問83
頻出度★★★
ボットへの感染防止の対策として, 適切でないものはどれか。
平成25年度 秋期 ITパスポート試験 問83
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 83
Incorrectア
Installing antivirus software is an appropriate measure to prevent bot infection. A bot is also a type of malware, and antivirus software can detect, quarantine, and remove a bot contained in an email attachment or a downloaded file at the moment it tries to get in, either by matching it against pattern files (definition files) or by behavior detection. This assumes the pattern files are always kept up to date, but it is a direct measure that blocks the infection itself, so it is appropriate and is not the answer to this question, which asks for the option that is NOT appropriate.
- イ
正解 The answer is イ, Encrypt the hard disk. This question asks which option is NOT appropriate. A bot is malware that lets an attacker remotely control an infected PC from a command server (C&C server) the attacker has set up; large numbers of infected PCs form a botnet, which is abused to send huge volumes of spam or to serve as a springboard for DDoS attacks. Bots spread through the same routes as ordinary viruses: browsing tampered or suspicious websites, email attachments, installing software of unknown origin, and so on. To prevent infection, therefore, you must either cut off these entry routes or detect and remove malware that has already got in. Encrypting the hard disk, by contrast, is a measure against information leakage: it prevents a third party from reading the information inside if the PC or the disk is stolen or lost. Even with encryption, you cannot stop a bot from getting in through an attachment or via the Web, and while a legitimate user is working, the data is decrypted and handled on the OS, so an infected bot can read and write files as usual. In other words, encryption does nothing to prevent infection, so it is not an appropriate measure.
Incorrectウ
Refraining from browsing suspicious websites is an appropriate measure to prevent bot infection. One typical infection route for bots is via websites: merely viewing a tampered or malicious site can allow a vulnerability in the browser or a plug-in to be exploited so that malware is pushed onto the PC automatically (a drive-by download). If you limit the sites you visit to trustworthy ones, you can cut off this infection route. Because it is an effective measure that blocks an infection route, it is not the answer.
Incorrectエ
Not casually opening email attachments from unknown senders is an appropriate measure to prevent bot infection. Email attachments are, alongside web browsing, a major infection route, and a common technique is to get the user to open an executable file or a specially crafted document file so that a bot is delivered to the PC. Making it a habit not to open attachments in mail from senders you do not recognize is a basic and effective way to cut off this route, so it is appropriate and is not the answer.
ここがポイント
- Bot: malware that lets an attacker remotely control an infected PC through a C&C server. Many infected PCs form a botnet, which is used to send large volumes of spam mail or to act as a springboard for DDoS attacks. Bots spread through the same routes as viruses: browsing suspicious websites, email attachments, installing software of unknown origin, and so on.
- Distinguish measures by their purpose. Installing antivirus software, avoiding suspicious sites, and not opening suspicious attachments are all measures for preventing malware infection, whereas encrypting the hard disk is a measure for preventing information leakage, so that data cannot be read if the machine is stolen or lost. Even an effective security measure is not the correct answer if it does not address the threat being asked about; this is a classic trap pattern.
用語