問57
頻出度★★★
IoT デバイスにおけるセキュリティ対策のうち, 耐タンパ性をもたせる対策として, 適切なものはどれか。
令和5年度 ITパスポート試験 問57
This question's explanation and your answers so far.
解説
問 57
Incorrectア
Cutting off the connection after authentication fails a set number of times in a row is a measure to prevent unauthorized login by brute-force attacks; its purpose differs from tamper resistance, which hinders internal analysis.
Incorrectイ
Encrypting communication data is a measure to protect the confidentiality of data on the communication path; it does not make analysis of the device’s interior difficult, so it does not count as a tamper-resistance measure.
Incorrectウ
Applying the latest patches via online updates is a measure to close known vulnerabilities (vulnerability management), which is a different aspect from tamper resistance that hinders internal analysis.
- エ
正解 Tamper resistance is the property of making a device’s internal structure, software, and stored information difficult to analyze, read, or alter from the outside. Choice エ, “Obfuscate the built-in software to increase the time required to decipher it,” makes it hard for an analyst to read and understand the program’s contents, which is exactly a measure that hinders internal analysis and thus strengthens tamper resistance. Therefore, エ is appropriate.
ここがポイント
- Tamper resistance is the property of making a device’s internal structure, data, and software difficult to analyze or alter from the outside. Typical means include obfuscation and erasing data when an analysis attempt is detected.
- Encryption (confidentiality), authentication-failure lockout (preventing unauthorized access), and patch application (vulnerability management) are all valid security measures, but distinguish that they differ in aspect from tamper resistance, which hinders internal analysis.
用語