問64
頻出度★★★
情報セキュリティのリスクマネジメントにおけるリスクへの対応を, リスク共有, リスク回避, リスク保有及びリスク低減の四つに分類するとき, リスク共有の例として, 適切なものはどれか。
令和6年度 ITパスポート試験 問64
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 64
Incorrectア
Setting up a backup center at a remote location is a response that keeps system downtime short and reduces the scale of damage even when a disaster occurs, which falls under risk reduction (lowering the impact level of the damage). It does not transfer the risk itself to a third party, so it is not risk sharing.
- イ
正解 Risk sharing (risk transfer) refers to a response in which part or all of a loss or liability is shifted to a third party through measures such as taking out insurance or outsourcing, so that the organization does not bear the risk entirely on its own. Choice “イ” is a mechanism in which, by taking out cyber insurance, the insurance company bears on the organization’s behalf the monetary losses, namely the damages and incident-handling costs arising from an information leak. Because the loss that occurs is shared with and transferred to a third party, this is exactly a typical example of risk sharing, and it is the correct answer.
Incorrectウ
A mechanism that requires a supervisor’s approval to send an e-mail with a file attached is a control that lowers the likelihood (probability of occurrence) of an information leak, which falls under risk reduction. It does not share the loss with a third party, so it is not risk sharing.
Incorrectエ
Encrypting the HDD of a laptop PC is a response that makes the contents unreadable even if loss or theft occurs, thereby preventing the damage of an information leak, which falls under risk reduction. It does not transfer the risk to a third party such as an insurance company, so it is not risk sharing.
ここがポイント
- The four categories of risk treatment: risk avoidance (eliminating the risk factor) / risk reduction (lowering the likelihood or impact) / risk retention (tolerating and accepting it) / risk sharing and transfer (sharing with or transferring to a third party through insurance or outsourcing).
- Taking out insurance is a representative example of risk sharing (risk transfer). The distinction to make is that technical and physical preventive measures (encryption, backup, approval workflows) are classified as risk reduction.
用語