A bug (バグ) is a defect in a program caused by an oversight in design or a mistake in the code.
It shows up as results that differ from what was intended, or as a program that halts on a particular operation. Once found, a bug is repaired with a fix (a patch) released by the developer.
AnalogyIt is like a recipe that says salt where it means sugar. Follow the steps exactly and the dish still comes out wrong.
How to rememberIn English a bug is an insect, a name that blames machine trouble on a creature in the works. The bug-hunting repair work is called debugging.
Exam points
Mix-upA bug (バグ) broadly means any error that keeps a program from working as intended, and it is one of the main causes of security holes (セキュリティホール). Not every bug, however, becomes an entry point for attacks.
A security hole (セキュリティホール) is a weakness in software or a system, caused by a bug or a design flaw, that attackers can exploit.
Bug or design flaw
Security hole
Left open, it lets attackers in
Closed with a security patch
Applying the developer's fix closes the hole and keeps the software up to date.
4 / 4
A weakness that attackers can take advantage of is called a vulnerability (脆弱性), and a security hole is the typical example. The fix a developer releases to close the hole is a security patch (セキュリティパッチ), and applying it early to keep software current is the basic countermeasure. An attack that strikes the hole before any fix is released is a zero-day attack (ゼロデイ攻撃), and patching alone cannot fully stop it.
AnalogyIt is like a small crack in the wall around a house. The family may never notice it, but a burglar will find it and slip in. Sealing it early is the basic defense.
How to rememberA hole is a gap, and a patch is the cloth sewn over a hole in clothing. Remember them as a pair: every hole gets a patch.
Exam points
ExamSecurity hole (セキュリティホール) is the name for a flaw in a system or network that serves as a way in for unauthorized access (不正アクセス) and similar attacks.
ExamA buffer overflow (バッファオーバーフロー) attack feeds in data longer than the memory area set aside for it in order to exploit a flaw in the program. The most effective countermeasure is applying the security patch (セキュリティパッチ) that closes that flaw.
Mix-upA security hole (セキュリティホール) is a weakness on the side being attacked (a vulnerability, 脆弱性). It is a different thing from the causes of harm, such as viruses or unauthorized access (threats, 脅威).
A disaster (災害) is a threat in which natural events or accidents, such as earthquakes, fires, and floods, damage equipment or data. It is the typical physical threat (物理的脅威).
What to protect
Example safeguard
Data
Keep copies at a distant site
Buildings and equipment
Use earthquake- and fire-resistant construction
Power
Provide an uninterruptible power supply or an on-site generator
Operations
Write recovery steps for a disaster into the business continuity plan
A physical threat is one in which equipment or data is harmed by a physical cause, such as a natural event or direct damage to a machine. Because a disaster strikes a wide area at once, a copy of the data kept in the same building is lost along with the original.
AnalogyKeep important papers in a single warehouse and one fire can wipe them all out. Leaving copies in another town is what preparing for a disaster looks like.
How to rememberThe Japanese character 災 stacks the river shape 巛 on top of 火 (fire), so flood damage and fire damage sit inside a single character.
Exam points
ExamAccidents caused by natural events, such as equipment damaged by lightning or an earthquake, are physical threats (物理的脅威).
Destruction (破壊) is damage that breaks equipment, storage media, or data so they can no longer be used, and it can come from an accident or from deliberate human action.
It directly undermines the state of being usable when needed (availability, 可用性). Locks and entry/exit control guard against people damaging equipment, and backups guard against data loss.
Exam points
ExamWhether destruction (破壊) counts as a physical threat (物理的脅威) depends not on the fact that something broke but on whether the cause was physical.
An act of obstruction (妨害行為) is a deliberate human act that keeps an information system or business operation from running normally.
Besides physical means such as cutting the power or a line, it can also be carried out over the network, as in a DoS attack (DoS攻撃) that floods a service with traffic until it stops. Both kinds undermine availability, and entry/exit control and traffic monitoring are the safeguards.
AnalogyIt is like a crowd camping at a shop's entrance and blocking the way so real customers cannot get in. The building is untouched, yet business stops.
Exam points
ExamA DoS attack (DoS攻撃) does not steal or alter information. It is an act of obstruction (妨害行為) aimed at keeping a service from being provided.
Mix-upDestruction (破壊) is damage that leaves equipment or data unusable, whereas an act of obstruction (妨害行為) aims less at breaking things than at stopping normal operation.
Stops normal operation, even without breaking anything
How it happens
From accidents or from deliberate human action
Done deliberately by people
Example
Smashing a storage medium
Flooding a service with traffic until it stops
Key points
Against attacks that exploit software flaws, the basic defense is to apply security patches promptly and keep software up to date. A zero-day attack, which strikes a hole before a fix is out, gets ahead of that measure.
Whether an incident is a physical threat depends on whether its cause was physical, not on the damage it left.
Damage from physical threats often undermines availability, the ability to use a system when it is needed.