Slide 1

Slide 1 text

3FUUZʹ͓͚Δ4JHOBM4DJFODFTͷ ಋೖࣄྫ Yuya Koda 2021/12/08

Slide 2

Slide 2 text

ࣗݾ঺հ ໊લ ޾ా༏࠸ ͜͏ͩΏ͏΍  ͓࢓ࣄ ΠϯϑϥΤϯδχΞ ޷͖ͳ͓ళ 4"70:ຑ෍े൪ళ 5XJUUFS !QPOLJP@P IUUQTVTFSSFUUZNF

Slide 3

Slide 3 text

͋ͳͨʹBESTͳ ͓ళ͕ݟ͔ͭΔ

Slide 4

Slide 4 text

"HFOEB  8"'ಋೖͷഎܠ  8"'ͷݕ౼  4JHOBM4DJFODFTΛ༻͍ͨ1P$ͷ࣮ࢪ  ࢖ͬͯΈͯײͨ͡4JHOBM4DJFODFTͷεΰ͍ͱ͜Ζ  UFSSBGPSNQSPWJEFSTJHTDJͷ׆༻ࣄྫ  ·ͱΊ

Slide 5

Slide 5 text

8"'ಋೖͷഎܠ

Slide 6

Slide 6 text

ಋೖͷഎܠ ΞΫηεϩάͳͲͰ࣌ʑ؍ଌ͸͍ͯͨ͠΋ͷͷɺ೥݄຤ͷ্৔ޙ͔Β߈ܸͱࢥΘΕΔ ϦΫΤετ͕໨ཱͭΑ͏ʹ w 42-J΍944ΛૂͬͨϦΫΤετ w ಛʹSFUUZNF͸ݹ͍ϖʔδ΋ଘࡏ͠ɺ͜ΕΒ͕ສશʹରࡦ͞Ε͍ͯΔͱ͸ ݴ͑ͳ͍ঢ়گʜ w ͓ߦّͷѱ͍CPUʹΑΔେྔͷϖʔδΫϩʔϧ w ͦΕʹ൐͏%#ͷෛՙ্ঢ΋ى͖͍ͯͨ🔥 → Ͱ͖Δ͚ͩ WAF ϨΠϠʔͰ๷ޚ͍ͨ͠

Slide 7

Slide 7 text

"848"'ͷࢼݧಋೖ ͱ͋ΔΠϯγσϯτൃੜ࣌ʹɺۓٸͰ"848"'Λಋೖ͢Δ΋શ͘νϡʔχϯάΛͤͣʹ ಋೖͨͨ͠Ίɺ'BMTF1PTJUJWF͕େྔൃੜ͠αʔϏεʹো֐͕ൃੜ ٸ͗Ͱ8"'Λಋೖͨ࣌͠ͷ༷ࢠ

Slide 8

Slide 8 text

"848"'ͷࢼݧಋೖ ͦͷޙεςʔδϯά؀ڥͳͲͰࢼͯ͠ΈΔ΋ɺ࣮ࡍͷӡ༻ʹ৐ͤΔͨΊʹ͸ϦΫΤετຖͷ ࡉ͔͍νϡʔχϯά΍ܧଓతͳϧʔϧͷௐ੔͕ඞਢʹͳΓͦ͏ͩͬͨ😢 σϑΥϧτͷϧʔϧͰݕग़͞ΕͨϦΫΤετ

