elements of information security (CIA): confidentiality = not letting unauthorized parties see the information; integrity = the information is accurate and has not been tampered with; availability = authorized users can use it when they need it. Train yourself to identify each one directly from its definition sentence.
- In addition to CIA, JIS Q 27000 defines further properties: authenticity, accountability, non-repudiation, and reliability. Reliability in particular, meaning consistency between intended behavior and results, is easily confused with availability and integrity, so learn to keep them distinct.
用語