Which of the following combinations would MOST negatively affect availability?

Availability, a core principle of information security, ensures that systems and data are accessible to authorized users when needed. This question asks for the combination of factors that most negatively impacts this principle. Denial of Service (DoS) attacks are malicious acts specifically designed to overwhelm a system's resources, rendering it unable to serve legitimate users, thus directly attacking availability. Outdated hardware poses a significant risk to availability due to a higher probability of failure (e.g., disk crashes, power supply burnout) and an inability to handle modern processing or traffic loads. The combination of an active, targeted attack (DoS) with an inherent systemic weakness (outdated hardware) creates a synergistic effect that is exceptionally detrimental to availability. The hardware is less likely to withstand the stress of the attack, leading to prolonged and frequent outages.

1. (ISC)² CISSP Official Study Guide

9th Edition.

Page 6: Defines the core security principles. "Availability ensures that systems and data are available to authorized users when they need them. Denial of service (DoS) attacks are a common attack against availability."

Page 780: Discusses hardware failures as a primary cause of system downtime. "The most common cause of system failure is the failure of a hardware component... Older systems are more likely to suffer hardware failures than newer systems." This directly links outdated hardware to reduced availability.

2. NIST Special Publication 800-53

Revision 5: Security and Privacy Controls for Information Systems and Organizations.

Appendix B

Page B-2: Defines Availability as "Ensuring timely and reliable access to and use of information."

Appendix J

Page J-1: In the context of threat events

it lists "Disruption" (e.g.

through Denial of Service) and "Failures or Malfunctions" (e.g.

system component failure) as distinct events that can lead to a loss of availability. Option A combines both of these threat categories.

3. NIST Special Publication 800-34

Revision 1: Contingency Planning Guide for Federal Information Systems.

Page 9

Section 2.2: Lists various threats to IT systems. It categorizes Denial of Service as a "Man-Made" threat and "Hardware failure" under "System Failures

" both of which directly impact system availability and require contingency planning. Unauthorized data alteration (transactions/changes) is listed separately as an integrity issue.