Information Security Management Examination — knowledge map
The 73 core concepts of Information Security Management Examination and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (73)
Malware
A collective term for malicious software created to harm users, including viruses, worms, trojan horses, and ransomware. Infection routes are varied, including email attachments, visiting malicious sites, and USB drives.
Related: Ransomware
Authentication (AuthN)
Verifying "who you are" (identity); performed before authorization.
Related: Authorization (AuthZ)
Risk assessment
The process of identifying, analyzing, and evaluating risk by surveying the threats and vulnerabilities affecting information assets. It quantifies risk magnitude (likelihood times impact) as the basis for subsequent risk treatment decisions, forming the core of the Plan phase in the ISMS PDCA cycle.
Prerequisites: PDCA cycle
Related: Risk treatment (reduction, avoidance, transfer, acceptance)、Information asset
Availability rate
The proportion of time a system operates correctly. Availability = MTBF ÷ (MTBF + MTTR); it rises as time-between-failures grows and repair time shrinks. A core availability metric, also used as an agreed SLA target (e.g., 99.9%).
Prerequisites: CIA triad、MTBF (mean time between failures)
CIA triad
The three pillars of information security: Confidentiality, Integrity, Availability.
Related: The CIA triad (confidentiality, integrity, availability)
Authenticity
An extended element of information security ensuring that a user, piece of information, or process is genuinely what it claims to be, free of impersonation or forgery. Digital signatures and multi-factor authentication substantiate authenticity. It supplements the core CIA triad (confidentiality, integrity, availability) and appears in exam questions distinguishing the seven security elements.
Prerequisites: Authentication (AuthN)、CIA triad、The CIA triad (confidentiality, integrity, availability)
Insider threat
Deliberate misconduct by someone inside the organization — an employee or contractor — who abuses legitimate access to exfiltrate or tamper with information or disrupt systems. It is harder to detect than external attacks and is often explained by the fraud triangle: motive (grievance, money), opportunity (excessive privilege), and rationalization. Access-log monitoring and separation of duties are the main countermeasures.
Prerequisites: Separation of duties
Digital signature
A technology that uses public-key cryptography to prove both that an electronic document was created by the claimed author (authenticity) and that the document has not been tampered with (integrity).
Prerequisites: Authenticity、CIA triad
HSM (Hardware Security Module)
A tamper-resistant device that generates, stores, and performs operations with cryptographic keys entirely within dedicated hardware, preventing private keys from ever being extracted to software or the outside. Because the private key is never held in plaintext in OS or application memory, it greatly reduces the risk of key leakage even if malware infects or a server is breached. It is a representative implementation of the "storage" stage of the key management lifecycle.
Prerequisites: Malware、Tamper resistance、Key management lifecycle (generation, storage, rotation, destruction)
Information asset
Information that has value to an organization and is subject to risk assessment, together with the systems that handle it. It covers not only the data itself — such as customer records or design documents — but also the equipment (servers, PCs) that stores or processes it, and related business processes. Building an inventory and rating importance (confidentiality, integrity, availability) is the starting point of asset management.
Prerequisites: CIA triad
Related: Risk assessment
Ransomware
Malware that encrypts files on an infected PC or server, rendering them unusable, and demands payment in exchange for decryption. In recent years, the dominant tactic is "double extortion" — threatening to leak exfiltrated data in addition to withholding the decryption key. Taking backups and keeping them isolated (offline) is an effective countermeasure.
Related: Malware
CSIRT
An organizational team dedicated to responding to computer security incidents. It handles detection, analysis, response, and prevention of recurrence, and often coordinates with external CSIRTs and related agencies.
Act on the Protection of Personal Information
A law that requires businesses handling information that can identify a specific individual, such as name and date of birth, to specify the purpose of use, acquire data appropriately, implement safety-management measures, and restrict third-party disclosure without the individual's consent.
Phishing
A fraud technique that lures victims to fake emails or websites impersonating real companies or financial institutions, in order to steal IDs, passwords, or credit card information. Carefully checking the URL and domain is a basic countermeasure.
Targeted attack
An attack that aims at a specific organization or individual, for example through a targeted attack email disguised as being related to the recipient's work, in order to steal confidential information or damage systems — unlike scattershot attacks aimed at an unspecified large number of targets.
Separation of duties
A design principle that avoids concentrating powerful privileges in one person—e.g., separating requester and approver—to prevent unilateral abuse/error; used with least privilege.
