[JAWS-UG Osaka]セキュリティ、ネットワークまわりのちょいテク

Transcript

1. ηΩϡϦςΟɺωοτϫʔΫ
   ·ΘΓͷͪΐ͍ςΫ Marumo Atsushi
2. KBXTVH
   KBXTVHPTBLB
   
3. εϥΠυ͸ޙͰೖख͢Δ͜ͱ͕ग़དྷ·͢ͷͰ ൃදதͷ಺༰ΛϝϞ͢Δඞཁ͸͋Γ·ͤΜɻ ࣸਅࡱӨΛ͢Δ৔߹͸ ϑϥογϡɾγϟολʔԻ͕ग़ͳ͍Α͏ʹ͝഑ྀ͍ͩ͘͞ Attention
4. ࣗݾ঺հ  ؙໟ
   ಞ࢙ Ϋϥεϝιου
   גࣜձࣾ
   "84ࣄۀຊ෦
   ίϯαϧςΟϯά෦
   ιϦϡʔγϣϯΞʔΩςΫτ ʢϚϧϞ
   Ξπγʣ "84
   ೝఆࢿ֨ף ޷͖ͳ"84αʔϏε
   w $MPVE'SPOU
   w 5SBOTJU(BUFXBZ
   w .BOBHFE
   #MPDLDIBJO
5. ݄ؒສ17ΛތΔٕज़ϒϩά
   %FWFMPQFST*0 
6. ݄ؒສ17ΛތΔٕज़ϒϩά
   %FWFMPQFST*0  ௨ࢉ
    ຊʂ
   ೥ؒ
    ຊʂ
   ݄ؒ
    ຊʂ
8. 80ਓ 736ຊ
9. ຊ೔ͷςʔϚ  "84ͷηΩϡϦςΟɺωοτϫʔΫ
   ·ΘΓͷʮͪΐ͍ςΫʯ
10. ຊ೔ͷςʔϚ  ࢸۃͷϒϩάهࣄΛఴ͑ͯ
    ʢৄࡉͳઆ໌͸ল͘ͷͰؾʹͳͬͨ΋ͷΛޙ͔Βख़ಡʣ
11. Security & Network
12. ͪΐ͍ςΫ̍  ؆୯ʹઃఆͰ͖Δ
    "84
    ͷൃݟత౷੍
13. ͜Ε͚ͩ͸΍ͬͱ͍ͯཉ͍͠"84αʔϏε̐બ  w"84
    $MPVE5SBJM
    w"NB[PO
    (VBSE%VUZ
    w"84
    $POpH
    w4*".
    "DDFTT
    "OBMZ[FS
14. $MPVE5SBJM  w"84
    ͷ
    "1*
    ʹର͢Δૢ࡞ϩά
    w"84
    ΞΧ΢ϯτʹରͯ͠ʮ୭͕ʯʮ͍ͭʯʮԿΛ͔ͨ͠ʯ
    wશϦʔδϣϯͰ༗ޮԽʢίϯιʔϧͰ؆୯ʹઃఆʣ
    wϩά෼ੳʹ͸
    "UIFOB
    ΍
    $MPVE8BUDI
    -PHT
    *OTJHIUT
    wҟৗͳ
    "1*
    ίʔϧ͸
    $MPVE5SBJM
    *OTJHIUT
    Ͱݕग़
15. $MPVE5SBJM
    *OTJHIUT  w௨ৗͱҟͳΔΞΫςΟϏςΟΛݕग़
    wର৅͸ॻ͖ࠐΈ؅ཧΠϕϯτ
    w ʢॻ͖ࠐΈ؅ཧΠϕϯτ͋ͨΓʣ https://dev.classmethod.jp/cloud/aws/aws-cloudtrail-announces-cloudtrail-insights/
16. (VBSE%VUZ  w͓΋ʹ
    &$
    ͱ
    *".
