問45
頻出度★★★
情報システムの安定稼働を妨げる様々な脅威への事前対策に関する説明のうち，適切なものはどれか。
平成21年度 秋期 ITパスポート試験 問45
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 45
Incorrectア
The threat of unauthorized access is not only intrusion from outside. Improper operations by insiders, abuse of privileges, and misuse of a legitimate user's ID are also major threats, so even if external intrusion could be completely blocked, the precautionary measures would still not be sufficient. Moreover, the premise that intrusion can be completely blocked is itself unrealistic.
Incorrectイ
For natural disasters such as earthquakes and floods, the timing is hard to predict, but estimating the damage and evaluating the probability of occurrence are possible, and precautionary measures such as storing backups at a remote site and securing alternative facilities are well established. Excluding natural disasters from consideration because they are hard to predict is wrong from the viewpoint of business continuity.
Incorrectウ
A backup is only a means of recovering from data loss; it does nothing to prevent information leaks, shorten service outage time, or block unauthorized access. On the contrary, the backup media themselves can become a source of leakage. Backups alone can never make other precautionary measures unnecessary.
- エ
正解 エ is correct. In dealing with threats to an information system, reducing every threat to zero is impossible in practice, and countermeasures always cost money. So a risk assessment is used to estimate the expected loss if the threat occurs (probability of occurrence × size of the damage), and this is compared with the cost of the countermeasure, so that measures with a good cost-benefit balance are implemented first. Where the cost of a countermeasure exceeds the expected loss, other options such as transferring the risk through insurance or accepting the risk are chosen. This idea of taking the necessary precautionary measures while considering the trade-off is exactly the basic principle of risk treatment, so it is an appropriate explanation.
ここがポイント
- Risk treatment sets priorities by the trade-off between the expected loss (probability of occurrence × amount of damage) and the cost of the countermeasure. The basic approach is not to aim for zero risk, but to choose based on cost-effectiveness.
- Threats are varied — external intrusion, insider misconduct, natural disasters, failures, and more — and a single countermeasure (only preventing intrusion, or only taking backups) cannot cover them all.
用語