問80
頻出度★★★
情報セキュリティを脅かすもののうち, ソフトウェアの脆弱性を修正するパッチを適用することが最も有効な対策となるものはどれか。
平成29年度 春期 ITパスポート試験 問80
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 80
Incorrectア
A brute-force attack tries passwords and the like one after another to break through, and it does not exploit a software defect. Effective countermeasures are using long, complex passwords and account lockout that locks the account after a set number of failures; it cannot be prevented by applying a patch.
Incorrectイ
Social engineering is a technique of extracting confidential information by exploiting people’s psychology or lapses (impersonation phone calls, shoulder surfing, dumpster diving, and so on); its cause is people, not a technical vulnerability. The countermeasures are employee education and thorough enforcement of operational rules, and it cannot be prevented by a software patch.
- ウ
正解 The correct answer is ウ “Buffer overflow.” A buffer overflow is an attack in which data larger than the size of the memory area (buffer) allocated by the program is written into it, overwriting memory outside that area, so that malicious code is executed or the system malfunctions; its root cause lies in a “software vulnerability” itself, namely inadequate input checking on the program side. Therefore, applying a fix program (patch) that repairs that vulnerability is the most effective and most direct countermeasure.
Incorrectエ
Port scanning is a preliminary reconnaissance act that checks which ports on the target are open, and it is not in itself a specific software vulnerability. The countermeasures are closing unnecessary ports and restricting communication with a firewall; applying a patch cannot be said to be the most effective countermeasure.
ここがポイント
- A fix patch (security patch) is a countermeasure that closes a “software vulnerability.” Whether a patch is effective can be judged by whether the threat stems from a defect in the program itself.
- Buffer overflow = a vulnerability attack that overwrites memory outside the buffer, countered by a patch; whereas brute force = strong passwords, social engineering = training people, and port scanning = closing unnecessary ports / a firewall — the countermeasure differs from threat to threat.
用語