    ΞΧ΢ϯτؔ࿈ͷൃݟత౷੍
    w"84
    ʹ͓͚Δෆ৹ͳΞΫςΟϏςΟΛݕ஌
    w$MPVE5SBJM
    FWFOU
    MPHT
    w71$
    'MPX
    -PHT
    w%/4
    MPHT
    wશϦʔδϣϯͰ༗ޮԽ https://dev.classmethod.jp/cloud/aws/set-guardduty-all-region/
17. (VBSE%VUZʢ͜͜೥ͷΞοϓσʔτɹɹʣ  w߈ܸऀʹՃ୲ͯ͠ͳ͍͔ https://dev.classmethod.jp/cloud/aws/guardduty-devect-new-findings-of-dos-attack/ w"ENJOͳͲͷಛݖΛׂΓ౰ͯΑ͏ͱ ͯ͠ͳ͍͔
    https://dev.classmethod.jp/cloud/aws/guardduty-can-now-detect-privilege-escalation/ wݕग़݁Ռ͸೔Ͱഁغ͞ΕΔ
    https://dev.classmethod.jp/cloud/aws/guardduty-supports-exporting-findings-to-an- amazon-s3-bucket/
18. Ͱ΋͓ߴ͍ΜͰ͠ΐɾɾɾʁ  wίεύ࠷ڧ
    w71$
    ϑϩʔϩάͱ
    %/4
    ϩά෼ੳɹ(#ʙ
    w$MPVE5SBJM
    Πϕϯτ෼ੳɹ  
    Πϕϯτʙ
    wฐࣾͰ؅ཧΞΧ΢ϯτͷҎ্͕
    "84
    ར༻අͷҎԼ
    wҎ্ͷΞΧ΢ϯτ͕
    "84
    ར༻අͷҎԼ
19. ͦΕͰ΋ෆ҆ͱ͍͏ͳΒ͹  w೔ؒͷແྉτϥΠΞϧͰ࣮ࡍͷར༻අΛ֬ೝ
20. "84
    $POpH  w"84
    ϦιʔεͷมߋཤྺΛه࿥
    wλΠϜϥΠϯͰมߋ಺༰͕֬ೝͰ͖Δ
21. ͓҆͘ͳΓ·ͨ͠  w೥݄೔Ҏ߱ɺैྔ՝ۚϞσϧʹมߋ
    wධՁ͋ͨΓ
    ʙ https://dev.classmethod.jp/cloud/aws/recommend-config-rules-for-all-user/
22. ඇ४ڌϦιʔεΛࣗಈम෮Ͱ͖ΔΑ͏ʹͳΓ·ͨ͠  w44.
    "VUPNBUJPO
    ͱ࿈ܞͨࣗ͠ಈम෮
    wैདྷ͸
    $MPVE8BUDI
    &WFOUT
    ˠ
    -BNCEB
    ͷ࡞ΓࠐΈ https://dev.classmethod.jp/cloud/aws/auto-recovery-restricted-ssh-without-lambda/
23. 4*".
    "DDFTT
    "OBMZ[FS  w֎෦ϓϦϯγύϧ͔ΒΞΫηεՄೳͳϦιʔε͕ର৅
    wજࡏతͳϦεΫΛ൑அʢ߈ܸΛݕग़͢Δ΋ͷͰ͸ͳ͍ʣ
    wαϙʔτ͞ΕΔϦιʔε
    w4
    όέοτ
    w*".
    ϩʔϧ
    w,.4
    Ωʔ
    w-BNCEB
    ؔ਺ͱ
    -BNCEB
    ϨΠϠʔ
    w424
    Ωϡʔ
24. 4*".
    "DDFTT
    "OBMZ[FS  wແྉͰར༻Մೳʂ
25. શϦʔδϣϯͰ༗ޮԽͯ͠͠·͓͏  https://dev.classmethod.jp/cloud/aws/create-analyzer-all-region/ wશϦʔδϣϯͰ༗ޮʹ͢Δ
    w4
    "DDFTT
    "OBMZ[FS
    ͸
    *".
