Outreach Activities #owaspnight18th

Transcript

1. 0VUSFBDI
   "DUJWJUJFTʴЋ 08"41
   +BQBO
   1SPNPUJPO
   5FBN
   ஥ా
   ᠳҰ
2. 0VUSFBDI
   "DUJWJUJFT
3. 08"41
   +BQBO
   #MPH࢝Ί·ͨ͠ʂ
   
4. 5FBNൃ଍͔Β༷ʑͳ0VUSFBDI׆ಈΛ͍ͯ͠·͢ʂ
   ࠓޙ΋Πϕϯτ੝Γ্͛ʹڠྗ͓ͨ͘͠੠ֻ͚͍ͩ͘͞ʂ   1)1
   $POGFSFODF
    ϒʔε   )BSEFOJOH
   &WPMVUJPOT -5   ਆށ*5ϑΣεςΟόϧ ϓϨθϯɺϒʔε   4&$$0/શࠃେձ -5ɺϒʔε   %FWFMPQFST
   4VNNJU
    -5ɺϒʔε   .JOJ
   )BSEFOJOH
   1SPKFDU
    -5ɺلͷળ   .JOJ
   )BSEFOJOH
   1SPKFDU
    لͷળ   1)1
   $POGFSFODF
   ,BOTBJ ϓϨθϯ   1)1
   $POGFSFODF
   'VLVPLB -5   +VMZ
   5FDI
   'FTUB -5ɺϒʔε   %FWFMPQFST
   4VNNJU
   
   4VNNFS ϒʔεʢϙελʔʣ
5. 5FBNൃ଍͔Β༷ʑͳ0VUSFBDI׆ಈΛ͍ͯ͠·͢ʂ
   ࠓޙ΋Πϕϯτ੝Γ্͛ʹڠྗ͓ͨ͘͠੠ֻ͚͍ͩ͘͞ʂ   1)1
   $POGFSFODF
    ϒʔε   )BSEFOJOH
   &WPMVUJPOT -5   ਆށ*5ϑΣεςΟόϧ ϓϨθϯɺϒʔε   4&$$0/શࠃେձ -5ɺϒʔε   %FWFMPQFST
   4VNNJU
    -5ɺϒʔε   .JOJ
   )BSEFOJOH
   1SPKFDU
    -5ɺلͷળ   .JOJ
   )BSEFOJOH
   1SPKFDU
    لͷળ   1)1
   $POGFSFODF
   ,BOTBJ ϓϨθϯ   1)1
   $POGFSFODF
   'VLVPLB -5   +VMZ
   5FDI
   'FTUB -5ɺϒʔε   %FWFMPQFST
   4VNNJU
   
   4VNNFS ϒʔεʢϙελʔʣ
6. ͜Ε͕$IBQUFS
   -FBEFSͷ্໺͞Μ΋Φεεϝ͢Δ
   لͷળͷຣ஡όόϩΞͰ͢ʂ࣍ճ ࢀՃͨ͠Β৯΂ΒΕΔʢ͔΋ʁʣ .JOJ
   )BSEFOJOH
   
   ʢ౔ʣʹ**+ࣾʹͯ։࠵༧ఆͰ͢ɻొ࿥͸ʢ౔ʣ͔Βɻ
   IUUQNJOJIBSEFOJOHDPOOQBTTDPNFWFOU
7. +VMZ
   5FDI
   'FTUBʢΠϯϑϥΤϯδχΞͷࡇయʣͰ͸
   ϒʔεͱγϣʔτϓϨθϯςʔγϣϯ Λఏڙ͠·ͨ͠ʂ 08"41
   +BQBOͷ4QFBLFS%FDL্ʹެ։͍ͯ͠·͢ɻ
   IUUQTTQFBLFSEFDLDPNPXBTQKBQBOPXBTQKBQBOTIPSUQSFTFOUBUJPOOVNCFSKUG
8. Ћ
   ʙ08"41ΛͪΌΜͱ׆༻͍ͯ͠·͔͢ʁʙ
9. ӡ༻ɾอक ઃܭɾ։ൃ ΢ΣϒγεςϜͷϥΠϑαΠΫϧʹ͓͍༷ͯʑͳ 08"41ͷυΩϡϝϯτʗπʔϧΛ׆༻Ͱ͖·͢ɻ ཁ݅ఆٛ ςετ     ᶃ ཁ݅ఆٛ 8FC
   γεςϜʗ8FC
   ΞϓϦέʔγϣϯηΩϡϦςΟཁ݅ॻ ᶄ ઃܭɾ։ൃ 08"41
   1SPBDUJWF
   $POUSPMT 08"41
   "474ʢ"QQMJDBUJPO
   4FDVSJUZ
   7FSJpDBUJPO
   4UBOEBSE
   ʣ 08"41
   $IFBU
   4IFFU
   4FSJFT ᶅ ςετ 08"41
   ;FE
   "UUBDL
   1SPYZ 08"41
   5FTUJOH
   (VJEF 08"41
   085'ʢ0⒎FOTJWF
   8FC
   5FTUJOH
   'SBNFXPSLʣ ᶆ ӡ༻ɾอक 08"41
   .PE4FDVSJUZ
   $PSF
   3VMF
   4FU
   1SPKFDU 08"41
   "QQ4FOTPS 08"41
   %FQFOEFODZ
   $IFDL ᶋ ͦͷଞ 08"41
   5PQ
   
