Explain why a digital watermark embeds information, and how a blockchain makes records hard to tamper with.
Tell digital forensics (preserving evidence after the fact) apart from penetration testing (probing for a way in beforehand) by when and why each is done.
Explain tamper resistance, which protects IoT devices, along with the roles of the TPM that strengthens it and secure boot, which works at startup.
A digital watermark (電子透かし) is a technique for embedding information such as the copyright holder or an identification number into digital content like images, audio and video, with almost no change to how it looks or sounds.
Original photo
Embed the rights holder's number
Copied and circulated
Read the number with dedicated software
Read the number from a photo you come across to confirm whose photo it is.
4 / 4
The embedded information survives in copied data, so when unauthorized use turns up it gives a lead on the rights holder or the source of the leak. Unlike encryption, the data itself stays open for anyone to view or listen to.
AnalogyLike a name tag sewn inside a garment: out of sight normally, but it tells you the owner when you check.
How to rememberThe English word watermark (water + mark) comes from a mark pressed into paper while it is still wet; a digital watermark moves that mark into the data.
Exam points
ExamA digital watermark embeds information so that the change cannot be spotted at a glance; it is not a see-through image overlaid on the content.
Mix-upThe mechanism that lets users confirm a program comes from its genuine distributor and was not altered along the way is code signing (コード署名), not a digital watermark.
Digital forensics (デジタルフォレンジックス) is the umbrella term for techniques and procedures that collect records left on computers as evidence, preserve them and analyze them after an incident such as unauthorized access or a data leak.
Incident occurs
Collect devices and logs
Make copies, preserve the originals
Analyze the copies and report
Examine the copies to establish what happened, and compile the findings in a form that can be submitted to a court.
3 / 3
If you cannot show that the collected data was left unaltered, a court is unlikely to accept it as evidence. The standard practice is therefore to keep the originals as they are and work on copies.
AnalogyThe digital version of crime-scene investigators wearing gloves so they do not smudge fingerprints, then taking the evidence back to the lab.
How to rememberForensic means "relating to courts of law," the same word as in forensic medicine. Think of it as handling evidence meant for court.
Exam points
ExamThe goal is to collect data that can serve as evidence in a crime or legal dispute and keep it in an unaltered state.
ExamThe whole set of techniques that, once a crime is suspected, gather and examine records and establish whether they will hold up as evidence in court is called digital forensics.
Mix-upAttacking your own system to find weaknesses is penetration testing. Forensics is the investigation after an incident has happened.
Penetration testing (ペネトレーションテスト) is a check that actually tries to break into a system with an attacker's own methods, to see whether any security weaknesses that could be broken through remain.
Unlike a review that only reads design documents or settings, it uses real attack techniques to see whether the defenses give way. It is carried out with the system owner's permission, so that weaknesses can be found and fixed before a real attack.
AnalogyHiring a security professional to genuinely try sneaking into your house and point out the window with the weak lock.
How to rememberPenetrate means "to pierce or get inside." In Japanese it is also called 侵入テスト (intrusion test).
Exam points
ExamPenetration testing finds weaknesses by attacking and attempting to break in. It is different from tests that apply heavy load or check the impact of changes.
ExamWhen run from the internet, it uncovers weaknesses reachable over the network, such as a route from outside into a public server. Misconduct by insiders or physical ways in cannot be found by testing over the network alone.
A blockchain (ブロックチェーン) is a technology that bundles transaction records into "blocks," puts into each block a value calculated from the contents of the previous one (a hash value) so they link like a chain, and shares the resulting ledger among many computers.
Block 1 (transaction records)
Block 2 (value from Block 1 + transaction records)
Block 3 (value from Block 2 + transaction records)
Block 3 likewise holds a value calculated from Block 2, and the chain keeps growing in order.
3 / 3
Rewriting a past block changes its hash value, which then no longer matches the value stored in the block after it. The altered copy would also conflict with the records held by the many other participants, so tampering without being noticed is difficult. Blockchain began as the foundation of crypto assets and is now used to manage other kinds of transaction records too.
AnalogyLike everyone in a class keeping the same cashbook, with each page ending in a copy of the previous page's total. If one person rewrites an old page, it no longer matches the next page or anyone else's book, and the change shows at once.
How to rememberJust as the name says: blocks joined into a chain. The links of the chain are the hash values.
