What is incapacitation in the context of information security?

• A. An attack on data confidentiality
• B. A form of denying access to legitimate users
• C. An attack on system availability
• D. A method of creating a backup of data

Answer: (C)

Incapacitation in information security refers to measures or scenarios that disrupt the availability of a system or data. This concept is particularly relevant in discussions of threats and attacks aimed at rendering a system unusable to authorized users. When a system is incapacitated, legitimate users cannot access the resources they need, which compromises the overall functionality of that system.

The correct choice highlights this critical aspect of information security, where availability is one of the core principles alongside confidentiality and integrity. When a system is seized or compromised, it loses its utility, which can have significant repercussions for organizations that rely on that system for operations.

The other options do address relevant concepts in information security but do not align with the definition of incapacitation. Denying access to legitimate users generally pertains to unauthorized access or denial of service situations, making it more aligned with different forms of attacks rather than the broad concept of incapacitation. Creating a backup of data is an essential practice for safeguarding against data loss, which does not fall under the incapacitation context, and an attack on data confidentiality focuses on maintaining the secrecy of data, which also diverges from the issue of system availability.