問81
頻出度★★★
J-CRAT に関する記述として, 適切なものはどれか。
令和3年度 ITパスポート試験 問81
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 81
Incorrectア
“A service that monitors networks and devices on a 24-hour basis” describes the role of a SOC (Security Operation Center), not the activity of J-CRAT. J-CRAT is not an organization that provides continuous monitoring services.
Incorrectイ
“Acting as the primary party itself to formulate the response policy and procedures” is wrong. J-CRAT is only in a position to “support” the response of the organization that consulted it; it is not an organization that takes charge of the response on behalf of the party involved. Taking charge of the response as the primary party is closer to the role of each organization itself or of that organization’s CSIRT.
Incorrectウ
“Centered on manufacturers of equipment used in critical infrastructure such as heavy industry and heavy electrical machinery, sharing cyberattack information and providing a venue for early response” describes J-CSIP (Initiative for Cyber Security Information sharing Partnership of Japan), not J-CRAT. J-CSIP is an industry information-sharing framework and has a different purpose.
- エ
正解 J-CRAT (Cyber Rescue Team) is a support organization operated by IPA that specializes in responding to targeted cyberattacks. Its purpose is to help organizations that seek consultation about things such as targeted attack emails to reduce the damage and to cut off the “chain of attacks” by which an attack spreads to other organizations. Choice エ correctly describes exactly this activity (supporting organizations that seek consultation, reducing the damage from targeted cyberattacks, and cutting off the chain of attacks), so it is the correct answer.
ここがポイント
- J-CRAT (Cyber Rescue Team) is an IPA organization that supports organizations that have suffered a targeted cyberattack or sought consultation; its purpose is to reduce damage and cut off the “chain of attacks” (it is in a supporting position, not one that leads the response itself).
- Distinguish it from similar, easily confused organizations and functions: do not mix up SOC (24-hour monitoring), J-CSIP (a venue for information sharing among manufacturers of critical infrastructure equipment), and CSIRT (the party within an organization that handles its own incidents).
用語