セキュリティのお仕事: インターネット屋さん編 / LOCAL DEVELOPER DAY '19 Security

by Yasunari Momoi

Slide 1

Slide 1 text

ηΩϡϦςΟͷ͓࢓ࣄ લઆ

Slide 2

Slide 2 text

ʮηΩϡϦςΟͷ͓࢓ࣄʯ ͱฉ͍ͯʜ Πϝʔδ͢Δ΋ͷ͸ʁ

Slide 3

Slide 3 text

! "

Slide 4

Slide 4 text

ʮηΩϡϦςΟͷ͓࢓ࣄʯ Πϝʔδྫ ૝ఆ w ੡඼ϕϯμ ϋʔυ ιϑτ w '8 *14 w 4BOECPY &NBJM w "OUJ7 &%3 w 4*&. w αʔϏεఏڙऀ w ϚωʔδυαʔϏε 40$ w Ϋϥ΢υαʔϏεఏڙଆ w "84 "[VSF w ։ൃ 4*FS w ݕࠪ ΞϓϦ ੡඼ w ؂ࠪ w ΠϯςϦδΣϯε w ίϯαϧ ڭҭ

Slide 5

Slide 5 text

$4*35 γʔαʔτ ΋ͬͱଟ͘ͷ૊৫ʹඞཁͳ ͢΂ͯͷ૊৫ʹʁ ηΩϡϦςΟରԠͷ͓࿩Ͱ͢

Slide 6

Slide 6 text

$4*35ͷ؆୯ͳઆ໌ w $PNQVUFS4FDVSJUZ*ODJEFOU3FTQPOTF5FBN w *ODJEFOUॏେࣄނ΍ɺॏେࣄނʹͳΓ͏Δࣄଶ w 3FTQPOTF5FBNରԠνʔϜ w ఆΊͨൣғͷΠϯγσϯτରԠΛߦ͏ w ಺֎ͷ࿈བྷ૭ޱͱͳΓɺద੾ͳରԠΛ͢Δ w ফ๷ஂɺࣗܯஂɺ࣏ࣗձͷΑ͏ͳ΋ͷ

Slide 7

Slide 7 text

ηΩϡϦςΟͷ͓࢓ࣄ Πϯλʔωοτ԰͞Μฤ גࣜձࣾΠϯλʔωοτΠχγΞςΟϒ ηΩϡϦςΟຊ෦ηΩϡϦςΟ৘ใ౷ׅࣨ ΋΋͍΍͢ͳΓNPNP!JJKBEKQ

Slide 8

Slide 8 text

ࣗݾ঺հ w ΋΋͍΍͢ͳΓ w 5XJUUFS!TCH'BDFCPPLZNPNPJ w ։ൃɺηΩϡϦςΟ w Πϯλʔωοτɺαʔό w ίϛϡχςΟ׆ಈɺษڧձ w ৯΂΋ͷɺϔϰΟϝλϧɺͶ͜

Slide 9

Slide 9 text

*OUFSOFU*OGSBTUSVDUVSF3FWJFX w **+ͷ೺Ѳͨ͠ηΩϡϦςΟ৘ใ΍؍ଌ݁Ռɺ **+ͷηΩϡϦςΟରࡦ׆ಈΛ·ͱΊͯެද͢ Δ͜ͱͰɺΠϯλʔωοτ্ͷΠϯγσϯτ ൃੜঢ়گΛ೺Ѳͯ͠΋Β͏ͨΊͷϨϙʔτɻ ೥݄ΑΓɺ࢛൒ظʹҰճൃߦɻ w ࠷৽൛͸7PM ೥݄ൃߦ ɻτϐοΫ ͸ϒϩοΫνΣʔϯٕज़Λϕʔεͱͨ͠ΞΠσ ϯςΟςΟ؅ཧɾྲྀ௨ͷಈ޲ղઆͱF4*.ɻ w 1%'൛Λ8FC͔ΒແྉͰμ΢ϯϩʔυՄೳɻ w ӳޠ൛΋͋Γ·͢ʂؤுͬͯ·͢ʂ w ʮ**+**3ʯͰݕࡧʂ

