問61
頻出度★★★
情報セキュリティリスクへの対応には, リスク移転, リスク回避, リスク受容及びリスク低減がある。リスク受容に該当する記述はどれか。
平成30年度 春期 ITパスポート試験 問61
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 61
Incorrectア
“Taking security measures to lower the possibility of a problem occurring” describes risk reduction (mitigation). It is a response that takes measures to make the probability or impact smaller, which is the opposite idea to risk acceptance, where you deliberately take no action.
- イ
正解 Risk acceptance (risk retention) is a response in which you deliberately take no active measures to reduce or avoid the risk, but simply accept it as it is, while anticipating and preparing in advance for the burden to be borne in case damage occurs. Choice イ, “Taking no particular action, while anticipating in advance the burden to be borne if damage occurs,” exactly expresses this idea, and it is applied to small risks whose countermeasure cost is not worth the risk. Therefore イ is correct.
Incorrectウ
“Transferring the risk to others, such as through insurance” describes risk transfer. It is a response that shifts the burden of damage to a third party through insurance or outsourcing, which differs from risk acceptance, where you anticipate bearing the burden yourself.
Incorrectエ
“Eliminating the factors that cause a problem, removing the possibility of the risk occurring” describes risk avoidance. It is a response that eliminates the risk source itself and reduces the possibility of occurrence to zero, which is the exact opposite of risk acceptance, where you accept the risk.
ここがポイント
- The four categories of risk treatment: risk reduction (lowering the possibility and impact of occurrence) / risk transfer (shifting to others via insurance, etc.) / risk avoidance (eliminating the causes and removing the possibility) / risk acceptance and retention (deliberately taking no action and accepting the risk while anticipating the burden).
- The key to identifying risk acceptance is that, in cases such as when the countermeasure cost is not worth the risk, you accept the risk and anticipate in advance the burden to be borne when damage occurs.
用語