問61
頻出度★★★
ワンタイムパスワードを用いることによって防げることはどれか。
平成27年度 春期 ITパスポート試験 問61
This question's explanation and your answers so far.
解説
問 61
Incorrectア
Even when a one-time password is used, if it travels in plaintext the password itself can still be seen on the communication path. What prevents the act of eavesdropping itself is encryption of the communication, such as SSL/TLS; the role of a one-time password is to make the password unusable again even if it is eavesdropped, not to prevent eavesdropping.
Incorrectイ
A one-time password is a mechanism that strengthens identity verification (authentication) at the entrance, and it cannot control what an attacker does after an intrusion has already succeeded. Guarding against file tampering after an intrusion requires other measures, such as properly configured access rights (access control), tamper-detection tools, log monitoring, and backups.
Incorrectウ
Virus infection caused by malicious programs occurs through routes such as email attachments, malicious websites, and USB memory sticks, and it has nothing to do with the authentication method. Preventing it requires installing anti-virus software, keeping its definition files up to date, and applying patches to the OS and applications.
- エ
正解 A one-time password (OTP) is a disposable password that can be used for only one authentication. Methods such as time-synchronous generation or challenge-response produce a different value every time, and a password that has been used once (or whose validity period has expired) becomes invalid. Therefore, even if the password leaks to a third party through eavesdropping, phishing, or a lost memo, that value has already been used or has expired, so an attacker cannot reuse it to log in. Hence, what a one-time password prevents is エ, “Unauthorized intrusion using a leaked password”.
ここがポイント
- A one-time password is a disposable password that differs every time; even if it leaks, it cannot be reused, so it prevents unauthorized intrusion using a stolen password (a replay attack).
- Match each countermeasure to the threat it actually covers: preventing eavesdropping itself relies on encrypting communication, countering tampering after an intrusion relies on access control and tamper detection, and preventing virus infection relies on anti-virus software — each covers a different area from strengthening authentication.
用語