Confidentiality (機密性) is the property that only people permitted to view information can see its content, and it does not leak to anyone else.
Information security rests on three elements, confidentiality, integrity and availability, known as CIA from their initials. Typical ways confidentiality is lost are leaks to outsiders and eavesdropping on communications. It is protected by, for example, encryption, which turns content into an unreadable form, and access control, which sets what each user may view.
AnalogyIt is like a records room that opens only to those who tap their staff ID card. The documents inside are seen by no one except those allowed in.
How to rememberConfidential is the word stamped on documents meant for internal eyes only, and it signals a limited audience. It supplies the C in CIA.
Exam points
ExamEncryption (暗号化) and access control (アクセス制御) keep the content of information from people without permission, so they raise confidentiality (機密性).
ExamA leak (漏えい) of information means confidentiality has been lost. Whether the cause was an outside intrusion or a malware (マルウェア) infection, the element affected is the same.
ExamConfidentiality and availability (可用性) pull against each other: the tighter the limit on who can see information, the fewer people and situations can use it. In practice, the two are kept in balance.
Integrity (完全性) is the property that the content of information stays correct, free of errors, unauthorized changes and missing parts.
Tampering means someone without authority rewriting the content of information. Even without malice, integrity is lost whenever an input mistake or a program bug leaves data with wrong content. A digital signature is a mark attached to data with a key only the sender holds, and it confirms both who created the data and that the content has not been altered.
AnalogyIf someone quietly changes the quantities in a recipe book, the dish fails even when you follow the steps exactly. The correctness of what is written is itself what needs protecting.
How to rememberIntegrity shares its root with integer (a whole number) and carries the sense of being whole and undivided.
Exam points
ExamAny incident where data is altered, wrong or lost so that its content is no longer correct and complete counts as a loss of integrity (完全性), whether the cause was malice or an operating error.
ExamAdding a digital signature (デジタル署名) and checking input data for errors are both measures that raise integrity.
Mix-upEncryption (暗号化) makes content unreadable, so it belongs on the confidentiality (機密性) side. Its purpose differs from that of measures that prevent or detect alterations.
Availability (可用性) is the property that permitted people can use information and systems without trouble whenever they need them.
Typical causes of lost availability are power outages, equipment failures and DoS attacks, which flood a service with traffic until it stops. One way to raise it is to duplicate equipment or storage so that processing continues even if one unit stops.
AnalogyAvailability is like a station ticket gate that stays open all day: its value lies in letting you through whenever you want. If the gate is shut, holding a ticket does not get you any further.
How to rememberThe Japanese 可用 reads as "can be used". The English Availability likewise comes from available, meaning at hand and ready to use.
Exam points
ExamWhatever the cause, be it a power outage, equipment failure, outside attack or a human operating error, a system that stops and becomes unusable means availability (可用性) has been lost.
ExamDuplicating hardware and mirroring (ミラーリング), which writes the same data to two disks at once, let processing continue when one unit fails, so they raise availability.
ExamUnplanned downtime and the share of scheduled time during which the system was actually usable both serve as measures of availability.
Authenticity (真正性) is the property that users, information and communication partners can be confirmed to be genuinely who or what they claim to be.
Authentication, which confirms identity, prevents impersonation, where someone pretends to be another person. What gets checked is not limited to people; it also covers the devices on the other end and the origin of received data.
AnalogyIt is close to checking a courier's uniform and staff ID to make sure they really work for the delivery company before opening the door.
How to rememberThe Japanese 真正 combines "true" and "right". Authenticity comes from authentic (genuine) and belongs to the same word family as authentication.
Exam points
ExamUnder the ISMS approach, information security means maintaining CIA. It sometimes also extends to maintaining properties such as authenticity (真正性).
Mix-upIntegrity (完全性) is about whether the content of information is correct, while authenticity is about whether the information or the other party is genuine.
Accountability (責任追跡性) is the property that who performed which operation and when can be traced afterwards, so the person responsible can be identified.
It is supported by logs, which record operations and communications, and by IDs issued to each user individually. If several people share one ID, the logs cannot show whose operation it was even when they exist.
AnalogyLike a construction site's work log where each worker writes their name and the time. When something goes wrong, the log shows whose work it was.
How to rememberAccountability comes from account (an explanation or report): being in a position where you must answer for what you did.
Exam points
Mix-upA log (ログ) is a record for checking afterwards what operations took place; it does not stop information from leaking. Its role differs from that of encryption (暗号化), which keeps leaked content unreadable.
Non-repudiation (否認防止) is the property that a person who performed an operation or sent something cannot later deny it by claiming they did not.
Sender signs with a key only they hold
Receiver verifies the signature and accepts
Sender later claims not to have sent it
Signature proves the sender sent it
Because a signature only the sender could have made remains, the denial does not hold.
4 / 4
The standard means is a digital signature: a signature only the sender can create stays on the data, so it serves as proof that this person sent it. Because people other than the recipient can also verify the signature, the sending can be proved to third parties as well.
AnalogyLike a contract stamped with your registered personal seal. The impression stays on the page, so you cannot later insist you never made that promise.
How to rememberThe Japanese 否認 reads as "refuse (否) to acknowledge (認)".
Exam points
Mix-upAccountability (責任追跡性) means the actor can be traced through logs and similar records, while non-repudiation (否認防止) means leaving evidence that keeps the actor from denying the act.
Reliability (信頼性) is the property that a system works as intended and gives consistent results every time under the same conditions.
Reliability means processing results do not conflict and malfunctions caused by defects are rare. Reducing defects in advance through thorough testing is one way to raise it.
AnalogyLike an alarm clock that rings at the same time every morning. A clock that sometimes rings and sometimes does not cannot be relied on, even if it sits within reach.
How to rememberReliability comes from rely (to depend on).
Exam points
ExamThe ISMS definition of information security names reliability (信頼性), among others, as a property that may be included on top of CIA; it does not name maintainability (保守性).
Mix-upAvailability (可用性) is about whether the system can be used when needed, while reliability is about whether its behavior and results during operation match expectations.
The core of information security is CIA: confidentiality protects who may see information, integrity protects the correctness of its content, and availability protects its usability.
To classify an incident, look at what was harmed. A leak points to confidentiality; content made incorrect or incomplete by alteration, error or loss points to integrity; a stoppage that leaves things unusable points to availability.
Authenticity, accountability, non-repudiation and reliability are four properties sometimes included in information security on top of CIA.