Backup strategy (full, differential, incremental, and the 3-2-1 rule)
A full backup copies all data every time — fastest to restore but slow and storage-heavy to take. A differential backup copies only changes since the last full backup, while an incremental backup copies only changes since the previous backup (full or incremental), making backups faster to take but restoration more complex since multiple backups must be applied in sequence. The 3-2-1 rule states that data should be kept in 3 copies (original plus two copies), on 2 different types of media, with 1 copy offsite; keeping a copy offline is also emphasized as a ransomware countermeasure.
Prerequisites: Ransomware
Business email compromise (BEC)
A scam technique in which an attacker impersonates a business partner or executive by email to trick the target into wiring money to a fraudulent account or disclosing confidential information. Unlike malware-based attacks, it exploits gaps in business processes and manufactured urgency, similar to phishing but narrowly targeted. Requiring multi-person approval and phone verification when changing payment details is a common countermeasure.
Cryptographic obsolescence
The phenomenon in which a cryptographic algorithm or key length once considered secure becomes breakable within a practical time frame, owing to advances in computing power or cryptanalysis. Continuing to use an obsolete scheme — such as short-key RSA or an outdated hash function — raises the risk of decryption or tampering, so readiness to migrate to stronger algorithms in a planned way (crypto-agility) is needed.
Prerequisites: Hash function (tamper detection)
Related: Crypto-agility (responding to cryptographic obsolescence)
JVN (Japan Vulnerability Notes)
A portal jointly operated by JPCERT/CC and IPA that publishes vulnerability information and countermeasures for software used in Japan. Entries note the corresponding CVE ID and severity (CVSS) and serve as a primary reference for vulnerability response.
Prerequisites: CVSS (severity)、JPCERT/CC
Key management lifecycle (generation, storage, rotation, destruction)
The set of processes for safely operating cryptographic keys: (1) generation—creating a key of sufficient strength by a secure method; (2) storage—safeguarding keys (e.g., in an HSM) to prevent private-key leakage; (3) rotation—periodically renewing keys to limit the damage scope if one is compromised; and (4) destruction—securely deleting unneeded keys so they cannot be recovered. Because a leaked private key undermines the trustworthiness of everything encrypted or signed with it, the storage stage requires particularly strong controls.
Offline (air-gapped) backup
A backup kept physically or logically disconnected from the network. A backup that stays continuously connected (an online backup) can itself become a target that ransomware encrypts or destroys, so keeping at least one copy offline (air-gapped) preserves a recovery path even after infection. It is often combined with the 3-2-1 rule (three copies of data, on two types of media, with one copy off-site).
Prerequisites: Backup strategy (full, differential, incremental, and the 3-2-1 rule)、Ransomware
Risk treatment (reduction, avoidance, transfer, acceptance)
Four response strategies chosen based on risk assessment results. Reduction lowers likelihood or impact through controls; avoidance stops the activity causing the risk; transfer shifts the risk to a third party via insurance or outsourcing; acceptance tolerates the risk without further action when it falls within an acceptable range. The choice balances cost against effect.
Related: Risk assessment
Targeted-attack email drill
A training exercise in which employees are sent simulated targeted-attack emails that mimic real attacks, measuring open and click rates to raise awareness and reinforce response procedures. Results are aggregated to provide additional training for employees who opened the email and to reinforce the procedure for reporting suspicious mail.
Prerequisites: Targeted attack
Internal control
The mechanisms and structures a company builds into its own business processes so that operations are carried out appropriately and efficiently. It aims to prevent fraud and ensure reliable financial reporting, and responsibility for establishing and operating it rests with management.
PDCA cycle
A method for continuously improving operations or management by repeating Plan, Do, Check, and Act. The key point is not to stop after one cycle: the result of Act feeds into the next Plan.
SLA and SLM
An SLA (service level agreement) is a document agreed between a service provider and its users specifying quality targets such as uptime and response time. SLM (service level management) is the ongoing activity of monitoring and reviewing that agreement.
Prerequisites: Availability rate
System audit
An activity in which an independent auditor verifies and evaluates, from a third-party standpoint, whether an information system is operated safely and efficiently, and advises on improvements. Independence from the audited department is a precondition for the audit's credibility.
Tamper resistance
The ability of an IC card or security chip (such as a TPM) to protect internal secrets (keys, etc.) against attempts at physical disassembly, observation, or alteration. It is an implementation property that makes reading out information or tampering difficult against side-channel and physical attacks.
Antivirus detection methods (pattern matching and behavior-based detection)
Pattern-matching (signature-based) detection checks files against a definition (pattern) file recording known malware characteristics; it is highly accurate against known threats but depends on keeping the definition file up to date and cannot detect unknown malware (zero-day) not yet in the file. Behavior-based detection instead monitors what a program actually does, so it can catch unknown malware without relying on definitions, but it can raise false positives by flagging legitimate activity as malicious. In practice the two methods are combined for layered defense.
