問83
頻出度★★★
社内のISMS活動の一環として, サーバのセキュリティについて監査を行うことになった。最初に実施することとして, 適切なものはどれか。
平成26年度 秋期 ITパスポート試験 問83
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 83
- ア
正解 The correct answer is ア. An information security audit (system audit) basically proceeds in the order “draw up the audit plan → preliminary survey → main survey → evaluation and conclusion → audit report → follow-up”, and what comes at the head of that sequence is drawing up the audit plan. The audit plan document states the purpose of the audit, its scope (here, which servers are examined and how far), the key items to focus on, the timing and schedule, the audit structure and staffing, and the audit procedures and the methods for obtaining evidence. Only once this plan exists is it possible to decide whether concrete work such as “which logs to look at” or “what tool to use and how far to inspect” is necessary and how far it should extend. Therefore, at the stage where it has been decided to audit server security as part of ISMS activities, the first thing to do is to create the audit plan document.
Incorrectイ
Reviewing the security settings is a corrective action taken by the audited department (the server operations side) after the audit points out problems; it is neither the auditor's work nor the first step. Changing the target before the audit would also make it impossible to evaluate the actual operating state, which is another reason it is inappropriate.
Incorrectウ
Confirming the location of the audit logs belongs to the preliminary survey and main survey work done to collect audit evidence. If the scope and key items have not been fixed in the audit plan, you cannot even judge whether “all servers” should be examined, so it is not something done ahead of planning.
Incorrectエ
Inspection with a vulnerability scanning tool is concrete work carried out at the main survey stage as one of the audit procedures. Whether to run it, on what targets, and at what time must be laid down in advance in the plan document (it can also affect servers that are in operation), so it is not the first task to perform.
ここがポイント
- The basic sequence of an information security audit / system audit is “draw up the audit plan → preliminary survey → main survey → evaluation and conclusion → audit report → follow-up”. When asked what is done first, answer that the audit plan is drawn up.
- The audit plan document defines the purpose, scope, key items, timing, structure, and procedures of the audit. Concrete work such as checking logs or scanning for vulnerabilities belongs to the survey stages carried out based on the plan, and reviewing the settings is a corrective action after findings are raised; neither is the auditor's first step.
用語