Slide 9

Slide 9 text

8"'ͷݕ౼

Slide 10

Slide 10 text

8"'ͷݕ౼ ଞࣾͷ8"'ͱൺֱͨ͠ॴɺԼهͷΑ͏ͳϙΠϯτͰ4JHOBM4DJFODFT͕Ϛονͨ͠😀 w ӡ༻ίετͷ௿͞ w ϖʔδຖʹਖ਼نදݱΛॻ͘Α͏ͳ͜ͱ͸ͳΔ΂͘ආ͚͍ͨ w ໢ཏతʹαΠτશମΛอޢ͍ͨ͠ w ۚમతͳίετ w 8"'ͷӡ༻୅ߦαʔϏεͳͲΛ࢖͏ͱ8"'ຊମҎ֎ʹ΋ग़අ͕ʜ w ಋೖͷ͠΍͢͞ w μ΢ϯλΠϜͳ͠Ͱಋೖ͍ͨ͠ w ෦෼తʹಋೖ͍ͨ͠ → Signal Sciences Ͱ PoC Λ࣮ࢪ͢Δ͜ͱʹ

Slide 11

Slide 11 text

4JHOBM4DJFODFT1P$ͷ࣮ࢪ

Slide 12

Slide 12 text

"HFOU8"'ͱ$MPVE8"' Agent WAF Cloud WAF ྉۚ ˕ ˚ ϨΠςϯγʔ ˕ ̋ ಋೖ࣌ͷखܰ͞ ˚ ˕ ӡ༻ίετ ̋ ˕ w "HFOU8"' w ࣗ෼ͨͪͰ"HFOUΛηοτΞοϓͯ͠ར༻͢ΔλΠϓ 1SPYZ.PEVMF  w ॳճͷ"HFOUͷߏங΍ΞοϓσʔτͳͲܧଓతͳอक͕ඞཁ w $MPVE8"' w 4JHOBM4DJFODFT͕ࣾ؅ཧ͢Δ"HFOUΛ࢖༻͢ΔλΠϓ w 4JH4DJଆͰ"HFOU͕؅ཧ͞Εɺಋೖ͸%/4Λ੾Γସ͑ΔͷΈ 4JHOBM4DJFODFTͷதͰ΋େ͖͘छྨͷಋೖํ๏͕͋Δ

Slide 13

Slide 13 text

$MPVE8"'ͷಋೖ 0SJHJOͱͳΔΤϯυϙΠϯτΛ4JH4DJࣾʹ఻͑Δ 4JH4DJଆͰొ࿥͕ඞཁͳͨΊ  4JHOBM4DJFODFTμογϡϘʔυ্Ͱূ໌ॻͷΞοϓϩʔυ αʔϏε ྫTFSWJDFSFUUZNF ͷϨίʔυΛ4JH4DJ͔ࣾΒࢦఆ͞Εͨ$/".&ʹมߋ ൺֱతϦΫΤετ͕গͳ͘ɺ%/4੾Γସ͑Ͱ΋Өڹൣғ͕খ͍͞αʔϏεʹ͸$MPVE8"' Λಋೖ TFSWJDFSFUUZNF "QQ4FSWFS $MPVE8"' TFSWJDFSFUUZNF $/".&YYTJHTDJDMPVEXBGDPN

Slide 14

Slide 14 text

"HFOU8"'ͷಋೖ 1SPYZ.PEFͰಈ࡞͢Δ4JH4DJ"HFOUΛߏங 4JH4DJ"HFOUͷVQTUSFBNͱͯ͠0SJHJO "QQ4FSWFS Λࢦఆ લஈͷ/(*/9ͷVQTUSFBNΛ4JH4DJ"HFOUʹมߋ ൺֱతϦΫΤετ͕ଟ͘ɺ%/4੾Γସ͑ͩͱӨڹൣғ͕େ͖͍αʔϏεʹ͸"HFOU8"' Λಋೖ SFUUZNF 4JH4DJ"HFOU 3FWFSTF1SPYZ /(*/9 "QQ4FSWFS

