問41
頻出度★★★
会計システムに次のようなアクセスの記録を蓄積する機能があるとき, この蓄積された情報を利用して実施するシステム監査の目的として, 適切なものはどれか。 入力されたユーザ ID とパスワードの組合せを, あらかじめ登録された内容と照合し, 一致する場合は会計業務メニュー画面へ遷移し, 一致しない場合はログインエラー画面へ遷移する。このとき, ユーザ ID, 照合日時及び照合結果をアクセス記録として蓄積する。
平成26年度 秋期 ITパスポート試験 問41
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 41
Incorrectア
This cannot be used for the purpose of confirming that failure information is recorded. Only the ID, the check date and time, and the check result are accumulated; nothing about failure events or their causes, such as hardware faults or abnormal termination of an application, is included. Note also that a check result of no match means a mistyped password or an attempted unauthorized access, not a system failure. Confirming failure information requires a failure log book or system logs (error logs).
Incorrectイ
The convenience of the system for its users cannot be evaluated from this access record. Confirming convenience requires things such as screen usability, response time, how easy the operating procedures are to understand, and questionnaires or interviews with users, but a record of whether login authentication succeeded or failed contains no such information.
- ウ
正解 The correct answer is ウ. What is accumulated is the user ID, the check date and time, and the check result (match / no match) — in other words, an access record (access log) that records whether login authentication succeeded or failed. In a systems audit, this kind of log is strong audit evidence. From it, the auditor can check whether there are login attempts using unregistered IDs or the IDs of people who have left or been transferred, whether there are IDs with repeated authentication failures (a sign of unauthorized access), and whether there are IDs used outside business hours or at an unexpected frequency. Every one of these checks amounts to verifying who has been given which usage privileges, and whether the granting, changing, and deleting of those privileges is being operated properly. Therefore, the appropriate purpose of an audit conducted with this information is to confirm the appropriateness of the operation of system usage privileges.
Incorrectエ
Confirming conformity to the requirements of a quality management system (QMS, such as ISO 9001) belongs to quality management system auditing, not to a systems audit. Moreover, its object is the organization's entire framework for ensuring product and service quality (policies, procedure documents, records, corrective actions, and so on), and conformity cannot be judged from login authentication access records alone.
ここがポイント
- In a systems audit, the logs a system automatically leaves behind (access logs, operation logs, update histories) serve as highly objective audit evidence. The audit purpose is determined by what can be verified from that log, so decide by first checking which items are recorded (here: user ID, check date and time, check result).
- Access logs of login authentication are used for auditing access management (access control). Besides detecting attempts at unauthorized access, they provide material for confirming whether IDs are registered, changed, and deleted appropriately and whether unnecessary IDs remain — that is, the appropriateness of the operation of usage privileges.
用語