Minimum knowledge for secure web payment

安全なウェブ決済のために
最低限知っておいてほしいこと
WebPay meetup #1 2014/07/22

Transcript

1. ҆શͳ΢ΣϒܾࡁͷͨΊʹ
   ࠷௿ݶ஌͓͍ͬͯͯ΄͍͜͠ͱ
   Yutaro Sugai
   @hokkai7go
   

   View Slide

2. ϖΠʂ
   (ָ͠ΜͰ·͔͢)
   

   View Slide

3. ҆શͳ΢ΣϒܾࡁͷͨΊʹ
   ࠷௿ݶ஌͓͍ͬͯͯ΄͍͜͠ͱ
   Yutaro Sugai
   @hokkai7go
   

   View Slide

4. @hokkai7go
   !
   WebPay
   ɾαʔό܈ͷӡ༻
   ɾPCIDSSͳͲηΩϡϦςΟج४΁ͷ४ڌ
   !
   ݸਓ
   ɾ֤छRubyܥΧϯϑΝϨϯεͷϨϙʔτ൝
   ɾΔͼ·ฤू
   ɾChef࣮ફೖ໳ॻ͖·ͨ͠
   

   View Slide

5. PCIDSS஌ͬͯ·͔͢ʁ
   

   View Slide

6. PCIDSSͱ͸
   ΫϨδοτΧʔυ৘ใ࿙Ӯ๷ࢭͷ
   ͨΊͷࠃࡍηΩϡϦςΟج४
   ΫϨδοτΧʔυ৘ใΛऔΓѻ͏
   શͯͷࣄۀऀ΍αʔϏεϓϩόΠ
   μ͸ɺ͜ͷඪ४ʹ४ڌ͢Δඞཁ͕
   ͋Γ·͢ɻ(േଇͳ͠)
   

   View Slide

7. PCIDSSͱ͸
   ܾࡁࣄۀऀ͚ͩͰͳ͘
   AWSͳͲͷαʔϏεϓϩόΠμ͕
   ४ڌ͢Δྫ͕૿͍͑ͯΔ
   

   View Slide

8. Χʔυ൪߸࿙Ӯͷ
   ࡾେϦεΫϙΠϯτ
   

   View Slide

9. ॲཧ ఻ૹ อଘ
   

   View Slide

10. 4242#4242#4242#4242
    ఻ૹ
    

    View Slide

11. 4242#4242#4242#4242
    ఻ૹ
    

    View Slide

12. 4242#4242#4242#4242
    ఻ૹɾॲཧ
    

    View Slide

13. 4242#4242#4242#4242
    อଘ
    

    View Slide

14. ఻ૹ
    

    View Slide

15. PCIDSS͸
    ఻ૹ࣌҉߸ԽΛཁٻ
    

    View Slide

16. ”ΦʔϓϯͳެڞωοτϫʔΫܦ༝Ͱػີ
    ੑͷߴ͍ΧʔυձһσʔλΛ఻ૹ͢Δ৔
    ߹ɺҎԼͷΑ͏ͳɺڧྗͳ҉߸ԽͱηΩϡ
    ϦςΟϓϩτίϧʢSSL/TLSɺIPSECɺ
    SSHͳͲʣΛ࢖༻ͯ͠อޢ͢Δɻ”
    - PCIDSS ཁ݅ͱηΩϡϦςΟධՁखॱόʔδϣϯ3.0 ΑΓൈਮ
    

    View Slide

17. ҉߸ԽͤͣʹΧʔυ൪߸
    ͷ఻ૹ͍ͯ͠·ͤΜ͔ʁ
    

    View Slide

18. ੜͷΧʔυ൪߸ΛαʔόͰ
    ड͚ͱΓͨ͘ͳ͍Ͱ͢ΑͶ
    

    View Slide

19. Έͳ͞Μ͕Χʔυ൪߸Λۃྗѻ
    Θͳ͍͍ͯ͘Α͏ʹɺτʔΫϯ
    ܾࡁͷ࢓૊ΈΛ༻ҙ͍ͯ͠·͢
    

    View Slide

20. ɾΫϥΠΞϯταΠυτʔΫϯ
    ɾαʔόαΠυτʔΫϯ
    

    View Slide

21. ΫϥΠΞϯταΠυτʔΫϯͷར఺
    ʮॲཧʯʮ఻ૹʯʮอଘʯͷ
    ͢΂ͯΛճආ͢Δ͜ͱ͕Ͱ͖·͢
    

    View Slide

22. https://webpay.jp/docs/payments_with_token
    

    View Slide

23. ΫϥΠΞϯταΠυτʔΫϯΛ࢖Θͳ͍
    ɾʮॲཧʯʮ఻ૹʯΛආ͚ΒΕͳ͍
    ɾੜͷΧʔυ൪߸Λѻ͏ϦεΫ
    ɹɾܦ࿏্ͷϩάʹΧʔυ൪߸࢒͍ͬͯ·ͤΜ͔ʁ
    ɹɾʮॲཧʯޙͷϝϞϦ͸҆શͰ͔͢ʁ
    

    View Slide

24. ʮॲཧʯʮ఻ૹʯΛߦ͏͜ͱ͸ϦεΫͰ͢ɻ
    ΫϥΠΞϯταΠυτʔΫϯΛར༻ͯ͠
    ආ͚Δ͜ͱΛ͓͢͢Ί͠·͢ɻ
    

    View Slide

25. ҆શͳ΢ΣϒܾࡁͷͨΊʹ
    ɾSSLͷ࢖༻(αΠτؙ͝ͱ or ࠷௿Ͱ΋ܾࡁϖʔδ)
    ɾద੾ͳΤϥʔϋϯυϦϯά
    ɾෆཁͳΧʔυ৘ใͷഁغ
    

    View Slide