組織的なインシデント対応を目指して〜成熟度評価と改善のステップ〜 / Towards an Organized Incident Response - Maturity Assessment and Improvement Steps -
by
Narimichi Takamura
Link
Embed
Share
Beginning
This slide
Copy link URL
Copy link URL
Copy iframe embed code
Copy iframe embed code
Copy javascript embed code
Copy javascript embed code
Share
Tweet
Share
Tweet
Slide 1
Slide 1 text
No content
Slide 2
Slide 2 text
2
Slide 3
Slide 3 text
גࣜձࣾTopotalʢͱΆͨΔʣ • h#ps:/ /topotal.com • SREΛओ࣠ʹϏδωεΛల։͢Δελ ʔτΞοϓ • 2ࣄۀΛӡӦ • SRE as a Service • SaaS for SREʢWaroomʣ 3
Slide 4
Slide 4 text
SRE as a Service • SREʹಛԽٕͨ͠ज़ࢧԉαʔϏε • ࢧԉͷྫ • SLI/SLOͷಋೖɾӡ༻վળ • CI/CDͷߏஙɾվળ • ΠϯγσϯτϚωδϝϯτͷվળ 4
Slide 5
Slide 5 text
WaroomʢϫϧʔϜʣ • h#ps:/ /waroom.com • ৫తʹΠϯγσϯτରԠΛߦ͏ͨΊ ͷSaaS • Slack AppϕʔεͰ࡞ΒΕ͓ͯΓɺීஈ ௨ΓରԠ͢Δ͚ͩͰࣗಈԽɾলྗԽ͕ Ͱ͖Δ 5
Slide 6
Slide 6 text
6
Slide 7
Slide 7 text
ΠϯγσϯτϨεϙϯεͷվળʹऔΓΉ͜ͱ͕ଟ͍ • ۩ମతʹɺҎԼͷ2ͭͷۀΛ௨ͯؔ͠ΘΓ͕͋Δ • SREaaS SRE: ސ٬ͷΠϯγσϯτϨεϙϯεڥΛվળ͢Δ • Waroom PdM: ΠϯγσϯτϨεϙϯεSaaSͷػೳΛߟ͑Δ • ͍ͣΕͷ߹ଐਓԽΛղফ͠ɺ৫తʹରԠͰ͖Δମ੍ͮ͘ Γ͕ٻΊΒΕΔ 7
Slide 8
Slide 8 text
ຊߨԋͷϞνϕʔγϣϯͱ֓ཁ • ৫తͳΠϯγσϯτରԠͷ࣮ʹؔ৺͕͋Δ • ΠϯγσϯτϨεϙϯεΛվળ͢ΔࡍʹཱͭಓඪͷΑ͏ͳͷ Λͭ͘Γ͍ͨ • ͞·͟·ͳاۀͷվળ͕গ͠ͰḿΔ͖͔͚ͬʹͳΕخ͍͠ • → ख़ϞσϧΛϕʔεʹاۀͷΠϯγσϯτϨεϙϯεڥΛ ධՁ͠ɺஈ֊తʹվળ͢Δख๏Λ͓͠·͢ 8
