既存のWebアプリをセキュアにするためにやったこと / Student-LT-WebSec

Slide 1

Slide 1 text

طଘͷ8FCΞϓϦΛ  ηΩϡΞʹ͢ΔͨΊʹ  ΍ͬͨ͜ͱ 5PNPZVLJ,0:"." ֶੜ-5

Slide 2

Slide 2 text

ࣗݾ঺հ w /BNFίϠϚτϞϢΩ w (SBEFཧ޻ܥେֶ# w 5XJUUFS!UNZL@LZN w #MPHIUUQTCMPHLPZBNBNF w 5BHT/FUXPSL8FC4FSWFS4FDVSJUZ

Slide 3

Slide 3 text

ҳൠͷޡՈఉ ϠϑΦΫͰதݹͷωοτϫʔΫػثΛߪೖ

Slide 4

Slide 4 text

ۙگ w ٕज़ॻయʹߦͬͨ w ొ࿥ηΩεϖΛड͚ͨ w ๭IBDLʹམͪͨ w ֶੜ-5ʹؒʹ߹ͬͨɹˡ/&8

Slide 5

Slide 5 text

8FCηΩϡϦςΟ  ͷجૅ

Slide 6

Slide 6 text

944 w ΫϩεɾαΠτɾεΫϦϓςΟϯά w )5.-಺ʹεΫϦϓτ͕ૠೖ͞ΕΔ͜ͱͰɺ೚ ҙͷॲཧ͕࣮ߦ͞ΕΔ w $8&*NQSPQFS/FVUSBMJ[BUJPOPG*OQVU %VSJOH8FC1BHF(FOFSBUJPO $SPTTTJUF 4DSJQUJOH

Slide 7

Slide 7 text

944 EPDUZQFIUNM NFUBDIBSTFUVUG UJUMF9444BNQMFUJUMF I QIQFDIP@(&5<NPEF> I EPDUZQFIUNM NFUBDIBSTFUVUG UJUMF9444BNQMFUJUMF IIFMMPI ม਺@(&5ʹIFMMP͕ઃఆ͞Ε͍ͯΔͱʜ 4BGF

Slide 8

Slide 8 text

944 EPDUZQFIUNM NFUBDIBSTFUVUG UJUMF9444BNQMFUJUMF I QIQFDIP@(&5<NPEF> I EPDUZQFIUNM NFUBDIBSTFUVUG UJUMF9444BNQMFUJUMF ITDSJQUBMFSU TDSJQUI ม਺@(&5ʹTDSJQUBMFSU TDSJQU͕  ઃఆ͞Ε͍ͯΔͱʜ VO4BGF

Slide 9

Slide 9 text

'SBNF8PSLʹཔΔͱʜ w 'SBNF8PSL͕ࣗಈͰΤεέʔϓͯ͘͠ΕΔ w ηΩϡϦςΟΛҙࣝͤͣʹ։ൃՄ w 3VCZPO3BJMT 'MBTL $BLF1)1 FUDʜ

Slide 10

Slide 10 text

طଘͷ8FCΞϓϦΛ  ηΩϡΞʹ͢ΔͨΊʹ  ΍ͬͨ͜ͱ

Slide 11

Slide 11 text

ܦҢ w ͱ͋Δ8FCΞϓϦ ൿ఻ͷιʔε Λಈ͔͢ґཔΛ ड͚Δ w ѻ͏σʔλ͸ݸਓ৘ใ w ηΩϡϦςΟΛݟ௚ͯ͠Έͨ

Slide 12

Slide 12 text

΍ͬͨ͜ͱ

Slide 13

Slide 13 text

44-Խ w )551ˠ)5514 w 44-ূ໌ॻΛ-FU`T&ODSZQUͰऔಘ w ैདྷ͸ݸਓ৘ใΛฏจͰ΍ΓऔΓ

Slide 14

Slide 14 text

͓͠·͍

Slide 15

Slide 15 text

΍ͬͨ͜ͱ w ॳڃ w 44-Խ w தڃ w ্ڃ

Slide 16

Slide 16 text

΍ͬͨ͜ͱதڃ w $PPLJF΁IUUQPOMZଐੑ TFDVSFଐੑΛ෇༩ w Ϩεϙϯεϔομ΁ҎԼΛ෇༩ w 99441SPUFDUJPONPEFCMPDL w 9'SBNF0QUJPOT4".&03*(*/ w 9$POUFOU5ZQF0QUJPOTOPTOJ⒎

Slide 17

Slide 17 text

$PPLJF΁IUUQPOMZଐੑ TFDVSFଐੑΛ෇༩

Slide 18

Slide 18 text

99441SPUFDUJPO NPEFCMPDL w 8FCϒϥ΢βͷ944ϑΟϧλʔΛڧ੍0/ w 944Λݕ஌͢ΔͱϒϩοΫ͢Δ IUUQFYBNQMFDPNTFBSDI TDSJQUBMFSU TDSJQU

Slide 19

Slide 19 text

9'SBNF0QUJPOT  9$POUFOU5ZQF0QUJPOT w 9'SBNF0QUJPOT4".&03*(*/ w ΫϦοΫɾδϟοΩϯάରࡦ  JGSBNFͰͷผαΠτ͔ΒຒΊࠐΈΛېࢭ w 9$POUFOU5ZQF0QUJPOTOPTOJ⒎ w FͷΞΠίϯͳϒϥ΢βͰͷ944Λ๷ࢭ

Slide 20

Slide 20 text

΍ͬͨ͜ͱ্ڃ w ηογϣϯɾλΠϜΞ΢τ w Ϩεϙϯεϔομ΁ҎԼΛ෇༩ w $BDIF$POUSPMQSJWBUF OPTUPSF w 4USJDU5SBOTQPSU4FDVSJUZNBY BHFJODMVEF4VCEPNBJOT

Slide 21

Slide 21 text

ηογϣϯɾλΠϜΞ΢τ $PPLJFͷ&YQJSFଐੑͰ༗ޮظݶΛઃఆ

Slide 22

Slide 22 text

$BDIF$POUSPM  QSJWBUF OPTUPSF w ϚΠϖʔδ ݸਓ৘ใ ͳͲΛ1SPYZ$%/ͰΩϟο γϡͰอ࣋͠ͳ͍ w ࢀߟʮϝϧΧϦɹݸਓ৘ใྲྀग़ʯ

Slide 23

Slide 23 text

4USJDU5SBOTQPSU4FDVSJUZNBY BHFJODMVEF4VCEPNBJOT w )454 )5514USJDU5SBOTQPSU4FDVSJUZ w IUUQˠIUUQT΁ஔ͖׵͑ͯϦΫΤετΛૹ৴ w

Slide 24

Slide 24 text

·ͱΊ w 8FCΞϓϦΛެ։͢Δͱ͖͸44-Խ͠Α͏ w $PPLJF΍Ϩεϙϯεɾϔομʹ஫ҙ͠Α͏ w ແঈεΩϟφͷ08"41;"1͸Φεεϝ