セキュリティ系アップデートの全体像とSecurity Hub深掘り #AWSreInvent #cmregrowth

Transcript

1. ηΩϡϦςΟܥΞοϓσʔτͷશମ૾ͱ 4FDVSJUZ
   )VC
   ਂ۷Γ
2. ࣗݾ঺հ ઒ݪ੐େ LBXBIBSBNBTBIJSP ˔ Ϋϥεϝιου ˔ "84ࣄۀຊ෦ίϯαϧςΟϯά෦ॴଐ ˔ 
   "1/
   "84
   5PQ
   &OHJOFFST
   4FSWJDF ˔ 
   +BQBO
   "84
   5PQ
   &OHJOFFST
   4FDVSJUZ ˔ ޷͖ͳ"84αʔϏε
   *".
   $-* ˔ SF*OWFOU
   
   όʔνϟϧࢀՃ੎ https://dev.classmethod.jp/author/kawahara-masahiro/
3. ΞδΣϯμ ˔ <NJO> ͸͡Ίʹ ࠓ͜͜ ˔ <NJO> ηΩϡϦςΟαʔϏε৽ػೳͷ͓͞Β͍ ˔ <NJO> 4FDVSJUZ
   )VC
   ਂ۷Γ ˔ <NJO> ͓ΘΓʹ
4. ηΩϡϦςΟαʔϏε৽ػೳͷ ͓͞Β͍
5. ηΩϡϦςΟαʔϏε l৽ػೳͷ݅਺z ϥϯΩϯά ˔ ݅
   4FDVSJUZ
   )VC
   %FUFDUJWF ˔ ݅
   *OTQFDUPS ˔ ݅
   (VBSE%VUZ
   *".
   "DDFTT
   "OBMZ[FS
   $POGJH
   $POUSPM
   5PXFS ˔ ݅
   *".
   *EFOUJUZ
   $FOUFS
   
   $MPVE5SBJM
   4FDSFUT
   .BOBHFS
6. ৽ػೳҰཡ 
   ൃදͰ͸ׂѪ 
   4FDVSJUZ
   )VC "84
   4FDVSJUZ
   )VC
   ͷ৽͍͠ൃݟͷڧԽΛൃද
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXOFXGJOEJOHFOSJDINFOUBXTTFDVSJUZ IVC "84
   4FDVSJUZ
   )VC
   ͷओཁͳμογϡϘʔυͷػೳڧԽΛൃ ද
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXEBTICPBSEFOIBODFNFOUTBXTTFDVSJUZ IVC "84
   4FDVSJUZ
   )VC
   ͷ৽͍͠தԝઃఆػೳͷൃද
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXBXTTFDVSJUZIVCDFOUSBMDPOGJHVSBUJPO "84
   4FDVSJUZ
   )VC
   ͰηΩϡϦςΟ੍ޚΛΧελϚΠζͰ͖ ΔΑ͏ʹͳΓ·ͨ͠
   IUUQTBXTBNB[PODPNBCPVU BXTXIBUTOFXDVTUPNJ[FTFDVSJUZDPOUSPMT BXTTFDVSJUZIVC 
   %FUFDUJWF "NB[PO
   %FUFDUJWF
   ͕ *".
