$30 off During Our Annual Pro Sale. View Details »

プロダクトセキュリティの「共通言語」を作る ― 技術教育と Policy as Code を例に / "Language" for Product Security

プロダクトセキュリティの「共通言語」を作る ― 技術教育と Policy as Code を例に / "Language" for Product Security

【日経×Flatt Security×IssueHunt】プロダクトセキュリティの民主化と協調 で発表した内容です!楽しいイベントでした。

イベントページ: https://nikkei.connpass.com/event/294774/

Takashi Yoneuchi

October 19, 2023
Tweet

More Decks by Takashi Yoneuchi

Other Decks in Programming

Transcript

  1. プロダクトセキュリティの「共通言語」を作る
    ― 技術教育と Policy as Code を例に ―
    株式会社Flatt Security 米内 貴志 (@lmt_swallow)

    View Slide

  2. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    dbaY`WcX
    ihbgeb†b‚…ƒ€ywusrbtWqWxYX
    n hmWllbjgkq“Xlpbf˜—bwt™
    n ”–b‘”d‰ˆ‡

    View Slide

  3. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    hfaigcYbeg`dXWd
    Ybetrvqp
    ‰ ˜—•”†…ƒ‚‡
    ‰ “’€ y‘–ˆ†„x‚†
    kjh’€
    fd™e
    urqpotmnnsl

    View Slide

  4. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    uqtfhgsrprdbair`ruqtfceYXW
    WydYv
    ‚i—fb–„ygd“e
    ’‘“Y‰ˆ™‡”s…ƒf
    WonmydYv
    …nb|€f†~“z
    ‚i—vtb{sb…ƒf

    View Slide

  5. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    uqtfhgsrprdbair`ruqtfceYXW
    WydYv
    ‚i—fb–„ygd“e
    ’‘“Y‰ˆ™‡”s…ƒf
    WonmydYv
    …nb|€f†~“z
    ‚i—vtb{sb…ƒf
    WŠf bŒ‰ˆe
    •g“’‘•
    ŸŸŸr¡Wžš›˜™œ”–

    View Slide

  6. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    ieh`bagfdfYXWc
    utusYrp
    v™‘–Xxs—”‡•
    †…‡rƒ‚“ˆgyw`
    utihgsYrp
    h{Xvz`€yx‡t
    v™‘pnXumXyw`

    View Slide

  7. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    qihedbapcg`fYXW
    ‡‚†uwƒy
    x„v„s…tr€
    ˆ

    View Slide

  8. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    qihedbapcg`fYXW
    xwvyus€ryuxt
    —’–…‡“‰
    ˆ”†”ƒ•„‚‘
    ˜

    View Slide

  9. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    fecb`YXadW
    ‚wprxt
    syqyh€igvu
    ƒ
    fecnkf”jagaf”doam —
    –•’e˜‰“ˆ‰‡†‘™…„ˆ
    src

    View Slide

  10. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    „ctiuxpfbqedwya‚v`Ytst€gƒXrWXhƒu
    e‡—”“‘ddd™–ˆ’˜•…™‰ˆ’ˆ†

    View Slide

  11. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    afdcbf`eYXW
    ‚wprxt
    syqyh€igvu
    ƒ
    –“‰”g’†‡‘…q“„
    v‚y…idf™e—…q

    View Slide

  12. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    fecaYXW`db
    ‚wprxt
    syqyh€igvu
    ƒ
    –“‰”g’†‡‘…q“„
    v‚y…idf™e—…q
    xc~{m}€ts|ywƒv
    urq`o}y nzl
    ‰‡†…ˆ„
    ¸²›«¯o©®¥†¨£¡œfecš†ªl±¶
    m³ž–§­“¡¬•’yo™™µƒnŽxo~W°Š{

    View Slide

  13. G8V4I3RPH9FCE5S@7F"C6A2
    G8V4)I3'Q%0!2
    G8V4(I3'&BU#Q%0!2
    G8V4I34TÉÈÇ$DÆÅÉ4ÄÃÂÁÀ !1
    G8V4I3RPH9FCE5S@7F"C6A2
    G8V4)I3'Q%0!2
    G8V4(I3'&BU#Q%0!2
    G8V4I34TÉÈÇ$DÆÅÉ4ÄÃÂÁÀ !1
    h5Cc5`dbXa6fWWW
    h5Cc5`
    ÄÃd’0!„€x
    "ut7c5HPi„p
    tmsz}ov{xuwpyqnll4|gfekdlr™˜j—–•”i

