問69
頻出度★★★
ソーシャルエンジニアリングによる被害に結びつきやすい状況はどれか。
平成27年度 春期 ITパスポート試験 問69
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 69
- ア
正解 Social engineering is a general term for techniques that obtain passwords or confidential information illegally without using computer or network technology, by exploiting people’s psychological gaps and carelessness. Typical examples include pretending to be a superior or a business partner and asking for a password over the phone, posing as a repair worker to get inside the office, peeking at a screen or keystrokes from behind someone (shoulder hacking), and going through documents in the trash (scavenging / trashing). In every case the target is not equipment but people, so countermeasures center on education, raising awareness, and strictly enforcing operational rules. Therefore, the situation most likely to lead to damage is one in which the people who handle information have low security awareness — that is, ア, “Operations staff have low security awareness.”, is the correct answer. When awareness is low, people easily give out a password without verifying who is asking, or let a visitor into a room without checking their identity, which is exactly the condition under which social engineering succeeds.
Incorrectイ
A lack of waterproofing on the server room ceiling relates to physical threats (natural disasters and facility accidents), such as leaks causing equipment failure or system downtime. It has nothing to do with social engineering, which deceives people to obtain information.
Incorrectウ
The absence of access control on the server is a gap in technical countermeasures (authentication and authorization settings). It can lead to unauthorized access and to data tampering or leakage, but it is a weakness on the equipment and system side, which is different from techniques that exploit human psychology.
Incorrectエ
An unencrypted communication path leads directly to technical threats on the communication channel, such as eavesdropping (sniffing) and man-in-the-middle attacks. The countermeasure is encryption technology such as TLS, so this does not apply to social engineering, which is a matter of human awareness.
ここがポイント
- Social engineering = obtaining information not through technology but by exploiting people’s psychological gaps and carelessness (impersonation phone calls, shoulder hacking, trashing, and so on). Because the target is people, the cause lies in human vulnerability (low security awareness).
- Organize how threats map to countermeasures: human threats call for education, awareness raising, and operational rules; technical threats call for access control and encryption; physical threats call for entry and exit control, waterproofing, fire prevention, and other facility measures. Think in these three categories.
用語