問64
頻出度★★★
ウイルス対策ソフトの適切な運用方法はどれか。
平成25年度 春期 ITパスポート試験 問64
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 64
Incorrectア
If you start the software only when scanning and stop it as soon as the scan is over, you are completely unprotected the whole time it is stopped. A virus can get in at any moment of ordinary work: the instant you open a mail attachment, the instant you download a file from the Web, the instant you plug in a USB flash drive, and so on. The appropriate way to operate anti-virus software is to keep it resident and monitoring in real time, so that it can detect and block an intrusion on the spot as it happens; running it only when needed throws that advantage away.
Incorrectイ
Resident scanning, just as the choice itself explains, is a mechanism that inspects a file whenever that file is read or written. Consequently, files that are merely stored and never read or written are not inspected, and viruses that got in and lay dormant during a period when the definition files did not yet cover them, as well as malicious files that slipped past the resident scan, can remain in place. Scanning everything once at installation does not mean resident scanning alone is enough afterwards: you also need to run a full scan of the entire hard disk periodically, re-checking hidden viruses with the latest definition files.
- ウ
正解 The correct answer is ウ. The basic mechanism by which anti-virus software finds known malware is to compare the files or communications being inspected against virus definition files (pattern files, signature files) that record the characteristics of viruses. In other words, what it can detect is limited to what is listed in the definition files on hand, so if you merely install the software itself, its capability stops at the moment of installation. However, new viruses and variants appear every day, so with old definition files the viruses that appear later simply slip through. Therefore, rather than treating installation as the end of the job, you should continuously update to the latest definition files supplied by the vendor (on most products by enabling automatic updates) so that detection capability always keeps up with the latest threats. That is the appropriate way to operate anti-virus software. Updating the definition files is maintenance work that should be carried out continuously, together with updates to the scan engine and the software itself and with the application of security fixes (patches) for the OS and applications.
Incorrectエ
Virus checking on the provider's (ISP's) side mainly targets specific routes such as mail that passes through that provider, and it cannot cover every infection route. External media such as USB flash drives and external drives, files brought in from other PCs or shared between them, and the contents of encrypted communications cannot be inspected on the provider's side. The principle of security is defense in depth, layering gateway-side (entrance) measures with terminal-side (PC) measures, so the fact that checking is done upstream is no reason to skip installing anti-virus software on the PC.
ここがポイント
- Anti-virus software detects known viruses by comparing them against virus definition files (pattern files, signature files). Because new viruses and variants appear every day, continuing to update the definition files after installation (enabling automatic updates) is the key to operating it; if you neglect updates, new viruses can no longer be detected.
- Resident (real-time) scanning inspects on the spot each time a file is read or written, while a full scan re-checks the entire disk; their roles differ, so the two are used in combination. In addition, measures at the provider or the gateway protect only part of the routes and are no substitute for measures on the PC, so as defense in depth the terminal-side measures must be maintained as well.
用語