Minimum knowledge for secure web payment

Transcript

1. ҆શͳ΢ΣϒܾࡁͷͨΊʹ ࠷௿ݶ஌͓͍ͬͯͯ΄͍͜͠ͱ Yutaro Sugai <sugai@webpay.jp> @hokkai7go

2. ϖΠʂ (ָ͠ΜͰ·͔͢)

3. ҆શͳ΢ΣϒܾࡁͷͨΊʹ ࠷௿ݶ஌͓͍ͬͯͯ΄͍͜͠ͱ Yutaro Sugai <sugai@webpay.jp> @hokkai7go

4. @hokkai7go ! WebPay ɾαʔό܈ͷӡ༻ ɾPCIDSSͳͲηΩϡϦςΟج४΁ͷ४ڌ ! ݸਓ ɾ֤छRubyܥΧϯϑΝϨϯεͷϨϙʔτ൝ ɾΔͼ·ฤू ɾChef࣮ફೖ໳ॻ͖·ͨ͠

5. PCIDSS஌ͬͯ·͔͢ʁ

6. PCIDSSͱ͸ ΫϨδοτΧʔυ৘ใ࿙Ӯ๷ࢭͷ ͨΊͷࠃࡍηΩϡϦςΟج४ ΫϨδοτΧʔυ৘ใΛऔΓѻ͏ શͯͷࣄۀऀ΍αʔϏεϓϩόΠ μ͸ɺ͜ͷඪ४ʹ४ڌ͢Δඞཁ͕ ͋Γ·͢ɻ(േଇͳ͠)

7. PCIDSSͱ͸ ܾࡁࣄۀऀ͚ͩͰͳ͘ AWSͳͲͷαʔϏεϓϩόΠμ͕ ४ڌ͢Δྫ͕૿͍͑ͯΔ

8. Χʔυ൪߸࿙Ӯͷ ࡾେϦεΫϙΠϯτ

9. ॲཧ ఻ૹ อଘ

10. 4242#4242#4242#4242
    ఻ૹ

11. 4242#4242#4242#4242
    ఻ૹ

12. 4242#4242#4242#4242
    ఻ૹɾॲཧ

13. 4242#4242#4242#4242
    อଘ

14. ఻ૹ

15. PCIDSS͸ ఻ૹ࣌҉߸ԽΛཁٻ

16. ”ΦʔϓϯͳެڞωοτϫʔΫܦ༝Ͱػີ ੑͷߴ͍ΧʔυձһσʔλΛ఻ૹ͢Δ৔ ߹ɺҎԼͷΑ͏ͳɺڧྗͳ҉߸ԽͱηΩϡ ϦςΟϓϩτίϧʢSSL/TLSɺIPSECɺ SSHͳͲʣΛ࢖༻ͯ͠อޢ͢Δɻ” - PCIDSS ཁ݅ͱηΩϡϦςΟධՁखॱόʔδϣϯ3.0 ΑΓൈਮ

17. ҉߸ԽͤͣʹΧʔυ൪߸ ͷ఻ૹ͍ͯ͠·ͤΜ͔ʁ

18. ੜͷΧʔυ൪߸ΛαʔόͰ ड͚ͱΓͨ͘ͳ͍Ͱ͢ΑͶ

19. Έͳ͞Μ͕Χʔυ൪߸Λۃྗѻ Θͳ͍͍ͯ͘Α͏ʹɺτʔΫϯ ܾࡁͷ࢓૊ΈΛ༻ҙ͍ͯ͠·͢

20. ɾΫϥΠΞϯταΠυτʔΫϯ ɾαʔόαΠυτʔΫϯ

21. ΫϥΠΞϯταΠυτʔΫϯͷར఺ ʮॲཧʯʮ఻ૹʯʮอଘʯͷ ͢΂ͯΛճආ͢Δ͜ͱ͕Ͱ͖·͢

22. https://webpay.jp/docs/payments_with_token

23. ΫϥΠΞϯταΠυτʔΫϯΛ࢖Θͳ͍ ɾʮॲཧʯʮ఻ૹʯΛආ͚ΒΕͳ͍ ɾੜͷΧʔυ൪߸Λѻ͏ϦεΫ ɹɾܦ࿏্ͷϩάʹΧʔυ൪߸࢒͍ͬͯ·ͤΜ͔ʁ ɹɾʮॲཧʯޙͷϝϞϦ͸҆શͰ͔͢ʁ

24. ʮॲཧʯʮ఻ૹʯΛߦ͏͜ͱ͸ϦεΫͰ͢ɻ ΫϥΠΞϯταΠυτʔΫϯΛར༻ͯ͠ ආ͚Δ͜ͱΛ͓͢͢Ί͠·͢ɻ

25. ҆શͳ΢ΣϒܾࡁͷͨΊʹ ɾSSLͷ࢖༻(αΠτؙ͝ͱ or ࠷௿Ͱ΋ܾࡁϖʔδ) ɾద੾ͳΤϥʔϋϯυϦϯά ɾෆཁͳΧʔυ৘ใͷഁغ