これが Cloud Native な セキュリティログ分析だ (仮)

これが Cloud Native な セキュリティログ分析だ (仮)

Cookpad techconf 2018のLTで講演した資料です

2ca9e6e68b43a796a8add2bcb9bbad2e?s=128

Masayoshi Mizutani

February 11, 2018
Tweet

Transcript

  1. ਫ୩ਖ਼ܚ ΠϯϑϥετϥΫνϟʔ෦ ͜Ε͕ Cloud Native ͳ ηΩϡϦςΟϩά෼ੳͩ (Ծ) Cookpad Inc

    2018.2.10
  2. ηΩϡϦςΟ؂ࢹ ΍ͬͯ·͔͢ʁ 2

  3. CookpadͰ΋ؤு͍ͬͯ·͕͢ 3 ηΩϡϦςΟ୲౰͸ؾʹͳΔ͜ͱ͕ͨ͘͞Μ ϥϯαϜ΢ΣΞ 42-*OKFUJPO EBZ"UUBDL 944 όϥϚΩܕϝʔϧ߈ܸ $43' %SJWFCZ%PXOMPBE߈ܸ

    ඪతܕ߈ܸ ηΩϡϦςΟઃఆϛε ύεϫʔυϦετܕ߈ܸ Ϋϥ΢υ্ͷΠϯελϯε 1BB4 ࣾһ͕ར༻͢Δ1$ ΦϑΟεωοτϫʔΫ ֎෦ͱͷϝʔϧ ۀ຿γεςϜ "DUJWF%JSFDUPSZ ΦϯϥΠϯετϨʔδ कΒͳ͚Ε͹ͳΒͳ͍෺ͨͪ ߈ܸͯ͘͠Δऀͨͪ Ϣʔβͷ৘ใ
  4. 4 SIEM ʢηΩϡϦςΟؔ࿈ͷϩάɾσʔλΛ͔͖ूΊͯ෼ੳ͢ΔϓϩμΫτʣ Security Information and Event Manager ͦ͜Ͱ Ͱ͢Α

  5. 5

  6. SIEMΛஔ͚͹શ෦ղܾͩͱࢥͬͯͨʁ ࢒೦ʂ ɾ؂ࢹର৅ͷ؀ڥͷߏ੒มߋʹऑ͍ ɾ ϩάૹ৴ݩͷ؅ཧ͕େมɺύʔαͱ͔࡞Δඞཁ༗ ɾࣗ਎ͷߏ੒มߋ΋ۤख ɾ HAઃఆɺεέʔϧΞ΢τɺϥΠηϯεܗଶɺetc ɾϧʔϧͷมߋ؅ཧ΍ςετ͕ۤख ɾ

    ಠࣗUIɺϚχϡΞϧૢ࡞ 6 Ϋϥ΢υ؀ڥ΍ؔ࿈πʔϧͱ૬ੑ͕͋·ΓΑ͘ͳ͍
  7. 7

  8. ͦ΋ͦ΋Կ͕͍ͨ͠ͷ͔ʁ 8 SIEMͷػೳ͔ΒৼΓฦΓ

  9. SIEMͷػೳ (1) 9 ϩάͷऩूͱਖ਼نԽ SIEM ɾϩάΛूΊͯॲཧ͠΍͍͢ܗࣜʹม׵͢Δ ɾڞ௨͢Δϩάͷଐੑ஋ʢ࣌ࠁɺ*1ΞυϨεͳͲʣΛͦΖ͑Δ ϩά ϩά ϩά

  10. SIEMͷػೳ (2) 10 ϩάͷ෼ੳΤϯδϯ SIEM ɾूΊͨϩά͔ΒΞϥʔτʹͳΔ΋ͷΛݟ͚ͭΔ ɾύλʔϯϚον΍ϩάͷ਺্͑͛ͳͲ ϩά ϩά ϩά

  11. SIEMͷػೳ (3) 11 ϩάͷอ؅ɾݕࡧ SIEM ϩά ϩά ɾूΊͨϩάΛద੾ʹอ؅͢Δ ɾूΊͨϩά͔Βඞཁͳ৘ใΛݕࡧͰ͖Δ ηΩϡϦςΟ୲౰

  12. SIEMͷػೳ (4) 12 Ξϥʔτͷൃใ͓Αͼ؅ཧ SIEM ɾΞϥʔτ͕ൃੜͨ͠৔߹ɺ୲౰ऀʹ௨஌͢Δ ɾ௨஌ͨ͠Ξϥʔτ͕ͲͷΑ͏ʹରԠ͞Ε͔ͨه࿥͢Δ ηΩϡϦςΟ୲౰

  13. ·ͱΊΔͱ 13

  14. SIEMΛ࠶ߟ͢Δ 1. ϩάͷऩूͱਖ਼نԽ 2. ϩάͷ෼ੳΤϯδϯ 3. ϩάͷอ؅ɾݕࡧ 4. Ξϥʔτͷൃใ͓Αͼ؅ཧ 14

    SIEMͷػೳ
  15. Cloud NativeͰ ྑ͍ײ͡ʹ͍ͨ͠ 15

  16. SIEMΛ࠶ߟ͢Δ 1. ϩάͷऩूͱਖ਼نԽ 2. ϩάͷ෼ੳΤϯδϯ 3. ϩάͷอ؅ɾݕࡧ 4. Ξϥʔτͷൃใ͓Αͼ؅ཧ 16

    AWSͷαʔϏε + α Ͱ୅ସͯ͠ΈΔ → CloudWatch + Fluentd + S3 + Lambdaແ → Lambdaແ → S3 + Graylog + AWS Athenaແ → PagerDuty + GHEແ
  17. ͜͏ͳͬͨ 17 ͜Ε͕ Cloud Native ͳηΩϡϦςΟϩά෼ੳͩ (Ծ) ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ ʜ

