問35
頻出度★★★
システム監査の内容として, 適切なものはどれか。
平成24年度 秋期 ITパスポート試験 問35
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 35
Incorrectア
This describes acceptance testing (approval testing). It is a test within the development process in which the actual users of the developed system verify it themselves in order to decide whether it may go into production, and it is the final testing stage of the system development life cycle. The party carrying it out is the user department, not an independent auditor, and its target is not “how well risk countermeasures are established and operated” but “whether the system works as required”; on both points it differs from an audit.
Incorrectイ
This describes biometrics authentication (biometric authentication). It is a technology that verifies a person's identity using physical characteristics such as fingerprints, the iris of the eye, or voiceprints, and it is one means of information security countermeasures (access control). An audit is the activity on the side that checks whether such countermeasures are appropriate; it is not the countermeasure itself. In other words, イ is “something that can be the target of an audit”, not the content of an audit.
- ウ
正解 The correct answer is ウ. A systems audit is an activity that inspects and evaluates whether the controls (risk countermeasures) against risks related to an organization's information systems are appropriately established and appropriately operated, and that gives advice and recommendations for improvement when necessary. Choice ウ states exactly this definition, and the point “verifying from an independent standpoint” is the decisive clue. Because the value of an audit lies in its objectivity, a systems auditor must be independent of the audited department (the department in charge of planning, developing, and operating the system), and auditing your own work yourself is not permitted. Only ウ has all three elements together: “whether the risk countermeasures are appropriate”, “from an independent standpoint”, and “verify”.
Incorrectエ
This describes cracking (unauthorized access). It is a criminal act of intruding into a system from the outside via a network without permission and secretly viewing, tampering with, or destroying data and programs, and it violates the Act on Prohibition of Unauthorized Computer Access. It stands on the side of the threats that an audit is meant to guard against; it is not an audit activity. It is also clearly distinguished from penetration testing, in which simulated attacks are carried out with permission to confirm security, the difference being that cracking is done without permission.
ここがポイント
- Systems audit = an activity that inspects and evaluates whether the risk countermeasures (controls) related to information systems are appropriately established and operated, and then gives advice and recommendations. The keywords are “independent standpoint” and “verify and evaluate”.
- Independence of the systems auditor: independence from the audited department is required both in appearance and in mental attitude, and an auditor cannot audit work in which they themselves were involved. Do not confuse an audit with “the countermeasure itself” (such as biometric authentication) or with “a test in the development process” (such as acceptance testing).
用語