問66
頻出度★★★
a～c のうち, フィッシングへの対策として, 適切なものだけを全て挙げたものはどれか。 a Web サイトなどで, 個人情報を入力する場合は, SSL 接続であること, 及びサーバ証明書が正当であることを確認する。 b キャッシュカード番号や暗証番号などの送信を促す電子メールが届いた場合は, それが取引銀行など信頼できる相手からのものであっても, 念のため, 複数の手段を用いて真偽を確認する。 c 電子商取引サイトのログインパスワードには十分な長さと複雑性をもたせる。
平成24年度 春期 ITパスポート試験 問66
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 66
- ア
正解 The correct answer is ア “a, b”. Phishing is an attack in which the attacker impersonates a real organization such as a bank, an e-commerce site, or a delivery company, lures users to a fake site through e-mail or SMS, and makes the users themselves enter and send secret information such as their ID, password, credit card number, or PIN, thereby stealing it. The attacker does not break the system technically; the attack targets the fact that the user can be made to mistake the impostor for the genuine party. Therefore, an effective measure must be an act of checking whether the party in front of you (the site or the e-mail) is genuine. Judge a to c from this viewpoint. Measure a is to confirm, when entering personal information, that the connection is SSL (HTTPS) and that the server certificate is legitimate. A server certificate is issued by a trusted certificate authority (CA) and certifies the name of the organization operating the site and its domain name. If you check the contents of the certificate, then even a fake site built to look exactly like the real one reveals itself as fake — the domain differs from the legitimate one, the certificate is no longer valid, or the browser shows a warning. In other words, a leads directly to checking whether the party is genuine, so it is appropriate. Measure b is that, when an e-mail arrives urging you to send a cash card number, PIN, or the like, you confirm its authenticity by multiple means even if it appears to come from a trustworthy party such as your bank. The sender name and address of an e-mail are easy to forge, and the layout and logos of the body text can be copied from the real thing, so apparent trustworthiness is no basis for belief. Instead of the link or phone number written in the e-mail, you therefore contact a legitimate address you looked up yourself — in your bankbook, on the back of your card, or on the official website — and check through a separate, independent channel. This too is checking whether the party is genuine, so it is appropriate. (In addition, the knowledge that a financial institution normally never asks you to send a PIN by e-mail supports the validity of b.) On the other hand, the length and complexity of the password in c is, as explained below, a measure against a different attack and does not work against phishing. Therefore only a and b are appropriate, and the correct answer is ア.
Incorrectイ
“a, b, c” treats c as appropriate in addition to a and b, but c is wrong, so this option is inappropriate. A measure like c, giving login passwords sufficient length and complexity, is certainly effective against brute-force attacks, dictionary attacks, and password-list attacks that try credentials leaked from other sites, and it is a basic of information security. In phishing, however, the user types that very password into the input field of a fake site he or she believes to be genuine, and sends it. The attacker needs neither to guess nor to crack anything and simply receives the string as it is sent, so the password is no defense whether it is 20 characters long or mixed with symbols. The question asks strictly for measures that are appropriate against phishing, and being a good practice in general is a different matter from being effective against this attack. This confusion is the biggest pitfall of the question, and イ can be called the wrong answer that is most often chosen.
Incorrectウ
“a, c” is right in that it includes the appropriate a, but it is wrong twice over: it leaves out b, which is effective against phishing, and instead includes c, which has no effect. Measure b is that, for an e-mail urging you to send a PIN or the like, you confirm its authenticity by multiple means even if it appears to be from a trustworthy party. The displayed sender can be forged and the appearance of the body text can be copied from the real thing, so skipping the check on the grounds that it looks like it came from a trustworthy party is precisely what leads straight to falling victim to phishing. Verifying through a channel separate from the e-mail (the official website, the phone number printed on the back of the card, and so on) is a typical and effective way to see through impersonation, and it must not be excluded. The reason c is inappropriate is as explained under イ: password strength is powerless against phishing.
Incorrectエ
“b, c” is right in that it includes the appropriate b, but it leaves out a, which is the key measure against phishing, and includes c, which has no effect, so it is wrong. Checking the SSL connection and the server certificate, as in a, is the most direct means of seeing through a fake site. A phishing site can create a screen indistinguishable from the real one, but it cannot prepare a legitimate server certificate under the legitimate domain name; therefore, if you have the habit of checking the organization name and domain name written in the certificate and of not ignoring browser warnings, you can notice that the site is fake just before entering your personal information. If you drop this from your countermeasures, then once you are lured to a fake site there is no longer any way to prevent the damage. The reason c is inappropriate is as explained under イ: a long, complex password is effective against brute-force attacks and the like, but has no effect against phishing, in which the user enters the information into the fake site himself or herself.
ここがポイント
- The essence of phishing and the direction of countermeasures — Phishing is an attack that impersonates a real organization, lures users with fake e-mails and fake sites, and makes the users themselves enter and send secret information in order to steal it. It does not break the system technically; it targets the point of making the user mistake the impostor for the genuine party. Effective measures are therefore limited to acts of checking whether the party is genuine, and the representative examples are confirming the SSL (HTTPS) connection and the legitimacy of the server certificate (a), and confirming authenticity through a separate channel even when the sender appears trustworthy (b). Keep in mind as well the premise that a financial institution never asks you to send a PIN by e-mail.
- Matching measures to attacks — Whether a security measure is appropriate is judged by whether it works against that particular attack. The length and complexity of a password (c) is effective against brute-force attacks, dictionary attacks, and password-list attacks, but is powerless against phishing, in which the user enters the information into a fake site himself or herself. Likewise, antivirus software is for malware and a firewall is for unauthorized access from the outside: memorize them as attack-and-measure pairs, and do not immediately conclude that something is an appropriate measure just because it is a good practice in general. That is the key to solving this kind of question that asks you to list only all the appropriate items.
用語