This question's explanation and your answers so far.
IoT デバイス群とそれらを管理する IoT サーバで構成される IoT システムがある。このシステムの情報セキュリティにおける①～③のインシデントと, それによって損なわれる, 機密性, 完全性及び可用性との組合せとして, 適切なものはどれか。 〔インシデント〕 ① IoT デバイスが, 電池切れによって動作しなくなった。 ② IoT デバイスと IoT サーバ間の通信を暗号化していなかったので, 情報が漏えいした。 ③ システムの不具合によって, 誤ったデータが記録された。
| ① | ② | ③ | |
|---|---|---|---|
| ア | 可用性 | 完全性 | 機密性 |
| ① | ② | ③ | |
|---|---|---|---|
| イ | 可用性 | 機密性 | 完全性 |
| ① | ② | ③ | |
|---|---|---|---|
| ウ | 完全性 | 可用性 | 機密性 |
| ① | ② | ③ | |
|---|---|---|---|
| エ | 機密性 | 可用性 | 完全性 |
Treating ① as availability is correct, but this treats ② as integrity. ② is an information leak caused by the lack of encryption, so it is not a matter of accuracy but a violation of confidentiality, in which information became known to unauthorized persons. In addition, this treats ③ as confidentiality, but ③ is incorrect data being recorded because of a malfunction = the accuracy of the data is lost, so it is a violation of integrity. ② and ③ are wrong.
正解 Apply the three main elements of information security (confidentiality, integrity, and availability) to each incident. ① The device stops working because its battery ran out = the system cannot be used when you want to use it, so availability is impaired. ② The communication was not encrypted and information leaked = the information became known to unauthorized persons, so confidentiality is impaired. ③ Erroneous data was recorded due to a malfunction = the accuracy and correctness of the data cannot be maintained, so integrity is impaired. Therefore, choice “イ”, which has the combination of ① availability, ② confidentiality, and ③ integrity, is correct.
This treats ① as integrity and ② as availability, which are reversed and inconsistent. ① is a stoppage = an unusable state, so it is availability; ② is an information leak, so it is confidentiality; neither assignment fits.
This treats ① as confidentiality and ② as availability. ① is not a case of information becoming known but a stoppage = a violation of availability; ② is a leak, so it is a violation of confidentiality; both ① and ② are mixed up.