   ͷௐࠪΛൃද
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXBNB[POEFUFDUJWFJOWFTUJHBUJPOTJBN "NB[PO
   %FUFDUJWF
   ͸ɺ"NB[PO
   (VBSE%VUZ
   &$4
   ϥϯλΠϜ؂ࢹ ͷηΩϡϦςΟௐࠪΛαϙʔτ͠·͢
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXBNB[POEFUFDUJWFTFDVSJUZHVBSEEVUZFDT NPOJUPSJOH "NB[PO
   %FUFDUJWF
   ͕ɺੜ੒ "*
   Λ࢖༻ͨ͠άϧʔϓͷ֓ཁͷݕࡧ Λಋೖ
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXBNB[POEFUFDUJWFHSPVQTVNNBSJFT HFOFSBUJWFBJ "NB[PO
   %FUFDUJWF
   ͕ "NB[PO
   4FDVSJUZ
   -BLF
   ͔ΒͷϩάऔಘΛα ϙʔτ͢ΔΑ͏ʹͳΓ·ͨ͠
   IUUQTBXTBNB[PODPNBCPVU BXTXIBUTOFXBNB[POEFUFDUJWFMPHSFUSJFWBM TFDVSJUZMBLF
7. ৽ػೳҰཡ 
   ൃදͰ͸ׂѪ 
   *OTQFDUPS "NB[PO
   *OTQFDUPS
   ͸։ൃऀπʔϧͱ౷߹͢Δ͜ͱͰίϯςφΠϝ ʔδͷηΩϡϦςΟΛڧԽ͠·͢
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXBNB[POJOTQFDUPSJNBHFTFDVSJUZEFWFMPQFS UPPMT "NB[PO
   *OTQFDUPS
   ͷ "NB[PO
   &$
   ޲͚ΤʔδΣϯτϨε੬ऑੑ ධՁ͕ϓϨϏϡʔத
   IUUQTBXTBNB[PODPNBCPVU BXTXIBUTOFXBNB[POJOTQFDUPSBHFOUMFTT BTTFTTNFOUTFDQSFWJFX "NB[PO
   *OTQFDUPS
   ͸ɺੜ੒ "*
   Λར༻ͨ͠म෮ʹΑΓ "84
   -BNCEB
   ίʔυεΩϟϯΛ֦ு͠·͢
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXBNB[POJOTQFDUPSBXTMBNCEBDPEF TDBOOJOH 
   (VBSE%VUZ "84
   'BSHBUF
   ΛؚΉ "NB[PO
   (VBSE%VUZ
   &$4
   ϥϯλΠϜϞχλϦϯάͷ ঺հ
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXBNB[POHVBSEEVUZFDTSVOUJNFNPOJUPSJOHGBSHBUF "NB[PO
   (VBSE%VUZ
   ͕ "NB[PO
   &$
   ͷϥϯλΠϜ؂ࢹΛαϙʔτ͢ΔΑ ͏ʹͳΓ·ͨ͠ ϓϨϏϡʔ 
   IUUQTBXTBNB[PODPNBCPVU BXTXIBUTOFXBNB[POHVBSEEVUZSVOUJNFNPOJUPSJOH BNB[POFDQSFWJFX 
   *".
   "DDFTT
   "OBMZ[FS *".
   "DDFTT
   "OBMZ[FS
   ͸ɺࣗಈԽ͞Εͨਪ࿦Λར༻ͨ͠ΧελϜ ϙϦγʔ νΣοΫΛಋೖ͠·͢
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXJBNBDDFTTBOBMZ[FSDVTUPNQPMJDZDIFDL *".
   "DDFTT
   "OBMZ[FS
   ͸ɺະ࢖༻ͷΞΫηεͷݕࠪΛ؆ૉԽ͠ɺ࠷খݶͷಛ ݖʹಋ͘Α͏ʹͳΓ·ͨ͠
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXJBNBDDFTTBOBMZ[FSJOTQFDUJOHVOVTFEBDDFTT
8. ৽ػೳҰཡ 
   ൃදͰ͸ׂѪ 
   $POGJH "84
   $POGJH
   ͕ఆظతͳه࿥Λαϙʔτ͢ΔΑ͏ʹͳΓ·ͨ͠
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUTOFXBXTDPOGJH QFSJPEJDSFDPSEJOH "84
   $POGJH
   ͕ "*
   Λ׆༻ͨ͠ੜ੒తͳࣗવݴޠΫΤϦΛ։࢝ ϓϨϏϡʔ 
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUTOFXBXTDPOGJH HFOFSBUJWFBJQPXFSFEOBUVSBMMBOHVBHFRVFSZJOHQSFWJFX 
   $POUSPM
   5PXFS "84
   $POUSPM
   5PXFS
   ͕σδλϧओݖཁ݅Λຬͨͨ͢Ίͷ 
   ͷίϯτϩʔ ϧΛൃද
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXBXTDPOUSPMUPXFSDPOUSPMTEJHJUBMTPWFSFJHOUZ SFRVJSFNFOUT "1*
   Λ࢖༻ͯ͠ "84
   $POUSPM
   5PXFS
   ϥϯσΟϯά κʔϯͷૢ࡞ΛࣗಈԽ ͢Δ
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXBVUPNBUFBXTDPOUSPMUPXFS[POFPQFSBUJPOTBQJT 
   *".