Slide 15

Slide 15 text

"HFOUNPEFʹ͍ͭͯ w /PUCMPDLJOH ໿ϲ݄  w ϦΫΤετΛه࿥͢ΔͷΈͰɺ࣮ࡍͷϒϩοΫ͸ߦΘͳ͍ w #MPDLJOH ໿िؒ  w ҰఆҎ্ѱҙͷ͋ΔϦΫΤετΛड͚ͨΒϒϩοΫ͢Δ w ϒϩοΫͨ͠ϗετͰ΋ѱҙͷͳ͍௨ৗͷϦΫΤετ͸ड͚෇͚Δ αʔϏεӨڹΛग़͞ͳ͍ͨΊʹϞχλϦϯά͔ͯ͠ΒϒϩοΫϞʔυʹҠߦͨ͠

Slide 16

Slide 16 text

4JHOBM4DJFODFTͷ͕͜͜εΰΠʂ

Slide 17

Slide 17 text

खܰʹಋೖͰ͖Δ "HFOU8"'$MPVE8"'ڞʹಋೖͷख͕ؒ΄ͱΜͲ͔͔Βͳ͔ͬͨ w $MPVE8"'Ͱඞཁͳ࡞ۀ͸ূ໌ॻͷΞοϓϩʔυͱ%/4ͷ੾Γସ͑ͷΈ w ΞϓϦέʔγϣϯଆͷมߋ΋ෆཁ w "HFOU8"'ͷ৔߹͸؀ڥʹ߹Θ༷ͤͯʑͳܗͰ૊ΈࠐΊΔͨΊɺ෦෼తʹಋೖ͢Δ ͜ͱ΋Մೳ w 3FWFSTF1SPYZ w 8FC4FSWFS.PEVMF /(*/9 "QBDIF **4  w -BOHVBHF.PEVMF +BWB /PEFKT 1ZUIPO

Slide 18

Slide 18 text

'BMTF1PTJUJWFͷগͳ͞ ࠷େͷݒ೦఺Ͱ͋ͬͨ'BMTF1PTJUJWF͕ͱʹ͔͘গͳ͍ w ϲ݄൒ͷ1P$ظؒதʹൃݟ͞Εͨ'BMTF1PTJUJWF͸ͳΜͱ݅ w ͔͠΋༧Ίઃఆͨ͠ڐՄϧʔϧͳͲ͸ͳ͘ɺͨͩ௨͚ͨͩ͠ͷঢ়ଶ w 'BMTF/FHBUJWF͕ଟ͍͔ͱݴΘΕΔͱͦΜͳ͜ͱ΋ͳ͘ɺ͔ͬ͠Γݕ஌͸͞Ε͍ͯΔ w ʮͷϢʔβ͕ຊ൪؀ڥͰϒϩοΫϞʔυΛ࢖༻͍ͯ͠Δʯͷ΋ೲಘ 0'$6450.&34*/'6--#-0$,*/(.0%&*/130%6$5*0/

Slide 19

Slide 19 text

ӡ༻ίετͷ௿͞ 8"'ͷӡ༻୅ߦͳͲΛར༻ͤͣͱ΋ࣗࣾͰे෼ʹ؅ཧͰ͖Δ w ʮϖʔδ͕૿͑Δͨͼʹਖ਼نදݱΛݟ௚͢ʯͳͲͷ࡞ۀ͕جຊతʹඞཁͳ͍ w ϓϦηοτతͳ5FNQMBUFE3VMFT΋༻ҙ͞Ε͓ͯΓɺྫ͑͹ʮϩάΠϯͷࣦഊʯͳͲ Λ؆୯ʹઃఆϞχλϦϯά΋Ͱ͖Δ -PHJO'BJMVSFͷ5FNQMBUFE3VMFTͷը໘

Slide 20

Slide 20 text

෼͔Γ΍͍͢μογϡϘʔυͱઃఆը໘ ͘͢͝γϯϓϧͳ6*Ͱ௚ײతʹૢ࡞͠΍͍͢ w ௚ײతͳ6*Ͱʮ͋Ε͕ݟ͍ͨʯͱࢥͬͨ৘ใʹ͙͢ʹḷΓண͚Δ w ϧʔϧʹ͍ͭͯ΋༧Ί༻ҙ͞ΕͨϑΟʔϧυΛຒΊΔͱ࡞੒Ͱ͖Δ w ਖ਼نදݱ΋ར༻Մೳ w ಠࣗͷϦετΛ࡞੒ͯ͠*TJOMJTU*TOPUJOMJTUΛࢦఆͨ͠Γ΋Ͱ͖Δ 4JUF3VMFTͷ࡞੒ը໘