   .PCJMF
   5PQ
   
   *P5
   5PQ
    08"41
   4OBLFT
   BOE
   -BEEFST 0QFO4"..ʢ4PGUXBSF
   "TTVSBODF
   .BUVSJUZ
   .PEFMʣ
10. ӡ༻ɾอक ઃܭɾ։ൃ ΢ΣϒγεςϜͷϥΠϑαΠΫϧʹ͓͍༷ͯʑͳ 08"41ͷυΩϡϝϯτʗπʔϧΛ׆༻Ͱ͖·͢ɻ ཁ݅ఆٛ ςετ     ᶃ ཁ݅ఆٛ 8FC
    γεςϜʗ8FC
    ΞϓϦέʔγϣϯηΩϡϦςΟཁ݅ॻ ᶄ ઃܭɾ։ൃ 08"41
    1SPBDUJWF
    $POUSPMT 08"41
    "474ʢ"QQMJDBUJPO
    4FDVSJUZ
    7FSJpDBUJPO
    4UBOEBSE
    ʣ 08"41
    $IFBU
    4IFFU
    4FSJFT ᶅ ςετ 08"41
    ;FE
    "UUBDL
    1SPYZ 08"41
    5FTUJOH
    (VJEF 08"41
    085'ʢ0⒎FOTJWF
    8FC
    5FTUJOH
    'SBNFXPSLʣ ᶆ ӡ༻ɾอक 08"41
    .PE4FDVSJUZ
    $PSF
    3VMF
    4FU
    1SPKFDU 08"41
    "QQ4FOTPS 08"41
    %FQFOEFODZ
    $IFDL ᶋ ͦͷଞ 08"41
    5PQ
    
    .PCJMF
    5PQ
    
    *P5
    5PQ
     08"41
    4OBLFT
    BOE
    -BEEFST 0QFO4"..ʢ4PGUXBSF
    "TTVSBODF
    .BUVSJUZ
    .PEFMʣ
11. ΢ΣϒΞϓϦٴͼϞόΠϧΞϓϦʹ͓͚Δ
    ϦεΫɺӨڹɺͦͷରࡦํ๏ΛཧղͰ͖·͢ɻ /P ΢ΣϒΞϓϦ ϞόΠϧΞϓϦ  ΠϯδΣΫγϣϯ 8FBL
    4FSWFS
    4JEF
    $POUSPMT  ηογϣϯ؅ཧͷෆඋ OTFDVSF
    %BUB
    4UPSBHF  ΫϩεαΠτεΫϦϓςΟϯά *OTV⒏DJFOU
    5SBOTQPSU
    -BZFS
    1SPUFDUJPO  ҆શͰͳ͍ΦϒδΣΫτ௚઀ࢀর 6OJOUFOEFE
    %BUB
    -FBLBHF  ηΩϡϦςΟઃఆͷϛε 1PPS
    "VUIPSJ[BUJPO
    BOE
    "VUIFOUJDBUJPO  ػີσʔλͷ࿐ग़ #SPLFO
    $SZQUPHSBQIZ  ػೳϨϕϧΞΫηε੍ޚͷܽམ $MJFOU
    4JEF
    *OKFDUJPO  ΫϩεαΠτϦΫΤετϑΥʔδ ΣϦ 4FDVSJUZ
    %FDJTJPOT
    7JB
    6OUSVTUFE
    *OQVUT  ط஌ͷ੬ऑੑΛ࣋ͭίϯϙʔωϯ τͷ࢖༻ *NQSPQFS
    4FTTJPO
    )BOEMJOH  ະݕ౼ͷϦμΠϨΫτͱϑΥʔϫ ʔυ -BDL
    PG
    #JOBSZ
    1SPUFDUJPOT 08"41
    5PQ
    08"41
    .PCJMF
    5PQ
    
