問53
頻出度★★★
ISMSにおけるセキュリティリスクへの対応には, リスク移転, リスク回避, リスク受容及びリスク低減がある。リスク回避に該当する事例はどれか。
平成27年度 春期 ITパスポート試験 問53
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 53
Incorrectア
“Implemented security measures to lower the likelihood of a problem occurring” is an example of risk reduction (risk mitigation). The activity itself continues, and only the likelihood and the size of the damage are made smaller by the measures, so this is not avoidance.
Incorrectイ
“Took out insurance to prepare for the loss in case a problem occurs” is an example of risk transfer (risk shifting). It merely moves the burden of the loss to a third party, the insurance company, while the risk-generating activity itself continues, so it is not avoidance.
Incorrectウ
“Confirmed that the risk was small and decided to bear the loss if a problem occurs” is an example of risk acceptance (risk retention). It is a decision to take no measures and accept the risk as it is, which is the opposite of avoidance, where the activity is stopped.
- エ
正解 The correct answer is エ. In ISMS risk treatment, “risk avoidance” means stopping (or never starting in the first place) the very activity that causes the risk, thereby eliminating the source of the risk itself. “Withdrew from the high-risk service” makes the risk cease to exist by no longer providing that service, so it is exactly risk avoidance. Unlike reduction (making the likelihood or impact smaller), transfer (having a third party bear it), and acceptance (accepting it as it is), only avoidance gives up the risk-bearing activity itself, and that is the deciding point.
ここがポイント
- The four categories of risk treatment: avoidance (stop the activity itself to eliminate the risk), reduction (use measures to make the likelihood and impact smaller), transfer (shift the burden to a third party via insurance or outsourcing), and acceptance/retention (accept a small risk as it is).
- A tip for telling them apart: “withdraw, stop, do not do it” = avoidance; “take measures, strengthen” = reduction; “insurance, outsourcing” = transfer; “do nothing and accept it” = acceptance.
用語