Fintech on AWS で満たすグローバルセキュリティ基準 / X-Tech-JAWS #1 Fintech

'JOUFDIPO"84Ͱ ຬͨ͢άϩʔόϧηΩϡϦςΟج४ 95FDI+"84

ɾ,FOJDIJ5BLBOP ɾ#"4& *OD1":%JWJTJPO.BOBHFS ɾ1":+1 1BZNFOUGPS.FSDIBOUT IUUQTQBZKQ ɾ1":*% 1BZNFOUGPS$VTUPNFST
IUUQTJEQBZKQ 8IP

ɾαʔϏεʹ͍ͭͯ ɹɾ1":+1 ɹɾ1":*% ɾ'JOUFDIܾࡁࣄۀऀʹͱͬͯͷηΩϡϦςΟ ɹɾܾࡁۀքͷ঺հ ɹɾ1$*%44 ɹɾ"84Ͱຬͨ͢ηΩϡϦςΟج४ "HFOEB

ωοτγϣοϓ࡞੒αʔϏε ։ൃऀ޲͚ΦϯϥΠϯܾࡁαʔϏε ߪೖऀ޲͚*%ܕܾࡁαʔϏε #"4&͕ࣾఏڙ͍ͯ͠ΔαʔϏε

ωοτγϣοϓ࡞੒αʔϏε ։ൃऀ޲͚ΦϯϥΠϯܾࡁαʔϏε ߪೖऀ޲͚*%ܕܾࡁαʔϏε ࠓ೔͸͜͜ͷ࿩ #"4&͕ࣾఏڙ͍ͯ͠ΔαʔϏε

ɾγϯϓϧͳ"1*ͱ෼͔Γ΍͍͢ྉۚܗଶͰ ɹ͋ΒΏΔαʔϏεʹܾࡁΛಋೖ͢Δ͜ͱ͕Մೳ ɾఆظ՝ۚɺ"QQMF1BZɺ23ίʔυܾࡁɺ1":*%ܾࡁ ɹͱ͍ͬͨଟ࠼ͳܾࡁखஈͷαϙʔτ ɾΫϨδοτΧʔυͷτʔΫϯԽɺࠃࡍج४ʹ४ڌͨ͠ ɹηΩϡϦςΟͰ҆৺ɾ҆શͷϓϥοτϑΥʔϜ IUUQTQBZKQ

1":+1ಋೖاۀ Ұ෦

1":+1ྉۚମܥ

ɾΦϯϥΠϯɾΦϑϥΠϯ໰Θͣ ɹ͋ΒΏΔγʔϯͰ͔ΜͨΜʹࢧ෷͍͕Ͱ͖ΔαʔϏε ɾΦϯϥΠϯͰ͸*%ͱύεϫʔυΛೖྗ͢Δ͚ͩͰ ɹΦϑϥΠϯͰ͸ΞϓϦͰ23ίʔυΛಡΈऔΔ͚ͩͰ ɹࢧ෷͍͕׬ྃ ɾສਓҎ্ͷϢʔβʔ͕ར༻͓ͯ͠Γ ɹສΛ௒͑Δ͓ళɾαʔϏεͰ1":*%ࢧ෷͍͕Ͱ͖Δ IUUQTJEQBZKQ

1":*%ΦϯϥΠϯܾࡁͷར༻γʔϯ https://atf.thebase.in/

1":*%ϞόΠϧΞϓϦ iOS: https://itunes.apple.com/jp/app/pay-id/id1143404977 Android: COMING SOON

