ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Skimming is the unauthorized reading of an RFID tag's data by an attacker's reader. The most effective countermeasure is to ensure tags will communicate only with authenticated, trusted readers. Implementing cryptographic access control-typically a challenge-response protocol where the tag releases data only after verifying that the reader possesses a shared secret key-thwarts unauthorized readers even if they are within range, thereby preserving usability for legitimate warehouse readers. Metallic shielding or "Faraday" packaging can block skimming, but it also blocks authorized scans unless each package is unwrapped, disrupting operations. Simply lowering reader power or moving to low-frequency tags may reduce range but does not prevent a determined attacker with sensitive equipment from eavesdropping or skimming the tag's static identifier. Therefore, employing mutual authentication and encryption on the tag is the most appropriate architectural mitigation.