12. /P *P5
    5PQ
     ର৅  ҆શͰͳ͍΢ΣϒΠϯλϑΣʔε IoTσόΠε؅ཧΠϯλϑΣʔε  ෆे෼ͳೝূʗೝՄ શσόΠεΠϯλϑΣʔεʗαʔϏε  ҆શͰͳ͍ωοτϫʔΫαʔϏε σόΠεɺΫϥ΢υɺ΢ΣϒɺϞόΠ ϧΛؚΉશωοτϫʔΫαʔϏε  τϥϯεϙʔτ૚ʹ͓͚Δ҉߸Խͷ ܽ೗ σόΠεɺΫϥ΢υɺ΢ΣϒɺϞόΠ ϧΛؚΉશωοτϫʔΫαʔϏε  ϓϥΠόγʔʹؔ͢Δݒ೦ IoTιϦϡʔγϣϯͷશίϯϙωϯτ  ҆શͰͳ͍Ϋϥ΢υΠϯλϑΣʔε Ϋϥ΢υAPI΋͘͠͸Ϋϥ΢υϕʔε ͷ΢ΣϒΠϯλϑΣʔε  ҆શͰͳ͍ϞόΠϧΠϯλϑΣʔε ϞόΠϧΞϓϦέʔγϣϯΠϯλϑΣ ʔε  ෆे෼ͳηΩϡϦςΟରࡦ IoTσόΠε  ҆શͰͳ͍ιϑτ΢ΣΞʗϑΝʔϜ ΢ΣΞ IoTσόΠε  ෺ཧηΩϡϦςΟͷෆ଍ IoTσόΠε ࣮͸࠷ۙ஌ͬͨͷͰ͕͢ɺ*P5
    5PQ
    ΋͋Γ·͢ɻ
    *OGPHSBQIJD൛Λ೔ຊޠԽ͠·ͨ͠ʂʢຊฤͷ೔ຊޠԽ͸ݕ౼தʁʣ 08"41
    *P5
    5PQ
    
13. 4OBLFT
    BOE
    -BEEFST
    08"41
    5PQʗ08"41
    .PCJMF
    5PQͰ
    ఆٛ͞ΕͨϦεΫΛ༡ͼͳ͕ΒֶͿ͜ͱ͕Ͱ͖·͢ɻ 100 99 98 97 96 95 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 D p f ❉ P ✭ ελʔτ ΰʔϧ 08"41$ ϞόΠϧσόΠεʹ ͓͚Δػີσʔλͷ ಛఆͱอޢ 08"41$ σόΠεʹ͓͚Δ ύεϫʔυͷ ҆શͳऔΓѻ͍ 08"41$ ػີσʔλͷ఻ૹͷ อޢΛ֬อ 08"41$ Ϣʔβʔೝূɺ ೝՄ ͓Αͼ ηογϣϯ؅ཧͷ ਖ਼͍࣮͠૷ 08"41$ όοΫΤϯυͷ"1* ʢαʔϏεʣ ͱϓϥοτ ϑΥʔϜ ʢαʔόʣ ͷ ҆શੑͷҡ࣋ 08"41$ αʔυύʔςΟͷ αʔϏε΍ ΞϓϦέʔγϣϯͱͷ σʔλ౷߹Λ҆શʹ 08"41$ Ϣʔβʔσʔλͷ ར༻ͱऩूͷͨΊͷ ঝ୚ͷऩूͱอ؅ʹ ಛผͳ஫ҙΛ෷͏ 08"41$ ༗ྉͷϦιʔε΁ͷ ෆਖ਼ΞΫηεΛ๷͙ ͨΊͷ੍ޚͷ࣮૷ 08"41$ ϞόΠϧΞϓϦͷ ഑෍ఏڙͷ ҆શੑͷ֬อ 08"41$ ίʔυ࣮ߦ࣌ʹΤϥʔ ͕ൃੜͨ͠৔߹ͷ࣮૷ Λ৻ॏʹ֬ೝ 08"41. ශऑͳαʔόଆͷ ੍ޚ 08"41. ҆શͰͳ͍ σʔλͷอ؅ 08"41. ෆे෼ͳ τϥϯεϙʔτ૚อޢ 08"41. ҙਤ͠ͳ͍ σʔλ࿙͍͑ 08"41. ශऑͳೝূͱೝՄ 08"41. յΕͨ҉߸Խॲཧ 08"41. ΫϥΠΞϯταΠυ ΠϯδΣΫγϣϯ 08"41. ৴པͰ͖ͳ͍ೖྗʹ ΑΔηΩϡϦςΟ൑அ 08"41. ෆద੾ͳ ηογϣϯॲཧ 08"41. όΠφϦอޢͷܽ೗ Created by Colin Watson Version MobApp-1.02-JA (Farringdon) 08"41
    τοϓ
    ϞόΠϧίϯτϩʔϧ
     08"41
    το ϓ
    
