問81
頻出度★★★
職場でのパスワードの取扱いに関する記述 a～d のうち, 適切なものだけを全て挙げたものはどれか。 a 業務で使用するパスワードをプライベートで Web サービスに利用する。 b 個人用パスワードはシステム管理者にも教えない。 c パスワードは定期的に変更するだけでなく, 第三者に知られた可能性がある場合にも変更する。 d 付与された初期パスワードは, 最初にログインしたときに変更する。
平成23年度 秋期 ITパスポート試験 問81
This question's explanation and your answers so far.
解説
問 81
Incorrectア
Statements b and c are appropriate, but this option is wrong because it also includes a, which is inappropriate. Statement a means using a password used for business at a private Web service as well, in other words reusing the same password. Web services used privately are often managed to a lower standard than workplace systems, and once a pair of user ID and password leaks from such a service, an attacker will try that pair on other sites as well (a password list attack, also called credential stuffing). As a result, unauthorized access can reach the workplace system, so as a rule passwords for business use and for private use must always be kept separate. This option also drops d, which is appropriate, so on that count as well it fails the condition of listing all and only the appropriate statements.
Incorrectイ
Simply by including a, which is inappropriate, this option is already wrong. In addition, the appropriate statements b (do not tell your personal password even to the system administrator) and d (change the assigned initial password at the first login) are both missing, and the only one listed is c. The question asks for all and only the appropriate statements, so neither mixing in an inappropriate one nor leaving out an appropriate one is allowed.
- ウ
正解 The correct answer is ウ. The appropriate statements are the three items b, c, and d. Statement b expresses the basic principle that a password assigned to an individual must not be told to anyone else. A system administrator has the authority to initialize or reset a user password, so the administrator does not need to know the password itself. In fact, only by keeping it known to the user alone can we say that an operation performed with that password was performed by that user, which is what makes accountability, the tracing of responsibility, possible. Someone claiming to be an administrator and asking for a password is also a classic form of social engineering, so the correct practice is to tell no one, whoever they claim to be. Statement c describes the practice of not relying on periodic changes alone, but changing the password immediately as soon as there is a possibility that a third party has learned it. The risk of a password rises not only as time passes but also suddenly, through events such as peeking, eavesdropping, phishing, or a leak on the service side. Once such a sign is noticed, changing the password without waiting for the next scheduled change is essential to preventing damage before it occurs. Statement d describes the practice of changing an assigned initial password at the first login. The initial password is known to the administrator who issued it, and it is delivered through routes that people other than the user may see, such as a notification e-mail or a printed document, so if it keeps being used as it is, the premise that the secret is known only to the user collapses. Only when it is changed at the first login to a value known only to the user does it begin to function as that user's own credential. In contrast, only a is inappropriate, so ウ, which lists exactly b, c, and d with nothing missing and nothing extra, is the answer.
Incorrectエ
Both c and d are appropriate, and it is correct that this option does not include the inappropriate a. However, it drops b, which is appropriate, so it does not list them all. Statement b, do not tell your personal password even to the system administrator, follows a basic principle of authentication: even an administrator does not need to know the password itself (it can simply be reset when necessary), and keeping it known only to the user is what guarantees that an operation was really performed by that user, so it is an appropriate statement. It is also important for preventing incidents in which someone answers an inquiry from a person impersonating an administrator, so it must not be excluded.
ここがポイント
- Basic principles of password management — a password is a secret known only to its owner, and it is not told to anyone else, including the system administrator. An administrator can reset a password but does not need to know the user's own password; keeping it known only to that person is what makes the tracing of responsibility, namely the claim that the operation was performed by that person, hold up. Extracting a password while claiming to be an administrator is a classic social engineering technique.
- No reuse, and the right moments to change — if a business password is reused at a private Web service, a leak from that service can lead, through a password list attack (credential stuffing), to unauthorized access to the workplace system. Changing a password must also be done not only on a periodic schedule but at every moment when it may have been compromised, such as when a third party may have learned it, or when replacing an initial password issued by an administrator at the first login.
用語