Security by buildersηΩϡϦςΟࢹΛΫϥυͰʮͭ͘ΔʯHokuto HoshiVP of Technology, Cookpad Inc.[email protected]
View Slide
ే (΄͠ ΄͘ͱ) / @kani_b• ΫοΫύουגࣜձࣾ VP of Technology ࠪҕһձ ࠪิॿऀ• શࣾԣஅͰͷใηΩϡϦςΟϦʔυ͍ͬͯ·͢• Site Reliability & Security Engineer• AWS ೝఆ SA, DevOps ΤϯδχΞ (Professional)• 2013৽ଔೖࣾ, AWS ར༻ྺ9͘Β͍
ΫοΫύουͱ AWS• 2011ʹશҠߦ• 2ͭͷϦʔδϣϯΛओʹར༻• 400 Ҏ্ͷ ECS αʔϏε͕ EC2 Spot Πϯελϯε্ͰՔಇ• શͯͷϢʔβ͚αʔϏε͜͜Ͱಈ͍͍ͯΔ
ΫοΫύουͱΫϥυ• ࣾγεςϜ΄΅શ͕ͯ AWS ্·ͨ SaaS ͱͯ͠Քಇ• ࣗલӡ༻ΛۃྗݮΒ͢ߏ• ΦϑΟεʹ͋ΔͷωοτϫʔΫػثͷΈ
ΫοΫύουʹ͓͚ΔใηΩϡϦςΟͷҙຯ
Α͘ฉ͔ΕΔ͜ͱ• ʮϨγϐαʔϏεʹใηΩϡϦςΟ͕ඞཁͳΜͰ͔͢ʁʯ
Α͘ฉ͔ΕΔ͜ͱ• ʮϨγϐαʔϏεʹใηΩϡϦςΟ͕ඞཁͳΜͰ͔͢ʁʯ• A. ඞཁ͔ͭෆՄܽͰ͢
ʮຖͷྉཧʯͱใηΩϡϦςΟ• Ϩγϐσʔλɺࣸਅɺίϝϯτɺϩάɺ༷ʑͳσʔλ• ৯ࣄਓؒͷੜ׆ͱີʹඥͮ͘• μΠΤοτಛఆͷපؾͳͲϓϥΠόγʹؔΘΔใ• ΑΓۙʹ͍͚ͬͯͨͩΔαʔϏεͰ͋Γଓ͚ΔͨΊʹ ৴པΛಘͯใΛ༬͔ΓɺΛՌͨ͢͜ͱ͕ॏཁ
कΔ͖ΤϦΞ• શࣾࢹʹཱͬͨରࡦ͕ॏཁ• Ϣʔβ͚αʔϏε• ࣾγεςϜ• ใͷऔΓѻ͍ํͳͲϧʔϧӡ༻• ͋ΒΏΔηΩϡϦςΟ՝ʹνʔϜͱͯ͠ରԠ
࣮ࡍͷରࡦӡ༻
جຊతͳߟ͑ํ• ϧʔϧΦϖϨʔγϣϯͰͳٕ͘ज़ΈͰकΔ• ૿Ճ͠ଓ͚ΔτϥϑΟοΫʹରԠͰ͖ͳ͍• ਓؒඞͣϛεΛ͢Δ• ΫϥυͱͷڥքΛೝࣝɺͤΔͱ͜ΖͤΔ• ޚ100%Ͱͳ͘ “Կ͕ى͖͔ͨΘ͔Δ” ঢ়ଶΛࢦ͢
ޚ100%Ͱͳ͍ཧ༝• ʮશͳޚʯଘࡏ͠ͳ͍• શʹ͚ۙͮΔ΄ͲίϯϑϦΫτ͕ى͖͍͢• ޚਫ਼Λ1%্͛Δίετ > ݕਫ਼Λ্͛Δίετ• ૯߹֨ಆٕͱͯ͠औΓΉ
ηΩϡϦςΟγεςϜͷઃܭํ• ޚ͢ΔͨΊͷΈϩΪϯάγεςϜ: ηϯαʔ• ηϯαʔ͔ΒσʔλΛूΊɺࢹɾੳ͢Δޚ ݕ ରԠ
ηϯαʔ• AWS ͷηΩϡϦςΟαʔϏε• Amazon CloudTrail, Amazon GuardDuty, AWS WAF, etc• ηΩϡϦςΟ• IDS, EDR, ίϯςφΠϝʔδεΩϟϯ, NGFW, etc• ͋ΒΏΔϩά• ΞΫηεϩά, OS ͷϩά, ΦϑΟεεΠʔτͷϩά, etc
໘͢Δ• ऩू͢Δϩάͷྲྀྔछྨ͕ଟ͗͢Δ• τϥϑΟοΫऔΓࠐΉγεςϜͷ૿Ճ• ίετ૿ʹ݁• ࢢൢͷ SIEM SaaS ͷඅ༻ओʹετϨʔδʹ͔͔Δ• ͦͷͨΊʹϩάͷྔΛߜΔͷຊస• ੳ࣌ʹ͡ΊͯϑΟϧλ͞ΕΔ͖