Slide 9
Slide 9 text
ΞδΣϯμ 1. ΠϯγσϯτϚωδϝϯτͷվળͷ 2. ΠϯγσϯτରԠख़Ϟσϧͱվળͷεςοϓ 3. ϑΣʔζϚΠάϨʔγϣϯͷϙΠϯτ 9
Slide 10
Slide 10 text
ΠϯγσϯτϨεϙϯεͷվળ͕ Ή͔͍ͣ͠ 10
Slide 11
Slide 11 text
՝1: اۀ͝ͱʹղܾࡦ͕ҟͳΔͨΊɺෆ࣮֬ੑ͕ߴ ͍ • اۀ͝ͱʹڥ͕ΘΓͱେ͖͘ҟͳΔ • ex. πʔϧɺϑϩʔɺϙϦγʔ...... • ͞·͟·ͳاۀSREࢧԉΛ͢ΔͨΊɺޮԽ͍͕ͨ͠௫Έॴ͕ͳ͍ • ex. AࣾͰ͏·͍ͬͨ͘ϓϥΫςΟε͕ɺBࣾͰ͏·͍͘͘ͱݶΒͳ͍ • ݁Ռͱͯ͠ɺํײͳ͘ঢ়گΛஅ͠ͳ͕Βվળ͢Δ͜ͱʹ → اۀͷঢ়گͱղܾࡦͷύλʔϯ͕େͰ͋ΓɺΞυϗοΫͳରԠʹͳͬͯ͠·͏ 11
Slide 12
Slide 12 text
՝2: ϕετϓϥΫςΟεͷಋೖ͕͏·͍͔͘ͳ͍έʔε͕͋Δ • ސ٬ͷ՝ײ • ϫʔΫϑϩʔ͕ఆ·͍ͬͯͳ͍ͷͰɺඋΛͯ͠৫తʹରԠ͍ͨ͠ • վળࡦ • ϕετϓϥΫςΟεʹج͍ͮͨϫʔΫϑϩʔͷಋೖ • ex. ίϚϯμʔϩʔϧͷಋೖɺSEVͷఆٛͳͲ • ݁Ռ • ϫʔΫϑϩʔ͕ཧղ͞Εͣɺఆண͢Δ·ͰʹఆΑΓଟ͘ͷ͕͔͔࣌ؒͬͨ 12
Slide 13
Slide 13 text
ϕετϓϥΫςΟεͷྫ1 • ΠϯγσϯτίϚϯμʔ(IC) ɺ্ڃ ཧ৬ͷϝϯόʔͰ͋Δඞཁͳ͘ɺత ͱํੑΛ࣋ͬͯΠϯγσϯτରԠΛਐ ΊΒΕΕ୭ͰΑ͍ • ׂ୲Λ͢Δ͜ͱͰɺ৫త͔ͭޮ తʹରԠ͕Ͱ͖Δ → ͞·͟·ͳલఏ͕ͬͯ͡ΊͯޮՌ Λൃش͢ΔɻاۀʹΑͬͯ୯ͳΔΦʔό ʔϔουʹͳΔՄೳੑ͋Δ 1 Incident Management for Opera3ons 13
Slide 14
Slide 14 text
՝3: ʮ৫తͳରԠʯͷظ͕اۀʹΑͬͯҟͳΔ • ʮ৫తͳΠϯγσϯτରԠʯͱҰݴͰ͍ͬͯɺاۀ͝ͱʹ ཧঢ়ଶ͕ҟͳΔ • ΑΓख़ͨ͠৫Ͱɺ୯ʹෳਓ͕࿈ಈͯ͠ରԠ͢Δ͜ͱͰ ͳ͘ɺਓγεςϜ͕ΑΓޮతʹ࿈ಈ͠ͳ͕ΒରԠͰ͖Δ ମ੍ΛٻΊΔ͕͋Δ • → ख़ͨ͠৫Ͱ͋ͬͯཁٻʹݟ߹ͬͨվળΛ͍͖͍ͯͨ͠ 14
Slide 15
Slide 15 text