    View Slide

  14. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    tuyxtugrxavqp‚ifedcdbw`YcshX€W‚
    ˆ†…‚ƒ‡‰
    †…‚olinhfd˜™
    —m–€p”p“’€kp‘
    dcvutbw`Y
    Œuˆ‚ƒ‡Š†ƒ„
    ‰~}{‚‚z‚€|Š

    View Slide

  15. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    gtrfisebapcqr`YXWhd
    ‚€xwWuy
    xwWgd—f–”’‘
    ‰eˆec†c…„e™cƒ
    qr`YXokji
    „Y€W{‚…~ufy
    wvusWzrWxt‚

    View Slide

  16. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    hxwt‚srygbeucaptvfY`iYd`€tXWq
    e“‘—–d•˜’ˆ
    ‡…”‰„–ƒ†™
    f

    View Slide

  17. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    hxwt‚srygbeucaptvfY`iYd`€tXWq
    e“‘—–d•˜’ˆ
    ‡…”‰„–ƒ†™
    f
    …u‚~wmy}—t€sx}ˆ
    pƒ|r{zonlkj‚„ihg

    View Slide

  18. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    tsri`fgbdahece`fgbqaYhecWpX
    ”•w’‘‰–‚˜†…ƒ
    €„˜yx„ˆ‘ƒvƒu‡—v“
    ™

    View Slide

  19. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    tsri`fgbdahece`fgbqaYhecWpX
    ”•w’‘‰–‚˜†…ƒ
    €„˜yx„ˆ‘ƒvƒu‡—v“
    ™
    zs}wx{˜u~€qvƒnrl
    kv|„v•‚pt|„•gfheod

    View Slide

  20. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    fecb`XWadY
    †‡i‚„ƒˆtxwus
    rvqpv€ƒuhugy‰h…
    ‘
    glmkjh™enid˜—–i”“’•f
    †•‹wˆŠŒ“~ˆ—ƒŽ—b‡ff{—zxvƒiut
    |‰€‡s‚rf…„k”kqi’pWf–

    View Slide

  21. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    w‘ˆy†€‡„et€‡‚sqiv‚‰uh†„fdpcgb…ƒa`cYXc…rWx
    ”
    e
    –
    ™
    ˜
    —
    g
    “
    f
    •d
    •”
    •e
    •–
    •™
    •˜
    •—
    •g
    •’
    qjtsrspnr
    qsrm
    kiipojq
    q
    tlh
    tlh
    “ ‡œ—
    › œœ koržkttpnmr“Šˆ
    › œœ tipqƒ€pnmžqsrm€sšmspnr“Š†
    › œœkrŠqjlkimŠ€ppmŠpš{jtm tpnlshx
    › œœ—
    ›› œ v
    ›–
    •
    krŠqjlkimŠ€ppmŠpš{jtm wœ—
    ›qjlkimŠ€ppmŠpš{jtm wœuœ
    ”œ œœ
    qjlkimŠ€ppmŠpš{jtm wœœ qjlkimzppm‚š{jtmœ—
    › qjlkimzppm‚š{jtmœuœni…
    › qjlkimzppm‚š{jtmœuœ™˜
    ”œjirjœœ™™
    q
    kttpnm sn§m
    kttpnm
    qsrm
    kiipojq
    tlh
    tlh
    jirj lkir«
    tlh tlh
    ž
    ž
    ž
    ž
    ž
    ž
    ™kiipojq™
    ™˜
    ¾Èd‚À»iÃÆ¿ɼ¹Å
    ¿‘º·¶´³Çɲµ½°Ä
    ¾Èd‚À»iÃÆ¿ɼ¹Å
    ¿‘º·¶´³Çɲµ½°Ä

    View Slide

  22. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    †gcyƒ€v„ƒ‚qxetƒsirfƒ€v„ƒpwdbh…auƒ`Yƒ‚qXW
    p•mnkhfeƒ„lx–`’
    ‘opwdbm”isˆ‡