    ϞόΠϧίϯτϩʔϧ͸ɺ ੬ऑੑ΁ͷ߈ܸʹΑΔඃ֐ɺ ͋Δ͍͸ͦͷՄೳੑΛݮগͤ͞ΔͨΊͷ։ൃ੍ޚͷҰཡͰ͢ɻ $
    ϞόΠϧσόΠεͷػີσʔλͷಛఆͱอޢ $
    σόΠεͷύεϫʔυͷ҆શͳऔΓѻ͍ $
    ػີσʔλͷ఻ૹͷอޢΛ֬อ $
    Ϣʔβʔೝূɺ ೝՄ͓Αͼηογϣϯ؅ཧͷਖ਼͍࣮͠૷ $
    όοΫΤϯυͷ"1* ʢαʔϏεʣ ͱϓϥοτ ϑΥʔϜ ʢαʔόʣ ͷ҆શੑͷ
    ҡ࣋ $
    
    αʔυύʔςΟͷαʔϏε΍ΞϓϦέʔγϣϯͱͷσʔλ౷߹Λ҆શʹ $
    
    Ϣʔβʔσʔλͷར༻ͱऩूͷͨΊͷঝ୚ͷऩूͱอ؅ʹಛผͳ஫ҙ
    Λ෷͏ $
    
    ༗ྉͷϦιʔε ʢࡒ෍ɺ 4.4ɺ ి࿩౳ʣ ΁ͷෆਖ਼ΞΫηεΛ๷͙ͨΊͷ
    ੍ޚͷ࣮૷ $
    
    ϞόΠϧΞϓϦͷ഑෍ఏڙͷ҆શੑͷ֬อ $
    ίʔυ࣮ߦ࣌ʹΤϥʔ͕ൃੜͨ͠৔߹ͷ࣮૷Λ৻ॏʹ֬ೝ 08"41
    τοϓ
    ϞόΠϧϦεΫ
     5IF
    08"41
    το ϓ
    ϞόΠϧϦεΫ͸ɺ ΞϓϦέʔγϣϯ૚Ͱͷ࠷ॏཁͳϞόΠϧ ΞϓϦͷϦεΫʹ͍ͭͯͷڞ௨ೝࣝΛࣔ͢΋ͷͰ͢ɻ .
    ශऑͳαʔόʔଆͷ੍ޚ .
    
    ҆શͰͳ͍σʔλͷอ؅ .
    ෆे෼ͳτϥϯεϙʔτ૚อޢ .
    ҙਤ͠ͳ͍σʔλ࿙͍͑ .
    ශऑͳೝূͱೝՄ .
    յΕͨ҉߸Խॲཧ .
    ΫϥΠΞϯταΠυͷΠϯδΣΫγϣϯ .
    ৴པͰ͖ͳ͍ೖྗʹΑΔηΩϡϦςΟ൑அ .
    ෆద੾ͳηογϣϯॲཧ .
    όΠφϦอޢͷܽ೗ ίϯτϩʔϧͱϦεΫͷ྆ํͱ΋ɺ ͪ͜Βͷ
    08"41ϓϩδΣΫτͷαΠτʹৄड़͞Ε͍ͯ·͢ɻ IUUQTXXXPXBTQPSHJOEFYQIQ08"41@.PCJMF@4FDVSJUZ@1SPKFDU ϓϩδΣΫ τϦʔμʔ Colin Watson ຋༁ऀ
    
