問67
頻出度★★★
情報資産に対するリスクは, 脅威と脆弱性を基に評価する。脅威に該当するものはどれか。
平成30年度 秋期 ITパスポート試験 問67
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 67
Incorrectア
'Unencrypted communication' is a management-level weakness that can be exploited by the threat of eavesdropping; it corresponds to a vulnerability, not a threat.
Incorrectイ
'Inconsistent methods for handling confidential documents' is an operational-management deficiency (weakness) that could lead to information leakage; it corresponds to a vulnerability, not a threat.
Incorrectウ
'A door that cannot be locked' is a physical weakness that can be exploited by the threat of unauthorized intrusion; it corresponds to a vulnerability, not a threat.
- エ
正解 エ is correct. A threat is a cause or event, external or internal, that could cause damage to information assets. 'An unexpected power outage caused by lightning or similar events' occurs outside the organization and is itself an event that threatens the availability of information assets (systems and data), so it exactly corresponds to a threat. A threat exists independently of whether a weakness is present; risk becomes manifest when that threat exploits a vulnerability (weakness) — that is the relationship between them.
ここがポイント
- Threat = a cause or event, external or internal, that could cause damage to information assets; vulnerability = an internal weakness that a threat can exploit. Risk is assessed by combining the two.
- Descriptions of weaknesses such as 'cannot do X' or 'X is insufficient / inconsistent' are vulnerabilities, whereas events or acts that exploit those weaknesses to damage assets (power outages, disasters, attacks, insider wrongdoing or operating mistakes, etc.) are threats — distinguish them this way.
用語