問70
頻出度★★★
Webブラウザの利用方法①～③のうち，セキュリティリスクが軽減する利用方法だけを全て挙げたものはどれか。 ① IDとパスワードをWebブラウザに記憶させる。 ② JavaScriptを無効にする。 ③ 管理者権限でPCにログインし，Webブラウザを利用する。
平成27年度 春期 ITパスポート試験 問70
This question's explanation and your answers so far.
解説
問 70
Incorrectア
① and ②. ② does correctly reduce risk, but ①—having the web browser remember your ID and password—increases risk. If the PC is stolen or operated by someone else, that person can log in directly without knowing the password, and there is also the danger that malware steals the stored credentials. Including ① makes this option wrong.
Incorrectイ
① and ③. It omits ②, the only item that reduces risk, and instead lists only ① (saving credentials in the browser) and ③ (using the browser with administrator privileges), both of which increase risk. The content is exactly the opposite.
- ウ
正解 Only ② reduces risk, so the correct answer is ウ, which indicates “②”. JavaScript is a mechanism for running programs on web pages. It is convenient, but it can also become an entry point for attacks: a user may be led to run a malicious script and get infected with malware, or information may be stolen through attacks such as cross-site scripting (XSS). If JavaScript is disabled, these script-based attacks can no longer run in the browser, so the security risk goes down (the trade-off is that some sites will not display or work correctly). On the other hand, both ① and ③ are ways of using a browser that increase risk. ① leaves authentication information—an ID and a password—inside the PC, so if the PC is stolen or lost, is operated by someone else, or the saved information is stolen by malware, an attacker can impersonate the user directly. ③ means using the browser with administrator privileges (the strongest access rights); if a malicious program is run by mistake, it also runs with administrator privileges and can cause damage across the whole PC, such as installing software or changing settings.
Incorrectエ
② and ③. ② is correct, but ③—using the browser with administrator privileges—increases risk. As a rule, daily work and web browsing should be done with a general user account that has only the minimum necessary privileges (the principle of least privilege); if you keep using administrator privileges, the damage caused by a malicious program spreads to the entire PC.
ここがポイント
- Safe ways to use a web browser: restricting execution features such as JavaScript reduces the entry points for attacks (a trade-off against convenience). Automatically remembering passwords, on the other hand, allows impersonation the moment the device is taken, so it is an operation that increases risk.
- The principle of least privilege: use administrator privileges only when necessary, and do everyday work and web browsing with a general user account. A program run with administrator privileges inherits those strong rights, so the damage reaches the entire PC.
用語