    ͦͷଞͷߩݙऀ Manuel Lopez Arredondo, Fabio Cerullo, Tobias Gondrom, Martin Haslinger, Yongliang He, Cédric Messeguer, Takanori Nakanowatari, Riotaro Okada, Ferdinand Vroom, Ivy Zhang ऄͱ͸͠͝͸ɺ ΞϓϦέʔγϣϯ ɾ ηΩϡϦςΟೝ஌޲্ͷͨΊͷڭҭతͳήʔϜͰ͢ɻ ͜ͷ൛͸ϞόΠϧΞϓϦέʔγϣϯʹॏ఺Λஔ͍ ͓ͯΓɺ ʮ08"41
    το ϓ
    ϞόΠϧίϯτϩʔϧʯ Λ ʮ͸͠͝ʯ ɺ ·ͨ༗໊ͳ ʮ08"41
    το ϓ
    ϞόΠϧϦεΫʯ Λ ʮऄʯ ͱ͠·ͨ͠ɻ ͜ΕΒͷϓϩδΣΫτͷϦʔμʔͳΒͼʹߩݙ͞Εͨํʑʹײँ͍ͨ͠·͢ɻ αΠίϩ΍ίϚ͕ͳ͍ʁԼͷਤܗΛ੾Γऔͬͯ࢖͍ͬͯͩ͘͞ɻ ৭ͷؙ͍͍ͭͨ΋ͷΛίϚͱͯ͠࢖͑ΔͰ͠ΐ͏ɻ ͋Δ͍͸ɺ ̒໘ͷαΠίϩγϛϡϨʔλΛϓϩάϥϜ͢Δͱ͔ɺ εϚϗ͔ύιίϯͰ͔Β·Ͱͷ੔਺ͷཚ਺ΞϓϦΛ࢖͑͹͍͍ɻ ͨͩ͠ɺ ग़Δ໨͕ϥϯμϜ͔Ͳ͏͔͸ͪΌΜͱνΣοΫ͢Δ͜ͱ ʂ ͜ͷγʔτͷιʔεϑΝΠϧɺ ଞͷΞϓϦέʔγϣϯηΩϡϦςΟ τϐοΫͷγʔτɺ ଞͷ༷ʑͳݴޠ൛ɺ ·ͨ ʮ08"41
    ऄͱ͸͠͝ϓϩδΣΫτʯ ʹؔ͢Δ৘ใ͸ɺ ҎԼͷ08"41ͷ΢ΣϒαΠτʹ͋Γ·͢ɻ
    https://www.owasp.org/index.php/OWASP_Snakes_and_Ladders എܠ ʮऄͱ͸͠͝ʯ ͸ΞδΞൃ঵ͷϘʔυήʔϜͰɺ ϏΫτϦΞே ࣌୅ʹӳࠃʹ༌ೖ͞ΕͨਓؾͷϘʔυήʔϜͰ͢ɻ ΋ͱ΋ͱɺ ͜ͷήʔϜ͸ળͱѱɺ ඒಙͱѱಙͷͦΕͧΕͷޮՌΛࣔͨ͠ ΋ͷͰͨ͠ɻ ͜ͷήʔϜ͸ɺ ΞϝϦΧͷҰ෦ͷ৔ॴͰ͸ɺ ʮӍͲ ͍ͱ͸͠͝ʯ ͱͯ͠஌ΒΕ͍ͯ·͢ɻ ͜ͷ08"41൛Ͱ͸ɺ ηΩϡΞͳίʔσΟϯά
    ʢϓϩΞΫςΟϒ ίϯτϩʔϧʣ
    Λߴܿͳߦಈͱ͠ɺ ΞϓϦέʔγϣϯϦεΫΛ ѱಙͱ͍ͯ͠·͢ɻ ܯࠂ 08"41
    ऄͱ͸͠͝͸ɺ ن໛ͷେখΛ໰Θͣɺ ιϑτ΢ΣΞϓϩ άϥϚʔʹ࢖͍ͬͯͨͩ͘ ͜ͱΛҙਤ͍ͯ͠·͢ɻ ͜ͷࢴͷήʔ Ϝγʔτͦͷ΋ͷ͸༗֐Ͱ͸͋Γ·ͤΜ͕ɺ ར༻ऀ͕ɺ ࣗ෼Ͱ ॴ༗͍ͯ͠ΔϓϥενοΫ͋Δ͍͸໦੡ͷαΠίϩ΍Χ΢ϯλʔ ίϚ Λ࢖͏͜ͱʹ͢Δ৔߹ɺ ࡀҎԼͷࢠڙͨͪʹ͸޴ʹ٧ ·Βͤͯ஠ଉ͢ΔϦεΫ͕͋Δ͔΋͠Ε·ͤΜɻ ϧʔϧ ͜ͷήʔϜ͸ਓ͔ΒਓͰ༡ͼ·͢ɻ ͦΕͧΕͷϓϨΠϠʔ ʹ৭ͷ͍ͭͨίϚΛ഑͍ͬͯͩ͘͞ɻ
    ࠷ॳʹɺ ͦΕͧΕͷϓϨ ΠϠʔ͸αΠίϩΛৼͬͯ୭͕࠷ॳʹϓϨΠ͢Δ͔ܾΊ·͢ɻ Ұ൪େ͖ͳ਺ͷ໨Λग़ͨ͠ਓ͕࠷ॳͰ͢ɻ શϓϨΠϠʔͷίϚΛ ʮελʔτ
