問76
頻出度★★★
情報セキュリティのリスクマネジメントにおけるリスク対応を, リスク回避, リスク共有, リスク低減及びリスク保有の四つに分類するとき, 情報漏えい発生時の損害に備えてサイバー保険に入ることはどれに分類されるか。
令和4年度 ITパスポート試験 問76
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 76
Incorrectア
Risk avoidance means stopping or withdrawing from the very activity that causes the risk, thereby eliminating the risk entirely. Taking out insurance prepares for losses while continuing the activity of handling information; since the activity is not stopped, it does not count as avoidance.
- イ
正解 Risk sharing (risk transfer) is a treatment in which a third party takes on the losses that occur when a risk materializes, through means such as insurance or outsourcing. Taking out cyber insurance to prepare for damage caused by information leakage passes the loss amount on to the insurance company to be shared, so it is classified as risk sharing. Therefore the correct answer is イ.
Incorrectウ
Risk reduction means taking measures to lower the probability of occurrence or the degree of impact of a risk (for example, introducing encryption or access control). Cyber insurance does not reduce how likely a leak is to occur or the size of the damage; it only compensates for the loss with money after it happens, so it is not reduction.
Incorrectエ
Risk retention (risk acceptance) means accepting the risk as it is without taking measures, and bearing the loss with your own company if a loss occurs. Taking out insurance has the insurance company take on the loss, which differs from bearing it yourself, so it is not classified as retention.
ここがポイント
- The four categories of risk treatment: risk avoidance (eliminate it by stopping the activity) / risk sharing and transfer (have a third party share it via insurance or outsourcing) / risk reduction (lower the probability and impact with measures) / risk retention (accept it without measures and bear it with your own company).
- Taking out insurance is a typical example of risk sharing (transfer). Judge by whether it is a mechanism that passes the loss on to a third party.
用語