セキュリティプラクティスの継続的な実践〜セキュアなシステム構築を目指して〜 / Continuous Security Practice

by aki.m

Slide 1

Slide 1 text

ηΩϡϦςΟϓϥΫςΟεͷ ܧଓతͳ࣮ફ BLJN !"[email protected]@ %FW0QT%BZT5PLZP ʙηΩϡΞͳγεςϜߏஙΛ໨ࢦͯ͠ʙ

Slide 2

Slide 2 text

ࣗݾ঺հ w ໊લBLJN !"[email protected]@ w ࢓ࣄ࠷ۙ͸ΞδϟΠϧίʔν w झຯษڧձ ೥͸ճࢀՃ w ϒϩάIUUQTBLJNIBUFOBEJBSZDPN

Slide 3

Slide 3 text

ൃදഎܠ

Slide 4

Slide 4 text

ൃදഎܠ w 34(5ͰߦͬͨൃදͷิҨ w 34(5Ͱ࿩ͤͳ͔ͬͨɺηΩϡϦςΟϓϥΫςΟεΛ࣮ફ͢Δࡍʹى͖͕ͪ ͳ໰୊ͱͦͷରԠࡦʹؔͯ͠આ໌ w %FW4FD0QTMJGFDZDMFTͷ࣮ફʹϑΥʔΧε ςετ΍τϦΞʔδ౳ͷ෦෼͸ׂѪ w πʔϧͷ࿩͸Χοτ w ϓϥΫςΟεͷ֓ཁ͸؆୯ʹઆ໌༧ఆͷͨΊɺ34(5ͷൃදΛฉ͍͍ͯͳͯ͘ ΋෼͔ΔΑ͏ʹߏ੒ IUUQTTQFBLFSEFDLDPNBLJ@NPPOBHJMFTFDVSJUZQSBDUJDF

Slide 5

Slide 5 text

08"41%FW4FD0QTMJGFDZDMFT

Slide 6

Slide 6 text

08"41%FW4FD0QTMJGFDZDMFTͱ͸ IUUQTPXBTQPSHXXXQSPKFDUEFWTFDPQTHVJEFMJOFMBUFTUB0WFSWJFX w 08"41͕࡞੒ w 1MBO $PEF #VJME 5FTU 3FMFBTF %FQMPZ 0QFSBUF .POJUPSͷ֤ϑΣʔζͰͲͷΑ ͏ͳ׆ಈΛ͢Δͷ͔ʁΛ঺հ w ܧଓతςετϞσϧ͕಄ʹ͋Δ ͱ5FTUϑΣʔζʹࠞཚ͢Δ͜ͱ ͕༧૝͞ΕΔͨΊɺຊൃදͰ͸ 5FTUΛϑΣʔζ͔Βൈ͍ͨ΋ͷ Λ঺հ

Slide 7

Slide 7 text

08"41%FW4FD0QTMJGFDZDMFT վ TEXT HERE TEXT HERE 01 01 02 03 04 DPEF CVJME SFMFBTF EFQMPZ PQFSBUF NPOJUPS QMBO

Slide 8

Slide 8 text

08"41%FW4FD0QTMJGFDZDMFT վ TEXT HERE TEXT HERE 01 01 02 03 04 DPEF CVJME SFMFBTF EFQMPZ PQFSBUF NPOJUPS QMBO

Slide 9

Slide 9 text

ڴҖϞσϦϯά 1MBO w γεςϜΛϗϫΠτϘοΫεԽͯ͠ΞϓϦέʔγϣϯʹજΉڴҖΛಛఆ͢Δ w ڴҖͷϦετɺ͋Δ͍͸Մೳੑͷ͋ΔڴҖͷγφϦΦΛΞ΢τϓοτͱ͢Δ w ηΩϡϦςΟ୲౰ऀͷΈͰ͸ͳ͘νʔϜͰڠಇͯ͠࡞Δ w ϞσϧΛ࡞੒͢Δํ๏ ڴҖͷಛఆํ๏ ͸ෳ਺͋Δ 5ISFBU.PEFMJOH%FTJHOJOHGPS4FDVSJUZ

