問56
頻出度★★★
情報セキュリティに関する用語である可用性, 完全性, 機密性及び脆弱性のうち, ISMSが組織の情報資産に対して維持管理すべき特性としているものだけを全て挙げたものはどれか。
平成27年度 春期 ITパスポート試験 問56
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 56
Incorrectア
Availability, integrity leaves out confidentiality. The question asks for exactly and only the characteristics that must be maintained, so missing even one of the three elements makes the option wrong. Confidentiality is the property of not showing information to unauthorized people, and it is a core characteristic of an ISMS.
- イ
正解 ISMS (Information Security Management System, JIS Q 27001) defines information security as maintaining the confidentiality, integrity, and availability of information. Taking their initials, these three are called the three elements of information security (CIA), and they are the characteristics an organization must maintain for its information assets. Confidentiality means only authorized people can access the information; integrity means the information is accurate and complete, with no tampering or loss; availability means the information and information systems can be used when they are needed. Of the four terms in the question, the option that lists exactly these three and nothing else is Availability, integrity, confidentiality, so イ is correct. Note that vulnerability is a weakness the information asset itself has; it is not something to maintain, but something to reduce through countermeasures.
Incorrectウ
Integrity, confidentiality leaves out availability. Availability is the property of keeping information assets usable by authorized users whenever they are needed, and it is secured through measures such as redundant equipment, backups, and disaster countermeasures. If protecting information makes it unusable, the requirements of an ISMS are not met.
Incorrectエ
Integrity, confidentiality, vulnerability is wrong twice over: it omits availability, and it includes vulnerability, which is not a characteristic to be maintained. A vulnerability is a weakness that creates risk; it should be reduced or eliminated through vulnerability assessments and applying security patches, not maintained.
ここがポイント
- The three elements of information security (CIA): confidentiality (only authorized people can access), integrity (accurate, with no tampering or loss), and availability (usable when needed). These three are exactly the characteristics an ISMS must maintain.
- Vulnerability, threat, and risk are not characteristics to protect; they are things to assess and reduce in risk management. Remember them through the relationship that a risk materializes when a threat exploits a vulnerability.
用語