    "DDFTT
    "OBMZ[FS
    Λ༗ޮԽʹ͢Δͱར༻Ͱ͖·͢
26. ͓๨Εͳ͘  ݕग़͢Δ͚ͩͰຬ଍͠ͳ͍Ͱɻ
    ௨஌΋ͪΌΜͱ΍Γ·͠ΐ͏ɻ
27. ͪΐ͍ςΫ̎  ؆୯ʹνΣοΫͰ͖Δ
    ηΩϡϦςΟɾίϯϓϥΠΞϯε
28. ίϯϓϥΠΞϯεɿ$*4
    #FODINBSL  w$*4
    ͸
    -JOVY
    ΍
    "QBDIF
    ͳͲ༷ʑͳηΩϡϦςΟج४Λ࡞ ੒͍ͯ͠Δஂମ
    w$*4
    "84
    'PVOEBUJPOT
    #FODINBSL
    ͱͯ͠
    "84
    ͷηΩϡ ϦςΟνΣοΫͷ۩ମతͳ߲໨Λఆٛ
    wฐࣾఏڙͷηΩϡϦςΟνΣοΫπʔϧ
 ʰJOTJHIUXBUDIʱͰແྉ਍அՄೳ
29. *OTJHIUXBUDI  wʮখ͞ͳൃݟΛ
    େ͖ͳ҆৺ʹʯΛίϯηϓτʹ
    "84
    ؀ڥ Λ਍அ͠ϨϙʔτΛग़ྗ͢Δπʔϧ https://insightwatch.io/
30. ͨ͘͞ΜͷܯࠂͰͨΜ΍͚Ͳɾɾɾ  https://dev.classmethod.jp/cloud/aws/insightwatch_challenge_allgreen/ https://dev.classmethod.jp/cloud/aws/insightwatch_challenge_allgreen2/ https://dev.classmethod.jp/cloud/aws/insightwatch_challenge_allgreen3/ https://dev.classmethod.jp/cloud/aws/insightwatch_challenge_allgreen4/
31. ͪΐ͍ςΫ̏  ήʔτܕ͔Β
    ΨʔυϨʔϧܕ΁
32. ैདྷͷηΩϡϦςΟͷߟ͑ํ  w࠷ۙɺ"84
    ͕ൃ৴ͯ͠Δϝοηʔδ
    wैདྷͷηΩϡϦςΟ͸ήʔτΩʔύత
    w·ͣ͸ϒϩοΫ
    w಺༰Λ֬ೝͯ͠໰୊͕ͳ͚Ε͹ͱ͓͢
    wྲྀΕΛͱΊΔ͜ͱ͸ɺϏδωεͷεϐʔυΛಷΒͤΔ
33.  ηΩϡϦςΟͰϏδωεʹ
    ϒϨʔΩΛ͔͚ͯ͸͍͚ͳ͍ ͲΜͳʹεϐʔυΛग़ͯ͠΋҆શͳ
    ΨʔυϨʔϧͷΑ͏ͳηΩϡϦςΟΛ
34. ΨʔυϨʔϧతͳηΩϡϦςΟͱ͸  wΨʔυϨʔϧతͳηΩϡϦςΟΛ࣮ݱ͢ΔҰྫ
    w"84
    0SHBOJ[BUJPOT
    ͷαʔϏείϯτϩʔϧϙϦγʔ
    w"84
    *".
    1FSNJTTJPOT
    CPVOEBSZ
    w1FSNJTTJPOT
    CPVOEBSZ
    w௨ৗͷ
    *".
    ϙϦγʔʹ
    "/%
    ৚݅ΛՃ͑ͯɺڐՄൣғΛ ݶఆ͢ΔϙϦγʔ
    wڥքൣғͳ͔Ͱࣗ༝ʹͤͯ͋͛͞Δ
35. 1FSNJTTJPOT
    CPVOEBSZ  wઃఆΛؒҧ͑Δͱ͍ΖΜͳݖݶΛ
 ࣦ͏ͷͰઃఆ͸৻ॏʹ https://dev.classmethod.jp/cloud/aws/iam-permissions-boundary/
36. w*".ϙϦγʔγϡϛϨʔλʹରԠ͠·ͨ͠
    wࣄલʹγϛϡϨʔγϣϯͰӨڹൣғΛ֬ೝ ҆͝৺͍ͩ͘͞  https://dev.classmethod.jp/cloud/aws/iam-policy-simulator-now-simulates-permissions-boundary/
37. ͪΐ͍ςΫ̐  *.%4ͷ
    ηΩϡϦςΟڧԽ
38. *.%4ʢΠϯελϯεϝλσʔλαʔϏεʣ  w&$
    Πϯελϯεϝλσʔλ
    w
    ʹ
    )551
    ϦΫΤετ༷ͯ͠ʑͳϝλ σʔλʹΞΫηεͰ͖Δ
    w*".