Slide 10

Slide 10 text

**+4FDVSJUZ%JBSZ w **+άϧʔϓͷ$4*35 νʔϜɺ**+4&$5ʹΑ Δ৘ใൃ৴αΠτ w ಛఆͷࣄ৅ʹؔ͢Δৄ ࡉͳௐࠪݚڀɺϋχʔ ϙοτ΍Ϋϩʔϥʔͳ Ͳಠࣗͷ؍ଌ݁ՌΛج ʹͨ͠৘ใΛఏڙ w IUUQTTFDUJJKBEKQ

Slide 11

Slide 11 text

8J[4BGF4FDVSJUZ4JHOBM w **+͕ఏڙ͢ΔηΩϡϦςΟ ࣄۀʮXJ[4BGFʯʹ͓͚Δ ࣮ࡍͷ߈ܸ΍ࣄҊͷ؍ଌ৘ ใ΍ɺͦΕΒͷ෼ੳ݁ՌΛ جʹͨ͠৘ใൃ৴αΠτ w ηΩϡϦςΟΦϖϨʔγϣ ϯηϯλʔͷ޿ൣͰ໢ཏత ͳ৘ใΛجʹ෼ੳͨ͠಺༰ ΛλΠϜϦʔʹൃ৴ w IUUQTXJ[TBGFJJKBEKQ

Slide 12

Slide 12 text

ຊ೔ͷ͓୊ ηΩϡϦςΟ͸૯߹֨ಆٕ

Slide 13

Slide 13 text

ηΩϡϦςΟͷ͓࢓ࣄ

Slide 14

Slide 14 text

ηΩϡϦςΟ͸෯޿͍ w ηΩϡϦςΟؔ܎ͷ࢓ࣄͱ͍͏ͱʁ w ಄ʹʮαΠόʔʯ͕͍ͭͨΒͲ͏͔ʁ w ࠓ೔͸$4*35 γʔαʔτ ʹয఺Λ౰ͯ·͢ w 40$ΛؚΜͰ͍ͨΓ΋͠·͢ w ηΩϡϦςΟରԠ૊৫

Slide 15

Slide 15 text

$4*35ͷ׆ಈ w $4*35ͷ׆ಈશൠ w ʮඇৗ࣌ʯͱʮฏ࣌ʯ +1$&35$$ʮ$4*35ΨΠυʯΑΓ

Slide 16

Slide 16 text

$4*35͕ఏڙ͢Δػೳ ηΩϡϦςΟରԠ૊৫ͷػೳʹΑΔ෼ྨ (ISOG-JʮηΩϡϦςΟରԠ૊৫ͷڭՊॻ v2.1ʯ) ηΩϡϦςΟରԠ૊৫ӡӦ ϦΞϧλΠϜΞφϦγε (ଈ࣌෼ੳ) σΟʔϓΞφϦγε (ਂ۷෼ੳ) ΠϯγσϯτରԠ ηΩϡϦςΟରԠঢ়گͷ਍அͱධՁ ڴҖ৘ใͷऩू͓Αͼ෼ੳͱධՁ ηΩϡϦςΟରԠγεςϜӡ༻ɾ։ൃ ಺෦౷੍ɾ಺෦ෆਖ਼ରԠࢧԉ ֎෦૊৫ͱͷੵۃత࿈ܞ

Slide 17

Slide 17 text

$4*35ʹؔΘΔਓʑ

Slide 18

Slide 18 text

$4*35૊৫ʹਖ਼ղ͸ͳ͍ w $4*35ػೳͷ࣮૷ํ๏͸༷ʑ w ࣮૷͸มԽ͢Δ w ૊৫ͷঢ়گɺਓࡐɺ༧ࢉ w $4*35ͷߏஙϑΣʔζ ن໛ w ੈؒͷ৘੎ +1$&35$$ʮ$4*35ΨΠυʯΑΓ

