問65
頻出度★★★
シャドーITの例として,適切なものはどれか。
令和3年度 ITパスポート試験 問65
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 65
Incorrectア
This is backing up important data to a remote location in accordance with company rules to prepare for a disaster—a legitimate operation (disaster recovery / BCP) that follows the procedures the organization has defined. It lacks the element of being unapproved by the IT department, so it is not shadow IT.
Incorrectイ
This is peeking at another employee entering their password (shoulder surfing) to obtain the credential and then logging in illegitimately—an example of unauthorized access or social engineering. It is a different kind of thing from shadow IT, which is about using unapproved IT devices or services.
Incorrectウ
This is locking the screen when leaving the desk so that the screen is not peeked at—a recommended, correct security measure (clear-screen policy). It is not using IT without permission outside the organization's control, so it is not shadow IT.
- エ
正解 Shadow IT refers to IT devices or cloud services that employees independently introduce and use for their work, even though the company's IT department is not aware of them or has not approved them. In choice エ, an employee uses their own judgment to send a work file via an online storage service that the company has not approved—exactly the kind of IT that is used without permission, outside the organization's control. Using unapproved services is regarded as a problem because it puts risks such as information leakage beyond the organization's control, and エ is the typical example, so エ is correct.
ここがポイント
- Definition of shadow IT: IT devices or cloud services that employees independently introduce and use for work without the approval or involvement of the company's IT department or managers (e.g., using company-unapproved online storage, or using personal devices for work). Because they are outside management control, risks such as information leakage cannot be brought under the organization's control, which is the problem.
- Distinguishing it from similar terms: it is a different concept from unauthorized access and shoulder surfing (choice イ), legitimate operation (choice ア), and recommended security measures (choice ウ). The key to the judgment is whether unapproved IT is being used.
用語