問83
頻出度★★★
a～c は情報セキュリティ事故の説明である。a～c に直接関連する情報セキュリティの三大要素の組合せとして，適切なものはどれか。 a 営業情報の検索システムが停止し，目的とする情報にアクセスすることができなかった。 b 重要な顧客情報が，競合他社へ漏れた。 c 新製品の設計情報が，改ざんされていた。
平成24年度 秋期 ITパスポート試験 問83
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 83
Incorrectア
Although a-Availability is correct, b and c are swapped. In b, “important customer information leaked to a competing company” is not an incident in which the content of the information was rewritten, so it is a problem of confidentiality, not integrity; in c, “the design information for a new product was tampered with” is not an incident in which information leaked outside, so it is a problem of integrity, not confidentiality.
- イ
正解 The three core elements of information security are Confidentiality, Integrity, and Availability, and from their initials they are also called CIA. Match each incident description to one element in turn. In a, the sales information retrieval system went down and the target information could not be accessed — that is, “it could not be used when it was needed” — so availability, the property that authorized users can use information assets whenever they need them, was damaged. In b, important customer information leaked to a competing company — that is, “it was seen by a party that must not see it” — so confidentiality, the property that only authorized people can access the information, was damaged. In c, the design information for a new product was tampered with — that is, “the content of the information was no longer correct” — so integrity, the property that information is accurate, complete, and not rewritten, was damaged. The combination is therefore a-Availability, b-Confidentiality, c-Integrity, and the row in the table in the figure that matches this order is イ.
Incorrectウ
Both a-Integrity and b-Availability are wrong. In a, the incident is that the system went down and the information could not be used, so it falls under availability, not integrity, which asks whether the information was rewritten. In b, the incident is a leak of information, so it falls under confidentiality, not availability, which asks whether the information can be used.
Incorrectエ
Only b-Confidentiality is correct; a and c are swapped. In a, being unable to access the information because the system went down is a problem of availability, not integrity, and in c, tampering is a problem of integrity, not availability. This choice mixes up the correspondence of “outage = availability” and “tampering = integrity.”
ここがポイント
- The three core elements of information security (CIA): confidentiality = only authorized people can access it; integrity = the information is accurate, complete, and has not been tampered with; availability = authorized people can use it whenever they need it.
- A tip for telling the elements apart from the symptoms of an incident: map “leakage or snooping” to confidentiality, “tampering, destruction, or introduction of errors” to integrity, and “outage, delay, or inability to access” to availability.
用語