問75
頻出度★★★
情報セキュリティに関して, 可用性が損なわれた事故の例に該当するものはどれか。
平成25年度 春期 ITパスポート試験 問75
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 75
- ア
正解 The correct answer is ア, “The system stopped due to a power outage.” Information security is defined as protecting three elements: confidentiality, integrity, and availability. Among them, availability is the property of keeping information and information systems reliably accessible and usable whenever authorized users need them. An incident in which availability is compromised is therefore neither an incident where information leaked nor one where the content became wrong; it is an incident where something could not be used at the moment it was wanted. A power outage is exactly such a case. Once power is lost, servers and communication equipment stop working and business systems come to a halt, and during that time users cannot receive service even if they hold proper authorization. The data itself has neither been seen by a third party nor been rewritten, but on the single point that it cannot be used when needed, availability has been lost. As concrete measures for protecting availability, one can list securing power with an uninterruptible power supply (UPS) or in-house generating equipment, duplexing (redundancy) of equipment and cluster configurations, well-prepared backup and recovery procedures, and preparing a backup site for disasters. The fact that all of these aim at not stopping and at recovering quickly also confirms that a system stoppage caused by a power outage is an availability problem.
Incorrectイ
An incident in which a file read permission was set incorrectly so that the file became accessible even to users without authorization is an example of compromised confidentiality. Confidentiality is the property of keeping information accessible only to authorized people, and a mistake in the access-right settings means that this control was broken. At that moment the system is operating normally and users can still use the file whenever they need it, so availability has not been lost. Rather, this is damage specific to confidentiality: the file became visible even to parties who should never have seen it. It is an incident to be prevented by confidentiality measures such as minimizing access rights and reviewing the configured settings, and it is not an example of availability.
Incorrectウ
An incident in which transaction data with customers was leaked through unauthorized access is also an example of compromised confidentiality. The moment an unauthorized third party obtains the information, the property that only a limited set of people can access it has already been broken. A leak means only that information went outside; it does not mean that the system stopped, nor that legitimate users could no longer use the data, so it does not amount to damage to availability. It is an incident that calls for measures protecting confidentiality, such as encryption, access control, and stronger authentication, and it is worth noting as well that it falls into the same category as choice イ.
Incorrectエ
An incident in which data was updated incorrectly because of a program bug is an example of compromised integrity. Integrity is the property of keeping information accurate and complete, free from unauthorized alteration and from errors. Data that has been rewritten to a wrong value can still be read, but its content cannot be trusted, so it has lost its value from the standpoint of accuracy. The system itself is running and users can access it, so availability is preserved; and no information leaked outside, so it is not a confidentiality problem either. Input checking, thorough testing, and management of update histories are the measures that protect integrity.
ここがポイント
- The core of this question is to memorize the definitions of the three elements of information security together with the type of incident each one produces. Confidentiality means that only authorized people can gain access; when it is broken, the result is a leak or unauthorized viewing. Integrity means that information is accurate and has not been altered; when it is broken, the result is wrong or falsified data. Availability means that the information can be used when it is needed; when it is broken, the result is a stoppage, a delay, or an inability to use it. When you read the choices, sort them by asking whether something leaked, went wrong, or stopped, and you will not hesitate.
- Causes that threaten availability include power outages, natural disasters, equipment failures, and denial-of-service (DoS) attacks, while the countermeasures are mechanisms for not stopping and for getting back quickly: securing power with a UPS or in-house generators, making the system redundant, backup and recovery procedures, and securing a backup site. It is also good to understand together with this that the availability rate is used as the metric for availability.
用語