FOLIO のこれまでの情報セキュリティへの取り組みについて / Scramble! #2 Security

Scramble! #2 Security (https://folio.connpass.com/event/109213/) で発表した資料です。

Transcript

1. '0-*0ךֿ׸תדך
   䞔㜠إُؗٔذ؍פך《׶穈׫חאְג
   2018/12/6ɹScramble! #2 Security
   

   View Slide

2. 㣐銮姻䛾 (Tadayuki Onishi)
   Software Engineer
   Twitter: @kenchan0130
   Blog: kenchan0130.github.io
   荈䊹稱➜
   

   View Slide

3. 秈䎃ծغحؙؒٝسؒٝآ
   ص،ך➂꟦ָ劢穗꿀זָ׵ծ
   爡ⰻ䞔㜠ءأذيה׃גו׿
   זֿה׾׃גֹ׋ַך➭䠥׮
   זְ僓鑧
   ➙傈鑧ֿׅה ➙傈鑧ׁזְֿה
   稢ְַ欽铂ծֶ״ןفٗتؙ
   زך铡僇
   

   View Slide

4. https://speakerdeck.com/kenchan0130/
   jiao-yu-qi-ye-niokerudebaisuguan-li-nituite
   侄肪٥⟰噟חֶֽ׷
   رغ؎أ盖椚䩛岀חאְג
   2018/9/2ɹiOSDC Japan 2018
   ؎ظك٦ءّٝ׾姺׭׆חծ
   畭劣盖椚ה麊欽׾遤ֲ倯岀
   2018/9/7ɹbuilderscon tokyo 2018
   https://speakerdeck.com/kenchan0130/
   builderscon-tokyo-2018
   

   View Slide

5. 痥♧珏ꆃ輐㉀ㅷ《䒷噟罏䎃։
   䎃剢ח鏣甧
   䖞噟㆞秈せ䎃剢植㖈
   ؿؓٔؔIUUQTGPMJPTFDDPNך؟٦ؽأ׾䲿⣘
   

   View Slide

6. ։➂ ։➂ ➂⟃♳
   晙䩛꟦㔐׵זֻז׷
   ּׁ׶ּׁ׶圓眠 ⚥鋉垷麊欽
   

   View Slide

7. ֿך涪邌ד鑧ׅهٔء٦ֶ״ן麊欽זוכծ
   傀ח麓⿠ך׮ךװ⦐➂ך䠐鋅׾ろ׿דֶ׶ծ
   '0-*0ה׃ג植㖈׮黝欽٥麊欽׃竲ֽגְ
   ׷ֿה׾⥂ꥺׅ׷׮ךדכ֮׶תׇ׿կ
   

   View Slide

8. װ׏גֹ׋䎃邌
   

   View Slide

9. 㼪Ⰵ畭劣鼅㹀
   䎃 䎃 䎃
   0LUB
   "DUJWF%JSFDUPSZ
   1SPMF.BOBHFS
   +BNG130
   "[VSF"%
   爡ⰻخ٦ؙٕٓؐس⻉
   8JOEPXT
   &OUFSQSJTF
   J04"OESPJE
   爡ⰻخ٦ٕ
   ؎و؝؝
   .JDSPTPGU*OUVOF
   ؒٝسه؎ٝزخ٦ٕ
   ؒٝسه؎ٝزخ٦ٕ
   㢌刿
   $JTDP.FSBLJ
   ؚٗ　꧊㛇湍ךⵗ倜
   

   View Slide

10. 䎃 䎃 䎃
    0LUB "[VSF"%
    8JOEPXT
    &OUFSQSJTF
    爡ⰻخ٦ٕ㼪Ⰵ
    ؎و؝؝
    爡ⰻخ٦ؙٕٓؐس⻉
    㼪Ⰵ畭劣鼅㹀 J04"OESPJE
    "DUJWF%JSFDUPSZ
    1SPMF.BOBHFS
    +BNG130 .JDSPTPGU*OUVOF
    $JTDP.FSBLJ
    ؒٝسه؎ٝزخ٦ٕ
    ؒٝسه؎ٝزخ٦ٕ
    㢌刿
    ؚٗ　꧊㛇湍ךⵗ倜
    

    View Slide

11. 㼪Ⰵ畭劣鼅㹀
    䎃 䎃 䎃
    0LUB "[VSF"%
    8JOEPXT
    &OUFSQSJTF
    J04"OESPJE
    爡ⰻخ٦ٕ㼪Ⰵ
    ؎و؝؝
    爡ⰻخ٦ؙٕٓؐس⻉
    "DUJWF%JSFDUPSZ
    1SPMF.BOBHFS
    +BNG130 .JDSPTPGU*OUVOF
    $JTDP.FSBLJ
    ؒٝسه؎ٝزخ٦ٕ
    ؒٝسه؎ٝزخ٦ٕ
    㢌刿
    ؚٗ　꧊㛇湍ךⵗ倜
    

