IPA IP 2023 Question 57
A question IPA Japan published in 令和5年度 ITパスポート試験 公開問題 問57, translated into English. ITPEC is based on the same exams.
Among security measures in IoT devices, which of the following is an appropriate measure that gives tamper resistance?
Explanation
Obfuscating the embedded software — tamper resistance is how hard it is to analyse or alter a device's inside, and obfuscation makes the software hard to read.
An IoT device sits where an attacker can take it apart. Tamper resistance protects against that: physical measures (sealed chips, circuits that erase keys when the case is opened) and logical ones that make the program and the data inside difficult to read or modify. Obfuscation rewrites the embedded software so that it still runs but is very hard to understand, increasing the time needed to decipher it and find keys or weaknesses.
Answer (d)
Why not others:
- •(a) — locking out the connection after repeated authentication failures is a countermeasure against password guessing, not against analysing the device
- •(b) — encrypting the communicated data protects its confidentiality on the network; it does nothing to stop someone reading the inside of the device
- •(c) — online updates apply patches for vulnerabilities; this is vulnerability management, not tamper resistance
Key rule: Tamper resistance means resisting analysis and alteration of a device's internals, by physical protection or by making the software and data hard to read.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.