問68
頻出度★★★
CSIRT として行う活動の例として, 最も適切なものはどれか。
令和7年度 ITパスポート試験 問68
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 68
Incorrectア
Regularly applying security patches to the OS and application software is part of routine vulnerability management and system operation (handled by the information systems department or operations staff). Although it is a measure to prevent incidents, it differs from the activities of a CSIRT, which responds when an incident occurs.
Incorrectイ
Formulating a company-wide business continuity plan (BCP) in anticipation of natural disasters such as earthquakes and floods is an activity of business continuity management and risk management. It is not the role of a CSIRT, which specializes in responding to security incidents such as cyberattacks.
- ウ
正解 A CSIRT (Computer Security Incident Response Team) is an organization or team that specializes in responding when an information security incident occurs. Its specific roles include detecting and receiving reports of incidents, investigating and analyzing the scope of impact and causes, providing containment and recovery support to prevent the spread of damage, and sharing information and coordinating communication among stakeholders. Choice ウ, “When a security incident occurs, investigate its scope of impact and support the implementation of measures to prevent the spread of damage,” precisely corresponds to this incident response activity, so it is the most appropriate example of a CSIRT activity.
Incorrectエ
Verifying whether workers' entries and exits were properly recorded on the day work was performed in the server room is an auditing (internal audit) activity that checks the effectiveness of internal controls. It is not an example of a CSIRT activity, which handles incident response.
ここがポイント
- A CSIRT is an organization or team established to deal with the occurrence of information security incidents, specializing in “post-incident response” such as detection, investigation, containment, recovery support, and communication coordination.
- Preventive measures (patch application), BCP formulation, and auditing are separate roles; one should distinguish that the central activity of a CSIRT is “incident response.”
用語