問97
頻出度★★★
情報セキュリティの三大要素である機密性, 完全性及び可用性に関する記述のうち, 最も適切なものはどれか。
令和元年度 秋期 ITパスポート試験 問97
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 97
Incorrectア
Preventing information leaks (information reaching unauthorized persons) is the role of confidentiality, not availability. Availability is the property that guarantees information can be used at any time, and it has no connection with reducing the risk of leaks. The element is matched incorrectly.
Incorrectイ
Duplicating systems and equipment to maintain an environment in which users can use them at any time is a method for ensuring availability. Integrity is the property of keeping information accurate and complete, with no tampering or loss, which differs from the purpose of duplication. The element has been mixed up.
- ウ
正解 Among the three main elements of information security, confidentiality is the property of restricting access so that “only authorized persons can access the information”, and availability is the property that “authorized persons can use the information whenever they need it”. The more strictly access is restricted, the higher confidentiality becomes, but the availability of being usable at any time tends to suffer accordingly; conversely, if anyone is allowed to use it freely, availability rises but confidentiality falls. Because the two thus have mutually conflicting aspects, actual operation requires not leaning toward either one but ensuring both in a well-balanced manner according to the importance of the target information. Choice ウ correctly describes this relationship and is the most appropriate.
Incorrectエ
Backups to prevent data loss and input checks to prevent erroneous input are methods for ensuring integrity—keeping information accurate and complete—(partly availability as well). Confidentiality is the property of restricting access to prevent leaks, so the measures listed here are not examples of confidentiality.
ここがポイント
- The three main elements of information security (CIA): confidentiality = only authorized persons can access; integrity = information is accurate and complete, with no tampering or loss; availability = it can be used whenever needed.
- Confidentiality (narrowing access) and availability (opening up access) have conflicting aspects, so in operation both must be ensured in a well-balanced manner according to the importance of the target.
用語