問90
頻出度★★★
情報セキュリティにおける物理的及び環境的セキュリティ管理策であるクリアデスクを職場で実施する例として, 適切なものはどれか。
令和5年度 ITパスポート試験 問90
This question's explanation and your answers so far.
解説
問 90
Incorrectア
Working at any vacant desk without a fixed seat is about a “hot desking” (free address) work style and seating arrangement, whose purpose differs from a clear desk policy of tidying the desk so that no information is left behind. In fact, if documents are left on the desk, because the seats are shared, there is even a risk of others seeing them.
- イ
正解 A clear desk policy is a physical and environmental security control: do not leave documents, notes, USB drives, or other storage media containing information on the desk, and tidy them away properly (locking them up if necessary) when you step away from your seat or leave work. Documents left out create an information-leakage risk of being peeked at, taken away, or photographed by a third party. Choice イ, “Do not leave documents or other materials containing information on the desk when stepping away from the seat,” is exactly the act of keeping the desktop free of information, so it is an appropriate example of implementing a clear desk policy.
Incorrectウ
Removing the LAN cable and using an encrypted wireless LAN is a “communication and network security” measure that protects the communication path; it is a different control from a clear desk policy, which tidies away physical information (documents and media) on the desk.
Incorrectエ
Locking the PC with a password when stepping away is an example of a “clear screen” policy. It is a measure to keep information shown on the screen from being seen by a third party, and it is distinguished from a clear desk policy, which leaves no documents on the desk (the two are often mentioned together but are different things).
ここがポイント
- Clear desk = a physical security control of not leaving documents or storage media on the desk when stepping away or leaving for the day. Remember it as a pair with clear screen (locking the PC screen).
- This question tests the distinction between the controls: “leaving no physical information on the desk” is clear desk, while “not letting information on the screen be seen” is clear screen.
用語