問60
頻出度★★★
情報セキュリティにおける脅威と脆弱性のうち，脆弱性に該当するものはどれか。
平成29年度 春期 ITパスポート試験 問60
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 60
Incorrectア
A computer virus is a malicious program that infects systems and harms information assets; it belongs to the threat side that exploits weaknesses. It is not a weakness itself, so it is not a vulnerability.
Incorrectイ
Social engineering is an attack technique that deceives people into revealing information, and it is classified as a threat. Although it exploits human vulnerability, it is itself a threat, not a weakness.
Incorrectウ
Eavesdropping on communication data is an attack that illicitly intercepts the content of communications, and it is classified as a threat. It is an act that exploits a weakness, not the weakness itself.
- エ
正解 A vulnerability is a weakness or flaw that a threat can exploit. Inappropriate password management, such as using easily guessed passwords, reusing the same password, or sharing and neglecting passwords, is a weakness inherent in how users or organizations operate, and it is exactly the kind of opening that an attacker can abuse. Therefore option エ is the vulnerability.
ここがポイント
- Distinguishing threats from vulnerabilities: a vulnerability is a weakness or flaw inherent in a system or its operation, while a threat is a factor that exploits that weakness to cause damage (attacks such as viruses, eavesdropping, and social engineering).
- Inappropriate password management is an operational weakness and a typical example of a human and managerial vulnerability. The key is not to confuse it with an attack (a threat).
用語