Slide 10

Slide 10 text

νʔϜϝϯόʔ͔ΒͷࢍಉΛಘʹ͍͘ w ࣮ࢪίετ͕ߴ͍ w ηΩϡϦςΟ؍఺ʹಛԽ͍ͯ͠ΔͨΊɺҙٛΛײ͡ ʹ͍͘ϝϯόʔ͕ଘࡏ͓ͯ͠ΓɺࢍಉΛಘʹ͍͘ w ϦϑΝΠϯϝϯτΛ͸͡Ίͱͨ͠طଘ׆ಈʹ૊Έࠐ Έɺ࣮ྫϚοϐϯά΍ΞλοΫετʔϦʔΛ׆༻ IUUQTOJIPOCVTPOIBUFOBEJBSZKQFOUSZ&YBNQMF.BQQJOH "TB\ఢ^ *XBOUUP\߈ܸ^ TPUIBU\߈ܸ͢Δ͜ͱͰఢ͕ಘΒΕΔརӹ^ ηΩϡϦςΟετʔϦʔ ࣮ྫϚοϐϯά ڴҖϞσϦϯά࣮ફ࣌ʹى͖͕ͪͳ໰୊

Slide 11

Slide 11 text

08"41%FW4FD0QTMJGFDZDMFT վ TEXT HERE TEXT HERE 01 01 02 03 04 DPEF SFMFBTF EFQMPZ PQFSBUF NPOJUPS QMBO CVJME

Slide 12

Slide 12 text

4"45%"45*"454$"*74$74 $PEF#VJME ϓϥΫςΟε໊ ϓϥΫςΟεͷઆ໌ ୅දతͳπʔϧ 4"45 4UBUJD"QQMJDBUJPO 4FDVSJUZ5FTUJOH ࣗ෼͕ͨͪॴ༗ݖΛ͍࣋ͬͯΔ಺෦ͷιʔείʔυʹରͯ͠੩తղੳΛ࣮ࢪͯ͠ɺ੬ऑੑΛݕग़ w ແঈπʔϧ #BOEJU#SBLFNBOʜ w ༗ঈπʔϧ 4OZL$PEF 4FNHSFQʜ %"45 %ZOBNJD"QQMJDBUJPO 4FDVSJUZ5FTUJOH ಛఆͷςετγφϦΦʹج͍ͮͯΞϓϦέʔγϣϯΛ࣮ߦ͠ͳ͕Β੬ऑੑΛݕग़ w ;"1 w #VSQ4VJUF *"45 *OUFSBDUJWF"QQMJDBUJPO 4FDVSJUZ5FTUJOH ΤʔδΣϯτ͕4"45ͱ%"45Λ૊Έ߹Θͤͳ͕Β੬ऑੑΛݕग़ w $POUSBTU$PNNVOJUZ&EJUJPO w TFFLFS 4$" 4PGUXBSF$PNQPTJUJPO "OBMZTJT 044Λ͸͡Ίͱͨࣗ͠෼ͨͪҎ֎͕ॴ༗ݖΛ͍࣋ͬͯΔ֎෦ͷιʔείʔυʹରͯ͠ղੳΛ࣮ࢪ͠ ͯ੬ऑੑΛݕग़ w (JU)VCEFQFOEBCPU w 4OZL0QFO4PVSDF *74 *OGSBTUSVDUVSF7VMOFSBCJMJUZ 4DBOOJOH ϑΝΠΞ΢Υʔϧɺϧʔλʔɺ΢ΣϒαʔόʔͳͲͷωοτϫʔΫϕʔεͷΠϯϑϥࢿ࢈ʹଘࡏ͢ Δ੬ऑੑΛ੬ऑੑεΩϟϯͰݕग़ w /FTTVT $74 $POUBJOFS7VMOFSBCJMJUZ 4DBOOJOH ϏϧυσϓϩΠ͞Εͨ৽͍͠ΠϝʔδΛఆظతʹεΩϟϯͯ͠੬ऑੑΛݕग़ w 5SJWZ

