Slide 1

Slide 1 text

2018೥9݄29೔ ୈ5ճ ϋχʔϙολʔٕज़ަྲྀձൃදࢿྉ ϋχʔϙοτͷҭ͔ͯͨ @morihi_soc

Slide 2

Slide 2 text

ϋχʔϙοτͷҭ͔ͯͨ XIPBNJ w ৿ٱ࿨ত !NPSJIJ@TPD  w ຊۀ͸ωοτϫʔΫηΩϡϦςΟΤϯδχΞɾΞφϦετ w झຯͰϋχʔϙοτΛӡ༻͢Δϋχʔϙολʔ w ϒϩάˠIUUQTXXXNPSJIJTPDOFU w ϋχʔϙολʔٕज़ަྲྀձओ࠵ऀ w IUUQTIBOJQPUFDIDPOOQBTTDPN 2 ࠓ·Ͱʹ͓ੈ࿩ʹͳͬͨΠϕϯτ(Ұ෦) ɾ*5,FZT ݱ4FD$BQ  ɾωοτϫʔΫύέοτΛಡΉձ Ծ  ɾ/*4$αΠόʔϋϩ΢Οϯ ɾ*OUFSOFU8FFLɾ)BSEFOJOH ɾTTNKQɾ"*4FDɾ4UVEZ$PEF ɾULULηΩϡϦςΟษڧձ ɾ૯ؔ੢αΠόʔηΩϡϦςΟ-5େձ ɾ08"41/BHPZBɾ*P54FD+1 ग़൛ͨ͠ຊ΍ٕज़ಉਓࢽ NEW 2018೥8݄ˣ

Slide 3

Slide 3 text

ϋχʔϙοτͷҭ͔ͯͨ ͓඼ॻ͖ w ϋχʔϙοτ͸͡Ί·ͨ͠ʙͦͷޙʙ w ָ͘͠ӡ༻͢Δํ๏ w QBTUFCJO w υϝΠϯΛׂΓ౰ͯΔ w ৵ೖݕ஌γεςϜ w ·ͱΊ 3

Slide 4

Slide 4 text

ϋχʔϙοτͷҭ͔ͯͨ ϋχʔϙοτ͸͡Ί·ͨ͠ʙͦͷޙʙ w ϋχʔϙοτͷ؀ڥΛߏங͢Δ͜ͱΛઐ໳༻ޠͰ
 ʮϋχʔϙοτΛ২͑Δʯͱ͍͏ɻ w ϋχʔϙοτΛӡ༻͢Δਓϋχʔϙολʔ w ت͹͍͜͠ͱʹɺϋχʔϙοτΛӡ༻͢Δ
 ϋχʔϙολʔ͕૿Ճ܏޲ʹ͋Γ·͢ɻ w ϒϩά΍4/4ͳͲͰϋχʔϙοτͰಘͨϩάͷ
 ෼ੳ݁ՌͳͲΛެ։ͯ͘͠Ε͍ͯΔਓ΋͍Δɻ w ެ։͞Εͨ৘ใ͸ࢀߟʹͳΓ·͢ɻ
 ͋Γ͕ͱ͏͍͟͝·͢ 4

Slide 5

Slide 5 text

ϋχʔϙοτͷҭ͔ͯͨ w ͜Μͳ೰ΈΛ͓࣋ͪͷํ͕͍Δ͔΋ʜ w ϋχʔϙοτΛ২͑ͯຬ଍ͨ͠ w ϩάऩू͕௙Βͳ͍ w ͋Δఔ౓ɺܾ·ͬͨ߈ܸ͔͠དྷͳ͍ w Ͳ͏΍ͬͯ෼ੳ͢Ε͹͍͍͔Θ͔Βͳ͍ w ߈ܸख๏ͷௐ΂ํ͕Θ͔Βͳ͍ 5 ϋχʔϙοτ͸͡Ί·ͨ͠ʙͦͷޙʙ →ͦͯ͠์ஔ΁ɾɾɾ

