Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
WAFのルールである OWASP ModSecurity Core Rule Set (CRS...
Search
delphinz
September 21, 2018
Technology
2
1.7k
WAFのルールである OWASP ModSecurity Core Rule Set (CRS)を 使った可視化までの苦労話/20180921_owasp_connect_crs
delphinz
September 21, 2018
Tweet
Share
More Decks by delphinz
See All by delphinz
【セキュリティ競技】MINI Hardeningのご紹介 / MINI Hardneing4 introduction
delphinz
1
1.5k
20200209MINI_INFRA
delphinz
1
380
MINI Hardening Road to Taiwan(2019 HITCON CMT)
delphinz
0
950
淡路島で開催されたhardening2017fesにプレミアムサポートメンバーで参加してきたよ。/20171202-go-for-hardening2017fes
delphinz
0
150
Other Decks in Technology
See All in Technology
【Oracle Cloud ウェビナー】クラウド導入に「専用クラウド」という選択肢、Oracle AlloyとOCI Dedicated Region とは
oracle4engineer
PRO
3
110
GopherCon Tour 概略
logica0419
2
190
Modern_Data_Stack最新動向クイズ_買収_AI_激動の2025年_.pdf
sagara
0
220
o11yで育てる、強い内製開発組織
_awache
3
120
SOC2取得の全体像
shonansurvivors
1
400
GC25 Recap+: Advancing Go Garbage Collection with Green Tea
logica0419
1
410
Exadata Database Service on Dedicated Infrastructure(ExaDB-D) UI スクリーン・キャプチャ集
oracle4engineer
PRO
2
5.4k
Why React!?? Next.jsそしてReactを改めてイチから選ぶ
ypresto
10
4.5k
LLM時代にデータエンジニアの役割はどう変わるか?
ikkimiyazaki
1
450
ACA でMAGI システムを社内で展開しようとした話
mappie_kochi
1
270
データエンジニアがこの先生きのこるには...?
10xinc
0
450
社内報はAIにやらせよう / Let AI handle the company newsletter
saka2jp
2
200
Featured
See All Featured
XXLCSS - How to scale CSS and keep your sanity
sugarenia
248
1.3M
What's in a price? How to price your products and services
michaelherold
246
12k
The Cult of Friendly URLs
andyhume
79
6.6k
Designing Dashboards & Data Visualisations in Web Apps
destraynor
231
53k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
45
2.5k
Understanding Cognitive Biases in Performance Measurement
bluesmoon
29
2.6k
No one is an island. Learnings from fostering a developers community.
thoeni
21
3.5k
Save Time (by Creating Custom Rails Generators)
garrettdimon
PRO
32
1.6k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
48
9.7k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
smashingmag
252
21k
Build The Right Thing And Hit Your Dates
