問71
頻出度★★★
情報セキュリティにおけるリスクマネジメントに関する記述のうち, 最も適切なものはどれか。
平成25年度 春期 ITパスポート試験 問71
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 71
Incorrectア
The line of responsibility is the other way round. Risk management itself includes management judgments such as which risks to accept and where to put people and budget, so in principle it is top management that bears the ultimate responsibility. On-site information security managers are in the position of carrying out day-to-day operation and monitoring in accordance with the policy decided by top management, and they hold neither the authority nor the budget required. If such a manager is placed as the ultimate person responsible, the judgment of whether or not to accept a serious risk is pushed onto the front line, and organization-wide countermeasures can no longer be decided.
Incorrectイ
The information assets that must be protected are used within everyday business operations, so risk management cannot be carried out as a standalone activity separated from those operations. If countermeasures alone are decided without taking the flow of the work into account, rules are produced that the front line cannot keep and that end up as empty formalities, or, conversely, the work is stopped more than necessary. In reality, risk evaluation and countermeasures should be built into business processes and into each stage of planning, developing, and operating information systems, and kept running continuously as one with business activities.
- ウ
正解 The correct answer is ウ “All members of the organization share their respective roles and work on it across the entire organization.” Risk management in information security is a series of activities: identifying the risks to information assets and analyzing and evaluating them (risk assessment), then selecting and implementing countermeasures according to the results, and reviewing how they work in practice and improving them. Information assets are handled every day everywhere in the organization — from top management to ordinary front-line employees and even outside contractors — and most incidents arise from the actions of individual people, such as losing something, sending it to the wrong address, or managing passwords carelessly. Therefore the risks of an organization do not go down just because the information systems department or the security staff work hard. Real effectiveness appears only when roles are divided according to each position — top management decides the policy and bears the ultimate responsibility, managers handle operation and training in their own departments, and ordinary employees observe the rules and report problems — and the entire organization works on it together. This is the basic idea of a management system (a mechanism that turns the PDCA cycle), and ウ correctly describes this organization-wide character, so it is the most appropriate.
Incorrectエ
This is wrong because in principle the basic policy is unified into a single one for the whole organization. An Information Security Policy is made up of a hierarchy: at the top is the organization-wide basic policy laid down by top management, below it the standards for countermeasures, and below those the concrete implementation procedures. It is natural that the procedures differ according to the nature of each department's work, but if even the basic policy is laid down separately by each department and implemented independently, the level of the countermeasures varies from department to department, the weakest department becomes the hole in the whole organization, and exchanges of information across departments and the response when an incident occurs can no longer be kept under unified control. It also contradicts the very premise of being under a single management system.
ここがポイント
- Risk management for information security is an organization-wide effort. Top management decides the policy and bears the ultimate responsibility, and managers, ordinary employees, and even outside contractors each take a share of the roles, so that the PDCA cycle of identifying risks, analyzing them, evaluating them (risk assessment), responding, and reviewing is kept turning continuously in a form built into business activities. It is neither an activity of the department in charge alone nor a one-off activity separated from the work.
- An Information Security Policy takes a hierarchical structure. At the very top is placed a basic policy unified across the whole organization (top management's declaration of what is to be protected and why); below it are laid down the standards for countermeasures (the rules that must be observed) and the implementation procedures (the concrete ways of doing things for each department and each system). What may differ from department to department is the lower-level procedures, not the basic policy.
用語