    ϩʔϧ͸͜ͷϝλσʔλ͔ΒΫϨσϯγϟϧΛऔಘ
    w8"'
    ͳͲͷެ։αʔόʹ͋Δ੬ऑੑͱ૊Έ߹Θͤͯɺෆਖ਼ ʹ
    &$
    ͷϝλσʔλ͔ΒΫϨσϯγϟϧΛऔಘ͠ѱ༻͢Δ ͜ͱ͕Մೳ
39. ࣄނࣄྫ  ʰpiyologʱɿhttps://piyolog.hatenadiary.jp/entry/2019/08/06/062154
40. *.%4W  https://dev.classmethod.jp/cloud/aws/ec2-imdsv2-release/ w7
    ΁ͷΞΫηεʹ͸
    5PLFO
    ͕ඞཁ
    w7
    ΛແޮԽͰ͖ΔʢσϑΥϧτ͸ซ༻ʣ
    wϝλσʔλαʔϏεࣗମΛແޮԽ΋Ͱ͖ΔɹʜFUD
41. ͋ΘͤͯಡΈ͍ͨ  ʰಙؙߒͷ೔هʱɿhttps://blog.tokumaru.org/2019/12/defense-ssrf-amazon-ec2-imdsv2.html w*.%4W
    ͸
    443'
    ߈ܸͷࠜຊతͳղܾͰ͸ͳ͍
    w͕ɺ443'
    ߈ܸͷ؇࿨ࡦͱͯ͠ҰఆͷޮՌ͸ظ଴Ͱ͖Δ
42. ͪΐ͍ςΫ̑  ͏͔ͬΓ࿙ӮΛ๷ࢭ
43. HJUTFDSFUT
    ࢖ͬͯ·͔͢ʁ  w"84
    ΞΫηεΩʔͷ࿙ӮͰҰ൪ଟ͍ύλʔϯ
    wHJU
    DPNNJU
    ʹ
    IPPL
    ͢ΔػೳΛ༗ޮʹ͠ͱ͚͹ɺΞΫηε Ωʔ΍γʔΫϨοτΩʔͷύλʔϯΛݕग़ɾ્ࢭͯ͘͠ΕΔ https://dev.classmethod.jp/cloud/aws/startup-git-secrets/
44. ͋ΘͤͯಡΈ͍ͨ  w*".
    ͷجຊ͸࠷খݖݶ
    w։ൃݕূຊ൪؀ڥͷ؀ڥ෼཭ͷϝϦοτɺσϝϦοτ https://dev.classmethod.jp/cloud/aws/account-and-vpc-dividing-pattern/
45. ͪΐ͍ςΫ̒  ֎෦ͱͷτϥϑΟοΫΛ
    ΠϯϥΠϯ؂ࠪ
46. *OHSFTT
    SPVUF  w*(8ɺ7(8ʹϧʔτ ςʔϒϧͷઃఆ͕Մೳ
    wૹ৴ઌ͸
    71$
    ͷ
    $*%3
    ൣғͷΈ
    w*%4*14
    ΞϓϥΠΞϯ ε੡඼΁ͷϦμΠϨΫτ Λγϯϓϧʹ࣮૷
47. ͋ΘͤͯಡΈ͍ͨ  https://dev.classmethod.jp/cloud/aws/what-is-vpc-ingress-routing/
48. 71$
    ؒτϥϑΟοΫͷΠϯϥΠϯ؂ࠪʢ5(8ʣ  https://www.slideshare.net/AmazonWebServicesJapan/20191113-aws-black-belt-online-seminar-aws-transit-gateway?ref=https://aws.amazon.com/jp/blogs/news/webinar-bb-aws-transit-gateway-2019/
49.  ·ͱΊ
50. ·ͱΊ  wൃݟత౷੍ͷ̐αʔϏε͸ઃఆ͠Α͏ʢ௨஌·Ͱ΍Δʣ
    wʮ*OTJHIUXBUDIʯͰίϯϓϥΠΞϯεΛνΣοΫ
    wڥքൣғʢΨʔυϨʔϧʣͷͳ͔Ͱࣗ༝౓Λߴ͘
    w*.%4
    ͕ѱ༻͞ΕΔ͜ͱ΋஌͓ͬͯ͘
    wΞΫηεΩʔ͸
    HJU
    DPNNJU
    Ͱ͖ͳ͍Α͏ʹ͢Δ
    wΠϯϥΠϯ؂ࠪΛγϯϓϧʹߏங
51. ͜Ε͚ͩ͸֮͑ͯؼͬͯ΄͍͠ɺͪΐ͍ςΫ  ͍͍ͩͨͷ͜ͱ͸
    %FWFMPQFST*0ʹॻ͍ͯΔ