問63
頻出度★★★
リスク対策のうち, ソーシャルエンジニアリングへの対策に該当するものはどれか。
平成26年度 秋期 ITパスポート試験 問63
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 63
Incorrectア
Virus scanning on the mail server is a technical countermeasure that mechanically detects and removes malware (virus) intrusions; its target is malicious programs, not the act of deceiving people. Social engineering exploits gaps in how people respond, so virus scanning cannot prevent it (for example, an impersonation phone call extracts information without using any virus at all).
Incorrectイ
Installing a backup power generator is a physical, facility-level countermeasure that ensures availability by keeping the system from stopping during a power outage. What it protects is the continued operation of the information system, which has nothing to do with deceiving people to extract information, so it is not a countermeasure against social engineering.
- ウ
正解 The correct answer is ウ “A procedure is established for conveying important information over the phone, and that procedure is followed”. Social engineering is not a technique that exploits system vulnerabilities technically; it steals confidential information by taking advantage of people’s psychological gaps and carelessness. A typical example is calling on the phone while pretending to be an employee, a business partner, or a system administrator, and pressing the other person with something like “Tell me the password right away” so that the information is disclosed verbally. This kind of attack succeeds because the person answering the call has no procedure for checking whether the caller is really who they claim to be. The countermeasure therefore has to be on the human and operational side rather than the technical side: when important information is conveyed by phone, the organization should decide in advance, as a written rule, how the caller’s identity is to be verified, whether to hang up and call back a registered number, and whether such information may be given over the phone at all, and everyone should respond exactly according to that procedure. ウ is precisely this kind of countermeasure of “establishing and following procedures for how people respond”, so it qualifies as a countermeasure against social engineering.
Incorrectエ
Inspecting incoming goods at the receiving location to make sure they contain no hazardous materials is a physical security (safety) countermeasure that prevents explosives or harmful substances from being brought in. It is not a defense against techniques that exploit human psychology to obtain information, so it cannot be called a countermeasure against social engineering.
ここがポイント
- Social engineering is a technique for obtaining confidential information not by technical means but by exploiting gaps in human psychology and behavior. Typical examples include extracting information through an impersonation phone call, shoulder hacking (peeking at a password over someone’s shoulder), and trashing (scavenging), which means digging documents out of the trash.
- Countermeasures center on people and operations rather than on equipment or software. Establishing and following written procedures for phone responses and information transfer, thoroughly verifying identities, locking the screen when leaving one’s desk, disposing of documents with a shredder, and continuously training employees all fall into this category. The key to answering is to tell whether each choice is a technical, a physical, or a human/operational countermeasure.
用語