Slide 6

Slide 6 text

ϋχʔϙοτͷҭ͔ͯͨ ϋχʔϙοτ͸͡Ί·ͨ͠ʙͦͷޙʙ w ์ஔ͞ΕͨϋχʔϙοτΛઐ໳༻ޠͰ
 ʮϋχʔϙοτ͕ރΕΔʯͱ͍͏ɻ w ͔ͤͬ͘ϋχʔϙολʔʹͳͬͨͷͳΒɺ
 ָ͘͠ӡ༻͍ͨ͠Ͱ͢ΑͶɻ 6

Slide 7

Slide 7 text

ϋχʔϙοτͷҭ͔ͯͨ ϋχʔϙοτΛָ͘͠ӡ༻͢Δํ๏ w ϩάΛऩू͢Δ্Ͱɺ΋ͬͱ΋ॏཁͩͱࢥ͏͜ͱ 7 ϋχʔϙοτͷଘࡏએݴ

Slide 8

Slide 8 text

ϋχʔϙοτͷҭ͔ͯͨ ଘࡏએݴ w ΍Δ͜ͱ͸؆୯ɻϋχʔϙοτΛ২͑ͨϗετͷ
 *1ΞυϨε΍υϝΠϯ໊Λग़͚ͩ͢ɻ w ࠓճ͸ͭ঺հ͠·͢ɻ w QBTUFCJOʹͨΕࠐΉ w υϝΠϯΛҭͯΔ 8

Slide 9

Slide 9 text

ϋχʔϙοτͷҭ͔ͯͨ ଘࡏએݴͦͷɿQBTUFCJO w QBTUFCJO͸ςΩετΛެ։Ͱ͖Δ8FCαΠτ w ࢖͍ํ͸ඇৗʹ؆୯ w Ϣʔβొ࿥͸ෆཁɻͨͩ͠ޙ͔ΒهࣄΛ࡟আͰ͖Δ Α͏ʹొ࿥͓͍ͯͨ͠ํ͕͍͍ɻ w ͱΓ͑͋͑ͣ*1ΞυϨεΛ
 ॻ͍͓͚ͯͩ͘Ͱ΋ޮՌ͋Γ 9 IUUQTQBTUFCJODPN

Slide 10

Slide 10 text

ϋχʔϙοτͷҭ͔ͯͨ ϋχʔϙολʔͷใࠂྫ 10 Ҿ༻ݩɿAWS Security JAWS ܦࡁతʹϋχʔϙοτͷϩά෼ੳΛ͢ΔͨΊͷϕετϓϥΫςΟεʁ
 https://www.slideshare.net/MasamitsuMaehara/aws-security-jaws ஫໨

Slide 11

Slide 11 text

ϋχʔϙοτͷҭ͔ͯͨ QBTUFCJOΛ࢖͏ͱ͖ͷ஫ҙ఺ w ςΩετΛެ։͢ΔͱɺΞΫηεͯ͘͠Δਓ͕݁ߏ ͍Δɻ ΫϩʔϦϯάͷ৔߹΋͋Δ 
 ˠςετͨ͠ͱ͖͸࣌ؒʹਓఔ౓Ӿཡ͞Εɺ ਓΞΫηε͠ʹ͖ͨɻ w ϩάऩूՄೳͳঢ়ଶͰॻ͖ࠐΜͩํ͕ྑ͍ w ϋχʔϙοτͷӡ༻Λऴྃͨ͠ͱ͖ͷͨΊʹ
 QBTUFCJOͷهࣄΛ࡟আͰ͖ΔΑ͏ʹ͓ͯ͘͜͠ͱɻ
 
 ˠϋχʔϙοτͷ*1ΞυϨε౳͕ɺࣗ෼ͷ؅ཧ͔Β ์Εͯ΋৘ใ͕࢒͍ͬͯΔͷ͸Α͘ͳ͍ɻ 11

Slide 12

Slide 12 text

ϋχʔϙοτͷҭ͔ͯͨ ଘࡏએݴͦͷɿυϝΠϯΛҭͯΔ w ࣾձਓϋχʔϙολʔͳΒ͹ɺαʔόͷϨϯλϧͩ ͚Ͱͳ͘ɺυϝΠϯΛܖ໿ͯ͠ϋχʔϙοτͷ*1
 ΞυϨεʹඥ͚ͮͯӡ༻͍ͯ͠Δ͸ͣɻ w ͔ͤͬ͘ͳͷͰɺඥ͚ͮͨυϝΠϯΛҭͯͯΈΑ͏ɻ w جຊతͳߟ͑ํ͸4&0ͱಉ͡ɻ͔͠͠ϋχʔϙο τ͸ͦ͜·Ͱ౒ྗ͠ͳͯ͘ྑ͍ɻ 12