Slide 13

Slide 13 text

$*$%ͷ࣮ߦ଎౓௿Լ w ηΩϡϦςΟύΠϓϥΠϯͷ࣮ߦ଎౓͕஗͍ w %"45ͷྔΛඞཁ࠷௿ݶʹ཈͑Δ "1*&OE1PJOU΍ ΞΧ΢ϯτ੍ޚपΓͳͲ w ηΩϡϦςΟςετϐϥϛουͷ׆༻ w ϚγϯεϖοΫΛ্͛ͯ΋Β͏ 4"45%"45*"454$"*74$74࣮ફ࣌ʹى͖͕ͪͳ໰୊

Slide 14

Slide 14 text

ิ଍ ηΩϡϦςΟςετϐϥϛου "HJMF"QQMJDBUJPO4FDVSJUZ 4"45Ͱݟ͔ͭΔ੬ऑੑ͸ςετʹճ͞ͳ͍ Ұൠతͳ6*ςετΑΓ΋࣮ߦ଎౓͕஗͍ ෆཁέʔεࣗಈԽʹΑΔίετ͕େ͖͍ #%%ͳͲΛ׆༻ͯ͠αʔϏεؒͷ ઀ଓ؍఺Λςετ ɾπʔϧ͸ݴޠͰબ୒ ɾͷෆ۩߹͸6OJU૚Ͱ௵ͤΔ

Slide 15

Slide 15 text

ِཅੑ஍ࠈ w πʔϧͷِཅੑ͕ଟൃ͠։ൃऀ͕ରԠʹ௥ΘΕΔ w 4DBO1PMJDZͷఆظ୨Է w ຊ൪؀ڥͱͷ؀ڥࠩҟΛ࠷খݶʹ͢Δ w *"45ͷੵۃతͳ׆༻ w ༗ঈπʔϧ΁ͷ੾Γସ͑ 4"45%"45*"454$"*74$74࣮ફ࣌ʹى͖͕ͪͳ໰୊

Slide 16

Slide 16 text

πʔϧͷཚཱ w ϓϥΫςΟεºݴޠͷ૊Έ߹ΘͤͰπʔϧ͕૿େ ΩϟονΞοϓίετ͕૿େ ಛఆͷਓʹෛՙ͕ूத PSա౓ͳ෼ۀͷଅਐ w πʔϧͷ౷Ұ ͓͢͢Ί͸TOZL 4"45%"45*"454$"*74$74࣮ફ࣌ʹى͖͕ͪͳ໰୊

Slide 17

Slide 17 text

08"41%FW4FD0QTMJGFDZDMFT վ TEXT HERE TEXT HERE 01 01 02 03 04 DPEF CVJME SFMFBTF EFQMPZ PQFSBUF NPOJUPS QMBO

Slide 18

Slide 18 text

$PNQMJBODF7BMJEBUJPO 3FMFBTF w ࣗಈϦϦʔεࣗಈϩʔϧόοΫ w ຊ൪ઃఆݕূ w ϢʔβʔΞΫηε੍ޚ w ϑΝΠΞ΢ΥʔϧΞΫηε੍ޚ w ۀքݻ༗ ϦϦʔεঝೝ༻υΩϡϝϯτͷࣗಈੜ੒

