問75
頻出度★★★
電子メールの安全性や信頼性に関する記述のうち, 適切なものはどれか。
平成23年度 秋期 ITパスポート試験 問75
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 75
Incorrectア
Incorrect. The body and attachments of an unencrypted email travel across the network exactly as they are, in plaintext. Moreover, email does not go directly from sender to recipient; along the way it is stored and forwarded through several mail servers. It can therefore be eavesdropped on in transit, or its contents can be read by the administrators of the servers it passes through or by an attacker who has broken into one of those servers. As the often-quoted comparison puts it, an unencrypted email is less like a sealed letter and more like a postcard. To protect the confidentiality of the contents, you must take explicit measures such as encrypting the body with S/MIME or PGP, encrypting the attachment itself (for example a password-protected ZIP file), or encrypting the communication path with something like SMTP over TLS.
- イ
正解 The correct answer is イ. SMTP, the protocol used to send and receive email, was designed in the early days of the Internet on the assumption that users communicating with each other could trust one another, and it has no standard mechanism for verifying that the sender is who they claim to be. The sender field (the From header) shown in the recipient email client is, just like the message body, nothing more than a string of text that the sending side can fill in freely; it does not even have to match the line or the mail account actually used to send the message. As a result, it is technically easy for a third party to write the address of an acquaintance, a business partner, or a real company into the sender field and send the message out — what is known as impersonation (spoofing). In practice, targeted attack emails, phishing emails, and mass-distributed malware emails routinely use the tactic of forging the address of someone the recipient knows in order to lower their guard. Therefore, even when the address of an acquaintance appears in the sender field, that is no proof that the person actually sent the message, and the statement in option イ is appropriate. Conversely, to confirm whether the sender really is that person, you need countermeasures added on top of SMTP: the sender attaches an electronic signature (digital signature) using S/MIME or PGP and the receiving side verifies it, or the legitimacy of the sending domain is confirmed through sender domain authentication such as SPF, DKIM, and DMARC. It is also important to have the right operational habits: if anything looks suspicious, check with the person by another means such as a phone call, and do not open attachments or links you were not expecting.
Incorrectウ
Incorrect. Email delivery is best-effort, and there is no guarantee that a message you send will reach its destination. There are many reasons a message may not arrive: a mistyped address, an address that has already been discontinued, the recipient mailbox being over its size limit, an attachment exceeding the size limit, a failure of a server or network along the path, or the message being quarantined or discarded by the recipient spam filter. When the address does not exist, an error message (a bounce message) is often returned, but the message can also simply be lost without even that. For important communications that must get through reliably, you need operational safeguards such as using a read receipt or confirming delivery through another channel.
Incorrectエ
Incorrect. Email has neither encryption nor tamper detection as a standard feature, so an attacker who controls a server it passes through or the communication path can rewrite the body or swap out an attachment (for example replacing the attachment with malware, or altering a bank account number for a transfer). In other words, integrity is not guaranteed. To confirm that the contents have not been altered in transit, you need a mechanism such as S/MIME or PGP, in which the sender attaches an electronic signature and the recipient verifies the signature and the hash value. An electronic signature achieves both tamper detection and confirmation of the sender identity at the same time, which is the flip side of the fact that the premise of this option does not hold.
ここがポイント
- The inherent weaknesses of email — SMTP provides none of the following as standard: sender authentication, encryption, tamper detection, or delivery guarantee. So memorize these four points as a set: in plaintext it can be eavesdropped on (no confidentiality), it can be rewritten in transit (no integrity), the sender field can be forged (no authenticity), and it may not arrive (no delivery guarantee).
- Countermeasures against impersonation — the ways to detect a forged sender (impersonation) are S/MIME and PGP, in which the recipient verifies an electronic signature applied by the sender, and sender domain authentication such as SPF, DKIM, and DMARC. Also keep in mind the difference in their roles: an electronic signature provides both tamper detection and confirmation of the sender identity, while encryption is the countermeasure against eavesdropping.
用語