IPA IP 2024 Question 73
A question IPA Japan published in 令和6年度 ITパスポート試験 公開問題 問73, translated into English. ITPEC is based on the same exams.
Among the security measures for IoT devices, which of the following is the most appropriate as a countermeasure against social engineering?
Explanation
Physically destroying a disposed IoT device — social engineering obtains information through people’s actions and carelessness, not through technical attacks, and searching discarded equipment is one of its methods.
Social engineering covers shoulder surfing (watching someone enter a password), pretending to be a colleague or an administrator on the telephone, and trashing (dumpster diving): picking up thrown-away documents and equipment to read the information left in them. An IoT device keeps settings, passwords and recorded data in its built-in storage. If it is thrown away as it is, someone can take it from the waste and read that storage. Physically destroying the storage on disposal removes what trashing would find.
Answer (d)
Why not others:
- •(a) — encryption protects the data on the network against eavesdropping, a technical attack on the communication
- •(b) — updating the firmware closes vulnerabilities against attacks that exploit them, a technical attack on the software
- •(c) — anti-malware software is a countermeasure against malware infection, not against deceiving or watching people
Key rule: Social engineering attacks people and what they leave behind (shoulder surfing, impersonation, trashing), so its countermeasures are procedures such as destroying media on disposal, privacy filters and verifying callers.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.