問30
頻出度★★☆
内部統制の一環として, 業務分掌と整合のとれたアクセス管理を実現することになった。情報システムの開発において, アクセス管理の検討を開始するプロセスとして, 適切なものはどれか。
平成27年度 秋期 ITパスポート試験 問30
ストラテジ系システム企画 › 要件定義
This question's explanation and your answers so far.
解説
問 30
- ア
正解 The correct answer is ア, Requirements definition. Access management is part of the requirements (functional and non-functional) that the information system must satisfy. To make it consistent with the segregation of duties (who is responsible for which task, and how much authority they hold), the policy, targets, and scope of access control must be examined and defined at the requirements definition stage, which is the most upstream part of development. If it is built into requirements definition, it can be reflected consistently through the later design and implementation processes, so the aims of internal control, namely fraud prevention and separation of duties, can be reliably incorporated. Therefore, the process appropriate for beginning this examination is requirements definition.
Incorrectイ
Programming is the implementation process that turns the specifications decided in requirements definition and design into actual code. Starting to examine access management only at this point means it is not reflected in the upstream requirements and design and cannot be made consistent with the segregation of duties, so it is not an appropriate place to begin the examination.
Incorrectウ
Testing is the process of verifying whether the implemented functions work as required. Beginning to examine access management at this stage is too late; if a specification change occurs, it causes major rework all the way back through requirements definition, design, and implementation.
Incorrectエ
If the examination begins after operation has started, it becomes a retrofit to an already-running system, with the risk of operating while still holding internal-control deficiencies. Access management should be built in during the development processes before operation begins.
ここがポイント
- As a principle, access management and security requirements should be examined and defined at the requirements definition stage, the most upstream part of development (security by design). Building them in during later processes leads to rework or insufficient implementation.
- In internal control, the segregation of duties must be made consistent with access privileges, and this policy should be established at requirements definition and reflected consistently through the subsequent processes.
用語