Prerequisites: Malware
CISO (Chief Information Security Officer) and security committee
The CISO is an executive-level role responsible at the management level for an organization's overall information security, linking business strategy to security investment and measures. The security committee is a body, convened under the CISO, in which representatives from each department deliberate on organization-wide policy and coordinate cross-departmental issues, preventing bias or silos from decisions made by a single department. Together they form the core governance structure for driving information security across the whole organization rather than leaving it to one department.
Crypto-agility (responding to cryptographic obsolescence)
Cryptographic obsolescence ("crypto degradation") is the phenomenon where a cipher or key length once considered secure becomes breakable due to increased computing power or newly discovered attack techniques. Administrators must not assume "secure at deployment means secure forever"; instead they need the capability to continuously track obsolescence and proactively migrate to stronger ciphers or key lengths — this readiness is crypto-agility. Recently, concern that quantum computers could break current public-key cryptography has made planned migration to post-quantum cryptography (PQC) an important aspect.
Related: Cryptographic obsolescence
EDR (Endpoint Detection and Response)
A mechanism that continuously monitors and records behavior on endpoints such as PCs and servers, detecting suspicious post-intrusion activity (process launches, network connections, file changes) and enabling isolation or investigation. Whereas antivirus is an entry-point control that detects known patterns, EDR assumes intrusion will happen and provides after-the-fact response and visibility.
Prerequisites: Layered defense (entry, internal, and exit controls)
JPCERT/CC
A general incorporated association that accepts incident reports, supports response, and issues alerts for computer security incidents in Japan. As a neutral coordinating body independent of any specific government agency or company, it also serves as a hub for information sharing among CSIRTs at home and abroad.
Prerequisites: CSIRT
Layered defense (entry, internal, and exit controls)
A design philosophy premised on the idea that intrusion can never be prevented with 100% certainty, combining entry controls (firewalls/WAF to block intrusion itself), internal controls (privilege management and EDR to contain damage after intrusion), and exit controls (DLP and proxies to stop data exfiltration) in multiple layers, avoiding over-reliance on any single measure.
Physical security controls (entry/exit management and tailgating prevention)
Controls that restrict and log entry to server rooms and offices using ID-card or biometric access management, locks, and surveillance cameras. Tailgating (piggybacking) — an unauthorized person entering right behind an authorized one — cannot be stopped by access management alone, so it is prevented with a mantrap (an interlocking double-door that lets only one person through at a time), guard observation, and keeping entrants alert. In addition, anti-passback — rejecting consecutive entries on the same ID or re-entry with no exit record — helps detect card sharing and tailgating.
Sandbox (malware analysis)
A mechanism that safely runs an unknown executable — such as an email attachment — inside a virtual environment (sandbox) isolated from production, to check for suspicious behavior before it can cause harm. Its value is that even malware that slips past pattern-matching detection can be observed in a harmless environment before execution; however, sandbox-evading malware that detects it is running inside a sandbox and disguises its activity is an emerging challenge.
Prerequisites: Malware
Supply chain attack
An attack technique that infiltrates a target not directly but via a business partner, subcontractor, or the supplier of software/libraries it uses, where security is weaker. Typical examples include unauthorized access through a subcontractor or malware inserted into a software update. Assuring subcontractors' security levels through contracts and audits is a key countermeasure.
Prerequisites: Malware
Vulnerability assessment
A service or activity in which tools or specialists inspect web applications, network devices, or servers for known vulnerabilities. Its purpose differs from penetration testing — which tries to actually break in — in that vulnerability assessment aims to exhaustively list known weaknesses.
Related: Penetration testing
SLA (service level agreement)
A contract defining guaranteed uptime; if missed, you may be eligible for service credits (partial refunds).
Prerequisites: Availability rate
Challenge-response authentication
An authentication method in which the server sends a different random value (challenge) each time, and the client responds with a value (response) computed from the password and that random value. Because the password itself never travels over the network, it resists reuse via eavesdropping (replay attacks).
Prerequisites: Authentication (AuthN)
The CIA triad (confidentiality, integrity, availability)
The three fundamental elements of information security management. Confidentiality means only authorized people can access information; integrity means information is accurate and has not been tampered with; availability means information can be accessed whenever it is needed.
Related: CIA triad
ISMS (Information Security Management System)
A systematic management framework an organization operates to appropriately protect its information assets, spanning policy formulation, risk assessment, implementing countermeasures, and review (PDCA). A certification scheme based on the international standard ISO/IEC 27001 exists.