Slide 13

Slide 13 text

ϋχʔϙοτͷҭ͔ͯͨ Ϙοτ͕ߟ͑ͯͦ͏ͳ͜ͱ w ݕࡧαΠτͰɺݕࡧͯ͠ग़ͯ͘Δ8FCαΠτ͸߈ܸ ͢ΔՁ஋͕͋Γͦ͏ɻ͔ͩΒ߈ܸ͢Δᶃ w ݕࡧͨ͠αΠτ͔ΒϦϯΫ͞ΕͨαΠτ΋ɺ߈ܸ͢ ΔՁ஋͕͋Γͦ͏ɻ͍ͭͰʹ߈ܸ͢Δᶄ w ߈ܸͷ༏ઌॱҐ͸ᶃᶄ w ϋχʔϙολʔͷࢹ఺Ͱߟ͑Δͱ w ᶃΛϋχʔϙοτͰӡ༻͢Δͷ͸େมɻ
 ͦ͜Ͱී௨ͷ8FCαΠτͱͯ͠ӡ༻͢Δɻ w ᶄΛϋχʔϙοτͱͯ͠ӡ༻͢Δͷ͸؆୯ɻ
 ᶃ͔ΒϦϯΫ͓͚͑ͯ͞͠͹ྑ͍ɻ 13

Slide 14

Slide 14 text

ϋχʔϙοτͷҭ͔ͯͨ ೥ͷ࣮ફه 14 ձ৔ݶΓ NO PHOTO ձ৔ݶఆ

Slide 15

Slide 15 text

ϋχʔϙοτͷҭ͔ͯͨ ೥ͷ࣮ફه 15 ձ৔ݶΓ NO PHOTO ձ৔ݶఆ

Slide 16

Slide 16 text

ϋχʔϙοτͷҭ͔ͯͨ υϝΠϯΛҭͯΔͱ͖ͷ஫ҙ఺ w ௕͘ӡ༻͢Δ΄Ͳ߈ܸΛऩू͠΍͘͢ͳΔ͕ɺ
 ϋχʔϙοτͱݟഁΒΕͯ͠·͏Մೳੑ΋͋Δɻ w ϋχʔϙοτͷαʔό୅ۚʹՃ͑ͯɺυϝΠϯͷҡ ࣋අ͕͔͞Ήɻ w ΋͠΋ͷ͜ͱΛߟ͑ͯɺϋχʔϙοτ͕εύϜϝʔ ϧͷ౿Έ୆ʹ͞Εͳ͍Α͏ʹ%/4ͷTQGϨίʔυ ͰʮBMMʯΛࢦఆ͓ͯ͘͠ͱ҆৺Ͱ͖Δɻ 16 ʢࢀߟʣ SPF Ϩίʔυ຤ඌͷ ”~all” ͱ ”-all” ͷҧ͍ https://www.nisc.go.jp/conference/suishin/adviser/dai5/pdf/sankou.pdf

Slide 17

Slide 17 text

ϋχʔϙοτͷҭ͔ͯͨ ϩά෼ੳͷ࿩ w QBTUFCJO΍υϝΠϯΛҭͯΔ͜ͱͰɺ߈ܸΛऩू͠ ΍͘͢ͳΓ·͢ɻ w ͦ͏͢Δͱɺࠓ·Ͱݟͨ͜ͱ΋ͳ͍߈ܸ΋ࠞͬͯ͟ ͖·͢ɻ w ͜͏͍͏ͱ͖͸ʮ৵ೖݕ஌γεςϜʯͷྗΛआΓΔ ͱָ͘͠ͳΓ·͢ɻ 17

