SBOMでソフトウェアを守れ！10年後も自信を持ってリリースするために今始めるDevSecOps / DevSecOps with SBOM for yourself 10 years from now

by ihcomega56

Slide 1

Slide 1 text

4#0.Ͱιϑτ΢ΣΞΛकΕʂ ೥ޙ΋ࣗ৴Λ࣋ͬͯ ϦϦʔε͢ΔͨΊʹ ࠓ࢝ΊΔ%FW4FD0QT σϒαϛ

Slide 2

Slide 2 text

%FW4FD0QTͷηογϣϯɺ ଟ͍Ͱ͢Ͷʂ 1

Slide 3

Slide 3 text

ͦΜͳத͓ӽ͠Լ͞Γ ͋Γ͕ͱ͏͍͟͝·͢ 2

Slide 4

Slide 4 text

Α͜ͳͰ͢ 3 • +'SPHͷ%FWFMPQFS"EWPDBUF • %FW0QTΛ੝Γ্͍͛ͯ͘κ • લ৬·Ͱ͸ओʹόοΫΤϯυͷ։ൃ 4*FS ޿ࠂձࣾ ূ݊ελʔτΞοϓ • ઌिɺେਓʹͳͬͯॳͷˆΛܦݧ օ͞ΜҾ͖ଓ͖ࣗ͝Ѫ͍ͩ͘͞! !"#$$%&' (#)*+,%-.

Slide 5

Slide 5 text

ࠓճͷσϒαϛςʔϚ ʮ೥ޙ΋ੈքͰ௨͡ΔΤϯδχΞͰ͋ΔͨΊʹʯ 4

Slide 6

Slide 6 text

೥ ͋ͬͱ͍͏͚ؒͩͲɺͨ͘͞Μͷ͜ͱ͕Ͱ͖Δ 5 ʙ೥લɺ೥લ͸ग़͖ͯͨͷʹ೥લ͚ͩग़ͯ͜ͳ͔ͬͨ(PPHMFQIPUPTʜ

Slide 7

Slide 7 text

͜ͷηογϣϯ͸ ೥ޙʹඋ͑ͯ ͍͔ʹ΋ͷͮ͘ΓΛ͢Δ͔ Ͱ͸ͳ͘ 6

Slide 8

Slide 8 text

͍͔ʹ΋ͷΛ҆શʹอ͔ͭɺ ҆શͳ΋ͷΛಧ͚Δ͔ ͷώϯτΛ͓ಧ͚͠·͢ 7

Slide 9

Slide 9 text

%FW4FD0QTͱ͸ •%FWͱ0QTʹՃ͑ͯɺ4FDVSJUZ΋ ڠۀͯ͠ιϑτ΢ΣΞΛ࡞͍ͬͯ͘ • શһ͕શ෦Λग़དྷΔΑ͏ʹͳΔ ඞཁ͸ͳ͍ • ·ͣ͸ؙ౤͛͠ͳ͍ɺཧղ͢Δ • গ͓ͣͭ͠ޓ͍खΛ޿͛Δ 8 8 ։ൃ ӡ༻ ηΩϡ ϦςΟ

Slide 10

Slide 10 text

ηΩϡϦςΟͱ͍ͬͯ΋༷ʑ 9 • Πϯϑϥɺιϑτ΢ΣΞɺ ώϡʔϚϯΤϥʔͳͲؾʹ ͢΂͖͜ͱ͸ଟذʹΘͨΔ • %FW4FD0QTͷλʔήοτ͸ ιϑτ΢ΣΞͷηΩϡϦ ςΟͰ͋Δ ग़యʮ8IBUBSFUIFMBZFSTPGTFDVSJUZ "DZCFSTFDVSJUZSFQPSUʯ IUUQTHPNJOETJHIUDPNJOTJHIUTCMPHXIBUBSFUIFMBZFSTPGTFDVSJUZ

