問82
頻出度★★★
企業内において, 不審な相手から届いた電子メールの添付ファイルを誤って開いてしまったところ, 使用していた PC がウイルス感染を強く疑う挙動を示した。この PC の使用者がまず最初に取るべき行動として, 適切なものはどれか。
平成29年度 春期 ITパスポート試験 問82
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 82
Incorrectア
Updating the virus definition file usually requires a network connection, and if the PC stays connected while infected, the risk of spread and information leakage remains. Scanning and removal should be done after isolation and reporting, under the administrator's instructions; they are inappropriate as the very first action the user takes.
Incorrectイ
Deleting the email cannot remove the infection that has already run, and it risks losing the specimen that would serve as evidence. Moreover, restarting does not stop the infection from spreading, and some malware begins its activity at startup, which can make the situation worse. It amounts to neither containment nor reporting, so it is inappropriate as an initial action.
- ウ
正解 ウ is correct. When a virus infection is strongly suspected, the principles of the initial response are ‘containment (preventing the damage from spreading)’ and ‘reporting’. First, disconnecting the PC from the network prevents the infection from spreading to other PCs or servers, and also cuts off the channel through which malware communicates with the outside to steal information or receive commands. On that basis, contacting the system administrator then lets evidence preservation, cause investigation, removal, and recovery be carried out professionally according to the organization's rules. Rather than the user continuing to handle it on their own judgment, isolating the PC first and then promptly reporting is the most appropriate first move.
Incorrectエ
Initializing the hard disk and reinstalling the OS is a last resort, and it loses all the data needed as evidence of the infection and for cause investigation. The user should not carry it out abruptly on their own judgment; it is a response the organization decides after confirming the scope of damage and identifying the cause. As a first action it goes too far and is inappropriate.
ここがポイント
- For an information security incident, the top priority in the initial response is ‘containment (isolating from the network to prevent the damage from spreading)’ and ‘reporting to the system administrator’.
- The user should not proceed with handling such as removal, restart, or initialization on their own judgment, but should isolate the PC and promptly hand it over to the organization (for evidence preservation and an organized response).
用語