問70
頻出度★★★
電子メールに対するウイルス検査に関する記述のうち, 適切なものはどれか。
平成24年度 秋期 ITパスポート試験 問70
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 70
Incorrectア
Incorrect. Encryption exists so that third parties cannot read the contents of a communication; it is not a guarantee that the contents are free of viruses. On the contrary, while the mail remains encrypted, antivirus software and mail gateways cannot scan its contents, so a virus slips past the check and the danger is in fact greater. Encrypted mail must always be virus-scanned after it is decrypted, so encryption is not a reason to skip scanning.
Incorrectイ
Incorrect. Even when the sender scans the mail, the sender's virus definition file (pattern file) may be too old to detect a new virus, the sender may be infected and send the mail without noticing, or the sender may not scan at all. As a principle, virus scanning is performed in multiple layers -- both when sending and when receiving, and furthermore on both the mail server and the client -- so scanning at the time of receipt must not be omitted.
- ウ
正解 The correct answer is ウ. Even if an attachment is an image file with the extension “jpg”, it must not be excluded from virus scanning. There are two reasons. First, the extension is only part of the file name and does not guarantee what the file actually is. An executable file may be given a name such as “photo.jpg” so that it looks like an image, or a double extension such as “report.jpg.exe” may be used so that it looks like an image in an environment where extensions are not displayed; safety cannot be judged from the extension alone. Second, even a genuine image file may contain data crafted to exploit a vulnerability in the software that displays images, and malware can run simply by opening it. Therefore, all attachments should be virus-scanned regardless of the type of extension, which makes ウ the correct statement.
Incorrectエ
Incorrect. Even mail from someone you know may be infected: that person's device may have been infected and be abusing the address book, sending a virus without the owner being aware of it. In addition, the sender address is easy to forge, and targeted attack mail that impersonates a business partner or a colleague is common. Scanning targets cannot be selected according to whether the sender is known or unknown, so all received mail must be scanned.
ここがポイント
- Virus scanning of attachments is applied to every attachment, without selecting targets by extension, by sender, or by whether the mail is encrypted. Because extensions can be faked, double extensions exist, and files can be crafted to exploit vulnerabilities in viewer software, the judgment that a file is safe because it is an image file does not hold.
- The basis of virus scanning is defense in depth carried out both when sending and when receiving (on the server side as well as the client side), and the virus definition file is always kept up to date. Encrypted mail is scanned after it has been decrypted.
用語