PCI DSS v 3.2に対する対応

@ Security Night #1 2016.5.11
http://secnight.connpass.com/event/30672/

Transcript

1. PCI DSS v 3.2ʹର͢ΔରԠ Junichi Okamura @ Security Night #1 2016.5.11
2. Who am I? • Junichi Okamura @benzookapi • API Lover/Midnight Creator/TDD (Talk Driven Development) Advocator • Rock/Wine/DQ/JOJO/I18N/Marketing/Payment • Scala/Java/Ruby/Python/Node.js/PHP/Mobile/Unity/../ppt
3. Today’s Topic PCI DSSͷ௒΍ΜΘΓઆ໌ͱɺ ͱ͋ΔFinTechاۀͷରԠʹ͍ͭͯ
4. PCI DSSͱ͸ʁ Payment Card Industry Data Security Standardͷུɻ ࠃࡍϖΠϝϯτϒϥϯυ5͕ࣾڞಉͰࡦఆͨ͠ɺ ΫϨδοτۀքʹ͓͚ΔάϩʔόϧηΩϡϦςΟج४ɻ PCI SSCʹΑͬͯ؅ཧɻ
5. PCI SSCͱ͸ʁ Payment Card Industry Security Standards Councilͷུɻ લग़̑ࣾͰઃཱͨ͠ηΩϡϦςΟ؅ཧஂମɻ
6. ͬ͘͟Γݴ͏ͱ ΫϨδοτΧʔυΛѻ͏ۀऀ͕औಘ͢΂͖ηΩϡϦςΟن֨
7. ͞Βʹݴ͏ͱ ΫϨδοτΧʔυ৘ใ͕̍ճͰ΋఻ૹ͢ΔՄೳੑͷ͋Δۀऀ͸औΒͳ ͍ͱμϝͳ΋ͷͰ͢ɻʢຊདྷ͸ʣ
8. PCI DSSͷओཁ߲໨ ҆શͳωοτϫʔΫͷߏஙɾҡ࣋ Χʔυձһσʔλͷอޢ ੬ऑੑΛ؅ཧ͢ΔϓϩάϥϜͷ੔උ ڧݻͳΞΫηε੍ޚख๏ͷಋೖ ఆظతͳωοτϫʔΫͷ؂ࢹ͓Αͼςετ ৘ใηΩϡϦςΟɾϙϦγʔͷ੔උ ʢ࣮ࡍ͸΋ͷ͘͢͝ࡉ෼Խ͞Εఆٛ͞Ε͍ͯ·͢ʣ
9. PCI DSSͷऔಘํ๏ ໰਍ථʹΑΔࣗݾ਍அ ੬ऑੑεΩϟχϯάςετ ๚໰ௐࠪ ʢ࣮ࡍ͸ΫϨδοτΧʔυͷѻ͍ํͰϨϕϧ෼͚͞Ε͍ͯ·͢ʣ
10. PCI DSSͷऔಘίετ औಘ͢ΔϨϕϧʹΑΓ·͕͢ɺ ௨ৗ೥ؒ਺ඦສ͙Β͍͔͔Γ·͢ɻ
11. PCI DSSΛऔΒͳ͍ͱͲ͏ͳΔͷʁ ΧʔυܾࡁΛड͚෇͚Δ͜ͱ͸Ͱ͖·ͤΜ ʢຊདྷ͸ʣ
12. ࣮৘͸… ܾࡁ୅ߦ΍ࢿۚҠಈۀऀͳͲ͕औಘ͍ͯͯ͠ɺ Χʔυ৘ใ͸൴Β͕ѻ͏ͷͰɺ Ұൠͷۀऀ͸൴ΒΛհͯ͠ΧʔυܾࡁΛड͚Δ͜ͱ͕Ͱ͖·͢
13. PCI DSSͷৄࡉʹ͍ͭͯ͸ ࣍ճҎ߱Ͱಛू૊Ή༧ఆͰ͢ ࠓ೔͸͜ͷลͰצห