OSS ͷྗΛआΓΔ• Graylog: ϩάϚωδϝϯτͷͨΊͷ OSS• ϩάͷશจݕࡧɺՄࢹԽɺΞϥʔςΟϯάͳͲ͕Մೳ• ਫฏεέʔϧ͢Δઃܭʹͳ͍ͬͯΔ• Elasticsearch ͕όοΫΤϯυ• Amazon Elasticsearch Service Ͱলྗӡ༻
Graylog ͷల։ϩάEC2 Instances Network Load Balancer Elasticsearch ServiceGraylog InstanceSecurity EngineerੳApplication Load Balancer
ΑΓͨ͘͞ΜͷϩάΛऔΓࠐΉͨΊʹ• ϩάͷૹΓઌ͕τϥϑΟοΫΛड͚͖Εͳ͘ͳΔ• όοΫΤϯυʹٻΊΒΕΔՄ༻ੑඇৗʹߴ͘ͳΔ• શͯͷϩά Amazon S3 ʹҰอଘ͔ͯ͠Βॲཧ• ߴՄ༻Ͱεέʔϧ͢ΔࢄετϨʔδ• όοϑΝΛઃ͚Δ͜ͱͰߏΛॊೈʹͰ͖Δ• อଘͨ͠ϑΝΠϧΛ AWS Lambda Ͱલॲཧͯ͠ Graylog ֨ೲ
ϩάอ࣋ظؒͷ• ΦϯϥΠϯετϨʔδϨΠςϯγ, ߴίετ (Elasticsearch)• શͯͷϩάΛΦϯϥΠϯʹ͓ͯ͘͠ඞཁͳ͍• Ұఆظؒܦͬͨϩά Graylog ͔Βআͯ͠ S3 ͷΈͰอ࣋• ඞཁͳࡍ Amazon Athena ͔ΒΫΤϦՄೳ• ίετ͔ͭेߴʹݕࡧɾੳͰ͖Δ
εέʔϧ͢ΔΞʔΩςΫνϟEC2 InstancesOfficeGuardDuty, CloudTrail, etc….Kinesis FirehoseLambdaFunctionS3 BucketAthenaGraylog EC2 InstancesLambdaFunction
εέʔϧ͢ΔΞʔΩςΫνϟEC2 InstancesOfficeGuardDuty, CloudTrail, etc….Kinesis FirehoseLambdaFunctionS3 BucketAthenaGraylog EC2 InstancesLambdaFunctionηϯαʔ ू ੵɾอ࣋ ࢹɾੳ
ϩάͷੳɾݕ• ݕγεςϜΛ AWS Lambda Λ࣮ͬͯ• ࣗಈԽ, লྗԽͷ࣮ݱ• ίʔυهड़ͰಘΒΕΔॊೈੑɺอकੑͷ্ɺଐਓੑͷഉআ• ૿Ճ͠ଓ͚Δϩάʹର͢ΔεέʔϥϏϦςΟΛಘΔ
https://speakerdeck.com/mizutani/techconf2019-mizutani
ʹରͯ͠• ऩू͢Δϩάͷྲྀྔछྨ͕ଟ͗͢Δ• εέʔϧՄೳͳΞʔΩςΫνϟʹΑͬͯड͚ࢭΊΒΕΔΑ͏ʹ• ίετ૿ʹ݁• ΑΓ҆ՁͳετϨʔδΛ͑ΔΞʔΩςΫνϟͷ࠾༻• ࣗಈԽɺϚωʔδυαʔϏεར༻Ͱӡ༻লྗԽ
ݱࡏͷঢ়گ• ࣾ֎ͷ༷ʑͳγεςϜͷϩάΛऩूɺੳ• Ұ͋ͨΓ 140GB Ҏ্ͷϩάΛॲཧ• Ұൠతͳϩάཧͱൺֱͯ͠ 1/4 ҎԼͷίετ• 2໊Ͱӡ༻
Security by builders: ͜Ε͔ΒͷϢʔβاۀͷηΩϡϦςΟ
ʮηΩϡϦςΟରࡦʯͨΓલʹͳͬͨ• ߈ܸΑΓ༰қʹɺΑΓৗతʹ• ͲΜͳαΠζͷ৫ηΩϡϦςΟΛؾʹ͍ͯ͠Δ• ηΩϡϦςΟͷͨΊͷαʔϏε૿Ճ͠ଓ͚͍ͯΔ
ʮങͬͯઃஔʯ͚ͩͰෆे• ରʹ߹Θͤͨߴͳ߈ܸ• e.g.) Web ΞϓϦέʔγϣϯʹର͢Δ߈ܸ, ඪతܕ߈ܸ• ʮίϯςΩετʯͷ࣮ࣄऀʹ͔͠Ͱ͖ͳ͍• ըҰతͳޚ͚ͩͰͳ͘γεςϜڥʹ߹ΘͤͨݕɾରԠ• e.g.) ΞϓϦέʔγϣϯϩάͷੳ, ࣾγεςϜͱͷ࿈ܞ
