問76
頻出度★★★
情報セキュリティポリシに関する考え方のうち, 適切なものはどれか。
平成22年度 秋期 ITパスポート試験 問76
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 76
Incorrectア
Spending the same amount on every information asset is not appropriate. The principle of information security measures is to spend an amount that matches the importance of each information asset (how large the damage would be if it leaked, was tampered with, or stopped working) and the size of the risk. Publicly released PR material and a customer's personal data or financial data before its official announcement have completely different values to protect. If the same amount is spent on everything, important assets are not protected enough while unimportant assets receive excessive investment, and cost-effectiveness gets worse.
Incorrectイ
Disclosing the information security basic policy only to executives is not appropriate. The basic policy is the top-level document in which top management declares the organization's attitude toward security, and it becomes something people can act on only when it is made known to all workers. In addition, it is common to publish it outside the company, for example on a website, to show trustworthiness to business partners and customers. What should be kept confidential is the lower-level documents that contain specific setting values and procedures, namely the standards and the operating procedures, not the basic policy.
- ウ
正解 The correct answer is ウ. An information security policy is an organization-wide set of rules that defines which information assets must be protected and how to protect them. Whether the rules actually work is decided at the weakest point, so everyone who may come into contact with information assets or information systems must be covered by the policy. If only regular employees are covered and part-timers, casual staff, temporary agency staff, and contract employees are left out, the customer information and devices those people handle fall outside management, and that spot becomes a hole for information leakage. Therefore the scope of application should not be limited to regular employees but should cover all workers, including part-timers and others, so ウ is appropriate.
Incorrectエ
Using another company's policy in the same industry as-is as much as possible is not appropriate. A policy should be created based on the results of identifying the information assets that your own organization holds and analyzing their risks, and the business content, organization size, system configuration, and applicable laws and regulations differ from company to company. If another company's document is used as it is, rules that do not exist in your own company get mixed in, while risks specific to your own company are left out, and the document becomes an empty formality that people on site cannot follow. Examples from other companies should be used only as a reference for the structure, and the content must be built to match the results of your own organization's risk assessment.
ここがポイント
- The scope of an information security policy covers all workers who may touch the organization's information assets regardless of employment type (regular employees, part-timers, casual staff, temporary agency staff, contract employees, and so on), and outsourcing contractors as well when necessary. Rules are broken at the weakest point, so anyone left out of the scope becomes a loophole.
- A policy has a layered structure. At the top, the information security basic policy is a declaration by top management; it is made known to all workers and may also be published outside the company. Below it, the standards and the operating procedures are more concrete and should be handled with limited distribution. Also, the cost of measures should be allocated according to the importance of the information assets and their risks, and the content should be created based on the organization's own risk assessment.
用語