問72
頻出度★★★
情報セキュリティにおける機密性，完全性及び可用性と，①～③のインシデントによって損なわれたものとの組合せとして，適切なものはどれか。 ① DDoS攻撃によって，Webサイトがダウンした。 ② キーボードの打ち間違いによって，不正確なデータが入力された。 ③ PCがマルウェアに感染したことによって，個人情報が漏えいした。
令和4年度 ITパスポート試験 問72
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 72
- ア
正解 When you map the three elements of information security onto each incident, the answer is uniquely determined. ① The DDoS attack brought the website down and users could no longer use the service, so what was compromised is Availability. ② A keyboard typing error caused incorrect data to be entered, breaking the correctness and accuracy of the information, so what was compromised is Integrity. ③ A malware infection leaked personal information to the outside, letting a third party learn information that should have stayed secret, so what was compromised is Confidentiality. Therefore the combination is ① Availability, ② Integrity, ③ Confidentiality, and the correct answer is ア.
Incorrectイ
① Availability is correct, but treating ② as Confidentiality and ③ as Integrity is wrong. ② is information made inaccurate by an input mistake, so it should be Integrity; ③ is a leak of personal information, so it should be Confidentiality — ② and ③ are swapped.
Incorrectウ
Treating ① as Integrity is wrong. A site going down because of a DDoS attack is an event where the service becomes unusable, so what was compromised is Availability, not Integrity. ③ Confidentiality is correct, but the mapping of ① and ② is broken.
Incorrectエ
Treating ① as Integrity and ③ as Availability is wrong. ① is a site going down = Availability, and ③ is a leak of personal information = Confidentiality; all three differ from the correct mapping.
ここがポイント
- The three elements of information security: Confidentiality (only authorized persons can access the information), Integrity (the information is accurate, with no tampering or loss), and Availability (information or services can be used whenever needed).
- Identify what was lost in the incident: link service outage = Availability, data becoming inaccurate or tampered = Integrity, and information leak or unauthorized access = Confidentiality.
用語