   *EFOUJUZ
   $FOUFS "84
   "OBMZUJDT
   ͸ɺ*".
   *EFOUJUZ
   $FOUFS
   Λ࢖༻ͯ͠αʔϏεؒͰͷϢʔβ ʔͷσʔλ ΞΫηεΛ؆ૉԽ͠·͢
   IUUQTBXTBNB[PODPNBCPVU BXTXIBUTOFXBXTBOBMZUJDTVTFSTEBUBBDDFTTJBN JEFOUJUZDFOUFS 
   $MPVE5SBJM "84
   $MPVE5SBJM
   -BLF
   σʔλ͕ "NB[PO
   "UIFOB
   Ͱͷθϩ &5-
   ෼ੳʹར༻ Մೳʹ
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXBXTDMPVEUSBJMMBLF[FSPFUMBOMZTJTBUIFOB 
   4FDSFUT
   .BOBHFS "84
   4FDSFUT
   .BOBHFS
   ͕γʔΫϨοτͷόονऔಘΛαϙʔτ͢ΔΑ͏ʹ ͳΓ·ͨ͠
   IUUQTBXTBNB[PODPNBCPVUBXTXIBUT OFXBXTTFDSFUTNBOBHFSCBUDISFUSJFWBMTFDSFUT
9. ࢥͬͨ͜ͱͭ ˔ ηΩϡϦςΟ º ੜ੒"* ͕Ξπ͍ ˓ ΫΤϦΛੜ੒"*Ͱ࡞੒ $POGJH ɺ-BNCEBίʔυमਖ਼Λੜ੒"*ͰΞγετ *OTQFDUPS
   ͳͲ ˔ (VBSE%VUZ
   *OTQFDUPS
   ৽ػೳ͋ͨΓ͸ఆ൪ ˓ (VBSE%VUZ
   &$4 'BSHBUF
   &$ϥϯλΠϜϞχλϦϯά ˞&$ϥϯλΠϜϞχλϦϯά͸ϓϨϏϡʔ ˓ *OTQFDUPS
   &$ΤʔδΣϯτϨε਍அ ϓϨϏϡʔ ɺ$*$%ύΠϓϥΠϯ૊ΈࠐΈ ˔ ΞΫηε؅ཧ͸ *".
   *EFOUJUZ
   $FOUFS
   ਪ͠ ˓ ෼ੳܥαʔϏε΍4ͷΞΫηεΛ *".
   *EFOUJUZ
   $FOUFS
   Ͱ؅ཧ ˓ SF*OWFOU
   ༧બམͪΞοϓσʔτ͕ଟ͔ͬͨ
10. 4FDVSJUZ
    )VC
    ਂ۷Γ
11. ͦͷલʹ͓ܰ͘͞Β͍ "84
    4FDVSJUZ
    )VC
    ͸ ͭͷػೳΛఏڙ͢ΔαʔϏε ˔ ֤छηΩϡϦςΟαʔϏεͷ lϋϒz ˔ $41.
    $MPVE
    4FDVSJUZ
    1PTUVSF
    .BOBHFNFOU
12. ֤छηΩϡϦςΟαʔϏεͷ lϋϒz 📌 ౷Ұ͞ΕͨϑΥʔϚοτͰηΩϡϦςΟΠϕϯτΛूத؅ཧ
13. $41.
