Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
PCI DSS v 3.2に対する対応
Search
benzookapi
May 12, 2016
Technology
2
2.4k
PCI DSS v 3.2に対する対応
@ Security Night #1 2016.5.11
http://secnight.connpass.com/event/30672/
benzookapi
May 12, 2016
Tweet
Share
More Decks by benzookapi
See All by benzookapi
技術をお金と貢献に変える、Shopifyテーマとアプリの開発
benzookapi
1
2.1k
Shopify Storefront APIを使った PWA e-commerceの解説とデモ
benzookapi
0
590
DevRel for tech. entrepreneurs: Beyond platform partners
benzookapi
0
160
Shopifyを使ったヘッドレスコマースの 実現方法と事例
benzookapi
0
200
React + GraphQL を使ったShopify Appの作り方と そのマネタイズ方法
benzookapi
1
1.3k
Shopifyアプリエコシステムで始める 第3のスキルマネタイズ
benzookapi
0
4.3k
Tech. Blog TIPS
benzookapi
0
290
Our new DevRel: Invention of scaling out partner ecosystem
benzookapi
0
280
WordPressとShopifyでECサイトを作ろう
benzookapi
0
1.1k
Other Decks in Technology
See All in Technology
Autonomous Database - Dedicated 技術詳細 / adb-d_technical_detail_jp
oracle4engineer
PRO
4
10k
JTCにおける内製×スクラム開発への挑戦〜内製化率95%達成の舞台裏/JTC's challenge of in-house development with Scrum
aeonpeople
0
210
ハードウェアとソフトウェアをつなぐ全てを内製している企業の E2E テストの作り方 / How to create E2E tests for a company that builds everything connecting hardware and software in-house
bitkey
PRO
1
130
20250913_JAWS_sysad_kobe
takuyay0ne
2
180
S3アクセス制御の設計ポイント
tommy0124
3
200
なぜスクラムはこうなったのか?歴史が教えてくれたこと/Shall we explore the roots of Scrum
sanogemaru
5
1.6k
20250903_1つのAWSアカウントに複数システムがある環境におけるアクセス制御をABACで実現.pdf
yhana
3
550
Rustから学ぶ 非同期処理の仕組み
skanehira
1
130
テストを軸にした生き残り術
kworkdev
PRO
0
200
Practical Agentic AI in Software Engineering
uzyn
0
110
オブザーバビリティが広げる AIOps の世界 / The World of AIOps Expanded by Observability
aoto
PRO
0
370
dbt開発 with Claude Codeのためのガードレール設計
10xinc
2
1.2k
Featured
See All Featured
Automating Front-end Workflow
addyosmani
1370
200k
jQuery: Nuts, Bolts and Bling
dougneiner
64
7.9k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
marktimemedia
31
2.5k
Distributed Sagas: A Protocol for Coordinating Microservices
caitiem20
333
22k
RailsConf 2023
tenderlove
30
1.2k
Designing for Performance
lara
610
69k
Build The Right Thing And Hit Your Dates
maggiecrowley
37
2.9k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
smashingmag
252
21k
What’s in a name? Adding method to the madness
productmarketing
PRO
23