Slide 11

Slide 11 text

ιϑτ΢ΣΞͷηΩϡϦςΟʁ 10 10 %%PT߈ܸ 42-ΠϯδΣΫγϣϯ ϥϯαϜ΢ΣΞ ϑΟογϯά θϩσΠ߈ܸ ϒϧʔτϑΥʔεΞλοΫ

Slide 12

Slide 12 text

ιϑτ΢ΣΞͷηΩϡϦςΟʁ 11 11

Slide 13

Slide 13 text

ͦΜͳʹ୯७Ͱ͸ͳ͍ 12

Slide 14

Slide 14 text

αϓϥΠνΣʔϯ߈ܸ 13

Slide 15

Slide 15 text

αϓϥΠνΣʔϯ߈ܸ • ιϑτ΢ΣΞʹෆਖ਼ͳϓϩάϥϜ΍όοΫυΞΛ࢓ࠐΈɺ ͦͷιϑτ΢ΣΞΛऔಘͨ͠૬खʹରͯ͠߈ܸΛߦ͏ • ඪతΛ௚઀߈ܸͤͣɺ ଟ͘ͷ৔߹ɺΑΓηΩϡϦςΟ ରࡦ͕खബͳ ؔ࿈ձࣾ΍औҾઌΛૂͬͨ߈ܸΛߦ͏ 14

Slide 16

Slide 16 text

࠷ۙͷࣄྫ 15 15 ग़యɿ ;%/FU೥݄೔ܝࡌʮถ੓෎ͳͲ΁ͷେن໛αΠόʔ߈ܸɺ4PMBS8JOETͷιϑτ΢ΣΞߋ৽Λѱ༻ʯ IUUQTKBQBO[EOFUDPNBSUJDMF

Slide 17

Slide 17 text

࠷ۙͷࣄྫ 16 16 ग़యɿ +'SPH೥݄೔ܝࡌʮ-PH4IFMMθϩσΠ஌͓ͬͯ͘΂͖͜ͱ IUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPVOFFEUPLOPX

Slide 18

Slide 18 text

खͷಧ͘ൣғ͚ͩͷରࡦͰ͸଍Γͳ͍ • ࣗ෼Ͱॻ͍ͨίʔυ͕҆શͰ΋ɺऔಘͯ͠࢖ͬͨιϑτ ΢ΣΞʹ੬ऑੑ͕ݟ͔ͭΔՄೳੑ͕͋Δ • ࡢࠓɺϓϩϓϥΠΤλϦͳιϑτ΢ΣΞͷʙׂఔ౓͕ 044ͱݴΘΕ͍ͯΔ 17 ग़యɿ 4ZOPQTZTXIJUFQBQFSʮ0QFO4PVSDF 3JTLJO."CZUIF/VNCFSTʯ IUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJHBTTFUTXIJUFQBQFSTXQSJTLNBOVNCFSTQEG ʮηΩϡϦςΟɾεΩϟϯʯ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$" ͱ͸ʁ IUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM ʮ&YQMPSFZPVS044EFQFOEFODJFT7JTVBMMZʯ IUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS

Slide 19

Slide 19 text

Կ͔͋ͬͨͱ͖ɺ ࣗ෼ͷιϑτ΢ΣΞ͕ େৎ෉͔͙͢෼͔Γ·͔͢ʁ 18

Slide 20

Slide 20 text

Ͳͷιϑτ΢ΣΞ͕ ίϯϙʔωϯτͱͯ͠ ԿΛ࢖͍ͬͯΔ͔ ೺ѲͰ͖·͔͢ʁ 19

Slide 21

Slide 21 text

ґଘઌͷґଘઌ ਪҠతґଘؔ܎ ΋ ݟམͱ͍ͯ͠·ͤΜ͔ʁ 20

Slide 22

Slide 22 text

ղܾࡦͷͻͱͭ4#0. 21

Slide 23

Slide 23 text

4#0.ͱ͸ • 4PGUXBSF#JMM0G.BUFSJBMT ιϑτ΢ΣΞ෦඼ද • ιϑτ΢ΣΞΛߏ੒͢Δίϯϙʔωϯτͱϝλσʔλͷ Ұཡ 22

Slide 24

Slide 24 text

4#0.ͰҰཡԽ͢Δίϯϙʔωϯτ • ιϑτ΢ΣΞ͕ґଘɾ࢖༻͢Δ044΍αʔυύʔςΟͷ ϥΠϒϥϦ • ιϑτ΢ΣΞ͕࢖͏ΞυΦϯɺϓϥάΠϯɺ֦ுػೳ • ϓϩϓϥΠΤλϦͳίʔυ • 4BB4ͷ৔߹ "1*΍αʔυύʔςΟͷαʔϏεͷ৘ใ 23

