問23
頻出度★★★
インターネット上の脅威となる行為のうち, 不正アクセス禁止法で禁止されているものはどれか。
平成26年度 秋期 ITパスポート試験 問23
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 23
- ア
正解 The correct answer is ア. The Unauthorized Access Prohibition Act (the Act on Prohibition of Unauthorized Computer Access) prohibits acts that, over a network, put another person's computer protected by an access control function into a state where it can be used without authorization. The prohibited acts of unauthorized access fall into two main types: (1) the impersonation type, in which someone enters another person's identification code (ID and password) without permission and uses the system; and (2) the security-hole attack type, in which no identification code is used, but attack information or commands that exploit a vulnerability (security hole) in the OS or an application are entered to bypass the access control function. Choice ア, exploiting a security hole to break into a website, is exactly type (2): it makes a server that the person has no right to access usable, so it violates the Unauthorized Access Prohibition Act. Note as well that the offense is established at the moment of the intrusion, regardless of whether any information was stolen afterwards.
Incorrectイ
Putting load on a system with massive traffic and the like so that the service becomes unavailable is a DoS attack (DDoS attack). It does not break through an access control function to make a system usable; it is an act of obstruction that makes a server unusable, so it is not something the Unauthorized Access Prohibition Act prohibits. Such conduct may instead be punished under the Penal Code as obstruction of business by damaging a computer, or as obstruction of business by fraudulent means.
Incorrectウ
Intercepting and analyzing wireless LAN radio waves to read technical information is eavesdropping, that is, viewing communication content from outside; it is not logging in to another person's computer past an access control function. It therefore falls outside the Unauthorized Access Prohibition Act, and instead raises issues such as violation of the secrecy of communications under the Radio Act, or wrongful acquisition of trade secrets under the Unfair Competition Prevention Act.
Incorrectエ
Deliberately sending a virus-infected email is an act of getting someone to run a program that issues illegitimate commands, and it falls under the Penal Code offense concerning electromagnetic records of unauthorized commands (the so-called virus creation and supply offense). Because it does not break through the other party's access control function to make their computer usable, it is not an act of unauthorized access prohibited by the Unauthorized Access Prohibition Act.
ここがポイント
- The core of what the Unauthorized Access Prohibition Act prohibits is the unauthorized use of another person's computer by bypassing an access control function, in two types: (1) the impersonation type, using someone else's ID and password without permission, and (2) the attack type, exploiting a security hole. The violation is established by the intrusion alone.
- Different cyberattacks fall under different laws depending on the act: DoS attacks under obstruction of business, eavesdropping on communications under the Radio Act and the Unfair Competition Prevention Act, and creating or supplying viruses under the Penal Code virus offense. The test for whether the Unauthorized Access Prohibition Act applies is whether the act is an unauthorized intrusion.
用語