    View Slide

  23. È
    Å
    Ã
    Ä
    Â
    Á
    Ç
    À
    Æ


    ÉÉ

    E 3QH
    P QA'Q S9E64
    P QA'Q É90(S(I9
    P QA'QR6$9É6(6I#B
    P QA'QH
    PP AQ
    PG
    F

    9 `9
    9

    ÉÉ
    S
    S
    tÉÉt
    –“’•”
    –‘’ˆ•†ƒ‰‚€
    wy…vyu‚‡„x

    View Slide

  24. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    bƒpewxuerywt‚sgwdeuƒcia`paxey€wfYhqXvW
    u”pe”r•mnrkj•gil™d
    ˜—qt“sY–hg’‘‰gˆg‡†t„g
    u”pe”r•mnrkj•gil™d
    ˜—qt“sY–hg’‘‰gˆg‡†t„g

    View Slide

  25. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    bƒpewxuerywt‚sgwdeuƒcia`paxey€wfYhqXvW
    €zxlz~{uv~rq{npgjk
    ep™n}˜tpshyfX”“Y|Y—d’‰i•ˆt‡go†…~„

    View Slide

  26. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    bƒpewxuerywt‚sgwdeuƒcia`paxey€wfYhqXvW
    x„ƒt„…m}€…lkmvz|so
    ˆq™‡npt‰r”i~yh—‡e˜f–“–’gw~•sg†ˆgY{‡†n…e„j’g
    Žw‹ˆŠY
    ¤‘—“¢†‹~š‡wsn…ew¡€ ewžˆ{Y~‹ˆŠ
    «
    ²
    ­
    °
    ¯
    ®
    ´
    ©
    ³
    ±
    ¬«
    ¬²
    ¬­
    ¬°
    ¬¯
    »
    ŽÁÃÀ»¿
    ÀÂ
    ¿¾¼½
    ºÁÀ¹¹½ÁÃ
    ø·½Â¶µ½
    ¸Á»¿
    ºÁÀ¾¹½
    ½Å½¿º
    ú¾º¶Ãĸ·¾¿¹½Âĺ»
    ÉË
    ÉË
    ÉË
    Ê
    ËË Ê
    ËËËÈË ÉË
    ËË Ê
    ËËËËÈË ÉËÇ Æ
    ËËËËËË Ê
    ËËËËËËËË
    ËËËËËËËËÈË
    ËËËËËËËË
    ËËËËËËËËÈË
    ÏͬÍÎ
    æõÁ½è¶¿Âµ½È¾äÃȸµ»¶ÂÚÁ»¿ºç
    æâÁ½è¶¿Âµ½ÉËÛ½ÅÀ½äË×ÖÙËÕµ»¶ÂÔÁ»¿ºËõ»Ãº¶Á½å
    æÏËëð¬ËëËëËëå
    ¶õ¾º½Â
    ¾ä¾ÀºÀ¿¹ÄÁ½ÅÀ½ã
    ¾¸Ð¿»äµ½Â¹½Â
    ˺·½ËÀÃö½ËÀÃ˸¾µµÀ¿¹ËÇ»¶ÁËÁ½ÅÀ½äÃ
    ˺·½ËÀÃö½ËÀÃ˾¸Ð¿»äµ½Â¹½À
    (Ž&Y$"#
    UY3YTQzwGR`@8VwX9ˆtEh4HC&Y$"#
    «
    ²
    ­
    °
    ¯
    ®
    ´
    ©
    ³
    ±
    ¬«
    ¬²
    ¬­
    ¬°
    ¬¯
    ¨
    ¬g
    s¶½ÁÇËu
    ËË Ëu
    ËËËË Ëu
    ËËËËËË Ëu
    ËËËËËËËË Ëu
    ËËËËËËËËËË Ëu
    ËËËËËËËËËËËË
    ËËËËËËËËËËt
    ËËËËËËËËËË Ëu
    ËËËËËËËËËËËË
    ËËËËËËËËËËt
    ËËËËËËËËt
    ËËËËËËt
    ËËËËt
    ËËt
    t
    ¾äÃ
    ¾¸¸»¶¿ºÃ
    ¸µ»¶ÂÔÁ»¿º
    ÂÀúÁÀ趺À»¿Ã
    ¼½º¾Â¾º¾
    ÀÀ
    ¸»¿ÚÀ¹
    ½ھ¶µºÛ»»ºwèy½¸…
    jŽwžˆ{Yed
    UY3YTQw¡€ ewžˆ{Y~"#s&Y$~oqn…eed
    «
    ²
    ­
    °
    ¯
    ®
    ´
    ©
    ³
    ±
    ¬«
    ¬²
    ¬­
    ¬°
    ¬¯
    »
    ½¸ÀÃÀ»¿Ã
    ÂÀú
    ¾µµ»ä½Â
    Â
    ¸Ú¹
    ¸Ú¹
    Ç ™Ëu
    ¬ ËÉ‘Ë ¾äÃ;¸¸»¶¿ºÃÇÄÆ
    ¬ ËÉ‘Ë ¸µ»¶ÂÔÁ»¿ºÍÂÀúÁÀ趺À»¿ÃÇĘ
    ¬ Ëɑ˷¾ÃĽھ¶µºÄÁ»»ºÄ»èy½¸º¢ ¸»¿ÚÀ¹Š
    ¬ ËɑËu
    ¬¬ ÉË ˆ
    ¬t
    t
    ·¾ÃĽھ¶µºÄÁ»»ºÄ»èy½¸º¢ ‰Ëu
    ¬Â½Ú¾¶µºÄÁ»»ºÄ»èy½¸º¢ ‰Ë‡‘Ë
    ¦Ë ËɑË
    ½ھ¶µºÄÁ»»ºÄ»èy½¸º¢ ‰ËÉ‘Ë Â½Ú¾¶µºÛ»»ºwèy½¸ºËu
    ¬ ½ھ¶µºÛ»»ºwèy½¸ºË‡‘Ë¿¶µ—
    ¬ ½ھ¶µºÛ»»ºwèy½¸ºË‡‘Ëæç
    ¦Ë½µÃ½ËɑËææ
    Â
    ¾¸¸»¶¿º À¿õ¶º
    ¾¸¸»¶¿º
    ÂÀú
    ¾µµ»ä½Â
    ¸Ú¹
    ¸Ú¹
    ½µÃ½ Ú¾µÃ¼
    ¸Ú¹ ¸Ú¹
    Í
    Í
    Í
    Í
    Í
    Í
    æ¾µµ»ä½Âæ
    æç