Slide 25

Slide 25 text

4#0.ʹؚ·ΕΔ಺༰ • ίϯϙʔωϯτͷαϓϥΠϠʔ • ίϯϙʔωϯτ໊ • ίϯϙʔωϯτͷόʔδϣϯ • ίϯϙʔωϯτΛࣝผ͢ΔΩʔ • ґଘؔ܎ • 4#0.ͷ࡞੒ऀ • λΠϜελϯϓ 24

Slide 26

Slide 26 text

4#0.ͷྫ 25 ग़యɿ 4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSET IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@@WFSTJPO@QEG

Slide 27

Slide 27 text

ϑΥʔϚοτ • ඪ४Խ͕ਐΜͰ͍Δ • 4PGUXBSF1BDLBHF%BUB&YDIBOHF 41%9 • 4PGUXBSF*EFOUJGJDBUJPO 48*% • $ZDMPOF%9 ͳͲ • UBHWBMVFܗࣜ 41%9 ɺ+40/ɺ:".-ɺ9.-ͳͲʹରԠ • ਓؒʹ΋ػցʹ΋ಡΊΔ 26

Slide 28

Slide 28 text

ͳͥ4#0.͕໾ʹཱ͔ͭ • ࣍ͷΑ͏ͳ༻్Ͱ࢖͑Δ • ࢿ࢈؅ཧ • ϥΠηϯεɾίϯϓϥΠΞϯε؅ཧ • ஌తࡒ࢈؅ཧ • ੬ऑੑ؅ཧ • ΠϯγσϯτϨεϙϯε • ιϑτ΢ΣΞͷ҆શੑͷ֬ೝɾอূʹ໾ཱͭ 27

Slide 29

Slide 29 text

ॏཁࢹ͞ΕΔ4#0. • ΞϝϦΧɿ೥݄ͷେ౷ྖྩͰɺ੓෎ͱऔҾͷ͋Δ ૊৫͸4#0.͕ඞਢͱͯٛ͠຿෇͚ΒΕͨ • ೔ຊͰ΋ࣗಈंۀքͳͲͰ׆༻͕޿·Δ 28 ग़యɿ ೔ܦ95&$) ೥݄೔ܝࡌ τϤλ͕ਪ͢αΠόʔରࡦͷ৽ৗࣝʮ4#0.ʯɺྲྀग़͢ΔϦεΫ͸ʁ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM

Slide 30

Slide 30 text

ࣅͨΑ͏ͳ͜ͱΛ طʹ΍͍ͬͯΔํɺ ͍Βͬ͠ΌΔ͔΋͠Ε·ͤΜ 29

Slide 31

Slide 31 text

͋Δ͋Δͳ؅ཧ 30 &YDFMˢ ˣ໨Ͱ֬ೝ

Slide 32

Slide 32 text

Slide 33

Slide 33 text

4#0.؅ཧϕετϓϥΫςΟε • Ұ؏ͯ͠ಉ͡ϑΥʔϚοτͰ؅ཧ͠ଓ͚Δ • πʔϧΛ࢖ͬͯࣗಈԽ͢Δ • ϦϦʔεͷͨͼʹߋ৽͢Δ • ϝλσʔλΛ͋Θͤͯอ࣋͢Δ • ӡ༻͍ͯ͠Δͷ͕4BB4Ͱ͋ͬͯ΋4#0.Λ࢖͏ 32

Slide 34

Slide 34 text

4$"ʢιϑτ΢ΣΞίϯϙδγϣϯղੳʣ • 4#0.ͷ࡞੒ʹ͸ɺιϑτ΢ΣΞʹԿؚ͕·Ε͍ͯΔ͔ ͷௐ͕ࠪ౰વඞཁͱͳΔ • ιϑτ΢ΣΞΛεΩϟϯͯ͠ߏ੒ͱ੬ऑੑɺϥΠηϯε ҧ൓ͳͲΛௐ΂Δ͜ͱΛ4$"ͱ͍͏ • ੈͷதʹ͸༷ʑͳ4$"πʔϧ͕͋Γɺ͜ΕΛ࢖ͬͯ $*$%࣮ߦ࣌ʹ4$"΋ࣗಈͰߦ͏ 33

