γεͷཱͰߟ͑Δ w ͜ͷ8FCαʔϏεΛͬͯʢ৴པͯ͠ʣେৎʁ w ͓ܾ·ΓͷใηΩϡϦςΟͷݪଇɿ$*" w $POpEFOUJBMJUZɿػີੑ w *OUFHSJUZɿશੑ w "WBJMBCJMMJUZɿՄ༻ੑ ใ࿙Ӯා͍͠ɺใΛվ͟Μ͞ΕͨΒࠔΔ͠ɺ͕ͬͭΓͬͯͯ αʔϏεऴྃ͞ΕΔͷݏͩ͠ɺ͋ΕؾʹͳΔɺ͜ΕؾʹͳΔɺɺɺ ԿΛͲ͏ͬͯ֬ೝ͢ΕΑ͍ͷʁ
/FUTLPQF͞Μʹڭ͑ͯΒ͓͏ w $"4# $MPVE"DDFTT4FDVSJUZ#SPLFSʣαʔϏε w 8FCαʔϏεͷར༻࣮ଶͷՄࢹԽ σʔλɾϓϩςΫγϣϯɺΨόφϯεΛ࣮ݱ w $$*ʢ$MPVE$POpEFOU*OEFYʣػೳ w /FUTLPQFͷಠࣗධՁͰΫϥυαʔϏεͷ ৴པੑΛԽ w 4BB4࠾༻࣌ͷࢀߟใ w /FUTLPQFͷධՁ߲ˠར༻࣌ʹؾʹ͖͢ࢦඪ
/FUTLPQFͷධՁ߲ w ̓ͭͷΧςΰϦ w ୈࡾऀೝূ w σʔλอޢ w ΞΫηείϯτϩʔϧ w ࠪੑ w ࡂରϏδωεܧଓੑ w σʔλॴ༗ݖݸਓใอޢ w ੬ऑੑѱ༻ • อσʔλͷ҉߸Խ • RSA • DES • BitLocker • Blowfish • AES • ௨৴ͷ҉߸Խ • ҉߸ԽʹශऑͳΞϧΰϦζϜͬͯͳ͍ʁ • SHA1 with RSA/1024 Bits • SHA1 with RSA/2048 Bits • SHA1 with RSA/4096 Bits • HTTPηΩϡϦςΟϔομʔͬͯΔʁ • Content Security Policy • XSS-Protection • HTTP Strict Transport Security • X-Content-Type-Options • X-Frame-Options
/FUTLPQFͷධՁ߲ w ̓ͭͷΧςΰϦ w ୈࡾऀೝূ w σʔλอޢ w ΞΫηείϯτϩʔϧ w ࠪੑ w ࡂରϏδωεܧଓੑ w σʔλॴ༗ݖݸਓใอޢ w ੬ऑੑѱ༻ •Does the app provide admin audit logs? •Does the app provide user audit logs? •Does the app provide data access audit logs?
/FUTLPQFͷධՁ߲ w ̓ͭͷΧςΰϦ w ୈࡾऀೝূ w σʔλอޢ w ΞΫηείϯτϩʔϧ w ࠪੑ w ࡂରϏδωεܧଓੑ w σʔλॴ༗ݖݸਓใอޢ w ੬ऑੑѱ༻ • ΠϯϑϥͷεςʔλεϨϙʔτΛఏ ڙ͍ͯ͠Δʁ • ΞϓϦͷόʔδϣϯΞοϓܭըΛ௨ ͯ͠Δʁ • ԕִʹσʔλΛόοΫΞοϓͯ͠ Δʁ • σʔληϯλཧతʹࢄͤͯ͞ ͍Δʁ • Ͳ͜ͷج൫ΛͬͯΔʁʢlaaSʣ
/FUTLPQFͷධՁ߲ w ̓ͭͷΧςΰϦ w ୈࡾऀೝূ w σʔλอޢ w ΞΫηείϯτϩʔϧ w ࠪੑ w ࡂରϏδωεܧଓੑ w σʔλॴ༗ݖݸਓใอޢ w ੬ऑੑѱ༻ • γεςϜʹొͨ͠σʔλ୭ͷ ͷʁ • Customer owns the data • Vendor owns the data • ܖऴྃ࣌ʹσʔλΛฦͯ͠Β͑ Δʁ • Available immediately • Not Supported by Vendor • ܖऴྃ࣌ʹͪΌΜͱσʔλΛফڈ ͯ͘͠ΕΔʁͲΕ͙Β͍ͷεϐʔυ ײʁʁ • Within a week • Within a month • Later than a month • Not Supported by Vendor • Ͳ͜ͷࠃ͔ΒαʔϏεఏڙ͍ͯ͠Δʁʁ
/FUTLPQFͷධՁ߲ w ̓ͭͷΧςΰϦ w ୈࡾऀೝূ w σʔλอޢ w ΞΫηείϯτϩʔϧ w ࠪੑ w ࡂରϏδωεܧଓੑ w σʔλॴ༗ݖݸਓใอޢ w ੬ऑੑѱ༻ •طͷ੬ऑੑͳ͍ʁ • Heartbleed • OpenSSL CCS Injection • POODLE SSL v3 fallback • FREAK • Logjam • DROWN • Cloudbleed •࠷ۙɺ߈ܸ͞Εͨ͜ͱ͋Δʁ
/FUTLPQF͞ΜʹධՁ͞ΕΔʹʜ w ࣗࣾଞࣾαʔϏεͷௐࠪ݁Ռ ˠࣄ࣮ͱҟͳΔใ͕݁ߏଟ͍ w ௨৴҉߸Խͷঢ়گʢ)5514Խʣ w ༻͍ͯ͠ΔΠϯϑϥج൫ αʔϏεͦͷͷͰͳ͘ϗʔϜϖʔδͰɹɹɹɹɹɹ அ͍ͯ͠ΔͬΆ͍ʢϨδετϥͱ͔ʣ w $$*ʹొ͞Ε͍ͯΔΫϥυαʔϏε ɹɹˠ
ݸʢશ෦ௐΒΕΔΘ͚ͳ͍ɺɺʣ
/FUTLPQF͞ΜʹධՁ͞ΕΔʹʜ w ࣗࣾଞऀαʔϏεͷௐࠪ݁Ռ ˠࣄ࣮ͱҟͳΔใ͕݁ߏଟ͍ w ௨৴σʔλͷ҉߸Խʢ)5514Խʣͷঢ়گ w ༻͍ͯ͠ΔΠϯϑϥج൫ ˠαʔϏεͦͷͷͰͳ͘ɺϗʔϜϖʔδ Ͱஅ͍ͯ͠ΔͬΆ͍ w $$*ʹొ͞Ε͍ͯΔΫϥυαʔϏε ɹɹˠ
ݸʢશ෦ௐΒΕΔΘ͚ͳ͍ɺɺʣ ใެ։͕େࣄʂʂ w ϗϫΠτϖʔύʔʢγεςϜߏʣ w ηΩϡϦςΟϙϦγʔɺʑ ಁ໌ੑ͕৴པʹͭͳ͕Δʂʂ
pirox07_dora
nagix
bonotake
sadonosake
riru
weaverryan
matsuihidetoshi
tkmnzm
keiji
yanzm
motsuhiro131
tammyeverts
mixi_engineers
sferik
jonyablonski
aleyda
bermonpainter
bryan
hannesfritz
lara
ddemaree
roundedbygravity
csswizardry
kneath
colly