問80
頻出度★★★
盗難にあった PC からの情報漏えいを防止するための対策として, 最も適切なものはどれか。ここで, PC のログインパスワードは十分な強度があるものとする。
平成25年度 春期 ITパスポート試験 問80
This question's explanation and your answers so far.
解説
問 80
Incorrectア
A BIOS password is a password requested by the BIOS (firmware) when the PC is powered on; unless it is entered correctly, the OS cannot start and BIOS settings cannot be changed. It does prevent a third party from starting a PC that is at hand without permission, but what it protects is only the path of starting up using that PC itself, and the contents of the disk remain in plaintext. A thief has no need to start that PC at all: simply removing the hard disk and connecting it to another PC allows the data to be read as is. In addition, a BIOS password can sometimes be cleared by a physical operation such as removing the motherboard battery. In a theft case where the equipment is physically carried away it is not decisive, so it is not the most appropriate choice.
Incorrectイ
An IDS (Intrusion Detection System) is a mechanism that monitors communications on a network and records on servers, detects signs of unauthorized access or attacks, and notifies the administrator. It presupposes that the monitored network or system is running, and its role is to detect and report, not to stop the leakage itself. A stolen PC is analyzed at the attacker's location, disconnected from the organization's network, so it is outside the IDS's monitoring range, and the act of reading the disk directly cannot be detected either. The threat (physical theft) and the countermeasure (detecting unauthorized access on a network) do not match.
Incorrectウ
A personal firewall is software installed on a PC that monitors and controls the communications that PC exchanges with the outside. It can block unauthorized access from outside and stop suspicious software from communicating externally without permission, and it is effective as a measure to protect a PC used while connected to a network. However, what it protects is the network entrance, not the data recorded on the storage medium. A firewall that controls communications cannot be involved at all in the path where the whole PC is carried away and the disk is removed and read in another environment. Therefore it is not a countermeasure against information leakage caused by theft.
- エ
正解 The correct answer is エ, Encrypting the hard disk. With theft as the threat, the attacker has the PC itself in hand, so you must assume they can take their time examining what is inside. The question states that the PC's login password has sufficient strength, so you need not assume the OS login screen will be broken through directly. However, login authentication is a mechanism that works only after the OS has started; it does not protect the data recorded on the storage medium itself. If the attacker removes the hard disk from the PC and connects it to another PC as an external drive, or boots a different OS from a USB memory stick or similar medium, the files can be read directly without going through that PC's OS login authentication at all. If the hard disk is encrypted, the data on the disk is recorded as ciphertext that is meaningless without the encryption key, so even if the medium is taken out and connected to another environment, its contents cannot be read. In other words, although encryption cannot prevent the device from being taken, it works as the last line of defense against information leakage after the device is taken. Therefore, エ is the most appropriate measure for preventing information leakage from a stolen PC.
ここがポイント
- Choose a countermeasure so that it matches the asset you want to protect and the threat you assume. Theft and loss are threats in which the attacker physically gets hold of the equipment, and OS login authentication is bypassed by methods such as removing the disk and connecting it to another PC or booting a different OS. A login password or a BIOS password is a measure to keep others from operating that PC; it does not protect the data on the storage medium itself, so it is insufficient as a countermeasure against theft.
- Hard disk encryption (disk encryption) is a mechanism that encrypts the data written to a storage medium so that its contents cannot be read without the correct key. It cannot prevent the equipment itself from being taken, but it is effective as a measure to prevent information leakage after it is taken, and it is regarded as standard equipment for PCs and mobile devices carried outside. In contrast, an IDS detects and reports unauthorized access and a firewall controls communications; both are countermeasures aimed at threats coming over a network, so remember to distinguish them by their differing purposes.
用語