3ͭͷʹ͖߹͏ • 1: اۀͷঢ়گͱղܾࡦͷύλʔϯ͕େͰ͋ΓɺΞυϗο ΫͳରԠʹͳͬͯ͠·͏ • 2: पғΛר͖ࠐΉγʔϯͰɺվળ͕ࢥ͏Α͏ʹਐ·ͳ͍͜ ͱ͕͋Δ • 3: ʮ৫తͳରԠʯͷظ͕اۀʹΑͬͯҟͳΔ 15
Slide 16
Slide 16 text
3ͭͷʹ͖߹͏ • 1: اۀͷঢ়گͱղܾࡦͷύλʔϯ͕େͰ͋ΓɺΞυϗοΫͳରԠʹͳͬͯ͠·͏ • → ؇͔ʹྨ্ͨ͠ͰɺதظతͳվળͷํੑΛࣔͤΔΑ͏ʹͳΓ͍ͨ • ex. ʮࣗͨͪࠓʓʓͱ͍͏ঢ়گͳͷͰɺ□□ͷঢ়ଶΛࢦͯ͠ɺ△△✗✗ʹऔΓΈ·͠ΐ͏ʂʯ • 2: पғΛר͖ࠐΉγʔϯͰɺվળ͕ࢥ͏Α͏ʹਐ·ͳ͍͜ͱ͕͋Δ • → ৫Λר͖ࠐΈ͘͢͢ΔͨΊʹɺஈ֊తͳվળͷεςοϓΛͭ͘Γ͍ͨ • 3: ʮ৫తͳରԠʯͷظ͕اۀʹΑͬͯҟͳΔ • → ख़ͨ͠اۀ͕ࢦ͢ཧঢ়ଶؚΊͯݴޠԽ͢Δ ্هͷ՝Λղܾ͢ΔͨΊʹɺख़ϞσϧͷߏஙΛ͢Δ͜ͱʹ 16
Slide 17
Slide 17 text
ख़Ϟσϧͷߏங 17
Slide 18
Slide 18 text
ख़Ϟσϧͱ2 ৫͕ϓϩηεΛఆΊચ࿅͢ΔͨΊͷख ஈɻҎԼΛఏڙ͢Δɻ • Կ͔Βணख͖͔͢ • ڞ௨ͷݴޠͱɺϏδϣϯͷڞ༗ • ࣮ߦͷ༏ઌॱҐ͚ͮͷΈ • ࣗͨͪͷ৫ʹͱͬͯվળ͕ҙຯ͢ Δ͜ͱΛ໌֬ʹ͢Δํ๏ 2 ΟΩϖσΟΞ: ೳྗख़Ϟσϧ౷߹ 18
Slide 19
Slide 19 text
SREͷίϯςΩετΛख़ϞσϧʹऔΓࠐΉ • ΠϯγσϯτϨεϙϯεɺϞχλϦϯάσϓϩΠͳͲͷप ลྖҬͷӨڹΛड͚͍͢ • ৫ʹ͓͚ΔSREͷঢ়گΛͱʹஈ֊తʹఆ͍ٛͨ͠ • → ৴པੑͷϚΠϯυηοτͷਫ४Λ༻͍ͯख़ϨϕϧΛఆٛ ͢Δ 19
Slide 20
Slide 20 text
ิ: ৴པੑͷϚΠϯυηοτ 3 • ৫ͷ৴པੑΛ5ͭͷجຊతஈ֊ʹ͚ͨͷ • Absent: ৫ʹͱͬͯ৴པੑೋ࣍తͳߟྀࣄ߲ • Reac.ve: ৴པੑͷ / ϦεΫͷରԠ͕࠷ۙͷαʔϏεఀࢭʹ݁ͼ͚ ΒΕɺࢄൃతͳϑΥϩʔ͕ߦΘΕΔɻγεςϜͷͷमਖ਼ʹظతͳ ࢿ͕ߦΘΕΔ͜ͱ΄ͱΜͲͳ͍ɻ • Proac.ve: ఆظతͳ৫ϓϩηεΛ௨ͯ͡જࡏతͳ৴པੑϦεΫ͕ಛఆ͞ Εରॲ͞ΕΔ • Strategic: ͜ͷϨϕϧʹ͋Δ৫ɺΞʔΩςΫνϟɺϓϩμΫτɺϓϩη εΛମܥతʹมߋ͢Δ͜ͱͰϦεΫͷΫϥεΛཧ͢Δ • Visionary: ৴པੑͷ࠷ߴҐʹ౸ୡ͓ͯ͠Γɺ৴པੑͷ෯͍औΓΈΛ ϕετϓϥΫςΟε͓Αͼܦݧʹج͍ͮͯࣾ֎ͰਪਐͰ͖Δʢͨͱ͑ ॻྨͷ࡞ࣝͷڞ༗ͳͲʣ 3 ৫ͷ৴པੑͷϚΠϯυηοτ:Google SRE ͷݟ 20