Slide 19

Slide 19 text

ηΩϡϦςΟରԠͷ໾ׂҰཡ

Slide 20

Slide 20 text

$4*35ਓࡐͷఆٛͱ֬อ w $4*35ʹٻΊΒΕΔ໾ׂͱਓࡐʹΑΔ෼ྨ /$"ʮ$4*35ਓࡐͷఆٛͱ֬อ7FSʯ w 1P$ 1PJOUPG$POUBDU w ϦʔΨϧΞυόΠβʔ w ϊʔςΟϑΟέʔγϣϯ୲౰ w Ϧαʔνϟʔ w ΩϡϨʔλʔ w ੬ऑੑ਍அ࢜ w ηϧϑΞηεϝϯτ୲౰ w ιϦϡʔγϣϯΞφϦετ w ίϚϯμʔ w ΠϯγσϯτϚωʔδϟʔ w Πϯγσϯτϋϯυϥʔ w ΠϯϕεςΟήʔλʔ w τϦΞʔδ୲౰ w ϑΥϨϯδοΫ୲౰ w ڭҭ୲౰

Slide 21

Slide 21 text

No content

Slide 22

Slide 22 text

No content

Slide 23

Slide 23 text

No content

Slide 24

Slide 24 text

No content

Slide 25

Slide 25 text

໾ׂ෼୲ w ΈΜͳͰࣄʹ͋ͨΔɺ໾ׂ෼୲ w εʔύʔϚϯ͸͍ͳ͍ w Ծʹ͍ͨͱͯ͠΋࣌ؒʹ͸ݶΓ͕͋Δ w ୭͔͕ൈ͚͚ͨͩͰ่յͯ͠͸ࠔΔ

Slide 26

Slide 26 text

࣮ࡍʹ͍Ζ͍Ζͳਓ͕͍·͢ w ֎͔Βݟ͑΍͍͢ਓͨͪ w 1P$ɺϦαʔνϟʔɺτϨʔφʔ w Τʔε ΞφϦετɺΤόϯδΣϦετ w ݟ͑ʹ͍͘ਓͨͪ w ΞφϦετɺௐࠪνʔϜ w ΦϖϨʔλʔɺج൫։ൃɺӡ༻ɺνʔϜӡӦ w ৘ใγεςϜɺ؅ཧɺ؂ࠪ

Slide 27

Slide 27 text

ηΩϡϦςΟͷ͓࢓ࣄΛ͢Δ

Slide 28

Slide 28 text

ηΩϡϦςΟͷ࢓ࣄʹͭ͘ʁ w ෯޿͍໾ׂͷͲΕ͔Λ୲͑Δ w ઐ໳εΩϧΛຏ͘ ྖҬ*** *7 w ྖҬ* **͸ʜʁ

Slide 29

Slide 29 text

*5ܕਓࡐ w ͋Δઐ໳෼໺ʹಛԽͨ͠ਓ*ܕਓࡐ w ηΩϡϦςΟۀքɺઈର਺͸গͳ͍ w ҰൠاۀͰ͸Ϛον͠ͳ͍ʁ w *5ܕਓࡐ w ݱۀ຿ͷεΩϧΛϕʔεʹ͢Δ w ηΩϡϦςΟΛ޿ֶ͘Ϳ w ηΩϡϦςΟͷ෼໺Λ۷ΓԼ͛Δ ISOG-JʮηΩϡϦςΟରԠ૊৫ͷڭՊॻ v2.1ʯ