14. PCI DSSͷόʔδϣϯ 2004೥12݄ ੍ఆ 2006೥9݄ v 1.1 2008೥10݄ v1.2 -> v 2.0 2013೥12݄ v 3.0 2015೥4݄ v 3.1 2016೥4݄ v 3.2 (࠷৽ʣ
15. ࠷৽൛ v 3.2ʹ͍ͭͯ v 3.0 ͔Βͷओͳมߋ఺ɿ TLS 1.1Ҏ্ͷ௨৴Λαϙʔτ͠ͳ͍͞ʢ2016೥6݄30೔·Ͱʹʣ SSL/TLS 1.0ͷ௨৴ΛແޮԽ͠ͳ͍͞ʢ2018೥6݄30೔·Ͱʹʣ
16. ͭ·Γ 2016೥6݄30೔Ҏ߱ʹTLS1.1Λαϙʔτ͍ͯ͠ͳ͍ۀऀ 2018೥6݄30೔Ҏ߱ʹSSl/TLS1.0Λαϙʔτ͍ͯ͠Δۀऀ ʹ PCI DSSΛണୣ͞ΕΔʁʢ͸ͣʣ
17. SSLʁTLSʁ ͍͖ͳΓࠓ೔ͷςʔϚʹ͍͖ۙͮͯ·ͨ͠
18. ͳͥ͜Μͳมߋ͕ͳ͞Εͨͷ͔ʁ ͜͜Ͱͪΐͬͱࢥ͍ग़ͯ͠Έ·͠ΐ͏
19. ࡢࠓͷOSSͷ੬ऑੑͷൃ֮ Heartbleedʢ2014೥4݄ʣ POODLEʢ2014೥10݄ʣ Logjamʢ2015೥5݄ʣ … ଟ෼಺༰͸Α͘Θ͔Βͳͯ͘΋ฉ͍ͨ͜ͱ͸͋Δ͸ͣ
20. ҆શͳωοτϫʔΫͷߏஙɾҡ࣋ ͜ͷେલఏ͕͜ͷ··ͩͱڴ͔͞ΕΔ ͦΕΛ્ࢭ͢ΔͨΊͷߋ৽
21. PCI DSSΛऔಘ͍ͯ͠ΔاۀͷରԠ ΍͸ΓFinTechاۀ͕Ұ൪හײ
22. FinTechاۀҐ֎͸ؔ܎ͳ͍ʁ ͦ͏Ͱ͸͋Γ·ͤΜ ݸਓ৘ใͳͲ༷ʑͳηϯγςΟϒ৘ใΛѻ͏େاۀ͸ PCI DSSΛऔಘ͍ͯ͠Δ͜ͱ͕ଟ͍Ͱ͢ ʢྫɿAWS͞Μͱ͔ʣ ͦ΋ͦ΋ηΩϡϦςΟ͸શͯͷαʔϏεʹେࣄ
23. FinTechاۀͷରԠྫ
24. PayPalͷࣄྫ PCI DSS v3.2Ҏ֎ͷ΋ͷ΋ؚΜͰ ηΩϡϦςΟܭըͱͯ͠άϩʔόϧͰ࣮ࢪ
25. ରԠ߲໨ SSLূ໌ॻͷΞοϓάϨʔυʢVeriSign G5ʣ TLS1.2/HTTP1.1΁ͷΞοϓάϨʔυ γεςϜؒ௨৴ͷHTTPͷഇࢭ ClassicɹAPIͷGETഇࢭʢREST͸আ͘ʣ ͦͷଞ…
26. ৄࡉʢϚΠΫϩαΠτʣ https://www.paypal-knowledge.com/infocenter/index? page=content&id=FAQ1913&expand=true&locale=ja_JP
27. ։ൃऀ޲͚ηΩϡϦςΟΨΠυϥΠϯ https://developer.paypal.com/docs/classic/lifecycle/info-security- guidelines/
28. ͳͥʢલ౗ͯ͠͠·Ͱʣ΍Δ͔ʁ FinTechاۀͱͯ͠ͷ҆શɾ҆શͷͨΊ
29. Thank You Junichi Okamura @ Security Night #1 2016.5.11