Real World Internet Security: Rakuten Fights Against Cybercrime

3/11にラック社において開催されたOWASP Dayにおける楽天福本さんからの発表資料です

Transcript

1. Real World Internet Security: Rakuten Fights Against Cybercrime Rakuten, Inc Tech & Div : Jack Fukumoto 2017/03/11
2. About Rakuten
3. Global Rakuten
4. Case Studies of Cyber Attacks in Rakuten
5. 1. Taiwan Ichiba Persistent Phishing Attack ‘rakuten’ ‘rakutens’ Real Fake
6. Browser based phishing protection Input phishing URLs into the APWG database. Some browser vendors blocked the phishing sites on the browser.
7. 2. Case study of Man in the Browser Malware Login form was overwritten by the malware in order to get cards credentials.
8. 3. DDoS Attacks
9. 4. Massive Login Attacks
10. ID Hacking Tools Criminals are buying attacking tools on the “Dark net”. The tools are customized to attack specifically Rakuten IDs. Distributed at the underground site.
11. Security Measures of Rakuten
12. Global Security Team 70 members from 13 countries
13. Security Countermeasures Response Incident Handing, Forensic, Malware Analysis Monitoring SOC Operations Vulnerability Advisory, Regular Scanning Secure Development Static Analysis, Coding Guide Security Guidelines Dynamic Scan, Security Audit Security Review, Consulting Design Requirements Verification Implementation Training Secure Coding, Security Operations Training Security Operations
14. Security Countermeasures Response Incident Handing, Forensic, Malware Analysis Monitoring SOC Operations Vulnerability Advisory, Regular Scanning Static Analysis, Coding Guide Security Guidelines Dynamic Scan, Security Audit Security Review, Consulting Design Requirements Verification Implementation Training Secure Coding, Security Operations Training Security Operations Secure Development
15. Training : Secure Coding Training No Training 2003 Criteria for risk evaluation 5 ：Critical 4 ：High 3 ：Middle 2 ：Low 1 ：No problem 2005 2008 20% reduction of additional audit cost Improved
16. Verification : Security Audit (In-house) Vulnerability Assessment/Penetration Testing targeting web, mobile, servers. Pre-release Audit • Before the release of application • Developers needs to fix it before release Annual Regular Audit • Like the recent health check Security Due Diligence • Security status evaluation prior to acquisition
17. Security Countermeasures Response Incident Handing, Forensic, Malware Analysis Monitoring SOC Operations Vulnerability Advisory, Regular Scanning Secure Development Static Analysis, Coding Guide Security Guidelines Dynamic Scan, Security Audit Security Review, Consulting Design Requirements Verification Implementation Training Secure Coding, Security Operations Training Security Operations
18. Response : Rakuten-CERT (Established in 2007)
19. OWASP: Contributing Corporate Members