問58
頻出度★★★
情報セキュリティにおけるソーシャルエンジニアリングへの対策の例として, 適切なものはどれか。
平成28年度 春期 ITパスポート試験 問58
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 58
Incorrectア
Introducing a virus detection and removal function into the email system is a technical countermeasure against malware (computer viruses). It prevents program-based attacks and does not counter social engineering, which is a technique for deceiving people.
Incorrectイ
Conducting a simulated attack test (penetration test) and addressing the vulnerabilities that are found is a measure that closes technical weaknesses in servers or systems. Its target differs from social engineering, which is an attack that exploits human psychology.
- ウ
正解 The correct answer is ウ. Social engineering is an attack method that steals passwords or confidential information not by exploiting a computer’s technical vulnerabilities, but by taking advantage of “gaps in human psychology or behavior” (for example, impersonating a superior or administrator over the phone to extract a password, peeking at keyboard input over someone’s shoulder, or rummaging through documents in the trash). Such attacks cannot be fully blocked by technical defenses; since the target is people themselves, the countermeasures must also be directed at “people”. If security education is provided to raise employees’ security awareness, they develop habits such as not casually responding to suspicious inquiries and not telling passwords verbally, which fundamentally prevents attacks like impersonation and peeking. Therefore ウ, a people-oriented countermeasure, is the most appropriate.
Incorrectエ
Introducing an in-house power generator is a countermeasure for power outages that ensures the system’s availability (staying up). It is a physical and environmental measure, unrelated to attacks that steal information by deceiving people.
ここがポイント
- Social engineering is an attack that obtains confidential information by exploiting gaps in human psychology and behavior rather than technology (impersonation, peeking, dumpster diving, etc.), so the core of the countermeasures is people-oriented measures such as security education.
- The trick is to classify the choices into “technical countermeasures (antivirus, vulnerability measures)”, “physical and availability countermeasures (in-house power generation)”, and “people-oriented countermeasures (education)”, then pick the one that matches the fact that the attack targets people.
用語