Slide 35

Slide 35 text

4#0.ͷجຊΛ஌ͬͯ ͍͖ͨͩ·ͨ͠ʂ 34

Slide 36

Slide 36 text

͜ΕͰηΩϡϦςΟ͸ όονϦʂ 35

Slide 37

Slide 37 text

ͱ͸ͳΓ·ͤΜɾɾɾ 36

Slide 38

Slide 38 text

ऴΘΓ͸ͳ͍ • ஌ਓηΩϡϦςΟΤϯδχΞʮ͜ΕΛ΍ͬͨΒେৎ෉ͱ ͍͏͜ͱ͸ܾͯ͠ͳ͍ʯ 37

Slide 39

Slide 39 text

༷ʑͳηΩϡϦςΟରࡦ • ڴҖϞσϦϯά 5ISFBUNPEFMJOH • ੩తΞϓϦέʔγϣϯηΩϡϦςΟςετ 4"45 • ಈతΞϓϦέʔγϣϯηΩϡϦςΟςετ %"45 • ιϑτ΢ΣΞίϯϙδγϣϯղੳ 4$" • ϑΝδϯά GV[[JOH • ϖωτϨʔγϣϯςετ ͳͲ 38

Slide 40

Slide 40 text

39 39 ڴҖ ϞσϦ ϯά νΣοΫ Ξ΢τ Ϗϧυ ςετ ϦϦʔε σϓϩΠ 4"45 %"45 ϖϯ ςετ 4$" ϑΝδ ϯά 4$" 4$" ηΩϡϦςΟରࡦΛ4%-$ʹ૊ΈࠐΉ ˞ਤ͸ҰྫͰ͢

Slide 41

Slide 41 text

Կ͔Β΍Ε͹ʜ • Ͱ͖Δͱ͜Ζ͔Β࢝ΊΔ • ʮ੬ऑੑ਍அʯΛطʹ΍͍ͬͯΔ૊৫͸ଟ͍ͷͰ͸ͳ͍͔ • ͜ΕʹՃ͑ͯ4$"ΛऔΓೖΕͯΈΔͷ͸Φεεϝ • ੬ऑੑΛݟ͚ͭΔͷ΋ݟ͔ͭͬͨ࣌ͷରԠ΋ൺֱత༰қ • πʔϧ ແྉ΋͋Δʂ ΛೖΕΔͷ͸ࣗࣾ಺Ͱ׬݁Ͱ͖Δ͜ͱ΋ଟ͘ɺ ਍அͷϓϩΛޏ͏ͷͱൺֱͯ͠΋खܰ • %"45ͱ4$"͕උΘΕ͹ɺͻͱ·ͣࣗ෼Ͱॻ͍ͨίʔυ΋औಘ ͨ͠ίʔυ΋ΧόʔͰ͖Δ 40

Slide 42

Slide 42 text

ݸਓͰ࢝ΊΒΕΔ͜ͱ΋͋Δ • ͪΐͬͱ͚ͩͰ΋ηΩϡϦςΟͷχϡʔεΛݟͯΈΔ • ʮηΩϡϦςΟ࢖͍ͬͯΔαʔϏεʗݴޠ΍ٕज़ʯͱ͔ࡶ ʹݕࡧͯ͠Έͯ΋৭ʑग़ͯ͘Δ • ࣾ಺ͷηΩϡϦςΟ୲౰ͷํͱ࿩ͯ͠ΈΔ 41

Slide 43

Slide 43 text

ؔ৺͕ͳ͍ͷ͕ Ұ൪ةݥʂ 42

Slide 44

Slide 44 text

աڈͷࢲ • ։ൃͦͷ΋ͷ͕ͦ͜ʮྑ͍΋ͷΛͭ͘Δʯ ߦҝͩͱೝ͍ࣝͯͨ͠ • ηΩϡϦςΟରࡦ͸ʮΑ͘෼͔Βͳ͍͚Ͳ ΍Βͳ͖Ό͍͚ͳ͍΋ͷʯͩͬͨ • ηΩϡϦςΟ͕ͱʹ͔͘೉ͯ͘͠ා͔ͬͨ 43 !"#$%&' ()* +,-."/ 01."/234

Slide 45

Slide 45 text

ࠓࢥ͏͜ͱ 44 • ։ൃͨ͠΋ͷ͸҆શʹಧ͚ɺͦͷޙ΋҆શʹӡ༻͠ଓ͚ ͳͯ͘͸ͳΒͳ͍ • ηΩϡϦςΟ୲౰΋Ұॹʹ΋ͷͮ͘ΓΛ͢Δ஥ؒͰ͋Δ • ʮ෼͔Βͳ͍ʯͱ͍͏ࢥ͍ࠐΈ͕෼͔Βͳ͍ͯ͘͠Δ • ηΩϡϦςΟ͸ൣғ͕๲େͳͷͰɺ෼ղͯ͠ΈΔͱগ͠ ͣͭཧղͰ͖Δ

