A社では，個人情報保護法に従って，個人情報を取り扱っている。Bさんが所属する営業部では，個人の顧客がインターネット上のA社のWebページに会員登録することで，商品購入ができるという事業を開始することになった。そこで，Bさんは会員登録をするWebページの仕組みとして，次の事項を考えた。 〔会員登録をするWebページの仕組み〕 ① 個人情報の利用目的を記述したWebページを表示し，顧客が同意ボタンを押すと，個人情報を入力するWebページに移動する。 ② 会員登録の項目としては，氏名，住所，電話番号，生年月日，性別，メールアドレス，ID及びパスワードがあり，これらは必ず入力してもらう。メールアドレスとパスワードについては，誤入力を防ぐために，同じ情報を2度入力してもらう。 ③ Webページでの個人情報の入力が終了し，送信ボタンを押した後，入力情報を確認するWebページを表示し，顧客に入力の間違いがないかを確認してもらう。このとき，入力されたIDが他の会員によって既に登録されている場合，変更を求める。 ④ 顧客が入力情報を確認し，登録ボタンを押した後，登録したメールアドレス宛に，A社の会員として登録された旨を伝える電子メール（以下，メールという）を送信する。 ⑤ ②及び③における顧客のPCとA社のWebサーバとのデータのやり取りは，暗号化による通信を行う。 A 社では，インターネットサービスプロバイダ（以下，ISP という）のハウジングサービスを使って，Web サーバとデータベースサーバ（以下，DB サーバという）を運用している。会員情報は，ISP の DMZ 内にある Web サーバを経由して，外部から保護された ISP のネットワーク内にある DB サーバに蓄積される。B さんは，会員情報を ISP の Web サーバ又は DB サーバから A 社内の PC に転送する必要があり，その間で個人情報の漏えいが発生しないような仕組みを考えることになった。転送の仕組みとして，適切なものはどれか。
平成24年度 秋期 ITパスポート試験 問100
This question's explanation and your answers so far.
問 100
Incorrectア
This is a method that exports the member information as CSV, writes it into the body of an email, and sends it. Email is not encrypted by default, and it is relayed in plaintext through several mail servers on its way from the sender to the destination. In other words, the personal information is exposed on the route just as it is, and it will be read if it is eavesdropped on. The phrase “perform a virus check first” in the choice is a measure that prevents malware from getting mixed in; it is not a countermeasure against eavesdropping (confidentiality), so it does not meet the leakage-prevention requirement the question asks about.
- イ
正解 What this question asks is a single point: whether member information, which is personal information, can be kept from being eavesdropped on over the transfer section that passes through the Internet. Choice イ first sets up a VPN (Virtual Private Network) between the ISP and Company A. A VPN is a technology that builds an encrypted tunnel over the public network that is the Internet, and communication passing through the tunnel cannot be read even if it is intercepted somewhere along the route. Therefore, even if the file transfer flowing inside it uses FTP, which has no encryption function, the VPN side wraps the whole communication and encrypts it, so member information never flows over the Internet in plaintext. In addition, it is appropriate that the transfer source is the DB server inside the ISP network that is protected from the outside, rather than the Web server in the DMZ. The official place where member information is accumulated is the DB server, and not routing the data through a server exposed on the DMZ keeps the attack surface smaller. Because it satisfies both points — encrypting the route (VPN) and taking the data out from a protected place (the DB server) — イ is the appropriate transfer mechanism.
Incorrectウ
This is a method that writes member information into the body of an email and sends it automatically at the moment of registration; as with ア, personal information is sent by plaintext email, leaving it defenseless against eavesdropping on the route. Furthermore, the order of performing a virus check only after receiving the mail is a step taken once the information has already finished flowing in plaintext, so it does not prevent leakage. The transfer source is also the Web server in the DMZ, which faces the outside, making it more dangerous than イ, which takes the data out of the protected DB server — another inappropriate point.
Incorrectエ
FTP is an old scheme in which the user ID, the password, and the transferred data are all exchanged in plaintext, and by itself it has no encryption function. If plain FTP crosses the Internet without the backing of an encrypted route such as a VPN, member information ends up flowing in plaintext. “Perform authentication with an ID and password” is an identity-checking (authentication) mechanism that confirms whether the party connecting is legitimate; it is a different thing from ensuring confidentiality, which hides the content of the communication from third parties. Adding authentication still does not prevent eavesdropping, so this does not meet the requirement.
- When personal information is carried across a public network such as the Internet, encrypting the route itself is essential. A VPN (Virtual Private Network) is a technology that builds an encrypted tunnel over a public network; if data is sent through it, the content can be protected even with a protocol that has no encryption function of its own, such as FTP.
- “Authentication” and “encryption” have different purposes. Authentication with an ID and password confirms whether the other party is legitimate, while encryption keeps third parties from reading the content of the communication. In the same way, a virus check is a measure against malware and is not a countermeasure against information leakage caused by eavesdropping.
- Both email and FTP travel in plaintext by default. A method that writes personal information directly into the body of an email and sends it is asked about in the IT Passport exam as a typical example of an inappropriate practice.