Fundamentals of InfoSecadvanced
A controlled test exposes account hashes, changes a configuration file, and then shuts down the target. Identify the direct Confidentiality, Integrity, and Availability (CIA) impact of each event and explain why the events should be reported separately.
Answer
Exposing account hashes is a confidentiality impact because sensitive information is disclosed. Changing a configuration file without authorization is an integrity impact because data has been altered. Shutting down the target is an availability impact because authorized users cannot access the system. They should be reported separately because each describes a different security property and may require a different response, even though they occurred during the same test.
Explanation
### The concept
The CIA goals are related but distinguishable. Confidentiality protects information from unauthorized viewing or disclosure, so exposed account hashes are a confidentiality concern. Integrity protects data from unauthorized alteration, so an unapproved configuration change is an integrity concern. Availability is timely access to systems and resources, so shutting down the target is an availability concern. Reporting the impacts separately helps responders identify the affected asset and select appropriate actions. They might need to restrict access to exposed account data, restore a known-good configuration, and bring the service back online. A single test or incident can affect multiple goals; identifying one impact does not rule out the others. The lesson's examples belong only in an authorized, isolated lab, because carrying them out against a real system without consent can cause harm and legal consequences.
### What a good answer covers
- Exposed hashes are a confidentiality impact.
- An unauthorized configuration change is an integrity impact.
- System shutdown is an availability impact.
- Separate classifications clarify the distinct harms and response needs.
- Testing must remain within explicit authorization and the approved lab scope.
### Terms
- **CIA**: Confidentiality, Integrity, and Availability, the three information-security goals.
- **Account hash**: A transformed account value that may be used in password verification.
- **Configuration file**: A file containing settings that influence how a system or program operates.
- **Confidentiality**: Protection against unauthorized access or disclosure.
- **Integrity**: Protection against unauthorized changes to information.
- **Availability**: Access to a system or resource when authorized users need it.
- **Known-good configuration**: A verified configuration that is believed to be correct and safe to restore.
- **Authorization**: Permission to perform a defined activity.
### Remember
One incident can harm several CIA goals, so classify each distinct consequence.
Related Questions
- Explain why computer security is described as a process rather than a product. Include the roles of technology, people, and environment.(intermediate)
- Select ALL items the review identifies as possible security risks or losses.(intermediate)
- Arrange these broad security activities in a sensible cycle, beginning with identifying what needs protection.(intermediate)
- A security product can replace the continuing work of managing people, technology, and the operating environment.(intermediate)
- Which statement best captures the course review’s view of computer security?(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free