問96
頻出度★★★
情報セキュリティにおけるリスクマネジメントに関して，次の記述中のa～cに入れる字句の適切な組合せはどれか。 情報セキュリティにおいて，組織がもつ情報資産の [ a ] を突く [ b ] によって，組織が損害を被る可能性のことを [ c ] という。
平成28年度 秋期 ITパスポート試験 問96
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 96
Incorrectア
a: threat, b: risk, c: vulnerability. A threat is the side that exploits a vulnerability, not the thing being exploited, so placing threat at a is wrong. The risk at b is likewise not an act or factor that causes damage. The possibility of suffering damage at c refers to risk, not vulnerability. All three words are placed incorrectly.
- イ
正解 The passage reads: the possibility that an organization suffers damage through a [ b ] that exploits the [ a ] of its information assets is called [ c ]. Since a is the thing being exploited, it is the weakness the information asset has, namely the vulnerability. b is the factor that exploits that vulnerability and causes damage, namely the threat. c is the possibility of suffering damage itself, namely the risk. The combination is therefore a: vulnerability, b: threat, c: risk, and the correct answer is choice イ. The key point is the relationship among the three: risk becomes real only when a threat exploits a vulnerability.
Incorrectウ
a: risk, b: threat, c: vulnerability. The threat at b is correct, but a is the weakness that gets exploited, so it must be vulnerability, not risk. The possibility that the organization suffers damage at c is the definition of risk, not vulnerability, so a and c are swapped.
Incorrectエ
a: risk, b: vulnerability, c: threat. a should be the thing being exploited, namely the vulnerability, so risk is wrong. b should be the side that exploits the vulnerability, namely the threat, but vulnerability is the thing being exploited, so it is wrong. The possibility of suffering damage at c is risk, not threat. All three words have their roles mismatched.
ここがポイント
- Relationship among vulnerability, threat, and risk: when a threat (a factor that causes damage) exploits the vulnerability (weakness) of an information asset, the possibility that the organization suffers damage, namely the risk, arises.
- Term definitions: vulnerability = a weakness inherent in an information asset; threat = a factor or event that exploits that weakness to cause damage; risk = the possibility that damage occurs.
用語