問78
頻出度★★★
情報の“機密性”や“完全性”を維持するために職場で実施される情報セキュリティの活動a～dのうち,適切なものだけをすべて挙げたものはどれか。 a PCは,始業時から終業時までロックせず常に操作可能な状態にしておく。 b 重要な情報が含まれる資料やCD-Rなどの電子記録媒体は,利用時以外は施錠した棚に保管する。 c ファクシミリで送受信した資料は,トレイに放置せずにすぐに取り去る。 d ホワイトボードへの書込みは,使用後直ちに消す。
平成22年度 秋期 ITパスポート試験 問78
This question's explanation and your answers so far.
解説
問 78
Incorrectア
It includes the inappropriate item a, and it also drops the appropriate items c and d. If a PC is left operable without being locked from the start to the end of the workday, as in a, a third party can view or tamper with business data while the user is away from the desk, so both confidentiality and integrity are damaged. The correct practice is to lock the screen when leaving the desk, that is, to carry out “clear screen”.
Incorrectイ
Items b and d are appropriate, but the option is wrong in that it also includes the inappropriate item a. Operating a PC so that it is unlocked at all times drops a safeguard that should be applied in favor of convenience, so it goes against the condition of “listing all and only the appropriate items”.
Incorrectウ
Both b and d are appropriate, but the equally appropriate item c is missing. Not leaving materials sent or received by facsimile in the tray is also a typical workplace rule for maintaining confidentiality, so c must be included in order to list “all and only the appropriate items”.
- エ
正解 The appropriate items are the three b, c, and d, so エ is correct. Item b is lock management: storing materials containing important information and media such as CD-Rs in a locked cabinet except when in use, which prevents theft and unauthorized removal and protects confidentiality. Item c is not leaving received documents in the shared facsimile tray, which prevents a passing third party from reading them or carrying them off (the clear desk idea). Item d is erasing what is written on the whiteboard right after use, which prevents things such as the content discussed or customer names from leaking to the people who use the meeting room next. All of these are basic workplace behaviors of “do not leave information lying around, do not let it be seen, do not let it be taken away”, and they lead directly to maintaining confidentiality and integrity (preventing unauthorized rewriting).
ここがポイント
- Confidentiality means “only authorized people can access the information”, and integrity means “the information is accurate and has not been rewritten without permission”. Physical and operational measures in the workplace are also part of the information security activities that protect these two properties.
- Clear desk (not leaving confidential documents on desks, trays, or shelves, and keeping them locked away after use) and clear screen (locking the PC screen when leaving the desk) are the basics of workplace operation. Information that remains in shared places, such as whiteboards and fax trays, is also subject to being erased or collected.
用語