Information Security

The 3 elements of information security are confidentiality, integrity, and availability, known as the CIA triad. Authenticity, accountability, reliability, and non-repudiation are elements considered in addition to the 3, and are not part of the triad itself.

Integrity is the property that information is kept accurate and complete, free from tampering, erasure, and destruction. Access limited to authorized persons is confidentiality, usability when needed is availability, and genuineness is authenticity; none of them is integrity.

Availability is the property of being able to use the system when needed, and it is raised through fault-tolerant design such as duplication, redundancy, and backups. Encryption serves confidentiality, tamper detection via hash values serves integrity, and digital signatures serve authenticity and non-repudiation; they do not directly raise availability.

Non-repudiation is the property that the person who performed an act such as sending or approving cannot later deny having done it, and it is achieved with digital signatures and the like. Consistent behavior is reliability, tracing access is accountability, and use limited to authorized persons describes confidentiality.

Taking out insurance shifts the burden of losses, should the risk materialize, to a third party — the insurance company — so it corresponds to risk transfer. Avoidance means stopping the activity that causes the risk, reduction means lowering the likelihood or impact through countermeasures, and retention (acceptance) means accepting the risk without countermeasures.

Ransomware is malware that renders systems unusable, for example by encrypting data, and demands a ransom in exchange for recovery; healthcare institutions have reported incidents where electronic medical records were shut down. Stealing keystrokes is a keylogger, planting a back door is a backdoor, and abusing macros is a macro virus.

A targeted attack aims at a specific organization or individual, using cleverly crafted email disguised as correspondence from business partners to get attachments opened and infect the target with malware for intrusion. Bulk sending to unspecified recipients is spam, simultaneous attack from many compromised machines describes DDoS, and indiscriminate infection contradicts the targeted nature of aiming at specific victims.

Phishing is a trick that uses email posing as real financial institutions or services to lure victims to fake sites, getting them to enter and thereby steal IDs, passwords, and card numbers. Overload through massive traffic is a DoS attack, eavesdropping on packets is sniffing, and privilege seizure via vulnerabilities describes unauthorized intrusion.

A DDoS (distributed denial-of-service) attack differs from DoS in using many bot-infected machines as stepping stones and sending massive traffic simultaneously from distributed sources, which makes it hard to block. Encryption with ransom demands describes ransomware, luring to fake sites describes phishing, and intrusion from 1 machine is not a DDoS characteristic.

The 3-2-1 rule means keeping 3 copies of the data (the original plus 2), storing them on 2 different types of media, and keeping 1 of them off-site, for example at a remote location. Retaining a copy disconnected from the network guards against ransomware encrypting even the backups. The other options talk about backup intervals or power configurations and are not this rule.

Symmetric encryption uses the same key for encryption and decryption, so the key must be shared securely with the communication partner (the key distribution problem). Using a public/private key pair is public key encryption, and public key certificates belong to PKI. Symmetric encryption is actually the faster of the two, so the slowness claim is reversed.

RSA is a representative public key encryption algorithm based on the difficulty of factoring large numbers, and is used both for encryption and for digital signatures. AES, DES, and 3DES are all symmetric encryption algorithms that use the same key for encryption and decryption.

When the goal is confidentiality, the document is encrypted with the recipient's (B's) public key so that only the recipient can decrypt it. Only B, holding the matching private key, can decrypt. Processing with A's private key is the case of a digital signature, and B's private key is a key no one but B may hold, so it cannot be used for encryption.

The ciphertext was encrypted with recipient B's public key, so decryption uses the matching key — B's private key. Since only B holds the private key, no one else can decrypt. The sender's public key is used to verify digital signatures, and something encrypted with B's public key cannot be decrypted with B's public key.

A digital signature is created by processing the document's hash value with the sender's private key, and the recipient verifies it with the sender's public key. Because only the person holds the private key, successful verification confirms that they created it. The recipient's public key is the key used for encryption to ensure confidentiality — note that the direction is the reverse of signing.

A digital signature achieves detection of tampering through hash comparison (integrity) and confirmation of the creator — since only the sender's private key could produce it (authenticity and non-repudiation). It does not encrypt the document itself, so prevention of eavesdropping (confidentiality) is not guaranteed, and it has nothing to do with availability or communication speed.