    View Slide

  27. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    xwviutghsqesrgfcrd`gbpaYXW
    g‘t™jiˆv™jxw“’˜‰f‡–
    †„ƒ‚hYXWxwy

    View Slide

  28. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    w‡ˆ†qh…‚€yvs‰igydeyxs„pywrƒbufa`ctYXW
    ˜–”“W‘•q
    ”“W‡tqvpnljk
    iuhYyfyedYsy™
    ƒ€W}Y|{~zy
    vs‰igydeyxs„pyW‡†k
    …e‘rr h
    Ÿž•™›š

    View Slide

  29. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    pqhfqgedc`abXiYW
    iYWvtxsr
    ‘ d™—–ˆ‡…’„‰
    ‘ •ƒ”‚ “˜ˆ†€’„ˆ
    mlj”‚
    hfeg
    wtsrevoppun

    View Slide

  30. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    urqsihfpeicbgda`iYXWte
    ƒyxev€‚
    yxehe˜g—•“‘’
    cf‰Wi‡i†…W`i„
    tqenWmplokj
    |‰Œˆƒi…„i‚‰ie€}’
    {†zŠŠ†Ž€~v‹u‡

    View Slide

  31. ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ
    HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP
    ‡‚‘†ˆvƒ…s„€xuwht‰pxrixiqxgf
    dcbv va`eYyXW
    g˜™fd—–”vg“ˆ˜˜•
    qorl
    hskpj
    min
    †ƒ…€|ˆ}z‡y{xv‚uw~vt„
    “ˆ z¤›w—šž£‘”’‹ŒŽ•¢Š™xv˜¤–
    šž£‘”’‹ŒŽ•ñíèÎÝÙ~vt„†ƒ…€
    ڈìæŘÈ×弹¼˜ƒÁ…Ťxv˜
    ò·‡Í߂뻴³t²±çšž£‘”’‹ŒŽ•Ùé
    ³°ïñÓ¯‚½®Ñ˜­¢«ºª©Õ³¨§Ì¦
    õüøööúôûsù÷s
    õöÁÃÀÅ
    ÉÈÆÇ
    y{x
    …zˆ
    ”(’&
    #%|ˆ}z
    210
    #%|ˆ}6
    y{xv
    EDC

    View Slide

  32. ÉÈÇÆÅÄÃÂÁÀ
    1)'&&%!#("$0&

    View Slide