問73
頻出度★★★
IoT機器のセキュリティ対策のうち, ソーシャルエンジニアリング対策として, 最も適切なものはどれか。
令和6年度 ITパスポート試験 問73
This question's explanation and your answers so far.
解説
問 73
Incorrectア
Always encrypting communication is a technical measure that prevents “eavesdropping”, in which content is intercepted on the communication path. It is a countermeasure against attacks that abuse network technology, not against social engineering, which exploits people's gaps.
Incorrectイ
Updating to the latest firmware is a technical measure that blocks attacks exploiting “vulnerabilities” remaining in the device's software. It closes weaknesses in the program, so its target differs from social engineering, which is a technique that deceives people.
Incorrectウ
Installing anti-malware software is a technical measure that prevents “malware infection” such as viruses. It is a defense against malicious programs, not a way to prevent attacks that exploit gaps in people's psychology or behavior.
- エ
正解 Social engineering is a general term for techniques that steal information without using network or computer technology, instead exploiting gaps in people's psychology or behavior. It includes peeking (shoulder hacking), phone calls impersonating an insider, and “trashing/scavenging”, which means picking up information from discarded items. Choice “エ” physically destroys the built-in storage device when an IoT device is disposed of, making the information unreadable, and it directly blocks trashing, where information is obtained by rummaging through discarded equipment. Therefore it is the most appropriate countermeasure against social engineering, and this is the correct answer.
ここがポイント
- Social engineering is a technique that obtains information not through technology but by exploiting people's gaps; peeking, impersonation phone calls, and trashing are typical examples.
- Physically destroying the storage device of discarded equipment is a direct countermeasure against trashing, in which information is picked up from thrown-away devices.