Slide 19

Slide 19 text

ୈࡾऀػؔʹΑΔ੬ऑੑ਍அ w ୈࡾऀػؔʹΑΔ੬ऑੑݕূͱΞδϟΠϧ։ൃͷ૬ ੑ͕ѱ͍ ݱ୅ٕज़Ͱ͸πʔϧͰୈࡾऀػؔͷ੬ऑੑ ਍அΛ׬શʹஔ͖׵͑Δͷ͸೉͍͠ w ηΩϡϦςΟΠϯγσϯτ͕ൃੜ͢ΔϦεΫΛड༰ Ͱ͖Δ͔ߟ͑Δ ηΩϡϦςΟϦεΫΑΓ΋ࢢ৔΍ސ ٬͔ΒͷϑΟʔυόοΫ͕஗ΕΔϦεΫͷํ͕ߴ͍ ͍͔Λߟ͑Δ Πϯγσϯτ͕ൃੜ͢ΔϦεΫΛड༰͢Δ৔߹ ϝδϟʔόʔδϣϯΞοϓͷλΠϛϯά΍ఆظతʹ ઃ͚Δ؂ࠪλΠϛϯάͰ࣮ࢪ Πϯγσϯτ͕ൃੜ͢ΔϦεΫΛड༰͠ͳ͍৔߹ ຊ൪؀ڥʹ͸ϦϦʔεͤͣ45؀ڥͳͲʹϦϦʔε͠ ͯɺϦϦʔεʹे෼ͳػೳ͕ἧͬͨλΠϛϯάͰ࣮ࢪ 3FMFBTF࣌ʹى͖͕ͪͳ໰୊

Slide 20

Slide 20 text

08"41%FW4FD0QTMJGFDZDMFT վ TEXT HERE TEXT HERE 01 01 02 03 04 DPEF CVJME SFMFBTF EFQMPZ PQFSBUF NPOJUPS QMBO

Slide 21

Slide 21 text

$PEF4JHOJOH7BMJEBUJPO %FQMPZ w CVJMEϑΣʔζͰ࣮ࢪͨ͠ςετ΍εΩϟϯΛܧଓతʹ࣮ࢪ w $PEF4JHOJOH w (JU)VC"DUJPOT w (JU-BC ͜͜·Ͱ࿩͖ͯͨ͠಺༰͕࣮ફͰ͖ΔΑ͏ʹͳͬ ͍ͯΕ͹ɺπʔϧͷٕज़తͳ՝୊Λআ͚͹ى͖͕ ͪͳ໰୊͸ॏෳ͢ΔͨΊઆ໌ΛׂѪ

Slide 22

Slide 22 text

08"41%FW4FD0QTMJGFDZDMFT վ TEXT HERE TEXT HERE 01 01 02 03 04 DPEF CVJME SFMFBTF EFQMPZ PQFSBUF NPOJUPS QMBO

Slide 23

Slide 23 text

؂ࢹ 0QFSBUF.POJUPS w ఆظతϞχλϦϯάΞϥʔτ௨஌ w 1SPNFUIFVT"MFSU.BOBHFSͳͲ w ηΩϡϦςΟҎ֎ͷ؍఺΋ؚΊͯϞχλϦϯά͢Δ͜ͱ͕ଟ͍

Slide 24

Slide 24 text

ηΩϡϦςΟΠϯγσϯτରԠʹ޲͚ͨ४උ 0QFSBUF.POJUPS JODJEFOUSFTQPOTFDZDMF

Slide 25

Slide 25 text

ΧΦεΤϯδχΞϦϯά 0QFSBUF.POJUPS w ຊ൪؀ڥͰҙਤతʹΠϯγσϯτΛى͜͠଱ো֐ੑΛ֬ೝ w ϓϩηε ఆৗঢ়ଶͷଌఆ Ծઆઃఆ ࣮ݧͷܭը Ծઆͷ֬ೝ ΧΦεΤϯδχΞϦϯά