Slide 21
Slide 21 text
ิ: ৴པੑͷϚΠϯυηοτ ͱϓϩμΫτͷঢ়ଶ • Absent: ։ൃதͷϓϩμΫτʹͯ·ΔՄೳੑ͕͋ Δ • Reac-ve: ϦϦʔεલ·ͨ҆ఆతظҡ࣋ϑΣʔζ ͷϓϩμΫτʹͯ·Δ • Proac-ve: ΄ͱΜͲͷϓϩμΫτ͕͜ͷϨϕϧʹ͋Δ ͖ • Strategic: ϏδωεΫϦςΟΧϧͳχʔζΛຬͨͨ͢ Ίʹߴ͍Մ༻ੑΛඞཁͱ͢ΔϓϩμΫτʹͯ·Δ • Visionary: ͜ͷϨϕϧʹ౸ୡ͍ͯ͠ΔϓϩμΫτ΄ ͱΜͲͳ͍ 21
Slide 22
Slide 22 text
ࢀߟ: ϓϩμΫτͷϑΣʔζͱٻΊΒΕΔ৴པੑͷมԽ 22
Slide 23
Slide 23 text
ख़Ϩϕϧͷఆٛ ҎԼͷ4ஈ֊ͷఆٛΛߦͬͨ(Visionary֘͢Δέʔε͕গͳ͍ͨΊׂѪ)ɻ • Absent • ΠϯγσϯτϨεϙϯεڥ͕΄΅ະඋͰ͋ΓɺଐਓతͳରԠ͕ৗଶԽ͍ͯ͠Δঢ়ଶ • Reac*ve • ॏେͳোͷରԠํఆ·͍ͬͯΔͷͷɺΠϯγσϯτϨεϙϯεͷڥվળ΄ͱΜͲߦΘΕ͍ͯͳ͍ঢ়ଶ • Proac*ve • ৫શମͰରԠΛߦ͏ମ੍͕͓ͬͯΓɺPre-IncidentPost-IncidentͷϑΣʔζͷऔΓΈʹΑͬͯࣄલʹϦεΫΛݮ ͍ͯ͠Δঢ়ଶ • Strategic • ͦΕͧΕͷϓϩηε͕ମܥԽɾΈԽ͞Ε͓ͯΓɺϑΟʔυόοΫϧʔϓΛճ͠ͳ͕ΒΠϯγσϯτରԠͷෛ୲Λ࠷খԽ ͠ଓ͚͍ͯΔঢ়ଶ 23
Slide 24
Slide 24 text
ධՁࢦඪͷࡉԽ • ΠϯγσϯτϨεϙϯεͷϓϩηεଟذʹΘͨΔͨΊɺ֤Ϩϕϧͷఆٛͩ ͚Ͱ࣮༻ੑ͕͍͠ • → ΠϯγσϯτରԠલɺରԠதɺରԠޙͷ3ϑΣʔζ͝ͱʹɺͦΕͧΕ3ͭ ͷϓϩηεΛධՁ͢Δ • Pre-Incident ϑΣʔζ: ݕɺରԠϑϩʔɺτϨʔχϯά • Response ϑΣʔζ: ݖݶҕৡɺΈԽɺίϥϘϨʔγϣϯ • Post-Incident ϑΣʔζ: ֶशɺੳɺࣄޙλεΫ 24
Slide 25
Slide 25 text
ΠϯγσϯτϨεϙϯεख़Ϟσϧ 25
Slide 26
Slide 26 text
26
Slide 27
Slide 27 text
27
Slide 28
Slide 28 text
