問61
頻出度★★★
組織で策定する情報セキュリティポリシに関する記述のうち, 最も適切なものはどれか。
平成26年度 秋期 ITパスポート試験 問61
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 61
Incorrectア
What management should establish and approve is the top-level basic information security policy. It is not appropriate to say that management should also draw up all of the concrete rules (control standards) and implementation procedures below it. Rules and procedures are realistically and commonly drawn up and maintained by the individual departments, the responsible sections, or the information security manager, who best understand the actual work and information systems, in a form that follows the basic policy. Management's responsibility is to set out the policy, secure the organizational structure and resources, and approve and review how things are operated.
Incorrectイ
What is required (or rather desirable) to be disclosed outside the organization goes only as far as the basic information security policy, which shows the organization's stance to the outside world. The rules and implementation procedures below it contain things such as the system configuration, the concrete settings of access control, the methods of monitoring and detection, and the details of incident response — publishing them would mean showing attackers one's hand. These are confidential information that should be shared only within the necessary scope inside the organization, so the statement that they are required to be disclosed outside the organization is wrong.
Incorrectウ
The explanation is the other way around. It is precisely the basic information security policy that should be established as management's will and specifically for one's own organization, taking into account the organization's business, the information assets it holds, the risks that can be expected, and legal and contractual requirements. Industry standards or another company's template can be referred to as a starting point for consideration, but adopting one as it is is not what is required, and a policy that does not fit the organization's actual situation ends up being a mere formality.
- エ
正解 The correct answer is エ. An information security policy is normally built as a hierarchy: the top-level basic information security policy, below it the control standards (rules), and below that the implementation procedures. Of these, the basic information security policy is the document in which management declares, as the will of the organization and to both internal and external audiences, the basic thinking, purpose, scope of application, and structure of responsibility for how the organization addresses information security; in principle only one such document exists in an organization. On the other hand, which measures are actually implemented naturally differs from department to department, because the importance of the information assets handled, the nature of the work, and the risks that can be expected all differ; the lower-level control standards and implementation procedures may be written separately to match those realities. Therefore エ, which states that even when multiple departments within an organization implement different information security measures the basic information security policy should be unified across the entire organization, is the most appropriate. If even the basic policy differed from department to department, the organization would have no consistent policy at all, and it would lose both the basis for judging whether a given department's measures are adequate and the unified stance it presents to the outside world.
ここがポイント
- An information security policy takes the hierarchical structure of basic information security policy → control standards (rules) → implementation procedures. The top-level basic policy is established and declared by management as the will of the organization, and in principle it is single and unified across the whole organization, while the lower-level control standards and implementation procedures may be written separately according to differences in each department's information assets and risks.
- The distinction in scope of disclosure is also frequently tested. The basic policy may be — and in fact preferably is — disclosed outside the organization as something that shows the organization's stance, but concrete measures and procedures would be information advantageous to attackers, so they are handled only within the necessary scope inside the organization. Also, a policy is not a straight copy of another organization's template; it is established to fit one's own business, assets, risks, and legal requirements.
用語