Slide 18

Slide 18 text

ϋχʔϙοτͷҭ͔ͯͨ ৵ೖݕ஌γεςϜ w ৵ೖݕ஌γεςϜ*%4 *OUSVTJPO%FUFDUJPO4ZTUFN ͸ɺ߈ܸͷಛ௃Λγάωνϟͱͯ͠ఆ͓͖ٛͯ͠ɺ ؂ࢹର৅ͷωοτϫʔΫʹྲྀΕΔ௨৴ͱҰகͨ͠ͱ ͖ʹΞϥʔτΛग़͢γεςϜɻ w Φʔϓϯιʔειϑτ΢ΣΞͩͱ4OPSU͕༗໊ w 51PUΛӡ༻͍ͯ͠Δਓ͸4VSJDBUB͕͓ೃછΈ 18 Snort https://snort.org/ Suricata https://suricata-ids.org/

Slide 19

Slide 19 text

ϋχʔϙοτͷҭ͔ͯͨ ໨ͰݟͯΘ͔Γ΍͘͢ w *%4͸ૉ੖Β͍͠ɻ߈ܸΛݟ͚ͭͯ͘ΕΔɻ w ͔͠͠ɺΞϥʔτ͸ਓؒͷ໨ʹ༏͘͠ͳ͍ ɻ w *%4ͷΞϥʔτΛՄࢹԽ͢ΔγεςϜ͕ཉ͍͠ɻ 19 * ͨͩ͠ύέοτ޷͖ͳਓ͸আ͘ɻ

Slide 20

Slide 20 text

ϋχʔϙοτͷҭ͔ͯͨ 4OPSCZ w 4OPSU΍4VSJDBUBͷϩάΛՄࢹԽͯ͘͠ΕΔγες ϜͰ͸4OPSCZ͕Φεεϝɻ 20 Snorby https://github.com/Snorby/snorby

Slide 21

Slide 21 text

ϋχʔϙοτͷҭ͔ͯͨ 4OPSCZʹ͓͚Δϩάͷݟ͑ํ 21

Slide 22

Slide 22 text

ϋχʔϙοτͷҭ͔ͯͨ ͨͱ͑͹ɺ͜Μͳ؂ࢹ؀ڥ͸͍͔͕ w ߈ܸΛड͚Δ w ϋχʔϙοτ 808)POFZQPU  w ߈ܸΛ؂ࢹ͢Δ w *%4 4OPSU  w 4OPSUͷϩάΛసૹ͢Δ w #BSOZBSE w ߈ܸͷϩάΛՄࢹԽ͢Δ w 4OPSCZ 22 Snorby ͸ɺ௚઀ Snort ͷϩά ΛݟΕͳ͍ɻͦ͜ͰBarnyard2 Ͱ Snort ͷϩάΛ Snorby ༻ͷ σʔλϕʔε΁సૹΛ͢Δɻ Snorby ͸σʔλϕʔεͷϩά ΛՄࢹԽͯ͠ɺϒϥ΢β͔Β ϩάΛ֬ೝ͢Δ͜ͱ͕Ͱ͖Δɻ

Slide 23

Slide 23 text

ϋχʔϙοτͷҭ͔ͯͨ ؂ࢹ؀ڥུ֓ਤ 23

Slide 24

Slide 24 text

ϋχʔϙοτͷҭ͔ͯͨ σϞ ձ৔ݶఆ 24

Slide 25

Slide 25 text

ϋχʔϙοτͷҭ͔ͯͨ ·ͱΊ w ϋχʔϙοτΛ͸͡Ίͨਓ͸ϩάऩूͱϩά෼ੳʹ ࠔΔ͔΋͠Εͳ͍ɻ w ϋχʔϙοτͷଘࡏએݴ͸େ੾ɻ w QBTUFCJOΛ࢖ͬͨΓɺϋχʔϙοτʹׂΓ౰͍ͯͯ ΔυϝΠϯΛҭͯΔͱ߈ܸΛूΊ΍͍͢ɻ w ϋχʔϙοτͱ*%4ΛฒߦՔಈͤ͞Δ͜ͱͰɺҧͬ ͨϩάͷݟ͑ํ͕Ͱ͖Δɻ w ඟᰈɺࣗ෼ͷ޷͖ͳελΠϧͰָ͠Ί͹͍͍ͱࢥ͏ɻ 25

Slide 26

Slide 26 text

ϋχʔϙοτͷҭ͔ͯͨ )BQQZ)POFZQPU 26 ←2018೥6݄9೔ ৽॓ޚԓ େԹࣨͰࡱӨ ৯஬২෺Ͱ͸ͳ͍ɻ ͓͠·͍