Slide 46

Slide 46 text

ͪΐͬͱ͖͔͚ͨͬ͠Ͱ นΛ৐Γӽ͑ΒΕΔ ͪΐͬͱͣͭʜ 45

Slide 47

Slide 47 text

਎ۙͳ໰୊͔Β 46 • օ͕࿩୊ʹ͍ͯ͠ΔτϐοΫ • ࣗ෼͕ରԠͨ͠੬ऑੑ ग़యɿ *5NFEJB /&84೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺ ࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ͍ʯ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM

Slide 48

Slide 48 text

৮Εͨ͜ͱͷ͋Δ΋ͷ͔Β 47 • ʮ੬ऑੑ਍அ͸ฉ͍ͨ͜ͱ͋Δ͚ͲɺͦΕҎ֎ʹ΋औΓ ૊ΊΔ࡞ۀ͕͋ͬͨΜͩͳ͊ʯ • ʮ044ͷόʔδϣϯ֬ೝɺखಈͰ΍Δͷ͠ΜͲ͗ͨ͢ʜ ࣗಈԽͰ͖Δπʔϧ͕͋ͬͨͳΜͯʂʯ

Slide 49

Slide 49 text

ͥͻ͜ͷηογϣϯ΋ Կ͔ͷ͖͔͚ͬʹ ͍ͯͩ͘͠͞ʂ 48

Slide 50

Slide 50 text

ͦͯ͠ԿΑΓ 49

Slide 51

Slide 51 text

4#0.׆༻Ͱ কདྷ΁ͷඋ͑Λʂ 50

Slide 52

Slide 52 text

ࠓޙʹޤ͏͝ظ଴ʂ 51

Slide 53

Slide 53 text

53 5IBOLZPV

Slide 54

Slide 54 text

ࢀߟจݙ • +FOOJGFS%BWJT 3ZO %BOJFMTʰ&GGFDUJWF %FW0QT ʕຊபʹΑΔ࣋ଓՄೳͳ૊৫จԽͷҭͯํʱ • ʮ8IBUBSFUIFMBZFSTPGTFDVSJUZ "DZCFSTFDVSJUZSFQPSUʯIUUQTHPNJOETJHIUDPNJOTJHIUTCMPHXIBUBSFUIFMBZFSTPG TFDVSJUZ • ;%/FU೥݄೔ܝࡌʮถ੓෎ͳͲ΁ͷେن໛αΠόʔ߈ܸɺ4PMBS8JOETͷιϑτ΢ΣΞߋ৽Λѱ༻ʯ IUUQTKBQBO[EOFUDPNBSUJDMF • +'SPH೥݄೔ܝࡌʮ-PH4IFMMθϩσΠ஌͓ͬͯ͘΂͖͜ͱʯIUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPV OFFEUPLOPX • 4ZOPQTZTXIJUFQBQFSʮ0QFO4PVSDF 3JTLJO."CZUIF/VNCFSTʯIUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJH BTTFUTXIJUFQBQFSTXQSJTLNBOVNCFSTQEG • ʮʰηΩϡϦςΟɾεΩϟϯʱ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$" ͱ͸ʁʯIUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM • ʮ&YQMPSFZPVS044EFQFOEFODJFT7JTVBMMZʯIUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS • ʮ4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSETʯ IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@@WFSTJPO@QEG • ೔ܦ95&$)೥݄೔ܝࡌ τϤλ͕ਪ͢αΠόʔରࡦͷ৽ৗࣝʮ4#0.ʯɺྲྀग़͢ΔϦεΫ͸ʁ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM • *5NFEJB /&84೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ ͍ʯIUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM • ܦࡁ࢈ۀল঎຿৘ใ੓ࡦہαΠόʔηΩϡϦςΟ՝ʮ044ͷར׆༻ٴͼͦͷηΩϡϦςΟ֬อʹ޲͚ͨ؅ཧख๏ʹؔ͢Δࣄྫूʯ IUUQTXXXNFUJHPKQQSFTTQEG • ʮ#FTUQSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QT QSPDFTTʯIUUQTNFEJBKGSPHDPNXQ DPOUFOUVQMPBET#FTUQSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QTQSPDFTTQEG 54 54