An attacker uses malicious software to disable network resources, demanding a ransom to restore access. Which category describes the purpose of the…

The attack described is a form of ransomware, where malicious software makes resources inaccessible. The primary purpose and impact of this action is the denial of availability. The attacker prevents legitimate users from accessing their own data or network resources until a condition (payment of a ransom) is met. This directly targets the "Availability" component of the Confidentiality, Integrity, and Availability (CIA) security triad, which ensures that systems and data are accessible when needed by authorized users.

A. Data modification: While ransomware modifies data by encrypting it, the ultimate goal from the victim's perspective is the loss of access, not the alteration of the data itself.

C. Data export: This attack's purpose is not described as stealing or exfiltrating data to an external location, but rather locking it in place.

D. Launch point: The compromised system is the final target of the attack, not a staging area used to launch subsequent attacks on other entities.

---

1. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2). Section 2.3.3

"Attack Vector Categories

" defines Denial of Service as an attack that "prevents or impairs the normal authorized use of networks

systems

or applications." Ransomware impairs normal use by making resources unavailable.

2. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278–1308. Section I.A.3

"Availability

" defines this principle as ensuring computer system assets are available to authorized parties when needed. The described attack directly violates this principle. (DOI: 10.1109/PROC.1975.9939)

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security

Fall 2014. Lecture 1: Introduction and Threat Models. The course materials define the "Availability" goal in security as "readiness for usage." An attack that disables resources is explicitly categorized as an attack on availability.