問72
頻出度★★★
情報セキュリティのリスクアセスメントにおける, 資産価値, 脅威, 脆弱性及びリスクの大きさの関係として, 適切なものはどれか。
平成26年度 春期 ITパスポート試験 問72
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 72
Incorrectア
Incorrect. A threat is the cause or event itself that could bring loss to an asset (malware, unauthorized access, an earthquake, a mistake by an operator, and so on), and it is given as a factor outside the organization. The magnitude of a threat is not determined by asset value or vulnerability, much less by the magnitude of risk, which is a result. This choice reverses cause and effect, so the direction of causation is wrong.
Incorrectイ
Incorrect. Asset value is determined by how important the information asset is to the organization (the size of the impact when its confidentiality, integrity, or availability is lost), and in risk assessment it is an input evaluated first. Threat, vulnerability, and the magnitude of risk do not determine asset value; the order is the other way around.
Incorrectウ
Incorrect. A vulnerability is a weakness on the asset side that a threat can exploit (an unpatched security hole, inadequate access management, insufficient training, and so on), and it is an input evaluated as the state of the system or management structure itself. Saying that the magnitude of a vulnerability is determined by asset value, threat, and the magnitude of risk, which is a result, again reverses the causation.
- エ
正解 The correct answer is エ. In information security risk assessment, the magnitude of risk is understood through the relationship «asset value × threat × vulnerability». The higher the value of the information asset to be protected, the greater the impact when it is lost. The more likely a threat that endangers that asset (unauthorized access, malware, disasters, human error, and so on) is to occur, the greater the danger. And the larger the vulnerability — a weakness that a threat can exploit (unpatched security holes, weak passwords, gaps in the management system, and so on) — the more easily a threat turns into actual damage. In other words, asset value, threat, and vulnerability are the three inputs that act as causes, and the magnitude of risk is the result determined from them. Choice エ states exactly this direction of causation, so it is appropriate. Conversely, since asset value itself often cannot be reduced, in practice the basic approach to lowering risk is to close vulnerabilities (applying patches and access control).
ここがポイント
- Magnitude of risk = asset value × threat × vulnerability. Keep this direction of causation in mind: asset value, threat, and vulnerability are the inputs (causes), and the magnitude of risk is the output (result).
- Distinguish the definitions of the terms. Asset value is the importance of what is protected, a threat is an external factor that could cause loss, a vulnerability is a weakness on the asset side that the threat exploits, and risk is the possibility of loss arising from the combination of these.
用語