1":*%ϞόΠϧΞϓϦʹΑΔ 23ίʔυܾࡁ

23ίʔυܾࡁͷར༻γʔϯ ϙελʔ͔Βνέοτ༧໿ ϝχϡʔද͔Β͓ห౰ߪೖ

Πϕϯτ౰೔݊Λߪೖ ͦͷ··ϏʔϧΛ23Ͱ 23ίʔυܾࡁͷར༻γʔϯ!ΞΠυϧԣஸՆࡇΓ

ΦϑΟεΦΞγεఏڙ ห౰ক܉ఏڙ 23ίʔυܾࡁͷར༻γʔϯ!#"4&ौ୩ΦϑΟε ࣾ಺ͷҿΈ෺ɾஔ͖՛ࢠ ࣾ಺ൢചͷ͓ห౰

1":*%23ίʔυܾࡁಋೖͷϝϦοτ

1":*%23ίʔυܾࡁͷಋೖํ๏ 1":+1 #"4& PAY.JP: https://pay.jp BASE: https://thebase.in/qr

1":+1͸ࣄۀऀɺ1":*%͸ߪೖऀ޲͚ͷܾࡁαʔϏε ࣄۀऀ͸1":+1ͰΦϯϥΠϯɾΦϑϥΠϯͷܾࡁΛಋೖͰ͖ ߪೖऀ͸1":*%Λ࢖ͬͯΦϯϥΠϯɾΦϑϥΠϯͰࢧ෷͍Մೳ ࣄۀऀɾߪೖऀΦϯϥΠϯɾΦϑϥΠϯ໰Θͣ ଟํ໘ͰαʔϏε֦େத

ܾࡁࣄۀऀʹͱͬͯͷηΩϡϦςΟ

ϒϥϯυ ΞΫϫΠΞϥ ΠγϡΞ ڞಉNW PSP ໾ׂ ϥΠηϯεɾωοτ ϫʔΫఏڙɺϨΪϡ Ϩʔγϣϯࡦఆ Ճໍళ৹ࠪɾ؅ཧ
औҾ؅ཧ Χʔυൃߦ ༩৴ɾऔҾ؅ཧ ڞಉܾࡁNWఏڙ ܾࡁॲཧ୅ߦ ྫ Visa, MasterCard, JCB ࡾҪॅ༑Χʔυ, JCB ࡾҪॅ༑Χʔυ, JCB CAFIS CARDNET PAY.JP ΫϨδοτΧʔυܾࡁۀքͷϓϨΠϠʔ੔ཧ

ߪೖऀ Ճໍళ 141 ڞಉ/8 ϒϥϯυ ΞΫϫΠΞϥ ΠγϡΞ ڞಉ/8 Ճໍళܖ໿ แׅՃໍళܖ໿Ͱ141ͱܖ໿
͢Δέʔε΋༗Γ ͓͓·͔ͳΫϨδοτΧʔυܾࡁͷྲྀΕ

ΫϨδοτΧʔυऔҾʹ͓͚ΔηΩϡϦςΟରࡦͷڧԽ ʹ޲͚࣮ͨߦܭը ɾܦࡁ࢈ۀল͕ࠃࡍਫ४ͷΫϨδοτΧʔυऔҾͷ ɹηΩϡϦςΟ؀ڥΛ੔උ͢ΔͨΊࡦఆ࣮ͨ͠ߦܭը ɾ೥݄຤·Ͱ ɾඇର໘ՃໍళΧʔυ৘ใͷඇ௨աԽܕγεςϜ΁ͷҠߦ ɹɹɹɹɹɹɹ ௨աɾอ࣋͢Δ৔߹͸1$*%44ରԠ ɾΧʔυձࣾɾܾࡁࣄۀऀ1$*%44ରԠ http://www.meti.go.jp/press/2016/03/20170308003/20170308003-1.pdf

1$*%44 ɾΧʔυϒϥϯυͰ͋Δ"NFSJDBO&YQSFTT %JTDPWFS +$# .BTUFS$BSE 7JTBʹΑͬͯઃཱ͞Εͨʮ1$*44$ʯ ɹʹࡦఆ͞ΕͨάϩʔόϧηΩϡϦςΟج४ ɾཁ݅ʙҎ্ͷ؂߲ࠪ໨Λຬ্ͨͨ͠ ɹ೥ճͷ24"ʹΑΔ๚໰؂ࠪରԠ͕ඞཁ
ɾ1":+11":*%͸1$*%44WFSTJPOʹ׬શ४ڌ https://www.pcisecuritystandards.org/

1$*%44ཁ݅αϚϦʔ ҆શͳωοτϫʔΫͱγεςϜΛߏங͠ɺอक͢Δ Χʔυॴ༗ऀͷσʔλΛอޢ͢Δ ੬ऑੑ؅ཧϓϩάϥϜΛอक͢Δ ڧྗͳΞΫηείϯτϩʔϧରࡦͷ࣮૷ ωοτϫʔΫΛఆظతʹϞχλʔ͠ɺςετ͢Δ
৘ใηΩϡϦςΟϙϦγʔΛอक͢Δ https://www.pcisecuritystandards.org/

