問53
頻出度★★★
DoS 攻撃によってサーバが受ける直接的な被害はどれか。
平成26年度 春期 ITパスポート試験 問53
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 53
Incorrectア
Encrypted data being decrypted is damage caused by cryptanalysis (such as a brute-force attack) or by theft of the key; it is an example of confidentiality being threatened. A DoS attack only makes the server unusable with a flood of accesses; it has no power to break encryption.
Incorrectイ
The administrator password being changed is damage that occurs when administrator privileges are seized through unauthorized access. A DoS attack is not an attack that breaks into a server and rewrites its settings, so it does not fit as direct damage.
Incorrectウ
Infection by a computer virus occurs when malware is delivered and executed. A DoS attack is an attack that sends a huge number of requests; infecting the target with a virus is neither its purpose nor its result (many terminals infected with bots may be used as stepping stones for a DDoS attack, but that is not direct damage suffered by the server under attack).
- エ
正解 A DoS attack (Denial of Service attack) floods a server with more accesses than it can handle, or with large numbers of invalid packets, exhausting resources such as the communication line, CPU, and memory. As a result, the server becomes extremely slow to respond or stops altogether, and legitimate users who should be able to use it can no longer receive the service. In other words, what a DoS attack directly aims at is not stealing information but destroying “availability”, and the direct damage is that “The provision of service is disrupted.” Therefore the correct answer is エ.
ここがポイント
- DoS attack / DDoS attack = an attack that exhausts a server's resources with a flood of accesses or invalid packets so that it can no longer provide its service. The aim is not to steal information but to destroy availability.
- Organize attacks by which of the three elements of information security (confidentiality, integrity, availability) is damaged: eavesdropping and cryptanalysis = confidentiality; tampering and rewriting a password = integrity; DoS = availability.
用語