問86
頻出度★★★
情報セキュリティのリスクマネジメントにおけるリスク対応を, リスクの移転, 回避, 受容及び低減の四つに分類するとき, リスクの低減の例として, 適切なものはどれか。
令和元年度 秋期 ITパスポート試験 問86
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 86
Incorrectア
This withdraws from the confidential-information service, stopping the very activity that is the source of the risk. This is an example of risk “avoidance,” not reduction.
Incorrectイ
This takes out insurance to prepare for a leak, having a third party (the insurance company) bear the loss instead. This is an example of risk “transfer,” not reduction.
Incorrectウ
This judges the theft risk to be low and deliberately takes no additional measures, holding the risk as it is. This is an example of risk “acceptance (retention),” not reduction.
- エ
正解 エ is correct. Risk “reduction” means keeping the activity itself going while taking safety measures to lower the probability that the risk occurs or the size of the damage. If the information stored on the notebook PC’s HDD is encrypted in advance, then even if loss or theft happens the information inside is hard to read, so the damage of information leakage is kept small. The use of the notebook PC itself is not stopped; the level of danger is instead lowered through a measure, which is exactly an example of reduction.
ここがポイント
- The four categories of risk treatment — avoidance (stop the causal activity), transfer (pass it to a third party via insurance, etc.), acceptance/retention (accept it as is without measures), and reduction (make the probability and impact smaller through measures).
- How to spot reduction — whether, while the business or activity continues, the size of the risk is lowered through safety measures such as encryption or access control.
用語