問63
頻出度★★★
社内の情報セキュリティ教育に関する記述のうち, 適切なものはどれか。
平成27年度 春期 ITパスポート試験 問63
This question's explanation and your answers so far.
解説
問 63
Incorrectア
Replacing the information system is not the only trigger for re-education. There are many situations that call for it: new threats and attack techniques appearing, laws and guidelines being revised, internal rules or the security policy being reviewed, personnel transfers, and awareness fading as time passes. Because education must be repeated regularly and whenever it is needed, limiting it to the time of a system replacement is inappropriate.
Incorrectイ
New employees would begin working without knowing the internal rules or the security policy, and the period until they get used to the work is the riskiest time. Mistaken operations, taking information out of the company, and careless social media posts can occur right after joining, so as a rule the education should be given before the work starts, or at the time of joining.
Incorrectウ
Even employees who do not directly access information assets carry security roles: controlling visitors coming in and out, handling documents and USB memory sticks, avoiding information leaks over the phone or in conversation, opening suspicious e-mail, and so on. Personnel security measures aim to reduce weak points across the whole organization, so if the target is limited, employees who have received no education become the way in for an attack. In principle everyone should be covered, including temporary staff and contractors.
- エ
正解 Information security education is not something you can deliver as the same uniform content to every employee. The information assets an employee handles and the privileges they hold differ according to their assigned duties, role, and responsibilities, and the threats they may face and the measures they should take change accordingly. For example, executives decide policy and make judgments when an incident occurs, system administrators manage access rights and monitor logs, and general employees manage passwords and deal with targeted e-mail attacks. Therefore エ, which says the content is changed according to each employee's assigned duties, role, and responsibilities, is appropriate. This is also the basic way of thinking behind continuous awareness activities based on the information security policy.
ここがポイント
- Information security education (awareness activities) should cover all employees, and the basic principle is to tailor the content to each person's assigned duties, role, and responsibilities.
- The education should be given before work begins, such as at the time of joining the company, and after that it must be repeated regularly in line with changing threats, revised rules, personnel transfers, and fading awareness.
用語