問80
頻出度★★★
ISMS適合性評価制度において, 組織がISMS認証を取得していることから判断できることだけを全て挙げたものはどれか。 a 組織が運営するWebサイトを構成しているシステムには脆弱性がないこと b 組織が情報資産を適切に管理し, それを守るための取組みを行っていること c 組織が提供する暗号モジュールには, 暗号化機能, 署名機能が適切に実装されていること
平成29年度 秋期 ITパスポート試験 問80
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 80
Incorrectア
This lists only a, which is wrong. ISMS certification guarantees that the management mechanism is appropriate; it does not go so far as to guarantee that the systems making up the website have 'no vulnerabilities at all'. Whether technical vulnerabilities exist is outside the scope of the certification.
- イ
正解 The ISMS conformity assessment scheme is a scheme in which a third party certifies that an organization has in place a proper 'mechanism' for building and operating an information security management system (ISMS) and for continuously carrying out efforts to appropriately manage and protect its information assets. Therefore, the only thing that can be judged from the fact that certification was obtained is choice b, that the organization appropriately manages its information assets and carries out efforts to protect them. Hence the answer is 'イ', which lists only b.
Incorrectウ
This lists b and c, but is inappropriate because c is wrong. What c states, that 'the cryptographic module properly implements encryption and signing functions', is content handled by the cryptographic module testing and validation program (JCMVP), and is not something ISMS certification judges.
Incorrectエ
This lists only c, which is wrong. c concerns the assessment of whether the cryptographic module itself is properly implemented (the domain of JCMVP), and is not something that can be judged from the fact that ISMS certification was obtained.
ここがポイント
- ISMS certification certifies that the 'management mechanism (PDCA)' for protecting information security is properly built and operated; it does not guarantee that systems have zero vulnerabilities or that individual products are correctly implemented.
- Whether a cryptographic module's functions are properly implemented is the domain handled by JCMVP (the cryptographic module testing and validation program), and should be understood as distinct from what ISMS certifies.
用語