An information security committee (情報セキュリティ委員会) is a deliberative body in which senior management and department heads meet to discuss and decide the organization-wide information security policy and its key measures.
The chair is often a senior executive or the CISO (chief information security officer), and the policies it agrees on are approved by top management and then passed down to each department and to the teams that carry out the work. The committee receives reports on how the measures are being implemented and revises the policy or measures when needed.
AnalogyThink of a school staff meeting. The teachers get together to set the school rules and the plan for the year, but the actual lessons are still taught by each class teacher in their own classroom.
Exam points
Mix-upThe information security committee (情報セキュリティ委員会) is a body that decides policy and measures. The organization that investigates and restores systems on the ground when an incident (インシデント) occurs is the CSIRT.
A CSIRT (Computer Security Incident Response Team, read "see-sert" in Japanese) is a specialist team that investigates the cause, contains the damage and restores systems when a security incident (インシデント) occurs.
Receive report
Analyze situation
Contain and recover
Prevent recurrence
Based on the cause, it draws up measures to prevent a repeat and reports to those concerned.
4 / 4
The full name is Computer Security Incident Response Team, and an incident here means any accident or event that undermines information security, such as unauthorized access or a malware infection. The CSIRT serves as the contact point for reports from inside and outside the company and leads incident response within the organization. It can be a permanent team, or it can be assembled from the relevant departments each time an incident occurs.
AnalogyIt is like a hospital's emergency team. When a patient is rushed in, they assess the condition and treat it, and once things settle down they look into the cause and advise on how to keep it from happening again.
How to rememberIn Japanese it is read "see-sert". The IRT at the end stands for Incident Response Team, so the name itself says "the team that responds to incidents".
Exam points
ExamThe CSIRT is the organization that handles the response after an incident (インシデント) has occurred. Its main work is to establish the scope of the impact and stop the damage from spreading.
Mix-upISMS is a framework for managing information security on an ongoing basis (a management system, マネジメントシステム), not the name of an organization that responds to incidents.
A SOC (Security Operation Center, read "sock" in Japanese) is an organization that continuously monitors network and server traffic and logs, and detects and analyzes signs of attack.
The full name is Security Operation Center, and it often keeps watch 24 hours a day. When it detects an anomaly, it judges how serious it is and then alerts a response team such as the CSIRT. Because the work needs analytical skill and staff on rotating shifts, some organizations outsource monitoring to a specialist provider.
AnalogyIt is like a weather service. It keeps observing day and night, and when it spots signs of danger it issues a warning so that local authorities and others can respond.
How to rememberThe O in SOC stands for Operation, which reminds you that it keeps watch as part of the day-to-day operation that keeps systems running.
Exam points
Mix-upThe SOC is the organization that monitors continuously, even in normal times, to find anomalies. The one mainly responsible for responding to an incident (インシデント) once it is found is the CSIRT.