問81
頻出度★★★
Web サーバの認証において, 同じ利用者 ID に対してパスワードの誤りがあらかじめ定められた回数連続して発生した場合に, その利用者 ID を自動的に一定期間利用停止にするセキュリティ対策を行った。この対策によって, 最も防御の効果が期待できる攻撃はどれか。
平成29年度 春期 ITパスポート試験 問81
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 81
Incorrectア
A zero-day attack exploits an unknown vulnerability before a fix (patch) is released, and has nothing to do with entering passwords consecutively. Account lockout cannot prevent it.
Incorrectイ
A password list attack reuses a list of correct user-ID-and-password combinations leaked from other services to attempt unauthorized logins. Because the correct password can be entered on the first try, lockout based on the number of errors rarely takes effect, so this measure has only limited effect.
Incorrectウ
A buffer overflow attack sends data longer than expected to overflow a memory area and execute malicious code; it has nothing to do with the number of password errors during authentication. Account lockout cannot prevent it.
- エ
正解 The correct answer is “エ Brute-force attack.” A brute-force attack (exhaustive attack) tries password combinations against the same user ID one after another from the start, repeating until it hits the correct value. The measure in this question is to automatically disable a user ID for a certain period (account lockout) once password errors occur consecutively a predetermined number of times for that same user ID; even if the attacker keeps trying, the ID is locked within a short time and no more passwords can be tried. Therefore, this measure can be expected to provide the greatest defensive effect against a brute-force attack, which assumes many consecutive failed attempts.
ここがポイント
- Account lockout (temporarily suspending an ID after a set number of consecutive authentication failures) is a basic countermeasure against a brute-force attack that tries passwords exhaustively.
- The difference between the two is that a brute-force attack tries many passwords against the same ID so errors occur consecutively, whereas a password list attack uses correct combinations so errors seldom occur consecutively.
用語