踏み台環境におけるAmazon Maice活用の提案 #secjaws #secjaws08

by fnifni

Slide 1

Slide 1 text

Everyone!  Are you doing? Proposal of using Amazon Macie in Bastion At S-JAWS # 8 2018.02.23

Slide 2

Slide 2 text

ΈΜͳʂ!  ΍ͬͯΔ͔͍? ౿Έ୆ ؀ڥʹ͓͚ΔAmazon Macie׆༻ͷఏҊ S-JAWS # 8 ʹͯ 2018.02.23

Slide 3

Slide 3 text

Who Am I !?ʢ͓લ୭Αʁʣ • Hirokazu YoshidaˏCloud Native Inc.  Security Engineer • Community  - Security-JAWS  - Deep Security User Group • Favorite AWS Service https://qiita.com/fnifni

Slide 4

Slide 4 text

ͱ͍͏Θ͚Ͱ ຊ୊

Slide 5

Slide 5 text

౿Έ୆ͱฉ͍ͯ ԿΛ࿈૝͠·͔͢ʁ

Slide 6

Slide 6 text

౿Έ୆αʔό࡞ͬͯ ͱݴΘΕͯ  ςϯγϣϯ্͕Γ·͔͢ʁ

Slide 7

Slide 7 text

Ͱ͸

Slide 8

Slide 8 text

ཁ࠹αʔό࡞ͬͯ ͱݴΘΕͨΒʁ

Slide 9

Slide 9 text

Motivation of Bastion server • ୭͕ϩάΠϯͰ͖Δ͔ʢೝূ/ೝՄʣ • ؀ڥ΁ͷ།Ұͷ௨Γಓʢ৴པ͢Δܦ࿏ʣ • Ϣʔβʔͷߦಈه࿥΍σʔλ͕௨ա  ʢ؂ࠪϙΠϯτʣ

Slide 10

Slide 10 text

΋ͬͱݴ͏ͱ

Slide 11

Slide 11 text

Really scary Bastion server • ੑѱઆʹཱͭͱɺ  ΠϯλϥΫςΟϒͳϩάΠϯૢ࡞͸ΞϯηΩϡΞ • ۀ຿ޮ཰ʢϏδωεͷ଎౓ʣʹ௚݁͢ΔͨΊɺ ηΩϡϦςΟͱརศੑ͕ৗʹఱṝʹྔΒΕΔ • ϏδωεͱηΩϡϦςΟͷલઢج஍

Slide 12

Slide 12 text

ଧ伴ϩάͷऔಘ/෼ੳ͸ ෆՄආ

Slide 13

Slide 13 text

ίϯϓϥΠΞϯεͰ  ఆΊΒΕͯΔ͠ɺऔͬͯΔΑ Կ͔͋Ε͹௥͑Δ͠ɻ

Slide 14

Slide 14 text

ͦΜͳϞνϕʔγϣϯͰ ྑ͔ͬͨΜ͚ͩͬʁ

Slide 15

Slide 15 text

https://www.cisecurity.org/controls/

Slide 16

Slide 16 text

20 CIS Controls is Կ • NIST SP800-53 (࿈๜੓෎৘ใγεςϜ ͓Αͼ ࿈๜૊৫ͷͨΊͷ ηΩϡϦςΟ؅ཧࡦͱϓϥ Πόγʔ؅ཧࡦ) Λ࣮૷͢Δ্ͰॏཁͱͳΔ20 ͷηΩϡϦςΟίϯτϩʔϧΛ·ͱΊͨจॻ

Slide 17

Slide 17 text

6. Maintenance, Monitoring, and Analysis of Audit Logs • ݕग़ɺཧղɺ·ͨ͸߈ܸ͔Βͷճ෮ʹ໾ཱͭ Մೳੑͷ͋ΔΠϕϯτͷ؂ࠪϩάΛऩूɺ؅ ཧɺ͓Αͼ෼ੳ • ଟ͘ͷ૊৫Ͱ͸ɺίϯϓϥΠΞϯεͷ໨తͰ ؂ࠪه࿥Λอ͍࣋ͯ͠·͕͢ɺ؂ࠪϩάΛ΄ ͱΜͲࢀর͠ͳ͍ͨΊɺγεςϜ͕৵֐͞Ε ͍ͯΔ͔Ͳ͏͔͸Θ͔Γ·ͤΜɻ