Prerequisites: Information asset、Risk assessment
Segregation of duties
A basic internal-control principle that prevents fraud and error by dividing a sequence of duties — such as approval, execution, recording, and custody — among multiple people rather than concentrating them in one person.
Prerequisites: Internal control、Separation of duties
Symmetric-key cryptography
An encryption method that uses the same key (a shared secret key) for both encryption and decryption. Processing is fast, but the key must be shared securely with each communication partner, making key management increasingly complex as the number of partners grows.
Prerequisites: Key management lifecycle (generation, storage, rotation, destruction)
MTBF (mean time between failures)
For a repairable system, the average operating time from one failure to the next. A larger value means fewer failures and higher reliability. Computed as total operating time ÷ number of failures.
MTTR (mean time to repair)
The average time from a failure until recovery. A smaller value means faster recovery and better maintainability. Computed as total repair time ÷ number of failures; it is part of the denominator in availability = MTBF ÷ (MTBF + MTTR), assessed together with MTBF (mean time between failures) for reliability and maintainability.
Prerequisites: Availability rate、MTBF (mean time between failures)
Account management lifecycle
Managing user accounts through a continuous cycle covering onboarding (issuance and privilege assignment), transfer (access review and reconciliation), and offboarding (prompt deactivation and deletion). Failing to delete a departed employee's account, or leaving stale privileges after a transfer, creates an opening for insider misuse or unauthorized login, making periodic reconciliation tied to HR records essential.
Prerequisites: Insider threat
System audit execution phases (preliminary survey, main survey, follow-up)
After the audit plan is set, the execution phase begins with a preliminary survey that gathers overview materials—such as the audited organization's structure and how access rights are managed. The main survey follows, extracting and verifying concrete evidence such as actual logs and change records to identify issues. After the audit report, a follow-up later confirms whether the recommended corrective actions were actually implemented.
Prerequisites: System audit
Penal Code (obstruction of business by damaging a computer)
A Penal Code provision that punishes obstructing another's business by damaging or tampering with a computer or its electromagnetic records, or by feeding it false information or unauthorized commands so that it fails to operate as intended or operates contrary to its intended purpose. This provision can apply when malware infection destroys systems or tampers with data in a way that disrupts business operations.
Prerequisites: Malware
Cybersecurity Management Guidelines
Guidelines formulated by the Ministry of Economy, Trade and Industry (METI) and IPA to help business executives drive cybersecurity measures through their own leadership. They consist of three principles executives should recognize and ten important items to direct to a CISO or equivalent, framing security investment as a management issue.
Prerequisites: CISO (Chief Information Security Officer) and security committee
Information security education and training
An ongoing effort that goes beyond drafting rules and regulations, using periodic group training, e-learning, and targeted-attack email drills to instill security awareness and behavior across all employees. It is central to the effectiveness of personnel-based controls, and keeping records of participation and measuring comprehension are key to preventing the program from becoming a formality.
Prerequisites: Targeted attack、Targeted-attack email drill
DLP (Data Loss Prevention)
A mechanism that monitors channels such as email, copying to USB drives, and uploads to cloud storage, detecting, warning about, or blocking the outbound movement of data matching patterns for confidential or personal information. It is used to prevent information leaks caused by insider misconduct or operator error.
Prerequisites: Insider threat
Act on Electronic Signatures and Certification Business
A law providing that an electronic record bearing an electronic signature meeting certain requirements (able to be created only by the signer, allowing detection of alteration, etc.) is presumed to have been created authentically. It is the legal basis for electronic contracts carrying the same legal effect as paper contracts.
Prerequisites: Digital signature
Residual risk
The risk that remains after risk treatment (reduction, avoidance, transfer) has been applied. Because risk can never be reduced to zero, management must judge whether the remaining level is acceptable and formally approve accepting it.
Prerequisites: Risk treatment (reduction, avoidance, transfer, acceptance)
Four categories of controls (technical, physical, personnel, and organizational)
A classification of controls addressing risks identified in risk assessment, grouped by their nature. Technical controls are system/device-based measures such as access control and encryption; physical controls cover space and facilities, such as locks and entry management; personnel controls concern employee behavior and awareness, such as training and pledges; and organizational controls concern rules and structure, such as policies and governance bodies. No single category is sufficient alone — effectiveness comes from combining them in layered defense.
Prerequisites: Physical security controls (entry/exit management and tailgating prevention)、Risk assessment
Statement of Applicability (SoA)
A document that specifies, for each control listed in Annex A of ISO/IEC 27001, whether it is applied or excluded in the organization and the rationale for that decision. It is drawn up based on risk assessment results and is a central artifact examined during ISMS certification audits.