"84ͱ1$*%44 ɾ"84͸1$*%44ʹ४ڌ͍ͯ͠ΔαʔϏεϓϩόΠμʔ ɾ1":+11":*%͸"84Λϑϧ׆༻ͯ͠1$*%44ʹ४ڌ ɾ"84ͷΠϯϑϥΛ׆༻͢Δ͜ͱͰ1$*%44ͷ ɹଟ͘ͷཁ݅Λύε͢Δ͜ͱ͕Ͱ͖Δ https://aws.amazon.com/jp/compliance/pci-dss-level-1-faqs/

º Amazon EC2 Amazon VPC AWS Lambda Amazon  S3 Amazon
  ElasticCache Amazon  RDS Amazon  Route 53 Amazon CloudFront Elastic Load Balancing AWS   CodeDeploy Amazon CloudWatch AWS  CloudTrail AWS Certificate Manager IAM AWS KMS Amazon API Gateway* Amazon SES Amazon Inspector

º ҆શͳωοτϫʔΫͱγεςϜΛߏங͠ɺอक͢Δ Χʔυॴ༗ऀͷσʔλΛอޢ͢Δ ੬ऑੑ؅ཧϓϩάϥϜΛอक͢Δ ڧྗͳΞΫηείϯτϩʔϧରࡦͷ࣮૷ ωοτϫʔΫΛఆظతʹϞχλʔ͠ɺςετ͢Δ
৘ใηΩϡϦςΟϙϦγʔΛอक͢Δ

҆શͳωοτϫʔΫͱγεςϜΛߏங͠ɺอक͢Δ   Χʔυॴ༗ऀͷσʔλΛอޢ͢Δ ɾ71$Λϑϧ׆༻ͯ҆͠શͳωοτϫʔΫΛ࣮ݱ ɾΧʔυॴ༗ऀͷσʔλ͸,.4Λ׆༻ͨ͠҉߸Խ ɾ"84$FSUJpDBUF.BOBHFSʹΑΔ44-5-4ূ໌ॻ؅ཧ

͓͓·͔ͳߏ੒ਤ

҆શͳωοτϫʔΫͱγεςϜΛߏங͠ɺอक͢Δ ɾͭͷ71$Ͱηάϝϯςʔγϣϯ ɹɹɾBQQ ɹɹɾWBVMU Χʔυσʔλձһ؀ڥ ɾ71$1FFSJOH 3PVUF5BCMF 4FDVSJUZ(SPVQͰΞΫηε੍ޚ

ˠ,.4 ,FZ.BOBHFNFOU4FSWJDF ʹΑΔ҉߸ԽΛ׆༻ Χʔυॴ༗ऀͷσʔλอޢ ɾΧʔυ൪߸ΛಡΈऔΓෆೳʹ ɾΧʔυ൪߸ͷ҉߸Խ ɾ҉߸Խʹ࢖͏Ωʔͷ؅ཧ ɾ҉߸ԽΩʔࣗମͷ҉߸Խ ɾΩʔΛ҉߸Խ͢Δผͷ҉߸ԽΩʔͷ؅ཧ

,.4ͷ׆༻ ɾ$VTUPNFS.BTUFS,FZT ɾσʔλΛ҉߸Խ͢ΔϚελʔΩʔ ɾΧʔυ൪߸҉߸Խʹؔ࿈͢ΔΩʔͷ؅ཧΛ,.4ʹҰ೚ ɾ*".ʹΑΔΩʔΛऔΓѻ͏ϩʔϧɾϙϦγʔͷ੍ޚ ɾ%BUB,FZT ɾϚελʔΩʔΛ҉߸Խ͢ΔσʔλΩʔ

੬ऑੑ؅ཧϓϩάϥϜΛอक͢Δ ڧྗͳΞΫηείϯτϩʔϧରࡦͷ࣮૷ ωοτϫʔΫΛఆظతʹϞχλʔ͠ɺςετ͢Δ ɾ"NB[PO*OTQFDUPSʹΑΔ੬ऑੑ਍அ ࢼݧಋೖத ɾ*".ʹΑΔϢʔβʔΞΧ΢ϯτͷ؅ཧ ɾ$MPVE5SBJMʹΑΔ؂ࠪূ੻ͷ؅ཧ