Slide 30

Slide 30 text

νʔϜϝϯόʔͷεΩϧηοτྫ

Slide 31

Slide 31 text

ࢲ͕৮Ε͖ͯͨ͜ͱ

Slide 32

Slide 32 text

ܭࢉػՊֶʹ৮ΕΔ w جૅతͳ਺ֶ w σʔλߏ଄ͱΞϧΰϦζϜ w ܭࢉྔͱ͔ w ௨৴΍ωοτϫʔΫͷཧ࿦

Slide 33

Slide 33 text

Πϯλʔωοτͱ5$1*1 w ωοτϫʔΫΛ࢖͏ w ෳ਺ͷϚγϯͰ෼ࢄॲཧ w 04*֊૚ͱ͔ w &NBJM /FU/FXT w 8FCग़ݱ

Slide 34

Slide 34 text

04΍αʔόʹ৮ΕΔ w ϑϦʔιϑτ w Φʔϓϯιʔε w #4% .*/*9 -JOVY w 98JOEPX w 4IFMM 1FSM 5DM5L

Slide 35

Slide 35 text

αʔόߏங΍ӡ༻Λͯ͠ΈΔ w ֶੜڞ༻ͷιϑτ΢ΣΞΛ؅ཧ w ֶੜ༻αʔόʹྖҬͱݖݶΛ΋Βͬͨ w ݚڀࣨωοτϫʔΫΛߏஙɺӡ༻ w %/4 &NBJM 8FCͳͲΛߏஙɺӡ༻

Slide 36

Slide 36 text

ϓϩάϥϜͷษڧΛ͢Δ w େ͖ͳϓϩάϥϜΛॻͨ͘Ίͷཧ۶ΛֶͿ w ߏ଄ԽɺΦϒδΣΫτࢦ޲ w όάΛ͋·Γग़͞ͳ͍ͨΊͷํ๏࿦ w 5SBQT1JUGBMMT w ੬ऑੑʹ΋ͭͳ͕Δ

Slide 37

Slide 37 text

ݚڀͱ͍͏΋ͷͱग़ձ͏ w 8*%&ݚڀձ w ଞେֶ΍اۀͷ͍͢͝ਓͨͪʹձ͏ w ݚڀͷ·Ͷ͝ͱΛ͢Δ

Slide 38

Slide 38 text

$"%ͷ։ൃձࣾʹब৬ w ۀ຿஌ࣝ͸ ͋ͨΓ·͑ w $"%ͷσʔλߏ଄Λཧղ͢Δ w ܗঢ়σʔλτϙϩδʔ w ΠϯλʔωοτΛͭͳ͙ w ωοτϫʔΫҕһձΛ࡞Δ

Slide 39

Slide 39 text

Πϯλʔωοτͷձࣾʹब৬ w ηΩϡϦςΟͷ෦ॺͰ͍Ζ͍Ζ࡞Δ w αʔϏεͷόοΫΤϯυɺ*%4 w ෆ۩߹௥ٻͰ͍Ζ͍ΖֶͿ w ৽͘͠ग़͖ͯͨ΋ͷΛ࢖͏ௐ΂Δ w ษڧձ΍׆ಈͷࢧԉ

Slide 40

Slide 40 text

ηΩϡϦςΟʹؔΘΔ

Slide 41

Slide 41 text

։ൃͰֶΜͩ͜ͱ w ۀ຿෼ੳɺཁ݅ఆٛɺઃܭ w ໰୊ͷ෼ղɺ୯७ԽɺఆࣜԽ w ਓؒ޻ֶɺ৺ཧֶͳͲͷॳา w ωοτϫʔΫ΍04ͷ͘͠Έ w τϥϒϧγϡʔτେࣄ w ޻ఔ؅ཧɺνʔϜӡӦ

Slide 42

Slide 42 text

ηΩϡϦςΟ͸ʜ޿͍ w ৘ใཧ࿦ɺ҉߸ w ౷ܭֶɺࣾձֶ w ۓٸରԠɺࡂ֐ରԠɺ๷ࡂ w ๏཯ɺ๷Ӵ w ֶशɺڭҭɺ৺ཧֶ w ҆શ޻ֶɺࣦഊֶ

Slide 43

Slide 43 text

։ൃऀͳΒͰ͖Δ͜ͱ w ৽͍͠؀ڥ΍πʔϧͷςετɺಋೖ w σόοάɺτϥϒϧγϡʔτ w ϓϩτλΠϐϯά w ࣗಈԽ w ੬ऑੑ৘ใΛಡΈղ͘ w ݪཧɺ1P$

