問62
頻出度★★★
セキュリティリスクへの対応には，リスク移転，リスク回避，リスク受容及びリスク低減がある。リスク低減に該当する事例はどれか。
平成28年度 秋期 ITパスポート試験 問62
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 62
- ア
正解 Risk reduction means taking security measures to lower the probability of a risk occurring or the size of the damage. Option ア, “implemented security measures to lower the likelihood of a problem occurring,” directly lowers the likelihood of occurrence itself through the countermeasures, so it is exactly risk reduction. Even if the risk cannot be brought completely to zero, reducing it to an acceptable level is the idea behind risk reduction.
Incorrectイ
Taking out insurance to prepare for a loss is “risk transfer.” It shifts the loss that arises when a problem occurs onto a third party, the insurance company, and does not actually make the risk itself smaller, so it is not risk reduction.
Incorrectウ
Confirming that the risk is small and then deciding to bear the loss oneself when a problem occurs is “risk acceptance (risk retention).” Since no measures are taken and the risk is simply accepted, it differs from risk reduction, which lowers the likelihood or the damage.
Incorrectエ
Withdrawing from a high-risk service is “risk avoidance.” It stops the risk-generating activity itself and thereby removes the source of the risk, which differs in approach from risk reduction, which uses measures to make the damage smaller.
ここがポイント
- The four types of risk treatment: risk reduction (use measures to lower the likelihood and the damage) / risk transfer (shift to a third party via insurance, etc.) / risk avoidance (stop the activity to remove the risk source) / risk acceptance and retention (accept the risk and bear the loss oneself).
- Distinguish them by keyword mapping: “lower the likelihood with security measures” = risk reduction, “insurance” = transfer, “withdraw / discontinue” = avoidance, “accept as is” = acceptance.
用語