3.7k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
507
140k
Six Lessons from altMBA
skipperchong
28
4k
Designing Experiences People Love
moore
142
24k
Transcript
PCI DSS v 3.2ʹର͢ΔରԠ Junichi Okamura @ Security Night #1
2016.5.11
Who am I? • Junichi Okamura @benzookapi • API Lover/Midnight
Creator/TDD (Talk Driven Development) Advocator • Rock/Wine/DQ/JOJO/I18N/Marketing/Payment • Scala/Java/Ruby/Python/Node.js/PHP/Mobile/Unity/../ppt
Today’s Topic PCI DSSͷΜΘΓઆ໌ͱɺ ͱ͋ΔFinTechاۀͷରԠʹ͍ͭͯ
PCI DSSͱʁ Payment Card Industry Data Security Standardͷུɻ ࠃࡍϖΠϝϯτϒϥϯυ5͕ࣾڞಉͰࡦఆͨ͠ɺ ΫϨδοτۀքʹ͓͚ΔάϩʔόϧηΩϡϦςΟج४ɻ
PCI SSCʹΑͬͯཧɻ
PCI SSCͱʁ Payment Card Industry Security Standards Councilͷུɻ લग़̑ࣾͰઃཱͨ͠ηΩϡϦςΟཧஂମɻ
ͬ͘͟Γݴ͏ͱ ΫϨδοτΧʔυΛѻ͏ۀऀ͕औಘ͖͢ηΩϡϦςΟن֨
͞Βʹݴ͏ͱ ΫϨδοτΧʔυใ͕̍ճͰૹ͢ΔՄೳੑͷ͋ΔۀऀऔΒͳ ͍ͱμϝͳͷͰ͢ɻʢຊདྷʣ
PCI DSSͷओཁ߲ ҆શͳωοτϫʔΫͷߏஙɾҡ࣋ Χʔυձһσʔλͷอޢ ੬ऑੑΛཧ͢ΔϓϩάϥϜͷඋ ڧݻͳΞΫηε੍ޚख๏ͷಋೖ ఆظతͳωοτϫʔΫͷࢹ͓Αͼςετ ใηΩϡϦςΟɾϙϦγʔͷඋ ʢ࣮ࡍͷ͘͢͝ࡉԽ͞Εఆٛ͞Ε͍ͯ·͢ʣ
PCI DSSͷऔಘํ๏ ථʹΑΔࣗݾஅ ੬ऑੑεΩϟχϯάςετ ๚ௐࠪ ʢ࣮ࡍΫϨδοτΧʔυͷѻ͍ํͰϨϕϧ͚͞Ε͍ͯ·͢ʣ
PCI DSSͷऔಘίετ औಘ͢ΔϨϕϧʹΑΓ·͕͢ɺ ௨ৗؒඦສ͙Β͍͔͔Γ·͢ɻ
PCI DSSΛऔΒͳ͍ͱͲ͏ͳΔͷʁ ΧʔυܾࡁΛड͚͚Δ͜ͱͰ͖·ͤΜ ʢຊདྷʣ
࣮… ܾࡁߦࢿۚҠಈۀऀͳͲ͕औಘ͍ͯͯ͠ɺ Χʔυใ൴Β͕ѻ͏ͷͰɺ Ұൠͷۀऀ൴ΒΛհͯ͠ΧʔυܾࡁΛड͚Δ͜ͱ͕Ͱ͖·͢
PCI DSSͷৄࡉʹ͍ͭͯ ࣍ճҎ߱ͰಛूΉ༧ఆͰ͢ ࠓ͜ͷลͰצห
PCI DSSͷόʔδϣϯ 200412݄ ੍ఆ 20069݄ v 1.1 200810݄ v1.2 ->
v 2.0 201312݄ v 3.0 20154݄ v 3.1 20164݄ v 3.2 (࠷৽ʣ
࠷৽൛ v 3.2ʹ͍ͭͯ v 3.0 ͔Βͷओͳมߋɿ TLS 1.1Ҏ্ͷ௨৴Λαϙʔτ͠ͳ͍͞ʢ20166݄30·Ͱʹʣ SSL/TLS 1.0ͷ௨৴ΛແޮԽ͠ͳ͍͞ʢ20186݄30·Ͱʹʣ
ͭ·Γ 20166݄30Ҏ߱ʹTLS1.1Λαϙʔτ͍ͯ͠ͳ͍ۀऀ 20186݄30Ҏ߱ʹSSl/TLS1.0Λαϙʔτ͍ͯ͠Δۀऀ ʹ PCI DSSΛണୣ͞ΕΔʁʢͣʣ
SSLʁTLSʁ ͍͖ͳΓࠓͷςʔϚʹ͍͖ۙͮͯ·ͨ͠
ͳͥ͜Μͳมߋ͕ͳ͞Εͨͷ͔ʁ ͜͜Ͱͪΐͬͱࢥ͍ग़ͯ͠Έ·͠ΐ͏
ࡢࠓͷOSSͷ੬ऑੑͷൃ֮ Heartbleedʢ20144݄ʣ POODLEʢ201410݄ʣ Logjamʢ20155݄ʣ … ଟ༰Α͘Θ͔Βͳͯ͘ฉ͍ͨ͜ͱ͋Δͣ
҆શͳωοτϫʔΫͷߏஙɾҡ࣋ ͜ͷେલఏ͕͜ͷ··ͩͱڴ͔͞ΕΔ ͦΕΛ્ࢭ͢ΔͨΊͷߋ৽
PCI DSSΛऔಘ͍ͯ͠ΔاۀͷରԠ ΓFinTechاۀ͕Ұ൪හײ
FinTechاۀҐ֎ؔͳ͍ʁ ͦ͏Ͱ͋Γ·ͤΜ ݸਓใͳͲ༷ʑͳηϯγςΟϒใΛѻ͏େاۀ PCI DSSΛऔಘ͍ͯ͠Δ͜ͱ͕ଟ͍Ͱ͢ ʢྫɿAWS͞Μͱ͔ʣ ͦͦηΩϡϦςΟશͯͷαʔϏεʹେࣄ
FinTechاۀͷରԠྫ
PayPalͷࣄྫ PCI DSS v3.2Ҏ֎ͷͷؚΜͰ ηΩϡϦςΟܭըͱͯ͠άϩʔόϧͰ࣮ࢪ
ରԠ߲ SSLূ໌ॻͷΞοϓάϨʔυʢVeriSign G5ʣ TLS1.2/HTTP1.1ͷΞοϓάϨʔυ γεςϜؒ௨৴ͷHTTPͷഇࢭ ClassicɹAPIͷGETഇࢭʢRESTআ͘ʣ ͦͷଞ…
ৄࡉʢϚΠΫϩαΠτʣ https://www.paypal-knowledge.com/infocenter/index? page=content&id=FAQ1913&expand=true&locale=ja_JP
։ൃऀ͚ηΩϡϦςΟΨΠυϥΠϯ https://developer.paypal.com/docs/classic/lifecycle/info-security- guidelines/
ͳͥʢલͯ͠͠·ͰʣΔ͔ʁ FinTechاۀͱͯ͠ͷ҆શɾ҆શͷͨΊ
Thank You Junichi Okamura @ Security Night #1 2016.5.11