問94
頻出度★★★
職場のPCを使用していたところ，ウイルス対策ソフトでウイルスを検出した旨のメッセージが表示された。このPCで直ちに行うべきこととして，適切なものはどれか。
平成29年度 秋期 ITパスポート試験 問94
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 94
Incorrectア
Restarting the PC is wrong. A restart does not remove the infection itself, and it may re-run malware that runs automatically at startup. It also loses the traces left in memory (volatile evidence), making it harder to investigate the cause. It does not prevent the spread either.
Incorrectイ
Sending a notification to the workplace by email is wrong. Sending email uses the network connection of the infected PC, so it should not be done before disconnecting. There is also a risk of spreading the virus as an attachment via the infected PC. Contacting and reporting to the relevant people is necessary, but it should be done by other means after isolating the machine first; it is not something to do immediately.
- ウ
正解 ウ is correct. When a virus infection (or a suspected one) is detected, the top priority is to prevent the infection from spreading, that is, to isolate the machine. Disconnecting the PC from the network immediately cuts off the spread of the virus to other PCs and servers in the company, as well as any unauthorized communication to the outside (remote control, data exfiltration). Containing the damage to a minimum first, and only then moving on to the next steps such as reporting to a supervisor and removing the virus, is the basic procedure for information security incident response.
Incorrectエ
Backing up the files is wrong. If you copy the already-infected files as they are, you back up the virus along with them. If you save them to a shared location on the network, there is also a risk of spreading the infection. Backups should be taken during normal times, not as the top-priority action right after an infection is detected.
ここがポイント
- In the initial response to an information security incident, preventing the spread (isolation) has the highest priority. When a virus is detected, first disconnect from the network to stop propagation and unauthorized communication.
- Restarting, notifying, and backing up all invite wider damage or loss of evidence if done before isolation, so they should be carried out after containment.
用語