問47
頻出度★★★
情報セキュリティのリスクマネジメントにおいて, リスクの重大さを決定するために, 算定されたリスクを与えられた基準と比較するプロセスはどれか。
平成26年度 秋期 ITパスポート試験 問47
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 47
Incorrectア
Risk treatment is the process of selecting and carrying out measures such as risk reduction, risk avoidance, risk transfer (sharing), or risk retention (acceptance) for risks judged significant in risk assessment, thereby modifying the risk. It is the stage that comes after assessment is finished, not the stage that compares risk with criteria to decide significance.
Incorrectイ
Risk identification is the process of finding and recognizing what information assets, threats and vulnerabilities an organization has and what risks exist, and describing them as a list. It is the first stage of risk assessment; at that point the magnitude of the risk has not yet been estimated, and no comparison with criteria is made.
- ウ
正解 The correct answer is ウ (Risk evaluation). The terms of information security risk management are defined in JIS Q 27000 (ISO/IEC 27000), where risk assessment consists of three stages: risk identification → risk analysis → risk evaluation. Risk evaluation, the last of these stages, is the process of comparing the magnitude of risk (the risk level) estimated by risk analysis with risk criteria decided in advance (the level of risk that can be accepted), and thereby determining whether the risk is acceptable and which risks should be handled first — that is, determining its significance and priority. In the question, the estimated risk is the output of risk analysis, the given criteria are the risk criteria, and determining the significance of the risk corresponds to judging acceptability and priority, so the definition applies exactly. In short, risk analysis measures the size, and risk evaluation judges the measured result against the criteria.
Incorrectエ
Risk analysis is the process of estimating factors such as the likelihood of occurrence and the degree of impact for identified risks, understanding the nature of the risk, and calculating the risk level (the magnitude of the risk). It is this risk analysis that produces the estimated risk mentioned in the question, not the next stage that compares that result with the criteria.
ここがポイント
- Risk assessment = risk identification (finding out what risks exist) + risk analysis (calculating the risk level from likelihood and impact) + risk evaluation (comparing the calculated result with risk criteria to decide acceptability and priority) — these three stages, followed by risk treatment (reduction, avoidance, transfer, retention). Fix this order in your mind.
- Telling risk analysis and risk evaluation apart is a frequent exam point. Calculating the magnitude = risk analysis; comparing with the criteria to decide significance and acceptability = risk evaluation. Whenever the question contains wording like “compare with the given criteria”, you can judge it to be risk evaluation.
用語