    View Slide

12. 㼪Ⰵ畭劣鼅㹀
    䎃 䎃 䎃
    0LUB "[VSF"%
    爡ⰻخ٦ؙٕٓؐس⻉
    8JOEPXT
    &OUFSQSJTF
    J04"OESPJE
    爡ⰻخ٦ٕ㼪Ⰵ
    ؎و؝؝
    "DUJWF%JSFDUPSZ
    1SPMF.BOBHFS
    +BNG130 .JDSPTPGU*OUVOF
    $JTDP.FSBLJ
    ؒٝسه؎ٝزخ٦ٕ
    ؒٝسه؎ٝزخ٦ٕ
    㢌刿
    ؚٗ　꧊㛇湍ךⵗ倜
    

    View Slide

13. 㼪Ⰵ畭劣鼅㹀
    䎃 䎃 䎃
    0LUB "[VSF"%
    爡ⰻخ٦ؙٕٓؐس⻉
    8JOEPXT
    &OUFSQSJTF
    J04"OESPJE
    爡ⰻخ٦ٕ㼪Ⰵ
    ؎و؝؝
    "DUJWF%JSFDUPSZ
    1SPMF.BOBHFS
    +BNG130 .JDSPTPGU*OUVOF
    $JTDP.FSBLJ
    ؒٝسه؎ٝزخ٦ٕ
    ؒٝسه؎ٝزخ٦ٕ
    㢌刿
    ؚٗ　꧊㛇湍ךⵗ倜
    

    View Slide

14. 㼪Ⰵ畭劣鼅㹀
    䎃 䎃 䎃
    0LUB "[VSF"%
    爡ⰻخ٦ؙٕٓؐس⻉
    8JOEPXT
    &OUFSQSJTF
    J04"OESPJE
    爡ⰻخ٦ٕ㼪Ⰵ
    ؎و؝؝
    "DUJWF%JSFDUPSZ
    1SPMF.BOBHFS
    +BNG130 .JDSPTPGU*OUVOF
    $JTDP.FSBLJ
    ؒٝسه؎ٝزخ٦ٕ
    ؒٝسه؎ٝزخ٦ٕ
    㢌刿
    ؚٗ　꧊㛇湍ךⵗ倜
    

    View Slide

15. 儗禸⴨ד鴬׏גְֻ
    

    View Slide

16. 㼪Ⰵ畭劣鼅㹀
    䎃 䎃 䎃
    0LUB
    "DUJWF%JSFDUPSZ
    1SPMF.BOBHFS
    +BNG130
    "[VSF"%
    爡ⰻخ٦ؙٕٓؐس⻉
    8JOEPXT
    &OUFSQSJTF
    J04"OESPJE
    爡ⰻخ٦ٕ
    ؎و؝؝
    .JDSPTPGU*OUVOF
    ؒٝسه؎ٝزخ٦ٕ
    ؒٝسه؎ٝزخ٦ٕ
    㢌刿
    $JTDP.FSBLJ
    ؚٗ　꧊㛇湍ךⵗ倜
    

    View Slide

17. 堣珏ך鼅㹀
    ⣣呓⮚⯓
    欽鷿ח䘔ׄ׋ؕأةو؎ؤ
    اؿزؒٝآص،ؚٔٝ
    곁㹏⦐➂䞔㜠ꠘ鋮
    鸐䌢噟⹡
    䎃כׄ׭鴟׶
    

    View Slide

18. 䎃כׄ׭鴟׶
    ؒٝسه؎ٝزخ٦ٕ
    1SPMF.BOBHFS
    

    View Slide

19. 㼪Ⰵ畭劣鼅㹀
    䎃 䎃 䎃
    0LUB
    "DUJWF%JSFDUPSZ
    1SPMF.BOBHFS
    +BNG130
    "[VSF"%
    爡ⰻخ٦ؙٕٓؐس⻉
    8JOEPXT
    &OUFSQSJTF
    J04"OESPJE
    爡ⰻخ٦ٕ
    ؎و؝؝
    .JDSPTPGU*OUVOF
    ؒٝسه؎ٝزخ٦ٕ
    ؒٝسه؎ٝزخ٦ٕ
    㢌刿
    $JTDP.FSBLJ
    ؚٗ　꧊㛇湍ךⵗ倜
    

