問64
頻出度★★★
情報セキュリティに関して発生したインシデントのうち, 可用性が損なわれる直接の原因となったものはどれか。
平成23年度 特別試験 ITパスポート試験 問64
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 64
Incorrectア
This is a case where a PC was infected with a virus and information in the PC leaked out without anyone noticing. What happens here is that content which should be known only to those allowed to access that information ended up in the hands of an outside third party, so what was violated is confidentiality (Confidentiality). Even though the information leaked, the PC and the server keep running, and users did not become unable to use that information or the equipment, so it cannot be called the direct cause of availability being compromised. A virus infection can in some cases also lead to a violation of availability (a system stoppage, files being encrypted, and so on), but the result written in this choice is ultimately a leak of information, and read literally it is classified as a violation of confidentiality.
- イ
正解 The correct answer is イ. Information security is defined as maintaining the three elements of confidentiality (Confidentiality), integrity (Integrity), and availability (Availability), which are called CIA after their initials. Among these, availability is the property that authorized users can access and use information, information systems, and services without interruption whenever they need them. Therefore, an incident in which availability is compromised is neither a case where information leaked nor a case where information was rewritten; it means a case where a system or data became unusable. In イ, the air conditioning equipment broke down, the temperature rose, and as a result the server stopped. Once the server stops, the business systems and services running on it become unusable from the users' point of view, and exactly the property of being usable when needed is lost. What deserves attention here is that the cause is not a human attack such as unauthorized access or a virus, but a failure on the equipment and environment side, namely an air conditioner failure. The factors that threaten availability include equipment failure, power failure, disasters, failures of facilities such as air conditioning and power supply, operational mistakes, and DoS attacks, so they are not necessarily only malicious attacks. What the question asks is the direct cause of availability being compromised, and イ, in which the causal chain from the temperature rise due to the air conditioner failure to the server stopping is connected in a single line, best fits this condition. In addition, measures to secure availability include making equipment redundant or using a cluster configuration, installing an uninterruptible power supply (UPS) and in-house power generation equipment, duplicating data center facilities including air conditioning and power supply, and preparing backups and a backup site. From the above, the incident that was the direct cause of availability being compromised is イ.
Incorrectウ
This is a case where a server was illegally intruded into and personal information was stolen. It is malicious in that an attack, an illegal intrusion, was carried out, but the damage described is that personal information was obtained by a third party, which is a state where information that must not be known became known, that is, a violation of confidentiality (Confidentiality). The server itself did not stop, and it is not written that legitimate users became unable to use the service, so this does not amount to a loss of availability. As with ア, judge by the division that a case where information leaked outside is confidentiality and a case where something became unusable is availability.
Incorrectエ
This is a case where the amount of transaction data in a file was updated by mistake. The data itself exists and the system is also in a usable state, but the stored amount has become a value that differs from the facts, and the property that information is accurate and complete has been lost. This corresponds to a violation of integrity (Integrity). What is important is that integrity is compromised not only by malicious acts such as falsification, but also by input mistakes and operational mistakes like the one in this choice. Users can open the file and continue their work, so availability is maintained, and this is not the direct cause of availability being compromised.
ここがポイント
- The three elements of information security (CIA) — confidentiality is the property that only authorized people can access information (examples of violation: information leakage, theft, eavesdropping); integrity is the property that information is accurate and complete with no falsification or omission (examples: falsification, erroneous updates caused by input mistakes); availability is the property that information and systems can be used when needed (examples: system stoppage, equipment failure, DoS attacks). In incident questions, the standard approach is to sort a case into one of the three elements by asking whether it leaked, went wrong, or became unusable.
- Factors that threaten availability and countermeasures — a loss of availability is caused not only by attacks such as unauthorized access, but also by unintentional events such as facility failures of air conditioning or power supply, equipment failure, disasters, and operational mistakes. Countermeasures include making equipment and systems redundant or using a cluster configuration, securing power with a UPS or in-house power generation, duplicating facilities such as air conditioning, and securing backups and a backup site.
用語