    ʯ ͱ͋Δ࠷ॳͷϚε໨ʹஔ͖ ·͢ɻ
    ॱʹɺ ֤ϓϨΠϠʔ͸αΠίϩΛৼΓɺ ͦͷ਺ʹ͕ͨͬͯ͠ ίϚΛҠಈ͠·͢ɻ Ҡಈͨ࣌͠ʹɺ ΋͠ίϚ͕͸͠͝ͷԼʹདྷͨͳΒɺ ίϚΛ͸͠͝ ͷ࠷্ஈͷͱ͜Ζʹ͋ΔϚε໨ʹ্͛ͳ͚Ε͹ͳΓ·ͤΜɻ ίϚ͕ऄͷޱͷͱ͜ΖʹདྷͨͳΒɺ ͦͷίϚΛऄͷ৲ඌͷͱ͜Ζ ʹ߱Ζ͞ͳ͚Ε͹ͳΓ·ͤΜɻ ࠨ্ͷͷͱ͜Ζʹ࠷ॳʹདྷͨϓϨΠϠʔ͕উऀͱͳΓ·͢ɻ ͜ͷγʔτ͔Β੾Γऔͬͨ΋ͷͰαΠίϩΛ࡞Δʹ͸ɺ ఺ઢʹԊͬͯંΓۂ͛ɺ ͷΓ͠Ζͷͱ͜Ζʹ઀ணࡎΛ͚ͭɺ ࢛֯͘ͳΔΑ͏ʹ৻ॏʹ੔ܗ͍ͯͩ͘͠͞ɻ Ұඖͷऄ͕࣍ͷॱ൪ͷΩϛͷαΠίϩ ͷ໨Λݴ͓͏͔ͬͯɺ ΢ΟϯΫͯ͠ΔΑɻ ݟ͔ͭͬͨʁ 08"41
    ऄͱ͸͠͝͸ɺ ແྉͰࣗ༝ʹ͓࢖͍͍͚ͨͩ·͢ɻ ΫϦΤΠςΟϒίϞϯζදࣔܧঝϥΠηϯεʹج͖ͮɺ ͜ͷ੒Ռ෺Λෳࣸɺ ഑෍ɺ ૹ৴ɺ վมɺ ঎ۀతར༻͕Մೳ Ͱ͕͢ɺ ͜ͷ࡞඼ʹجͮ͘ ͍͔ͳΔ΋ͷʹ͍ͭͯɺ ·ͨ࠶ར༻ɺ సૹɺ ೋ࣍తஶ࡞෺ʹ͍ͭͯ͸ɺ ͜ͷϥΠηϯεͱಉ͡࢖༻ ڐ୚৚݅Ͱͳ͚Ε͹ͳΓ·ͤΜɻ © OWASP Foundation 2014. OWASP Snakes and Ladders – ऄͱ͸͠͝
    ϞόΠϧΞϓϦ൛ –
14. ࣮͸4OBLFT
    BOE
    -BEEFSTʹ͸
    5XJUUFS
    CPU͕ଘࡏͨ͠Γ͠·͢ɻ
15. 08"41
    5PQ
    ͷϦεΫΛআڈ·ͨ͸ܰݮ͢Δ ͨΊͷࣄલରࡦख๏͕వΊΒΕ͍ͯ·͢ɻ  ΫΤϦͷύϥϝʔλԽʢ1BSBNFUFSJ[F
    2VFSJFTʣ  ΤϯίʔυॲཧʢEncode Dataʣ  ೖྗ஋ݕূʢValidate All Inputsʣ  ద੾ͳΞΫηε੍ޚʢImplement Appropriate Access Controlsʣ  ΞΠσϯςΟςΟٴͼೝূ੍ޚʢEstablish Identity and Authentication Controlsʣ  σʔλٴͼϓϥΠόγʔอޢʢProtect Data and Privacyʣ  ϩΪϯάɺΤϥʔϋϯυϦϯάɺ৵ೖݕ஌ʢImplement Logging, Error Handling and Intrusion Detectionʣ  ϑϨʔϜϫʔΫͱηΩϡϦςΟϥΠϒϥϦͷ׆༻ʢLeverage Security Features of Frameworks and Security Librariesʣ  ηΩϡϦςΟཁ݅ͷߟྀʢInclude Security-Specific Requirementsʣ  ηΩϡϦςΟઃܭʢDesign and Architect Security Inʣ 08"41
    1SP"DUJWF
    $POUSPMT
    
