問86
頻出度★★★
情報セキュリティにおけるリスクアセスメントを, リスク特定, リスク分析, リスク評価の三つのプロセスに分けたとき, リスク分析に関する記述として, 最も適切なものはどれか。
令和4年度 ITパスポート試験 問86
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 86
- ア
正解 Risk analysis is the process of combining, for each identified risk, its “likelihood (frequency of occurrence)” and its “consequence (magnitude of impact)” to estimate the size of that risk, that is, its risk level. The level obtained here is then compared against the acceptance criteria (a benchmark for acceptable risk) in the subsequent risk evaluation to decide whether a response is needed. Choice ア states exactly that it is necessary to determine the level of each risk so that it can be compared against the acceptance criteria, which correctly expresses the very role of risk analysis, so it is the correct answer.
Incorrectイ
“Making all information assets the target of analysis” concerns the scope of analysis, not the definition of risk analysis. The risks that should be analyzed are the ones already surfaced in the earlier risk identification step, and in practice the targets may even be narrowed down according to their importance. This is not a description of risk analysis, so it is incorrect.
Incorrectウ
It is not necessary to “use the same analysis technique for all identified risks.” Depending on the nature of the risk and the availability of data, you may use different techniques such as quantitative analysis or qualitative analysis. On the contrary, forcing a single uniform technique can sometimes make a proper level assessment impossible, so as a requirement for risk analysis this is incorrect.
Incorrectエ
“Determining whether a risk is acceptable” is the role of the later step, risk evaluation, which compares the level obtained from risk analysis against the acceptance criteria to decide whether a response is needed. Risk analysis goes only as far as determining the level; it does not make the acceptability judgment, so as a description of risk analysis this is incorrect.
ここがポイント
- Risk assessment consists of three stages: risk identification (listing out the risks) → risk analysis (estimating the level of each risk) → risk evaluation (comparing against the acceptance criteria to decide whether a response is needed) (JIS Q 27000 / ISO 27005).
- Risk analysis is the process that determines the risk level, while risk evaluation is the process that determines acceptability; not confusing the roles of the two is the key point of this question.
用語