Slide 44

Slide 44 text

ಛʹࠔ͍ͬͯΔ͜ͱ

Slide 45

Slide 45 text

ӳޠͱ਺ֶ

Slide 46

Slide 46 text

਺ֶ͸ཧ޻ֶͷجૅ w ৘ใཧ࿦ʹ΋ͨ͘͞Μ਺ֶ͕ʜ w ৽͍͠෺Λཧղ͢Δʹ͸਺ֶ͕ʜ w ػցֶश %FFQ-FBSOJOH "* w #MPDL$IBJO #JUDPJO w ҉߸·ΘΓ

Slide 47

Slide 47 text

'*345"OOVBM$POGFSFODF

Slide 48

Slide 48 text

'*345೥࣍૯ձʹߦͬͯ·ͨ͠ w '*345ͱ͸ʁ w '*345JTUIFHMPCBM'PSVNPG *ODJEFOU3FTQPOTFBOE 4FDVSJUZ5FBNT w ੈքதͷηΩϡϦςΟʹؔΘΔ ૊৫͕ू·ΔϑΥʔϥϜ w ೥ʹҰ౓ɺେن໛ͳΧϯϑΝϨϯ ε͕։࠵͞ΕΔ ࠓ೥͸ճ໨ https://www.first.org

Slide 49

Slide 49 text

'*345"OOVBM$POGFSFODF ঺հ

Slide 50

Slide 50 text

'*345"OOVBM$POGFSFODF #BORVFU *DF#SFBLFS /FUXPSLJOH w *DF#SFBLFS w ॳ೔ͷॳࢀՃऀ޲͚ձ߹ޙ w $POGFSFODF#BORVFU w ೔ఔਅΜத΁Μͷ໷ w /FUXPSLJOH#SFBL w ஥ྑ͘ͳΔͨΊͷ࣌ؒ

Slide 51

Slide 51 text

'*345"OOVBM$POGFSFODF "OOVBM(FOFSBM.FFUJOH w 'PSVNͷ೥࣍૯ձ w ໾һબग़ w ׆ಈใࠂ w ձܭใࠂ w ن໿มߋ

Slide 52

Slide 52 text

'*345"OOVBM$POGFSFODF &WFOUT w '*345'PPUCBMM$VQ w 1IPUP8BML w #:# #SJOH:PVS#PUUMF

Slide 53

Slide 53 text

No content

Slide 54

Slide 54 text

ͦͷଞηΩϡϦςΟؔ܎ͷ૊৫ ࢲ͕ؔ܎͍ͯ͠Δ΋ͷ w /$" ೔ຊγʔαʔτڠٞձ w *4"$ ෼໺ผͷຽؒ૊৫ͷू·Γ w *40(+ ࣄۀऀͷू·Γ w ଞɺͱͯ΋ͨ͘͞Μ͋Γ·͢

Slide 55

Slide 55 text

ຊ೔ͷ͓୊ ηΩϡϦςΟ͸૯߹֨ಆٕ

Slide 56

Slide 56 text

·ͱΊ ηΩϡϦςΟ͸޿͍ ࣄଶ͸ৗʹมԽ͢Δ มԽʹڧ͍ࣗ෼Λ࡞Δ جૅ͸େࣄ

Slide 57

Slide 57 text

Slide 58

Slide 58 text

࣭ٙ w શମΛ௨ͯ͠ɺͳΜͰ΋ฉ͍͍ͯͩ͘͞ w ग़ͯ͜ͳ͔ͬͨ࿩Ͱ΋େৎ෉Ͱ͢ ਺ଟ͘ͷࣸਅఏڙ: ͨʹ͌͞Μ