16. 5PQ
    ͱ1SPBDUJWF
    $POUSPMTʹ͸ؔ࿈ੑ͕͋Γ·͢ɻ
    
17. ࣌఺ͰͷνʔτγʔτʹՃ͑ɺ
    ͷϨϏϡʔஈ֊ͷνʔτγʔτ͕͋Γ·͢ɻ  %FWFMPQFS
    $IFBU
    4IFFUT "VUIFOUJDBUJPO
    $IFBU
    4IFFU  )5.-
    4FDVSJUZ
    $IFBU
    4IFFU  42-
    *OKFDUJPO
    1SFWFOUJPO
    $IFBU
    4IFFU  944
    $SPTT
    4JUF
    4DSJQUJOH
    1SFWFOUJPO
    $IFBU
    4IFFU  ɾɾɾ  "TTFTTNFOU
    $IFBU
    4IFFUT "UUBDL
    4VSGBDF
    "OBMZTJT
    $IFBU
    4IFFU  ɾɾɾ  .PCJMF
    $IFBU
    4IFFUT *04
    %FWFMPQFS
    $IFBU
    4IFFU  .PCJMF
    +BJMCSFBLJOH
    $IFBU
    4IFFU  0Q4FD
    $IFBU
    4IFFUT 7JSUVBM
    1BUDIJOH
    $IFBU
    4IFFU 08"41
    $IFBU
    4IFFU
    4FSJFT
    