A hash function is a one-way function that generates a fixed-length message digest (hash value) from data of any length, and recovering the original data from the hash is practically impossible. The same input always yields the same hash value (which is exactly why it works for tamper detection), and the hash length is fixed per algorithm, not proportional to the data length.

The hybrid scheme combines the strengths of both methods: the bulk of the data is encrypted with fast symmetric encryption, and public key encryption is used only to share the symmetric key, which suffers from the key distribution problem. The reverse combination would process the bulk data with slow public key encryption, which is unreasonable. Double symmetric encryption and reusing key pairs do not describe the hybrid scheme.

The certificate authority (CA) verifies the applicant's identity, issues the public key certificate (digital certificate) that vouches for the binding between a public key and its owner, and manages revocation. This prevents public key impersonation. Encrypting data is done by the users, central password management by an authentication server, and intrusion detection and blocking by IDS/IPS.

HPKI is the public key infrastructure for the health, medical, and welfare fields; it can certify national qualifications such as physician and pharmacist and facility administrator roles with digital certificates, and is used for digital signatures. The government PKI is GPKI, SSL server certificates are a separate mechanism for authenticating Web servers, and wireless encryption schemes are WPA2 and the like — none describes HPKI.

HTTPS is the protocol that protects HTTP Web communication by encrypting it with SSL/TLS, verifying the communication partner with a server certificate and encrypting the content. SMTP is for sending mail, DHCP for automatic IP address assignment, and FTP for file transfer; none of them aims to protect Web communication.

Multi-factor authentication combines 2 or more different factors from knowledge (passwords), possession (IC cards and the like), and biometrics (fingerprints and the like); combining an IC card (possession) with a password (knowledge) qualifies. Using 2 passwords or 2 secret questions repeats the same knowledge factor and is not multi-factor.

Biometric authentication uses physical characteristics such as fingerprints, veins, and irises, so there is no risk of forgetting or losing them; on the other hand, the errors of falsely rejecting the genuine person and falsely accepting someone else can never be eliminated completely. Physical characteristics cannot be reissued like passwords and cannot be lent to others, so the other options are wrong.

One-time password authentication uses disposable passwords valid only once, so even if the communication is eavesdropped, the same value cannot be used to log in again. Challenge/response authentication has a similar effect. Sending fixed passwords in plain text or authenticating by ID alone is weak against eavesdropping and guessing, and a plain-text password on a card can be abused directly if leaked.

Single sign-on is a mechanism by which one authentication grants use of multiple linked systems without further authentication, improving convenience and reducing the burden of password management. On the other hand, if the credentials are compromised the impact spreads widely, so protecting the authentication platform is critical. Limiting simultaneous logins, periodic password changes, and terminal sharing are not SSO.

The basics of access control are the principle of least privilege — granting rights only within the scope needed for one's duties — and keeping access records as audit logs. Logs are indispensable for deterring misconduct and tracing it afterward. Granting everyone administrator privileges or leaving retirees' accounts active breeds unauthorized access, and operating without audit logs destroys accountability.

A publicly exposed server is placed in the DMZ, a buffer zone separated from both the outside and the inside by firewalls, so that even if the public server is attacked and compromised, the intruder cannot reach the internal network directly. Placing it on the internal network or the terminal segment spreads damage inward when compromised, and a direct connection without a firewall is defenseless.

An IDS detects traffic that signals intrusion attempts and notifies the administrator, while an IPS goes further and automatically takes defensive action such as blocking the offending traffic. The option reversing the roles is wrong, and the distinction is not wired versus wireless. Virus removal is the job of antivirus software and encryption of cryptographic technology; neither is an IDS/IPS function.

A VPN is a technology that creates a virtual leased line over a public network with encryption and authentication; variants include IPsec-VPN and SSL-VPN, and it is used to protect site-to-site links and remote access. DNS maps domain names to IP addresses, NTP synchronizes time, and DHCP assigns IP addresses automatically; none protects the communication channel.

The direct countermeasure against attacks on security holes is to promptly apply the fix programs (security patches) distributed by the vendor, eliminating the vulnerability itself. Many attacks exploit known vulnerabilities left unpatched. Backups are for recovery after damage, stronger passwords concern authentication, and privacy filters are a physical measure; none removes the vulnerability.