Exam points
ExamBecause each block carries the previous block's hash value, records are hard to rewrite without creating inconsistencies.
ExamIt is a distributed ledger in which many computers hold the same ledger and each checks that its contents are correct, and it underpins crypto assets.
ExamThe hash function it uses always produces the same value for the same input, and the original data cannot be recovered from that value.
Tamper resistance (耐タンパ性) is the ability to withstand attacks that read or rewrite the keys and data inside a device by taking it apart or measuring its signals.
Ways to raise tamper resistance (examples)
Hardware measures
Keep keys sealed inside a security chip
Erase stored data when the case is opened
Software measures
Transform the program so it is hard to read (obfuscation)
To tamper is to meddle with a device without permission in order to probe or alter what is inside. IoT devices sit where people can reach them and may even be stolen, so they need to keep their secrets even when someone analyzes them in hand.
AnalogyA safe built so that forcing it open leaves the papers inside unreadable.
How to rememberTamper means "to meddle with" in English. It is the same word as in tamper-evident food packaging, which shows a trace once it has been opened.
Exam points
ExamThe property that keeps internal data in hardware and similar devices hard to decipher, alter or extract from outside is tamper resistance, a different term from availability or reliability.
ExamExamples of measures that raise it include encrypting data with a security chip that holds a built-in key, and obfuscating the embedded software.
Mix-upEncrypting the communication path and updating software counter eavesdropping and known vulnerabilities; they do not make a device harder to analyze once it is in someone's hands.
Secure boot (セキュアブート) is a technology that verifies the digital signatures of the OS and firmware when a device starts up and runs only software confirmed to be legitimate.
Power on
Verify the firmware signature
Verify the OS signature
Boot if verification passes
If the signature is valid, startup continues; if not, it stops there.
3 / 3
A digital signature is a mark applied with a key that only the author holds, letting you confirm that the author is genuine and the contents have not been changed. If a tampered program slips in during startup, security software that runs later struggles to detect it, so the check stops it at the boot stage. IoT devices also use it to guard their software against tampering.
AnalogyLike a front desk at a building entrance that checks each person's staff ID and lets only real employees in.
How to rememberBoot comes from bootstrap, the loop at the back of a boot, and refers to the process from power-on until the OS is up and running. Making that process secure gives you secure boot.
Exam points
ExamSecure boot verifies digital signatures at startup and runs only legitimate software. It is not the same as a reboot (リブート), which simply means restarting.
Mix-upBuilding security in from the planning and design stages is the idea of security by design (セキュリティバイデザイン). Do not confuse it with secure boot, a verification technique used at startup.
A TPM (Trusted Platform Module) is a security chip built into PCs and IoT devices that stores encryption keys internally and carries out cryptographic processing inside the chip.
Because the key never leaves the chip during processing, and the chip itself is built to resist reading from outside, the key is harder to steal than one stored by software. One use is protecting the key for full-disk encryption.
AnalogyLike leaving an important seal in a bank's safe-deposit vault and having documents stamped only inside the vault room. The seal itself never comes out.
How to rememberTrusted Platform Module: a module mounted on the device (platform) that serves as the anchor of trust (trusted). It is often just called a TPM chip.
Exam points
ExamA TPM is a security chip that stores data-encryption keys internally and resists having its contents extracted from outside.
Mix-upTLS is a protocol for encrypting the communication path and a GPU is a processor for graphics; neither is a chip that stores keys.
Tamper resistance vs. TPM (Trusted Platform Module)
Aspect
Tamper resistance
TPM (Trusted Platform Module)
Key differenceWhat it refers to
A property of a device
A specific component (chip)
Relationship
The goal to improve
One way to raise tamper resistance
What it protects
Keys and data inside the device in general
Mainly keys used for encryption
Key points
A digital watermark embeds information without changing how content looks, a different purpose from code signing, which checks whether software has been altered.
Digital forensics gathers, preserves and analyzes evidence after an incident, while penetration testing tries to break in beforehand to find weaknesses.
A blockchain is hard to tamper with because its blocks are linked by the previous block's hash value and shared among many computers.
Tamper resistance is the property of a device whose insides are hard to analyze, and a TPM with built-in keys is one way to raise it.
Secure boot verifies signatures at startup and runs only legitimate software.