Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Minimum knowledge for secure web payment

Minimum knowledge for secure web payment

安全なウェブ決済のために
最低限知っておいてほしいこと
WebPay meetup #1 2014/07/22

527e2af04bd5b212b479840016274cdb?s=128

Yutaro Sugai

July 22, 2014
Tweet

Transcript

  1. ҆શͳ΢ΣϒܾࡁͷͨΊʹ ࠷௿ݶ஌͓͍ͬͯͯ΄͍͜͠ͱ Yutaro Sugai <sugai@webpay.jp> @hokkai7go

  2. ϖΠʂ (ָ͠ΜͰ·͔͢)

  3. ҆શͳ΢ΣϒܾࡁͷͨΊʹ ࠷௿ݶ஌͓͍ͬͯͯ΄͍͜͠ͱ Yutaro Sugai <sugai@webpay.jp> @hokkai7go

  4. @hokkai7go ! WebPay ɾαʔό܈ͷӡ༻ ɾPCIDSSͳͲηΩϡϦςΟج४΁ͷ४ڌ ! ݸਓ ɾ֤छRubyܥΧϯϑΝϨϯεͷϨϙʔτ൝ ɾΔͼ·ฤू ɾChef࣮ફೖ໳ॻ͖·ͨ͠

  5. PCIDSS஌ͬͯ·͔͢ʁ

  6. PCIDSSͱ͸ ΫϨδοτΧʔυ৘ใ࿙Ӯ๷ࢭͷ ͨΊͷࠃࡍηΩϡϦςΟج४ ΫϨδοτΧʔυ৘ใΛऔΓѻ͏ શͯͷࣄۀऀ΍αʔϏεϓϩόΠ μ͸ɺ͜ͷඪ४ʹ४ڌ͢Δඞཁ͕ ͋Γ·͢ɻ(േଇͳ͠)

  7. PCIDSSͱ͸ ܾࡁࣄۀऀ͚ͩͰͳ͘ AWSͳͲͷαʔϏεϓϩόΠμ͕ ४ڌ͢Δྫ͕૿͍͑ͯΔ

  8. Χʔυ൪߸࿙Ӯͷ ࡾେϦεΫϙΠϯτ

  9. ॲཧ ఻ૹ อଘ

  10. 4242#4242#4242#4242 ఻ૹ

  11. 4242#4242#4242#4242 ఻ૹ

  12. 4242#4242#4242#4242 ఻ૹɾॲཧ

  13. 4242#4242#4242#4242 อଘ

  14. ఻ૹ

  15. PCIDSS͸ ఻ૹ࣌҉߸ԽΛཁٻ

  16. ”ΦʔϓϯͳެڞωοτϫʔΫܦ༝Ͱػີ ੑͷߴ͍ΧʔυձһσʔλΛ఻ૹ͢Δ৔ ߹ɺҎԼͷΑ͏ͳɺڧྗͳ҉߸ԽͱηΩϡ ϦςΟϓϩτίϧʢSSL/TLSɺIPSECɺ SSHͳͲʣΛ࢖༻ͯ͠อޢ͢Δɻ” - PCIDSS ཁ݅ͱηΩϡϦςΟධՁखॱόʔδϣϯ3.0 ΑΓൈਮ

  17. ҉߸ԽͤͣʹΧʔυ൪߸ ͷ఻ૹ͍ͯ͠·ͤΜ͔ʁ

  18. ੜͷΧʔυ൪߸ΛαʔόͰ ड͚ͱΓͨ͘ͳ͍Ͱ͢ΑͶ

  19. Έͳ͞Μ͕Χʔυ൪߸Λۃྗѻ Θͳ͍͍ͯ͘Α͏ʹɺτʔΫϯ ܾࡁͷ࢓૊ΈΛ༻ҙ͍ͯ͠·͢

  20. ɾΫϥΠΞϯταΠυτʔΫϯ ɾαʔόαΠυτʔΫϯ

  21. ΫϥΠΞϯταΠυτʔΫϯͷར఺ ʮॲཧʯʮ఻ૹʯʮอଘʯͷ ͢΂ͯΛճආ͢Δ͜ͱ͕Ͱ͖·͢

  22. https://webpay.jp/docs/payments_with_token

  23. ΫϥΠΞϯταΠυτʔΫϯΛ࢖Θͳ͍ ɾʮॲཧʯʮ఻ૹʯΛආ͚ΒΕͳ͍ ɾੜͷΧʔυ൪߸Λѻ͏ϦεΫ ɹɾܦ࿏্ͷϩάʹΧʔυ൪߸࢒͍ͬͯ·ͤΜ͔ʁ ɹɾʮॲཧʯޙͷϝϞϦ͸҆શͰ͔͢ʁ

  24. ʮॲཧʯʮ఻ૹʯΛߦ͏͜ͱ͸ϦεΫͰ͢ɻ ΫϥΠΞϯταΠυτʔΫϯΛར༻ͯ͠ ආ͚Δ͜ͱΛ͓͢͢Ί͠·͢ɻ

  25. ҆શͳ΢ΣϒܾࡁͷͨΊʹ ɾSSLͷ࢖༻(αΠτؙ͝ͱ or ࠷௿Ͱ΋ܾࡁϖʔδ) ɾద੾ͳΤϥʔϋϯυϦϯά ɾෆཁͳΧʔυ৘ใͷഁغ