maggiecrowley
37
2.9k
GitHub's CSS Performance
jonrohan
1032
460k
Transcript
WAFͷϧʔϧͰ͋Δ OWASP ModSecurity Core Rule Set (CRS)Λ ͬͨՄࢹԽ·Ͱͷۤ࿑ !EFMQIJO[ 08"41$POOFDU!'PMJP
໊લɿ Masahiro Tabataʢ@delphinzʣ ࣄɿγεςϜίϯαϧλϯτ ηΩϡϦςΟͨ͠ͳΈఔ झຯओʹङྌ࠾ूɻ BBQͰϚάϩͦͯ͠ಲΛ͖͞·͢ɻ MINI
Hardening ӡӦϝϯόʔ(ϑΝγ Ϧςʔγϣϯʣͬͯ·͢♫ ࣗݾհ ʹ+"84%":Ͱ08"41ͱ .*/*IBSEFOJOHΛએதͷ༷ࢠ
.*/*IBSEFOJOHͰฉ͍ͨ ʢݫ͍͠ʣ͝ҙݟɾཁ ɾΠϚυΩ"QBDIFͱ͔Θͳ͍͠ʔʂ ɾ8"'ͱ͔ೖͬͯͳ͍αʔϏε͋Γ·͔͢ʔʁ
ΑΖ͍͠ ͳΒOHJOY NPETFDVSJUZͩʂ
NPETFDVSJUZʹ$34Λఴ͑ͯ .PETFDVSJUZ w .PE4FDVSJUZΦʔϓϯιʔεͷ8FCΞϓϦέʔγϣϯϑΝΠΞΥʔ ϧ 8"' Ͱɺ"QBDIFɺOHJOYɺ**4ͷϞδϡʔϧͱͯ͠ಈ࡞͢Δɻ ։ൃ4QJEFS-BCT͕ߦ͍ͬͯΔɻ IUUQTHJUIVCDPN4QJEFS-BCT.PE4FDVSJUZ 08"41NPETFDVSJUZ$PSF3VMF4FU
w 08"41͕ఏڙ͢ΔNPETFDVSJUZ༻ͷ߈ܸΛݕ͢Δجຊతͳϧʔϧ ηοτ IUUQTXXXPXBTQPSHJOEFYQIQ$BUFHPSZ08"
[email protected]
@$PSF@3VMF@4FU@1SPKFDU
OHJOY NPETFDVSJZͷ᠘ w "QBDIFͷ߹΄ͱΜͲͷMJOVYύοέʔδͰެࣜఏڙ͞ Ε͍ͯΔɻ OHJOYιʔε͔ΒͷϏϧυ͕ඞཁʂ w ެࣜͲ͏ΓʹͬͯઈରʹೖΒͳ͍ʂ CVJME࣌ͷϢʔβʔࢦఆ͕ඞཁ
ύοέʔδ͕Γͳ͍ͱಈ͔ͳ͍ɻ ΤϥʔΛు͔ͳ͍ʢٽʣ
͓Αͦਓྨͷखʹෛ͑ͳ͍ ϩάग़ྗܗࣜ
ՄࢹԽπʔϧΛࢼͯ͠ΈΔ w "VEJU$POTPMF NPETFDVSJUZͷϩάΛཧ͢ΔͨΊʹ࡞ΒΕͨ+BWBΞϓ Ϧέʔγϣϯ 5PNDBU্ʹల։͞Εͯ8&#ϒϥβ͔Βϩάͷऩूɺ อଘɺϑΟϧλϦϯάͳͲͷػೳΛఏڙ͢Δɻ IUUQXXXKXBMMPSHXFCBVEJUDPOTPMFJOEFYKTQ
͜Ε"VEJU$POTPMFͷ᠘͔ w +BWBܾΊଧͪɺެࣜͲ͓Γͩͱ͕ೖΓಈ͔ͳ͍ w SPPUҎԼʹஔ͠ͳ͍ͱϦΞϧλΠϜϩάऔࠐෆՄ w ϦΞϧλΠϜग़ྗʹඞཁͳNMPHDʢNPETFDVSJUZͷϩάग़ ྗπʔϧʣBQBDIF൛ͷΈରԠɺOHJOYඇରԠ w όονܗࣜͷସπʔϧ
QFSM OHJOY൛Ͱಈ͔ͳ͍ w BVEJUDPOTPMF͕ఏڙ͢Δϩάૹ৴πʔϧͰ༻ ʢͨͩ͠ɺҰׅૹ৴Ͱࠩૹ৴Ͱ͖ͳ͍ʣ
ແࣄʹՄࢹԽʹޭ͠·ͨ͠ʂ w ͱΓ͋͑ͣ.*/*IBSEFOJOHͰൃੜͨ͠NPETFDVSJZϩά ΛҰׅͰऔΓࠐΜͰΈΔͱ͜Μͳײ͡
͓·͚ɿ$34࡞ऀͷϫφ w 08"41ެࣜͷ$34ͷઆ໌ʹʮϥΠΞϯɾόʔωοτʯͷه ࡌ͋Γ w ʮϥΠΞϯɾόʔωοτʯͱ͍͑%%04ରࡦͷαʔϏεͰ ༗໊ͳ1SPMFYJDࣾʢͷͪʹ"LBNBJ͕ങऩʣͷۀऀ ʢৄࡉॻ੶ʮαΠόʔɾΫϥΠϜʯΛࢀরʣ
͡Όɺͳ͍ਓͩͬͨʂ
͓·͚ɿ$34࡞ऀͷϫφ w ޡΓʮ-ZPOʯਖ਼͘͠ʮ3ZBOʯͰͨ͠ɻ ϥΠΞϯɾόʔωοτͷ௲Γʹҙʂ ޡɿ ਖ਼ɿ ͪ͜Β͕$34ͷ࡞ऀͰͨ͠ʂ
݁ɿPTTͷΈͰͷ8"'ೖ ਏ͍ɺֶ͕ͼ͋ͬͨ w 8"'ͷΈΛΔ͜ͱ͕Ͱ͖ͨɻ ༻8"'Λ͑ͳ͍ਓPTT͔ΒॳΊͯྑ͍͔ɻ w ݕઐ༻ͷઃఆʹͯ͠ΒΕαʔόΛ͍͡ΔͱͲΜͳΞΫηε͕ 8"'ʹҾ͔͔ͬΔ͔ݟΕΔɻ w ଞͷPTT8"'࣌ؒ
ͱϞνϕʔγϣϯ ͕͋Εࢼͯ͠Έ͍ͨɻ w 7BHSBOU BOTJCMFͰॻ͍ͨͷͰHJUެ։͍ͨ͠ ͔ w ਖ਼͍͠࡞ऀ͕Θ͔ͬͨʂ
ͪΐͬͱࠂ .*/*IBSEFOJOH։࠵༧ఆ w ੈքॳʂʁɹςʔϚʮԾ௨՟ࢢΛकΓ͖Εʂʯ w ౦ژ!:BIPPͰ։࠵ɺͦͷޙෳճ։࠵༧ఆ ౦ژҎ֎Ͱ໊ݹɺେࡕͰͷ։࠵Λௐத ଞͷҬͰͷ։࠵ཁΛ͓͓ͪͯ͠Γ·͢ʂ w ࢀՃرͷํ$POOQBTTΛνΣοΫ͍ͯͩ͘͠͞ɻ
IUUQTNJOJIBSEFOJOHDPOOQBTTDPN
"QQFOEJY w 8FC"QQMJDBUJPO'JSFXBMM 8"' ಡຊվగୈ̎൛ IUUQTXXXJQBHPKQpMFTQEG w 08"41.PE4FDVSJUZ$PSF3VMF4FU3ZBO#BSOFUUQQU IUUQTXXXPXBTQPSHJOEFYQIQ 'JMF08"
[email protected]
@$PSF@3VMF@4FU3ZBO@#BSOFUUQQU