    ʜ Lambda Lambda Lambda Kinesis Stream Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ
  18. AWSαʔϏεʴαͰ࡞ΔηΩϡϦςΟ؂ࢹΞʔΩςΫνϟ (1/4) ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ ʜ ʜ Lambda Lambda Lambda Kinesis

    Stream Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ ϩάͷऩूͱਖ਼نԽ 18 w ͱʹ͔͘ϩά͸·ͣ4ʹ౤͛ࠐΉ w ॲཧͷલஈͰ·ͣอଘ͢Δ͜ͱͰϩά ଛࣦͷࣄނΛ๷͙ w ϑϧϚωʔδυ͔ͭεέʔϥϒϧͳ4 Λ࢖͏͜ͱͰӡ༻ෛՙΛԼ͛Δ w ϩάͷਖ਼نԽ͸-BNCEBΛ࢖ͬͯίʔ υ؅ཧˍςετΛॻ͍ͯ$*
  19. AWSαʔϏεʴαͰ࡞ΔηΩϡϦςΟ؂ࢹΞʔΩςΫνϟ (2/4) ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ ʜ Lambda Lambda Lambda Kinesis Stream

    Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ ϩάͷ෼ੳΤϯδϯ 19 w 4ʹϑΝΠϧ͕อଘ͞ΕͨΠϕϯτΛ͏͚ ͱͬͨ-BNCEB'VODUJPO͕ϩάΛಡΈ ग़ͯ͠෼ੳ w ෼ੳΤϯδϯΛૄ݁߹ʹઃܭ͢Δ͜ͱͰɺ ༰қʹεέʔϧΞ΢τ w ݕ஌ΤϯδϯͷBUUBDIEFUBDI΋ࣗ༝ࣗࡏ w ΋ͪΖΜϧʔϧ΋ίʔυ؅ཧˍςετ
  20. AWSαʔϏεʴαͰ࡞ΔηΩϡϦςΟ؂ࢹΞʔΩςΫνϟ (3/4) ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ ʜ Lambda Lambda Lambda Kinesis Stream

    Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ ϩάͷอ؅ɾݕࡧ 20 w ࠷ॳʹΞϥʔτ͕ൃใ͞Εͨࡍ ͷॳಈ૞ࠪ͸(SBZMPHͰࣗ༝ ʹݕࡧඞཁͳϩάͷநग़ w Ξϥʔτ͕௕ظؒʹ౉͍ͬͯΔ ͜ͱ͕Θ͔ͬͨ৔߹ɺ"UIFOB Λ࢖ͬͯେྔͷϩάΛݕࡧͯ͠ աڈʹḪͬͨਝ଎ͳௐ͕ࠪՄೳ
  21. AWSαʔϏεʴαͰ࡞ΔηΩϡϦςΟ؂ࢹΞʔΩςΫνϟ (4/4) ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ ʜ Lambda Lambda Lambda Kinesis Stream

    Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ 21 Ξϥʔτͷൃใ͓Αͼ؅ཧ w ΦϖϨʔλ΁ͷ௨஌͸1BHFS%VUZ 4MBDLΛར༻ w ൃใͱಉ࣌ʹ(JUIVC&OUFSQSJTFʹJTTVFΛν έοτͱͯ͠࡞੒͠ɺΞϥʔτͷௐࠪʹؔ͢Δ৘ใΛ ूத؅ཧ w ͞Βʹࣗಈతʹ-BNCEB͕Ξϥʔτͷؔ࿈৘ใΛ֎ ෦αΠτ͔Βݕࡧ͠νέοτʹ͓·ͱΊ͢Δ
  22. ʢ࠶ܝʣ 22 ͜Ε͕ Cloud Native ͳηΩϡϦςΟϩά෼ੳͩ (Ծ) ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ ʜ

    ʜ Lambda Lambda Lambda Kinesis Stream Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ
  23. 23 ࣮ࡍͷΦϖϨʔγϣϯͷ༷ࢠ

  24. Cloud Nativeʹ ηΩϡϦςΟ؂ࢹΛߏங͢ΔϝϦοτ 24 (1) ϚωʔδυαʔϏεͷར༻ʹΑΓӡ༻ͷফ໣Λ๷͛Δ (2) طଘαʔϏεͷ͍͍ͱ͜औΓ͕Ͱ͖Δ (3) ίʔυมߋ؅ཧˍςετʴCIͱ૬ੑ͕ྑ͍

  25. Thank you 25