問84
頻出度★★★
業務中に受信した電子メールの添付文書をワープロソフトで開いたら，ワープロソフトが異常終了した。受け取った電子メールがウイルスを含んでいた可能性が考えられる場合，適切な処置はどれか。
平成21年度 春期 ITパスポート試験 問84
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 84
Incorrectア
Disconnecting from the network is correct in itself, but reinstalling the OS afterwards on the user’s own judgment is wrong. A reinstall erases all of the evidence needed to find the cause (the attachment, the logs, the traces of infection), so the responsible department can no longer investigate what virus it was or whether other PCs were affected too. On top of that, it has not even been confirmed that an infection really occurred; if it was only a software malfunction, the work is unnecessary. Choosing the means of recovery is the role of the person in charge who receives the report.
- イ
正解 When a virus infection is suspected, there are two principles of action: (1) stop the damage from spreading, and (2) do not judge by yourself, but report promptly to the specialist in charge. Choice イ satisfies both. First, disconnecting the PC from the network cuts off the route by which the virus could spread to the company LAN or to other PCs (preventing the spread). Next, promptly contacting the person in charge of the system administration department hands the later steps — confirming whether an infection occurred, removing the virus, issuing a correct company-wide alert, and reporting to an outside body if necessary — over to a person who has both the authority and the knowledge. Also, because you report while leaving the PC as it is, the evidence needed to investigate the cause (the suspicious attachment and the logs) is preserved as well. All that is asked of a user is to “disconnect and report immediately”; the decisions beyond that are the role of the responsible department.
Incorrectウ
Trying to open that attached document once more in order to see whether the symptom recurs means giving yourself another chance of infection, which is the most dangerous thing to do. Since the PC is still connected to the network, the damage may also spread to others. If the cause of the abnormal termination is a virus, reproducing it gains nothing and only increases the damage. In addition, reinstalling the word-processing software is a measure that assumes a software malfunction, so it misses the point as a first response when a virus infection is suspected.
Incorrectエ
Issuing an alert is necessary in itself, but sending it to all employees at the user’s own discretion is inappropriate. At a stage where the infection has not been confirmed, the information may be inaccurate and cause needless confusion. Furthermore, if that PC is infected, the email you send may itself become a medium that spreads the virus. A company-wide announcement should be made by the system administration department, which decides the content and the timing after confirming the facts. In addition, this choice says nothing about disconnecting the PC from the network, so it fails to prevent the damage from spreading.
ここがポイント
- When an information security incident occurs, the order of the first response is “prevent the damage from spreading (disconnect from the network)” and then “report promptly (contact the system administration department)”. An ordinary user should not perform recovery, investigation, or announcements on their own judgment, but hand the matter over to the specialist department.
- Reinstalling the OS or the software, and checking whether the symptom can be reproduced, either erase the evidence of the infection or make the damage worse. To allow the cause to be investigated, the PC should be preserved as it is, and the decision on how to deal with it should be left to the responsible department.
用語