問72
頻出度★★★
情報セキュリティ対策に関する記述 a～c のうち，通信内容を暗号化することによって実現できることだけを全て挙げたものはどれか。 a 通信途中に改ざんされたデータを復旧する。 b 通信内容を第三者に知られないようにする。 c 盗聴された場合に，盗聴した者を特定する。
平成25年度 秋期 ITパスポート試験 問72
This question's explanation and your answers so far.
解説
問 72
Incorrectア
It lists only a, but a, “Recover data that was tampered with during transmission,” cannot be achieved by encryption. Encryption merely hides the content; it has no function to restore data whose bits were rewritten along the way. Tampering is “detected” by hash values (message digests), digital signatures, or message authentication codes, while “recovery” is handled by resending the data or restoring it from a backup. In addition, this option does not include the correct item b, so it is wrong twice over.
Incorrectイ
Item b is correct, but this option is wrong because it also includes a. As stated above, encryption has no function for recovering tampered data. Since the question asks for the option that lists all and only the correct items, an option becomes incorrect as soon as even one wrong item is mixed in.
Incorrectウ
Both a and c are wrong, and on top of that the only correct item, b, is missing. Item c, “Identify the eavesdropper when communication is intercepted,” also cannot be achieved by encryption. Even with encryption, the electrical signals or radio waves themselves can still be received by a third party, and encryption neither records the act of eavesdropping nor traces its source. Tracing and identifying eavesdroppers or unauthorized users is the role of other measures, such as monitoring access logs and communication logs, or intrusion detection systems.
- エ
正解 The correct answer is “エ” (b only). Encrypting the communication content is a technique that converts the data flowing over the communication channel into a form that a third party without the key cannot decipher, and it is a measure for protecting “confidentiality,” one of the three elements of information security. Therefore b, “Prevent the communication content from being known by third parties,” is exactly what encryption itself achieves. On the other hand, a and c cannot be achieved by encryption (see below). The option that lists only what encryption can achieve is “エ,” which contains b alone.
ここがポイント
- What encryption protects is “confidentiality,” one of the three elements of information security; its inherent effect is to keep third parties from reading the communication content. Integrity (detecting and recovering from tampering) and tracing or identifying people are outside its scope.
- Tampering is detected with hash values, digital signatures, and message authentication codes; recovery after tampering is handled by resending or backups; and identifying eavesdroppers or wrongdoers relies on log monitoring and intrusion detection systems — different measures are used for different purposes.
用語