IPA FE Subject B 2023 Question 6

Topic: Security Scenarios

A question IPA Japan published in 令和５年度 基本情報技術者試験 科目B 公開問題 問6, translated into English. ITPEC is based on the same exams.

Company A runs an advertising production business for broadcasting companies and transportation companies. To improve the efficiency of its human resources operations, Company A decided to consider outsourcing its human resources operations. Figure 1 shows the work that Company A will outsource (hereinafter, work B).

•Convert documents mailed by prospective employees, such as the written pledge submitted on joining the company and the withholding tax slip from the previous employer, into PDF files, and store them on a file server.(Omitted)

Figure 1 Work B

Company C, a candidate outsourcing contractor, made the following proposal to Company A about work B.

  • •Assign dedicated employees who are engaged only in work B.
  • •In work B, use the scan function of the multifunction printer shown in Figure 2.
•When using the scan function, enter on the panel the user ID and password assigned to each employee.•Convert the scanned data into a PDF file.•Encrypt the PDF file with a key that differs for each employee, and attach it to an email.•Send the email to the person who performed the scan.•If the PDF file is large, instead of attaching the PDF file, automatically save it on a server installed on the company’s own internal network (hereinafter, server B)1), and send the email with the URL of the save location written in the body of the email.
Note 1)Accessing server B requires the user ID and password of each employee.

Figure 2 Scan function of the multifunction printer (excerpt)

Before concluding an outsourcing contract with Company C, Company A concluded a non-disclosure agreement. After that, Company A sent a questionnaire to Company C, received the answers, and conducted an assessment of the information security risks in the outsourcing. As a result, the findings in Figure 3 were made.

•In the scan function of the multifunction printer, the sender address, subject, body and attachment file name of the email are used in the state of the initial settings1), and they are the same no matter who performs the scan.•The information on the initial settings of the scan function of the multifunction printer is published on the vendor’s website, and anyone can view it.
Note 1)Only the Information Systems Department of Company C can change the initial settings of the multifunction printer.

Figure 3 Findings

Therefore, Company A assessed that leaving the initial settings as they are poses an information security risk to Company A, and that a countermeasure of changing them from the initial settings is necessary.

QuestionWhich is the information security risk for which Company A assessed that a countermeasure is necessary? From the answer group, select the most appropriate one.

Answer group

Explanation

A forged email that looks exactly like the printer’s leads an employee to a phishing site — the scan emails all use the published default sender, subject and body, so an attacker can copy them exactly.

Figure 3 says the sender address, subject, body and attachment file name of every scan email are the initial settings, the same whoever scans, and that these settings are published on the vendor’s website. Anyone can therefore write an email that cannot be told apart from a genuine one and put a link to a phishing site in its body. The employees of work B receive such emails daily, and for large files a URL in the body is normal, so they are likely to click it; a fake login page can then collect what they enter, and the prospective employees’ data leak. Changing the defaults removes the look-alike.

Answer (a)

Why not others:

  • •(b) — genuine emails taken for spam have nothing to do with the settings being public; identical emails are if anything easier to recognise
  • •(c) — the attached PDF is already encrypted with each employee’s key, and encrypting an intercepted copy locks nothing Company A holds
  • •(d) — the URL alone does not open server B: Note 1) of Figure 2 requires each employee’s user ID and password, and eavesdropping does not depend on the defaults either

Key rule: A message whose content is fixed and public can be forged by anyone; make genuine messages distinguishable, or the fixed look becomes a phishing template.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.