σʔλऩूͱݕ• ࿈ܞͷ伴σʔλ (ϩά, Ξϥʔτ, etc)• ηΩϡϦςΟ͚ͩͰͳ͍σʔλͷऩूͱੳ͕ඞཁ͕ͩ…• ӡ༻ʹਓखۚમίετ͔͔Δ• τϥϑΟοΫ૿ՃʹΑΓ͞Βʹ૿େ• ӡ༻ऀʹ͍͘͢εέʔϧ͢ΔΈͮ͘Γ͕ෆՄܽ
ΫϥυͰηΩϡϦςΟΛʮͭ͘Δʯ• αʔϏε৫ͷίϯςΩετΛηΩϡϦςΟγεςϜʹؚΊΔ• ϚωʔδυαʔϏεΛར༻ͭͭ͠औΓΉ͖ՕॴʹऔΓΉ• AWS ΛͬͨηΩϡϦςΟͷՄೳੑ• εέʔϥϒϧͳσʔλॲཧج൫ (S3, Athena, Kinesis, EMR, Redshift..)• ҟৗݕͷ࣮ (SageMaker, Forecast)• ࣮ੈքͷηΩϡϦςΟ (IoT, Kinesis Video Streams, Rekognition)
Ͳ͏ͭ͘Δ͔: ʮࢭΊΔʯ͚ͩͰΓͳ͍• ʮશͳޚʯʹۙͮ͘΄ͲίϯϑϦΫτ͕ى͖Δ• ΞϓϦέʔγϣϯͷػೳϏδωεͦͷͷͱিಥ͢Δ• ʮޚʯ͚ͩͰकΓ͖Δ͜ͱ͕Ͱ͖ͳ͍• ϏδωεͷΛอͪͳ͕ΒʮकΔʯʹͲ͏͢Εྑ͍ʁ• ʮͭ͘ΔਓʯΛ્͠ͳ͍Έʹ͢Δඞཁ͕͋Δ
ʮήʔτΩʔύʔʯ͔ΒʮΨʔυϨʔϧʯ• ʮͭ͘ΔਓʯΛޙԡ͢͠ΔηΩϡϦςΟ• ͱΓ͋͑ͣࢭΊΔͷͰͳ͘Կ͔͋ͬͨͱ͖ʹकͬͯ͘ΕΔ• ϩάج൫ͦͷΈͷҰͭ
ΨʔυϨʔϧͷྫ• ϝΠϯڥͱಉͷηΩϡϦςΟϨϕϧΛ֬อ͠ͳ͕Β ࣗ༝ʹ͑Δ AWS ΞΧϯτΛ։์• ։ൃऀ͚ΞΧϯτ (ࣗ༝ʹར༻Ͱ͖ΔΞΧϯτ)• ةݥͳ API ΛࢭΊΔ, ࢹ (IAM, CloudTrail), ةݥͳઃఆΛ௨ (Config)• νʔϜ͝ͱͷΞΧϯτ (ಛʹࣗ༝ͳڥ͕ඞཁͳ߹)• ηοτΞοϓ࣌ʹ CloudTrail, GuardDuty, Config ͳͲΛల։• ࢹϩάج൫ʹूͯ͠ߦ͏
ʮͭ͘Δྗʯ͕ॏཁ• ੈքͷηΩϡϦςΟνʔϜऔΓΈ࢝Ί͍ͯΔ• “Builder” ͱͯ͠ͷྗ• ͏ٕज़Λબͼɺઃܭ͠ɺίʔυΛॻ͖ɺ৫ϓϩηεʹ ηΩϡϦςΟΛΈࠐΉ• ʮͭ͘ΔʯͨΊͷෑډԼ͕Γଓ͚͍ͯΔ• ίϯϙʔωϯτͱͯ͑͠ΔαʔϏεʑ૿͍͑ͯΔ
https://unsplash.com/photos/1eFgYRwYctg
ϏδωεΛՃͰ͖ΔηΩϡϦςΟ• ͪΌΜͱػೳ͢ΔʮΨʔυϨʔϧʯͷԼͰ• ҆৺ͯ͠શྗΛग़ͤΔڥͮ͘Γ
Security for builders,by builders
We’re hiring• ʮຖͷྉཧΛָ͠Έʹ͢ΔʯͨΊͷηΩϡϦςΟΛ Ұॹʹͭ͘Γ·ͤΜ͔ʁhttps://cookpad.jobs/
Fin.
kanny
oracle4engineer
sbtechnight
kako351
shimashima35
asazutaiga
tarao
takufujii
searls
caitiem20
keithpitt
dougneiner
brianwarren
lynnandtonic
bkeepers
chriscoyier
holman
ammeep
iamctodd
jnunemaker