問63
頻出度★★★
情報セキュリティの基本方針に関する記述のうち, 適切なものはどれか。
平成23年度 特別試験 ITパスポート試験 問63
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 63
Incorrectア
The basic policy is not made a confidential matter. The basic policy is the basis of conduct that all employees are expected to follow, and it has no real effect unless it is made known to them. Moreover, it also plays the role of a sign of trust that shows business partners and customers that the organization is working seriously on information security, so it is common to publish it outside the organization, for example on a web site. It is a document that states principles and direction, and it does not contain details that should be kept secret, such as the contents of the information assets to be protected, the system configuration, or vulnerabilities. Therefore the statement that it is treated as a management confidential matter mistakes the nature of the basic policy and is not appropriate. What should be managed as confidential is the lower-level documents that contain concrete setting values and operating procedures, and the information assets themselves.
- イ
正解 The correct answer is イ. An information security policy is generally made up of three levels, from the top down: the basic policy (information security policy), the countermeasure standards, and the implementation procedures. The basic policy sits at the very top, and it is a declaration document that shows, both inside and outside the organization, the organization's own attitude toward information security. Specifically, it sets out the organization's basic way of thinking: why it works on information security (the purpose), what it protects (the targets and the scope of application), who bears responsibility (the structure and the responsible persons), and how it complies with laws and contracts. It does not write down individual technical procedures; its characteristic is that it stays at the level of principles and direction. This document binds every member of the organization and is directly linked to management decisions such as the allocation of budget and staff, so it must be approved by management (top management) rather than by the department in charge on the ground, and issued as the will of the organization. JIS Q 27001 and JIS Q 27002 likewise require the information security policy to be established and approved by top management and communicated to the employees in the organization and to relevant external parties. Choice イ correctly states both the nature of the policy, that it indicates the organization's approach to information security, and the procedure, that it is approved by management, so it is appropriate.
Incorrectウ
The order of levels is reversed. Of the three levels, the basic policy is at the top; the countermeasure standards are the middle-level rules that define what is to be done and how far it is to be done in order to realize the basic policy; and the implementation procedures are the lowest-level documents that bring this down to how it is actually carried out. Formulation proceeds from the upper level to the lower level: the basic policy is set first, the countermeasure standards are then formulated on the basis of it, and the implementation procedures are created on the basis of the countermeasure standards. This choice states that the basic policy is formulated based on the countermeasure standards, which would mean creating an upper-level document on the grounds of a lower-level one, so it is incorrect.
Incorrectエ
This is the role of the lower-level documents, not of the basic policy. Management methods such as the number of characters in a password and how often it is changed, and matters such as where documents are stored, how long they are kept, and how they are disposed of, are items prescribed concretely at the level of the countermeasure standards or the implementation procedures. If such details were written into the basic policy, then every time technology or operations changed, approval would have to be obtained from management again in order to revise the top-level document, and the stability of the policy would be lost. The basic policy takes charge of principles, which rarely change, while the lower-level documents take charge of concrete measures, which change easily; this is how the roles are divided. This choice attributes concrete rules to the basic policy, so it is not appropriate.
ここがポイント
- The three levels of an information security policy — from the top: the basic policy (information security policy), the countermeasure standards, and the implementation procedures. The basic policy carries the organization's principles and declaration, such as the purpose, the scope of application, and the structure; the countermeasure standards carry the rules to be observed; and the implementation procedures carry the concrete work steps. Formulation goes from the upper level to the lower level: the countermeasure standards are created based on the basic policy, and the implementation procedures based on the countermeasure standards.
- Who approves the basic policy, and its openness — because it binds the whole organization and is directly linked to management decisions, it is approved and declared by management (top management). It is normally communicated to all employees and, as a statement of trust toward business partners and customers, it is commonly published outside the organization; it is not something to be hidden as a confidential document.
用語