問86
頻出度★★★
情報セキュリティにおけるソーシャルエンジニアリングの例として，適切なものはどれか。
平成28年度 春期 ITパスポート試験 問86
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 86
- ア
正解 Social engineering refers to a method of stealing confidential information not through computer or network technology, but by exploiting gaps in human psychology, carelessness, or trust relationships. Choice ア describes pretending to be a company employee (impersonation) and calling from outside the company, then gaining the other person’s trust and verbally extracting confidential internal information. This is a classic example of social engineering, deceiving a person to obtain information. Therefore ア is correct.
Incorrectイ
Using packets with a forged source IP address to bypass access restrictions is “IP spoofing”, a network attack that technically forges packets. It is not a method of deceiving a person, so it does not count as social engineering.
Incorrectウ
Eavesdropping on packets flowing over the network to steal passwords and the like is “eavesdropping (sniffing)”, an attack that technically intercepts communications. It is not a method that exploits human psychology, so it does not qualify as social engineering.
Incorrectエ
Downloading software that performs malicious operations when run is a method of planting malware (such as a Trojan horse). It is an attack by a malicious program, which is distinct from social engineering, where a person is deceived directly to extract information.
ここがポイント
- Social engineering obtains confidential information not through technology but by exploiting gaps in human psychology and behavior (trust, carelessness, kindness, etc.). Typical examples include impersonation phone calls, shoulder surfing, and dumpster diving (trashing).
- IP spoofing, eavesdropping (sniffing), and malware are all attacks by technical means; remember them in contrast to social engineering, which is a human-based method.
用語