    View Slide

20. 㼪Ⰵ畭劣鼅㹀
    䎃 䎃 䎃
    0LUB
    "DUJWF%JSFDUPSZ
    1SPMF.BOBHFS
    +BNG130
    "[VSF"%
    爡ⰻخ٦ؙٕٓؐس⻉
    8JOEPXT
    &OUFSQSJTF
    J04"OESPJE
    爡ⰻخ٦ٕ
    ؎و؝؝
    .JDSPTPGU*OUVOF
    ؒٝسه؎ٝزخ٦ٕ
    ؒٝسه؎ٝزخ٦ٕ
    㢌刿
    $JTDP.FSBLJ
    ؚٗ　꧊㛇湍ךⵗ倜
    

    View Slide

21. 䎃⚥湍ַ׵䖓⼱חַֽג
    &UD
    

    View Slide

22. 䎃⚥湍ַ׵䖓⼱חַֽג
    

    View Slide

23. 㼪Ⰵ畭劣鼅㹀
    䎃 䎃 䎃
    0LUB
    "DUJWF%JSFDUPSZ
    1SPMF.BOBHFS
    +BNG130
    "[VSF"%
    爡ⰻخ٦ؙٕٓؐس⻉
    8JOEPXT
    &OUFSQSJTF
    J04"OESPJE
    爡ⰻخ٦ٕ
    ؎و؝؝
    .JDSPTPGU*OUVOF
    ؒٝسه؎ٝزخ٦ٕ
    ؒٝسه؎ٝزخ٦ٕ
    㢌刿
    $JTDP.FSBLJ
    ؚٗ　꧊㛇湍ךⵗ倜
    

    View Slide

24. 㼪Ⰵ畭劣鼅㹀
    䎃 䎃 䎃
    0LUB
    "DUJWF%JSFDUPSZ
    1SPMF.BOBHFS
    +BNG130
    "[VSF"%
    爡ⰻخ٦ؙٕٓؐس⻉
    8JOEPXT
    &OUFSQSJTF
    J04"OESPJE
    爡ⰻخ٦ٕ
    ؎و؝؝
    .JDSPTPGU*OUVOF
    ؒٝسه؎ٝزخ٦ٕ
    ؒٝسه؎ٝزخ٦ٕ
    㢌刿
    $JTDP.FSBLJ
    ؚٗ　꧊㛇湍ךⵗ倜
    

    View Slide

25. 䎃䖓⼱ַ׵䎃⵸⼱
    1SPMF.BOBHFS
    

    View Slide

26. 䎃䖓⼱ַ׵䎃⵸⼱
    %FWJDF(VBSE
    $SFEFOUJBM(VBSE
    

    View Slide

27. 㼪Ⰵ畭劣鼅㹀
    䎃 䎃 䎃
    0LUB
    "DUJWF%JSFDUPSZ
    1SPMF.BOBHFS
    +BNG130
    "[VSF"%
    爡ⰻخ٦ؙٕٓؐس⻉
    8JOEPXT
    &OUFSQSJTF
    J04"OESPJE
    爡ⰻخ٦ٕ
    ؎و؝؝
    .JDSPTPGU*OUVOF
    ؒٝسه؎ٝزخ٦ٕ
    ؒٝسه؎ٝزخ٦ٕ
    㢌刿
    $JTDP.FSBLJ
    ؚٗ　꧊㛇湍ךⵗ倜
    

    View Slide

28. 㼪Ⰵ畭劣鼅㹀
    䎃 䎃 䎃
    0LUB
    "DUJWF%JSFDUPSZ
    1SPMF.BOBHFS
    +BNG130
    "[VSF"%
    爡ⰻخ٦ؙٕٓؐس⻉
    8JOEPXT
    &OUFSQSJTF
    J04"OESPJE
    爡ⰻخ٦ٕ
    ؎و؝؝
    .JDSPTPGU*OUVOF
    ؒٝسه؎ٝزخ٦ٕ
    ؒٝسه؎ٝزخ٦ٕ
    㢌刿
    $JTDP.FSBLJ
    ؚٗ　꧊㛇湍ךⵗ倜
    

    View Slide

29. ٌثك٦ءّٝך竰竲
    

    View Slide

30. 䚀䟘ד֮׷ֿה
    瀉孡ד֮׷ֿה
    額妜ד֮׷ֿה
    ٌثك٦ءّٝך竰竲
    

    View Slide

31. תה׭
    畭劣㼪Ⰵծ畭劣盖椚ծؒٝسه؎ٝزإُؗٔ
    ذ؍ծ*E1ծ爡ⰻخ٦ٕؚٕ٦فؐؑ،זו
    䌴䎢ֻװ׏גֹ׋
    䚀䟘ծ瀉孡ծ額妜ד֮׶אבֽ׷
    

    View Slide

32. ׫זׁ׿ד׮דֹ׷
    

    View Slide

33. View Slide