Slide 18

Slide 18 text

13. Data Protection • ओʹ҉߸ԽͱDLPʹ͍ͭͯͷهࡌ • DLPίϯτϩʔϧ͸ϙϦγʔʹج͍͓ͮͯ Γɺػີσʔλͷ෼ྨɺاۀશମͷσʔλͷ ݕग़ɺ੍ޚͷ࣮ࢪɺϙϦγʔͷ४ڌΛอূ͢ ΔͨΊͷϨϙʔτ࡞੒ͱ؂ࠪͳͲؚ͕·Ε· ͢ɻ

Slide 19

Slide 19 text

ͭ·Γ • ଧ伴ϩάΛऩूͯ͠΋ɺ؂ࠪ͠ͳ͍ͳΒҙຯ͕ ͳ͍ • ϙϦγʔʹج͍ͮͨػີσʔλͷ෼ྨͳͯ͘͠ɺ ػີσʔλ΁ΞΫηε͢Δӡ༻ʹؾ෇͘͜ͱ͢ ΒͰ͖ͳ͍

Slide 20

Slide 20 text

෼ੳ is grep …?

Slide 21

Slide 21 text

What is Amazon Macie? • ػցֶशʹͯS3಺ͷػີσʔλΛࣗಈతʹݕ ग़ɺ෼ྨɺอޢ͢ΔηΩϡϦςΟαʔϏε • ݸਓ৘ใ (PII) ΍஌తࡒ࢈ͳͲͷػີσʔλ͕ೝ ࣝ͞ΕΔɻ • όʔδχΞͱΦϨΰϯͰར༻Մೳ https://docs.aws.amazon.com/ja_jp/macie/latest/userguide/what-is-macie.html

Slide 22

Slide 22 text

ඦฉ͸Ұݟʹ͔ͣ͠

Slide 23

Slide 23 text

ATTENTION ! • ઃఆखॱ͸؆୯͗͢ΔͷͰ঺հ͠·ͤΜɻ  AWSϒϩάͰྲྀΕΛ֬ೝ͍ͯͩ͘͠͞ɻ  https://aws.amazon.com/jp/blogs/news/launch-amazon-macie-securing-your-s3-buckets/ • CloudTrail΋ྑ͍ײ͡ʹධՁͯ͘͠Ε·͕͢ɺ  ࠓճ͸঺հ͠·ͤΜɻ  ઃఆ͢Δͱ͙͢ʹݟΕΔͷͰɺମײ͍ͯͩ͘͠͞

Slide 24

Slide 24 text

No content

Slide 25

Slide 25 text

case1: logs/linux_syslog

Slide 26

Slide 26 text

No content

Slide 27

Slide 27 text

case2: PII Priority / moderate

Slide 28

Slide 28 text

No content

Slide 29

Slide 29 text

No content

Slide 30

Slide 30 text

ΞϥʔτʂϨϙʔτʂͷલʹ ؀ڥͷบ΍ੑ࣭Λ஌Ζ͏ʂ

Slide 31

Slide 31 text

མͱ݀͠ͷڞ༗

Slide 32

Slide 32 text

Pitfall • MacieͷධՁλΠϛϯά͸ɺόέοτઃఆ࣌ͱ s3ΦϒδΣΫτ͕Put͞Εͨ࣌ • Macie͕࢖͏αʔϏεϩʔϧ͸ɺ CloudFormationͰఏڙ͞Ε͍ͯΔ ελοΫΛޡͬͯফ͢ͱ ෮ؼ·ͰͷؒʹPut͞ΕͨObject͸ධՁ͞Εͳ͍

