問56
頻出度★★★
情報セキュリティポリシに関する記述のうち, 適切なものはどれか。
平成21年度 秋期 ITパスポート試験 問56
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 56
Incorrectア
A security policy is an internal rule that a company establishes on its own initiative; it is not a matter for which the Companies Act requires approval at the shareholders' meeting. Normally it is established and communicated through approval and declaration by management.
Incorrectイ
A policy consists of directions and standards applied consistently across the whole organization; it is not something defined separately for each system. Writing separate content for individual systems belongs to the level of implementation procedures or system operation rules placed below the policy.
Incorrectウ
An organization's own vulnerabilities are valuable information for attackers, so disclosing them publicly actually increases risk. Vulnerabilities identified while establishing the policy should be managed strictly inside the organization and used as information for countermeasures; there is no obligation to disclose them.
- エ
正解 An information security policy is a document in which an organization sets the goal of how well it will protect its information assets, and puts in writing the standards of behavior that its members must observe and the way of thinking they can rely on when a judgment is unclear. It is generally structured in layers: the information security basic policy, in which management states its direction; the control standards, which define the level to be maintained; and the implementation procedures, which describe the concrete steps. Choice エ correctly states this essence, namely that in order to achieve the targeted security level it is necessary to clarify the actions to be observed and the way of thinking behind judgments, so it is appropriate.
ここがポイント
- Information security policy = an organization-wide document that puts in writing the targeted security level and the actions and judgment criteria to be observed in order to maintain it (structured as basic policy / control standards / implementation procedures).
- A policy is an internal rule approved by management; it requires neither approval at the shareholders' meeting nor public disclosure of vulnerabilities, and it is established across the whole organization rather than per system.
用語