問82
頻出度★★★
JPCERT コーディネーションセンターと情報処理推進機構 (IPA) が共同運営する JVN (Japan Vulnerability Notes) で, “JVN#12345678” などの形式の識別子を付けて管理している情報はどれか。
平成30年度 春期 ITパスポート試験 問82
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 82
Incorrectア
Information about OSS licenses belongs to the domain handled by the individual license texts or organizations such as the OSI (Open Source Initiative); it is not something JVN manages with identifiers. JVN is a site that handles vulnerability information.
Incorrectイ
The latest version information of antivirus software definition files (pattern files) is distributed and announced by each antivirus software vendor on its own site; it is not managed by JVN.
Incorrectウ
Standards for industrial products, measurement methods, and the like fall under the domain of JIS (Japanese Industrial Standards), handled by the Japanese Industrial Standards Committee (JISC); they are not covered by JVN, which is a vulnerability information portal.
- エ
正解 JVN (Japan Vulnerability Notes) is a Japanese portal for vulnerability countermeasure information, jointly operated by the JPCERT Coordination Center and the Information-technology Promotion Agency (IPA). For vulnerabilities in software and devices used in Japan, it assigns identifiers such as “JVN#12345678” and publishes together the details, the affected products, and the countermeasures (fix programs or workarounds). Therefore, the information managed with this identifier is エ, “Vulnerability-related information of software and the like, and its countermeasures,” which is the correct answer.
ここがポイント
- JVN (Japan Vulnerability Notes) is a vulnerability countermeasure information portal jointly operated by JPCERT/CC and IPA; it publishes vulnerability-related information of software and the like, together with its countermeasures, using identifiers of the form “JVN#serial-number.”
- JVN is the place where vulnerabilities reported under the Vulnerability-Related Information Reporting System are coordinated and disclosed; distinguish this role from that of standards (JIS), licenses, and antivirus definition file distribution.
用語