Prerequisites: Risk assessment
Three categories of threats (human, technical, physical)
A classification of information-security threats by their source. Human threats arise from people — insider fraud, operational mistakes, negligence; technical threats use technical means such as malware or unauthorized access; physical threats come from physical harm such as disasters, theft, or destruction. SG places particular emphasis on managing human threats, including insider fraud and negligence.
Prerequisites: Malware、Insider threat
Vendor (outsourcing) management
The practice of confirming and managing, through contracts (NDAs, SLAs), pre-selection evaluation, and periodic audits, that an outsourcing partner maintains a security level equal to or better than the commissioning organization's own, when business operations or system development/operation are outsourced. It aims to prevent information leaks or supply chain attacks originating from the vendor.
Prerequisites: Supply chain attack
Wireless LAN security (rogue AP countermeasures)
Because anyone within radio range can attempt to intercept traffic or connect to a wireless LAN, it is protected with WPA2/WPA3 encryption and authentication, careful SSID management, and MAC address filtering. A particular threat is a rogue access point masquerading as a legitimate one — an evil twin — that lures users into connecting so their traffic can be eavesdropped on or tampered with; users should verify the certificate and authenticity of the SSID they connect to, while organizations use wireless intrusion detection/prevention (WIDS/WIPS) to detect and remove unauthorized APs.
Prerequisites: Authenticity、Authentication (AuthN)
Hash function (tamper detection)
A function that computes a fixed-length value (a hash value) from data of arbitrary length. The same input always produces the same output, and even a tiny change drastically alters the value, which is why hash functions are used for tamper detection and password storage.
Hybrid cryptography
A scheme that combines the processing speed of symmetric-key cryptography with the secure key distribution of public-key cryptography. The data itself is encrypted with a symmetric key, and that symmetric key is then encrypted with the recipient's public key before being sent. Used in S/MIME, PGP, and TLS 1.2 and earlier (note that current TLS 1.3 uses (EC)DHE key exchange and no longer sends a symmetric key encrypted under a public key).
Prerequisites: Symmetric-key cryptography
CVSS (severity)
Common Vulnerability Scoring System—a standard scoring vulnerability severity. For prioritization, combine with EPSS (exploit probability), reachability, and asset criticality.
Multi-factor authentication (knowledge, possession, inherence)
An authentication method that combines two or more different types of factors — knowledge (e.g., a password), possession (e.g., a smartphone or IC card), and inherence (e.g., a fingerprint or face) — to verify identity, making unauthorized login harder even if one factor is compromised.
Prerequisites: Authentication (AuthN)
SCM (Supply Chain Management)
A management approach that shares information across companies along the chain from raw-material procurement through production, distribution, and sales, optimizing the whole to reduce inventory and shorten lead times.
Pseudonymized information and anonymized information
Both are processing categories under the Act on the Protection of Personal Information, but they serve different purposes. Pseudonymized information is processed so the individual cannot be identified unless cross-referenced with other data; it is intended for internal analytical use, with some relaxed restrictions on using it for other purposes without consent, but third-party provision is generally prohibited. Anonymized information is processed so the individual cannot be identified and the data cannot be restored, allowing it to be provided to third parties without consent.
Prerequisites: Act on the Protection of Personal Information
CSIRT operations and SOC
While the CSIRT is the command center for incident response, the SOC (Security Operation Center) is the operational team that monitors logs and alerts around the clock to detect threats and perform initial analysis. Smaller organizations often outsource this monitoring to an MSSP (managed security service provider) rather than building it in-house.
Prerequisites: CSIRT
Penetration testing
A test that attempts to break into a system using the same techniques and perspective as a real attacker, demonstrating that a discovered vulnerability is actually exploitable and how far the resulting damage could spread. Unlike vulnerability assessment, which exhaustively lists weaknesses, it digs deep into a specific attack path.
Related: Vulnerability assessment
Special care-required personal information
A category under the Act on the Protection of Personal Information covering data such as race, creed, medical history, and criminal record, which requires especially careful handling to prevent unjust discrimination or prejudice against the individual. Acquiring it generally requires the individual's consent, and it is subject to stricter protection than ordinary personal information.
Prerequisites: Act on the Protection of Personal Information
Supply chain management (security perspective)
An effort to make the entire supply network for a product or service visible — component suppliers, the software/OSS libraries used, even sub-subcontractors — and to assess and manage security risk at each stage. Maintaining a software bill of materials (SBOM) has recently gained attention as an effective tool for this.
Prerequisites: SCM (Supply Chain Management)