問70
頻出度★★★
ISMS におけるリスク分析に関する記述として, 適切なものはどれか。
平成30年度 春期 ITパスポート試験 問70
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 70
Incorrectア
Risk value is fundamentally understood through the relationship “asset value × threat × vulnerability”, and if the levels of threat and vulnerability are the same, the larger the asset value, the larger the risk value. ア says “the smaller the asset value, the larger the risk value”, reversing the size relationship, so it is wrong.
Incorrectイ
Analyzing all risks in detail uniformly is unrealistic and is not even required. Practical risk analysis distinguishes, according to the scale and importance of the system, between targets that need detailed analysis and targets that can be handled with a simple method (such as a baseline), so イ is wrong.
Incorrectウ
Information assets include not only electronic data but also paper documents, people, equipment, and so on. Paper data also carries risks such as leakage and loss, so it must not be excluded from the scope of analysis; ウ, which says “paper media is not included”, is wrong.
- エ
正解 The correct answer is エ. In principle, risk analysis in an ISMS should be carried out using a method that fits the actual situation of the target organization. The kinds of information assets to be protected, the threats that may be expected, laws and regulations, the nature of the business, and so on differ greatly by industry and business type, so the content of risks is not uniform either. Therefore, rather than applying a single, one-size-fits-all method, an analysis method suited to the target organization should be selected and used, which makes エ appropriate.
ここがポイント
- Risk value is captured as “asset value × threat × vulnerability”; if threat and vulnerability are the same, the larger the asset value, the larger the risk value.
- ISMS risk analysis is performed by selecting a method suited to the target organization and business type, and information assets are included in the scope of analysis regardless of whether they are electronic or paper media.
用語