問77
頻出度★★★
セキュリティリスクへの対応には, リスク移転, リスク回避, リスク受容, リスク低減などがある。リスク移転に該当する事例はどれか。
平成28年度 春期 ITパスポート試験 問77
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 77
Incorrectア
Handling a risk by implementing security measures to lower the likelihood of a problem occurring is “risk reduction (mitigation)”. It makes the probability or impact of the risk itself smaller, and is not risk transfer, which moves the damage to an external party.
- イ
正解 The correct answer is “イ”. Risk transfer means shifting the responsibility or burden for the damage caused by a risk to a party outside your own organization (a third party). Taking out insurance is a mechanism in which the insurance company takes on the losses when a problem occurs; because it moves the burden of loss to an external party, it is exactly a typical example of risk transfer. Similarly, outsourcing business operations and the like are also included in transfer.
Incorrectウ
Handling a risk by confirming that the risk is small and then deciding to bear the losses yourself when a problem occurs is “risk acceptance (retention)”. It is an approach that accepts the risk as it is, and is not risk transfer, which moves the damage to an external party.
Incorrectエ
Handling a risk by withdrawing from a high-risk service is “risk avoidance”. It is an approach that stops the very activity causing the risk so that the risk does not arise, and is not risk transfer, which moves the damage to an external party.
ここがポイント
- The four categories of risk treatment: risk reduction (lowering the probability and impact of occurrence) / risk transfer (moving the burden of damage to a third party via insurance or outsourcing) / risk acceptance and retention (accepting a small risk and bearing it yourself) / risk avoidance (stopping the activity that is the cause).
- “Taking out insurance” and “outsourcing” are representative examples of risk transfer and appear frequently on exams. The key to identifying it is that the losses are borne by an external party rather than by yourself.
用語