問47
頻出度★★★
情報セキュリティ基本方針, 又は情報セキュリティ基本方針と情報セキュリティ対策基準で構成されており, 企業や組織の情報セキュリティに関する取組みを包括的に規定した文書として, 最も適切なものはどれか。
平成27年度 春期 ITパスポート試験 問47
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 47
- ア
正解 An information security policy is the set of documents in which an organization defines how it will address information security. It is generally organized into three levels from the top down: “information security basic policy (management's declaration of why and what is to be protected)” →“information security countermeasure standards (the rules the whole company must meet in order to protect it)” →“information security implementation procedures (concrete step-by-step manuals used on site)”. Of these, the range treated as the policy is, in the narrow sense, only the basic policy, and in the broad sense the basic policy plus the countermeasure standards. The wording in the question, “consists of an information security basic policy, or an information security basic policy together with information security countermeasure standards”, matches this narrow/broad explanation exactly, and the phrase “a document that comprehensively defines an enterprise's or organization's initiatives regarding information security” is precisely the role of a policy: a document approved by management and applied company-wide. Therefore the correct answer is ア, Information Security Policy.
Incorrectイ
An information security management system (ISMS) is a “mechanism and management structure” for continuously operating and improving information security through the PDCA cycle; it is not a particular document itself. The relationship is that a policy is one of the documents prepared in order to run the ISMS, so it does not fit the description asked about in the question, “a document made up of a basic policy and countermeasure standards”.
Incorrectウ
Social engineering is a general term for attack techniques that steal information by exploiting gaps in human psychology and behavior rather than technology, such as impersonation phone calls, peeking over someone's shoulder (shoulder hacking), and rummaging through trash (scavenging). It is a technique used by attackers, not a document used by defenders, so its direction is completely different from what the question describes.
Incorrectエ
Risk assessment is an “activity (process)” that identifies and evaluates the magnitude of the risks an organization faces, through the series of steps of risk identification, risk analysis, and risk evaluation. Policies and countermeasures are decided based on its results, but the assessment itself is not the name of a document, nor is it something made up of a basic policy and countermeasure standards.
ここがポイント
- Grasp the information security policy as a hierarchy of “basic policy / countermeasure standards / implementation procedures”. In the narrow sense only the basic policy is called the policy; in the broad sense the basic policy plus the countermeasure standards are called the policy.
- Distinguish confusing terms by whether each one is a “document”, a “mechanism”, an “activity”, or an “attack technique”. Policy = document, ISMS = management mechanism, risk assessment = evaluation activity, social engineering = attack technique.
用語