Slide 21

Slide 21 text

-JTUΛ࢖༻ͨ͠3VMFͷઃఆྫ ྫ͑͹ɺ༧Ίάϩʔόϧ*1ΞυϨεϦετΛ࡞੒͓͍ͯͯ͠ɺ*TJOMJTUΛࢦఆ͢Δ͜ͱͰ ΦϑΟε͔ΒͷΞΫηεΛࣝผͭͭ͠ɺϒϩοΫ͠ͳ͍ϧʔϧΛ؆୯ʹઃఆͰ͖Δ

Slide 22

Slide 22 text

5FSSBGPSN1SPWJEFSͷ׆༻ࣄྫ

Slide 23

Slide 23 text

ެࣜͷ5FSSBGPSN1SPWJEFS ެࣜͰ5FSSBGPSN1SPWJEFS͕༻ҙ͞Ε͍ͯΔͨΊઃఆͷίʔυ؅ཧ͕Ͱ͖Δ w 4JH4DJͷ΄ͱΜͲͷઃఆΛ5FSSBGPSNͰهड़͢Δ͜ͱ͕Ͱ͖Δ w Ұ෦ରԠ͍ͯ͠ͳ͍΋ͷ΋͋Δ ࠓޙʹظ଴ IUUQTHJUIVCDPNTJHOBMTDJFODFTUFSSBGPSNQSPWJEFSTJHTDJ

Slide 24

Slide 24 text

UFSSBGPSNQSPWJEFSTJHTDJͷ׆༻ࣄྫ ฐࣾͰ͸ରԠ͍ͯ͠ͳ͍ϦιʔεҎ֎͸͢΂ͯ5FSSBGPSNͰ؅ཧ͢ΔΑ͏ʹ͠ɺ13࡞੒Ͱ $*͔ΒUFSBSGPSNQMBOΛ࣮ߦ͠ɺ̼FSHFͰUFSSBGPSNBQQMZ͢ΔΑ͏ʹ͍ͯ͠·͢ 8"'ΛϒϩοΫϞʔυʹมߋ͢Δ13Λग़͍ͯ͠Δ༷ࢠ

Slide 25

Slide 25 text

·ͱΊ

Slide 26

Slide 26 text

ಋೖͯ͠ΈͯͲ͏͔ͩͬͨ w શମΛ௨ͯ͠ w 'BMTF1PTJUJWF͕ͱʹ͔͘গͳ͍ w ਖ਼نදݱͷௐ੔Έ͍ͨͳ΍͕ͭجຊ͍Βͳ͍ w 'BMTF/FHBUJWF΋গͳ͘ɺͪΌΜͱ߈ܸΛݕ஌ͯ͘͠ΕΔ w $MPVE8"' w ಋೖ͕؆୯Ͱอक΋ඞཁͳ͘ӡ༻ָ͕ w τϥϑΟοΫྔʹΑͬͯ͸ίετ͕ωοΫʹͳΔ͜ͱ΋ w "HFOU8"' w ߏங͸ඞཁͳ΋ͷͷɺͦ͜·Ͱେ͖͘ӡ༻ʹखؒ͸औΒΕͳ͍ҹ৅ w ಋೖλΠϓʹ༷ʑͳબ୒ࢶ͕͋Γɺࣗࣾʹ͋ͬͨ΋ͷΛ࢖͑Δͷ͸"HFOU8"' ͷ͍͍ͱ͜Ζ

Slide 27

Slide 27 text

͋Γ͕ͱ͏͍͟͝·ͨ͠