18. 4VNNBSZ
19.  1SPNPUJPO
    5FBN͸ৗ࣌͝ڠྗ͍͚ͨͩΔํΛืू͍ͯ͠·͢ɻ
     08"41͕ڠྗՄೳͳΠϕϯτ͕͋Ε͹͝঺հ͍ͩ͘͞ɻ
     08"41
    OJHIUͰ࿩͍ͨ͜͠ͱ͕͋Ε͹ؾܰʹ͝࿈བྷ͍ͩ͘͞ɻ
     08"41ͷπʔϧʗυΩϡϝϯτΛੵۃతʹ͝׆༻͍ͩ͘͞ɻ
20. "QQFOEJY
21. 08"41
    1SPKFDU 63- 8FC
    γεςϜʗ8FC
    ΞϓϦέʔγϣϯηΩϡϦςΟཁ݅ॻ
    IUUQTXXXPXBTQPSHJNBHFT 8FC@BQQMJDBUJPO@TFDVSJUZ@SFRVJSFNFOUTQEG 08"41
    1SPBDUJWF
    $POUSPMT IUUQTXXXPXBTQPSHJOEFYQIQ08"41@1SPBDUJWF@$POUSPMT 08"41
    "474ʢ"QQMJDBUJPO
    4FDVSJUZ
    7FSJpDBUJPO
    4UBOEBSE
    ʣ1SPKFDU IUUQTXXXPXBTQPSHJOEFYQIQ $BUFHPSZ08"41@"QQMJDBUJPO@4FDVSJUZ@7FSJpDBUJPO@4UBOEBSE@ 1SPKFDU 08"41
    $IFBU
    4IFFU
    4FSJFT IUUQTXXXPXBTQPSHJOEFYQIQ08"41@$IFBU@4IFFU@4FSJFT 08"41
    ;FE
    "UUBDL
    1SPYZ IUUQTXXXPXBTQPSHJOEFYQIQ 08"41@;FE@"UUBDL@1SPYZ@1SPKFDU IUUQTEPDTHPPHMFDPNpMFE #F$NB(6MMB[/6/7Q08E(:[HFEJU 08"41
    5FTUJOH
    (VJEF IUUQTXXXPXBTQPSHJOEFYQIQ08"41@5FTUJOH@1SPKFDU 08"41
    085'ʢ0⒎FOTJWF
    8FC
    5FTUJOH
    'SBNFXPSLʣ IUUQTXXXPXBTQPSHJOEFYQIQ08"41@085' 08"41
    .PE4FDVSJUZ
    $PSF
    3VMF
    4FU
    1SPKFDU IUUQTXXXPXBTQPSHJOEFYQIQ $BUFHPSZ08"41@.PE4FDVSJUZ@$PSF@3VMF@4FU@1SPKFDU 08"41
    "QQ4FOTPS IUUQTXXXPXBTQPSHJOEFYQIQ08"41@"QQ4FOTPS@1SPKFDU 08"41
    %FQFOEFODZ
    $IFDL IUUQTXXXPXBTQPSHJOEFYQIQ08"41@%FQFOEFODZ@$IFDL
22. 08"41
    1SPKFDU 63- 08"41
    5PQ IUUQTXXXPXBTQPSHJOEFYQIQ $BUFHPSZ08"41@5PQ@5FO@1SPKFDU IUUQTXXXPXBTQPSHJNBHFT 08"41@5PQ@@@+1/QEG 08"41
    .PCJMF
    5PQ IUUQTXXXPXBTQPSHJOEFYQIQ 08"41@.PCJMF@4FDVSJUZ@1SPKFDU IUUQTEPDTHPPHMFDPNEPDVNFOUE 2080ST"PC)-E";LT,B'@@"@9OEP%'SJOB@LFEJU 08"41
    *P5
    5PQ
     IUUQTXXXPXBTQPSHJOEFYQIQ 08"41@*OUFSOFU@PG@5IJOHT@5PQ@5FO@1SPKFDU 08"41
    4OBLFT
    BOE
    -BEEFST IUUQTXXXPXBTQPSHJOEFYQIQ 08"41@4OBLFT@BOE@-BEEFST IUUQTXXXPXBTQPSHJOEFYQIQ 08"41@4OBLFT@BOE@-BEEFST IUUQTXXXPXBTQPSHJNBHFTDD08"41 4OBLFT"OE-BEEFST.PCJMF"QQT+"QEG IUUQTUXJUUFSDPN08"414OBLFT8FC IUUQTUXJUUFSDPN08"414OBLFT.PC 0QFO4"..ʢ4PGUXBSF
    "TTVSBODF
    .BUVSJUZ
    .PEFMʣ IUUQTXXXPXBTQPSHJOEFYQIQ $BUFHPSZ4PGUXBSF@"TTVSBODF@.BUVSJUZ@.PEFM IUUQXXXPQFOTBNNPSHEPXOMPBET4"..KB@+1QEG
23. #SFBLFS
    ਍Δਓ
    ͝੩ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ
    #VJMEFS
    ૑Δਓ
    %FGFOEFS
    ӴΔਓ
    https://www.owasp.org/index.php/japan https://www.owasp.org/index.php/Kansai https://www.owasp.org/index.php/Kyushu 6TFS
    ࢖͏ਓ
    ΢ΣϒʹܞΘΔ͢΂ͯͷਓʹ