Slide 33

Slide 33 text

Α͋͘Δޡղ

Slide 34

Slide 34 text

MacieͬͯS3όέοτΛ ධՁ͢ΔΜͰ͠ΐʁ S3͸৘ใ࿙͍͕͑৺഑

Slide 35

Slide 35 text

Cause is a misconﬁguration of S3 • WWE Leaks 3 Million Emails  https://mackeepersecurity.com/post/world-wrestling-entertainment-leaks-3- million-emails • Dow Jones customer data exposed in cloud error  http://thehill.com/policy/cybersecurity/342333-dow-jones-customer-data-exposed- in-cloud-error • VerizonՃೖऀ1400ສਓͷݸਓ৘ใɺۀ຿ҕୗઌ͕ ʮແ๷උঢ়ଶʯͰΫϥ΢υʹอଘ  http://www.itmedia.co.jp/enterprise/articles/1707/13/news055.html

Slide 36

Slide 36 text

Α͋͘Δ৺഑

Slide 37

Slide 37 text

AWS MacieͰ ػີ৘ใಡΈऔΒͤͯ େৎ෉ͳͷʁ

Slide 38

Slide 38 text

Third Party Authentication ~See AWS Artifact~ • ISO 27001:2013 Certification • ISO 27017:2015 Certification • ISO 27018:2014 Certification • ISO 9001:2015 Certification • PCIDSSv3.2 • SoC1/2͸ݸผʹௐ΂ͯͶΜ(ཁผ్৘ใೖྗ)

Slide 39

Slide 39 text

·ͱΊ • ׬ᘳͳ΋ͷ͸ͳ͍ɻ  ͔֬Β͠͞ΛੵΈॏͶΔ͜ͱɻ • ਓྗͰͷఆٛʹ͸ϛε΍ݶք͕͋Δɻ  ੵۃతʹػցͷྗʹཔΓͭͭڍಈΛ؍࡯ͯ͠ɺ  ΧόʔͰ͖ͳ͍ͱ͜Ζ͸ผͷ΋ͷͰϑΥϩʔ • νϟϨϯδ͢Δ͜ͱɻ  ΍ͬͯΈͯॳΊͯؾ෇͘͜ͱ͕͋Δ(ص্ݕ౼͸୹͘)

Slide 1

Slide 1 text

Slide 2

Slide 2 text

Slide 3

Slide 3 text

Slide 4

Slide 4 text

Slide 5

Slide 5 text

Slide 6

Slide 6 text

Slide 7

Slide 7 text

Slide 8

Slide 8 text

Slide 9

Slide 9 text

Slide 10

Slide 10 text

Slide 11

Slide 11 text

Slide 12

Slide 12 text

Slide 13

Slide 13 text

Slide 14

Slide 14 text

Slide 15

Slide 15 text

Slide 16

Slide 16 text

Slide 17

Slide 17 text

Slide 18

Slide 18 text

Slide 19

Slide 19 text

Slide 20

Slide 20 text

Slide 21

Slide 21 text

Slide 22

Slide 22 text

Slide 23

Slide 23 text

Slide 24

Slide 24 text

Slide 25

Slide 25 text

Slide 26

Slide 26 text

Slide 27

Slide 27 text

Slide 28

Slide 28 text

Slide 29

Slide 29 text

Slide 30

Slide 30 text

Slide 31

Slide 31 text

Slide 32

Slide 32 text

Slide 33

Slide 33 text

Slide 34

Slide 34 text

Slide 35

Slide 35 text

Slide 36

Slide 36 text

Slide 37

Slide 37 text

Slide 38

Slide 38 text

Slide 39

Slide 39 text

Slide 40

Slide 40 text