Slide 26

Slide 26 text

ٕज़త෮چ΁ͷڧ͍ϑΥʔΧε w Ϗδωε্ى͖ͨΠϯύΫτ΁ͷରԠ४උ͕ൈ͚ͯ ͠·͏ ͦͷ৔൑அʹͳͬͯ͠·͏ w ސ٬ใࠂจॻͷࣄલ࡞੒ w Ḫٴൣғͷબఆํ਑ࡦఆ ηΩϡϦςΟΠϯγσϯτରԠʹ޲͚ͨ४උͰى͖͕ͪͳ໰୊

Slide 27

Slide 27 text

αόΠόϧϞʔυ΁ͷҠߦʹΑΔࠞཚ w ཧ૝తͳέʔεͰͷࣄલ४උ͕த৺ʹͳΓ͕ͪ w ʮΈΜͳͰରԠ͠·͠ΐ͏ʯ͕ෆ໌ྎͳ໾ׂ෼୲Λ ੜΉ w ࢦشܥ౷΋ܾΊ͓ͯ͘ w ίϚϯυίϯτϩʔϧ΋બ୒ࢶʹ͍ΕΔ ηΩϡϦςΟΠϯγσϯτରԠʹ޲͚ͨ४උͰى͖͕ͪͳ໰୊

Slide 28

Slide 28 text

$IBPT&OHJOFFSJOH5SBQT ΧΦεΤϯδχΞϦϯάͰى͖͕ͪͳ໰୊ ੬ऑੑͷ਺Ͱ$IBPT&OHJOFFSJOHͷ੒ޭΛܭଌ Ұ෦ͷਓͷΈ͕ΧΦεΤϯδχΞϦϯάʹࢀՃ نൣతͳϧʔϧ͕͋Δͱࢥ͍ࠐΉ ΧΦεΤϯδχΞ͸ϧʔϧ੍ఆऀͰ͋Δ΂͖ αϯυϘοΫε؀ڥͰ༧ߦԋश͠ͳ͍ ࣮ݧΛى͜͢͜ͱ͕ԿΑΓ΋ॏཁ ҆શੑ͸ޙͰߟྀ͢Δ γεςϜཧղ͕ͳͯ͘΋࣮ߦͰ͖Δ IUUQTNFEJVNDPN!OKPOFT@DIBPTFOHJOFFSJOHUSBQTFD

Slide 29

Slide 29 text

·ͱΊ

Slide 30

Slide 30 text

·ͱΊ 1IBTF ϓϥΫςΟε ى͖͕ͪͳ໰୊ ରԠࡦ 1MBO ڴҖϞσϦϯά νʔϜϝϯόʔ͔ΒͷࢍಉΛಘʹ͍͘ طଘ׆ಈ΁ͷ૊ΈࠐΈ $PEF#VJME 4"45%"45*"454$"*74$74 $*$%ͷ࣮ߦ଎౓௿Լ w %"45ΛߜΔ w ηΩϡϦςΟςετϐϥϛουͷ׆༻ ِཅੑ஍ࠈ w εΩϟϯϙϦγʔͷఆظߋ৽ w ຊ൪ಉ౳؀ڥͷ੔උ w *"45ͷ׆༻ w ༗ঈπʔϧ΁ͷ੾Γସ͑ πʔϧͷཚཱ πʔϧ౷߹ 4OZL͕͓͢͢Ί 3FMFBTF $PNQMJBODF7BMJEBUJPO ϦϦʔεલʹߦ͏֎෦ͷ੬ऑੑ਍அ ηΩϡϦςΟΠϯγσϯτ͕ڐ༰Ͱ͖Δ͔Ͳ͏͔Ͱର ԠΛߟ͑Δ 0QFSBUF.POJUPS ηΩϡϦςΟΠϯγσϯτରԠʹ޲͚ͨ४උ ٕज़త෮چ΁ͷڧ͍ϑΥʔΧε Ϗδωε؍఺Ͱͷ෮چ΁޲͚ͨ४උ αόΠόϧϞʔυ΁ͷҠߦʹΑΔࠞཚ w ໾ׂ෼୲ͷ໌ྎԽ w ࢦشܥ౷ͷܾఆ