੬ऑੑ؅ཧϓϩάϥϜΛอक͢Δ ɾ"NB[PO*OTQFDUPSͰ&$্ͰՔಇ͢Δ ɹΞϓϦέʔγϣϯͷධՁɺ੬ऑੑ਍அ ɾͦͷଞ֤छϕϯμʔఏڙͷ੬ऑੑ਍அπʔϧΛ׆༻ ɾϦεΫʹԠͨ͡ηΩϡϦςΟύονͷద༻

"NB[PO*OTQFDUPSͰݕग़͞Εͨ੬ऑੑ

ڧྗͳΞΫηείϯτϩʔϧରࡦͷ࣮૷ ɾΧʔυձһσʔλ؀ڥ΁ͷΞΫηεΛ*".Ͱݶఆ੍ޚ ɾ*".ͰϢʔβʔͷݖݶɺೝূɺύεϫʔυ؅ཧΛγεςϜԽ ɾҰఆظؒඇΞΫςΟϒͳϢʔβʔແޮԽ ɾҰఆճ਺ͷύεϫʔυޡΓʹΑΔϢʔβʔϩοΫ ɾύεϫʔυϙϦγʔͷنఆ

ωοτϫʔΫΛఆظతʹϞχλʔ͠ɺςετ͢Δ ɾ$MPVE5SBJMʹΑΔ"84؂ࠪূ੻ͷܧଓతͳ؅ཧ ɾ"84-BNCEB 4Λ׆༻ͨ͠γεςϜ؂ࠪূ੻ͷ؅ཧ ɾ֎෦ϕϯμʔʹΑΔఆظతͳϖωτϨʔγϣϯςετ਍அ

$MPVE5SBJMʹΑΔ؂ࠪূ੻Ұྫ

·ͱΊ "84Λϑϧ׆༻͢Δ͜ͱͰ1$*%44४ڌ͕εϚʔτʹ

ͪͳΈʹʜ

1":+1Λ࢖ܾͬͨࡁγεςϜͳΒ 1$*%44ରԠ͸ෆཁͰ͢ ߪೖऀ Ճໍళ $IFDLPVUϞδϡʔϧʹΑΔϑΥʔϜը໘ఏࣔ ߪೖը໘ͳͲදࣔ Χʔυձһ৘ใΛૹ৴ τʔΫϯΛฦ͢ τʔΫϯΛ࢖ͬͯαʔόʔଆͰܾࡁॲཧ ɾ1":+1͕ఏڙ͍ͯ͠Δ$IFDLPVUΛ͔ͭͬͯΧʔυ൪߸͕
ɹՃໍళͷαʔόʔΛ௨ա͠ͳ͍࢓૊ΈΛ͔ΜͨΜʹ࣮ݱ ɾ਺෼ͰηΩϡΞͳߪೖϑΥʔϜΛ࡞੒ ɾϦμΠϨΫτͳ͠Ͱܾࡁ͸׬݁ https://pay.jp/security

#"4&1":+11":*% ଞۀछίϥϘϨʔγϣϯେ׻ܴͰ͢ ɾ&$ɺΦϯϥΠϯΦϑϥΠϯͷܾࡁγεςϜͰ͓ࠔΓͷํ ɾ1":+11":*%ͷσʔλΛ׆༻ͨ͠৽͍͠৴༻ͷ࢓૊Έ ɾࢧ෷͍ͱ͍͏ߦҝ͸ੜ׆ʹࠜͨ͟͠΋ͷɺ ɹΏ͑ʹͲΜͳۀछʹ͓͍ͯ΋Մೳੑ͕͋Δ

͓ΘΓ

Fintech on AWS で 満たすグローバルセキュリティ基準 / X-Tech-JAWS...

Fintech on AWS で 満たすグローバルセキュリティ基準 / X-Tech-JAWS #1 Fintech

More Decks by Kenichi Takano

Other Decks in Technology

Featured

Transcript

Fintech on AWS で満たすグローバルセキュリティ基準 / X-Tech-JAWS...

Fintech on AWS で満たすグローバルセキュリティ基準 / X-Tech-JAWS #1 Fintech