    $MPVE
    4FDVSJUZ
    1PTUVSF
    .BOBHFNFOU 📌ʮηΩϡϦςΟϦεΫͷ͋Δઃఆʯ͕ແ͍͔νΣοΫ
14. 4FDVSJUZ
    )VC
    ͷ৽ػೳͨͪ  ݕग़݁Ռͷ৽ϑΟʔϧυ  μογϡϘʔυͷػೳڧԽ  ίϯτϩʔϧͷΧελϚΠζ  ৽͍͠தԝઃఆػೳ
15. ݕग़݁Ռͷ৽ϑΟʔϧυ ˔ ʮ͜ͷϦιʔε*%ΞΧ΢ϯτ*%ɺͲΕ͚ͩͬʯ͕ແ͘ͳΓ·͢ ˔ ΞΧ΢ϯτ໊΍ϦιʔελάΛݕग़݁Ռ͔Β֬ೝͰ͖·͢ [アップデート]AWS Security Hubの検出結果に新たな項目が増えました #AWSreinvent | DevelopersIO ώϡʔϚϯϑϨϯυϦʔ౓
    ˒˒˒˒˒
16. μογϡϘʔυͷػೳڧԽ ˔ ͍ΖΜͳ΢ΟδΣοτΛ഑ஔͰ͖ΔΑ͏ʹͳΓ·ͨ͠ ˔ ϑΟϧλʔ΋Ͱ͖·͢ ௐ͕ࠪḿΔ౓
    ˒˒˒˒˒ [アップデート]AWS Security Hubのサマリダッシュボード上でウィジェットのカスタマイズや フィルタリング機能が実装されました #AWSreInvent | DevelopersIO
17. ίϯτϩʔϧͷΧελϚΠζ ˔ ίϯτϩʔϧͷύϥϝʔλΛνϡʔχϯάͰ͖·͢ ͔Ώ͍ͱ͜Ζʹख͕ಧ͘౓
    ˒˒˒˒˒ [アップデート]AWS Security Hubでコントロールのパラメータをカスタマイズ できるようになりました #AWSreinvent | DevelopersIO
18. ৽͍͠தԝઃఆػೳ ˔ ϚϧνΞΧ΢ϯτ؀ڥͷ 4FDVSJUZ
    )VC౷੍͕௒ઈڧԽ͞Ε·ͨ͠ ˓ ίϯτϩʔϧແޮԽͷूத؅ཧ ˓ ΦϓτΠϯܗࣜͰίϯτϩʔϧ༗ޮԽ ˓ 06୯Ґͷίϯτϩʔϧ੍ޚ ຊ౰ʹཉ͔ͬͨ͠΋ͷ౓˒˒˒˒˒˒˒˒˒˒˒˒˒ [アップデート]AWS Security Hubの組織への展開がセキュリティ標準やコントロールなどを カスタマイズして設定できるようになりました！ #AWSreInvent | DevelopersIO
19. ͓ΘΓʹ ײͨ͜͡ͱ
20. ײͨ͜͡ͱ ˔ ෳ਺ΞΧ΢ϯτͷ؅ཧऀ͕େ׻ت͢ΔΑ͏ͳΞοϓσʔτ ˓ ΞΧ΢ϯτ಺Ͱ΋ௐ͕ࠪḿΔ৽ػೳ͕དྷͨͷͰɺ։ൃऀʹͱͬͯ΋خ͍͠ ˔ ϑΟʔυόοΫΛண࣮ʹ൓өͯ͘͠Ε͍ͯΔײ ˓ ݄
    ౷߹ίϯτϩʔϧ ˓ ݄
    "VUPNBUJPO
    3VMFT ˓ ݄
    ࠓճͷ৽ػೳͨͪ ˓ ͨ͘͞Μ
    ৽نίϯτϩʔϧ௥Ճ ˔ ͲΜͲΜ׆༻ɺͲΜͲΜϑΟʔυόοΫ͍͖ͯ͠·͠ΐ͏ʂ