ΠϯγσϯτϨεϙϯεվળͷεςοϓ 1. ख़ϞσϧΛͱʹɺ9ͭͷϓϩηεʹରͯ͠ϨϕϧΛఆ͢Δ 2. 1ΛͱʹɺAbsentʙStrategicͷͲͷ͋ͨΓʹ͕ࣗͨͪҐஔ͍ͯ͠Δ ͔Λ֬ೝ͢Δ 3. ؔऀͱͱʹɺΠϯγσϯτϨεϙϯεͷ͋Δ͖ঢ়ଶΛσΟεΧο γϣϯ͢Δ 4. վળͷํੑ͕ఆ·ͬͨΒɺ֤ϓϩηε͝ͱʹ۩ମతͳվળͷΞΫγ ϣϯΛఆΊΔ 28
Slide 29
Slide 29 text
վળͷεςοϓͷ۩ମྫ 1. ख़ϞσϧΛͱʹ9ͭͷϓϩηεʹରͯ͠ධՁΛߦ͏ • ex. Training: AbsentɺDetec5on: Reac5ve...... 2. 1ΛͱʹɺAbsentʙStrategicͷͲͷ͋ͨΓʹ͕ࣗͨͪҐஔ͍ͯ͠Δ͔Λ֬ೝ͢Δ • ex. 9ͭதେΛΊ͍ͯΔϨϕϧ͋Δ͔Λ֬ೝ͢Δ 3. ؔऀͱͱʹɺΠϯγσϯτϨεϙϯεͷ͋Δ͖ঢ়ଶΛσΟεΧογϣϯ͢Δ • ex. Pre-IncidentϑΣʔζ͕શମతʹ͍͚Ͳվળͨ͠΄͏͕Α͍ͩΖ͏͔ 4. վળͷํੑ͕ఆ·ͬͨΒɺ֤ϓϩηε͝ͱʹ۩ମతͳվળͷΞΫγϣϯΛఆΊΔ • ex. ఆܕλεΫͷࣗಈԽʹऔΓ͏ 29
Slide 30
Slide 30 text
֘ՕॴΛ৭͚͢Δͱશମײ͕͔ͭΈ͍͢ 30
Slide 31
Slide 31 text
ϑΣʔζϚΠάϨʔγϣϯͷϙΠϯτ 31
Slide 32
Slide 32 text
Absent → Reac,ve • վળ֓ཁ • ΫϦςΟΧϧͳোͷϑΥϩʔ͕ਝʹͰ͖ ΔΑ͏ʹͳΓɺ৴པੑ্͕͢Δ • ΩʔϙΠϯτ • ॏେͳΠϯγσϯτͷΈʹείʔϓΛߜ্ͬͨ ͰɺPre-IncidentϑΣʔζͱPost-IncidentϑΣ ʔζͷ׆ಈΛ෦తʹ͡ΊΔ͜ͱʹྗ͢Δ • ҙ • ݕͷΈ͚ͩΛඋͯ͠ɺରԠϑϩʔ ͕ະఆٛͰࣦഊʹऴΘΔࣄ͕ଟ͍ 32
Slide 33
Slide 33 text
Reac%ve → Proac%ve • վળ༰ • ΠϯγσϯτϨεϙϯεࣗମͷվળ͕ߦΘΕɺτΠ ϧղফ࠶ൃࢭ͕ਐΉͨΊɺ৫શମͷΠϯγσ ϯτରԠෛՙ͕ܰݮ͞Ε͡ΊΔ • ΩʔϙΠϯτ • ֤ϓϩηεͷମܥԽͱΈԽΛओ؟ʹ্͓͍ͯ ͰɺιϑτΣΞΤϯδχΞϦϯάΛϕʔεʹվળ ׆ಈΛߦ͏ • ҙ • ৫શମΛר͖ࠐΉࢪࡦ͕૿͑ΔͨΊɺ͖ʹج ͍ͮͯҰؾʹਐΊͨΓͤͣɺ֤ϓϥΫςΟε͝ͱ ʹஈ֊తʹਐΊΔͱΑ͍ 33
Slide 34
Slide 34 text
Proac&ve → Strategic • վળ༰ • গͳ͍ϦιʔεͰ࠷େݶͷՁ͕ಘΔͨΊʹɺ ͜Ε·Ͱߏஙͨ͠ΈΛ͞ΒʹϒϥογϡΞ οϓ͠ɺΠϯγσϯτͷෛ୲Λ࠷খԽ͢Δ • ΩʔϙΠϯτ • σʔλυϦϒϯͳվળ͕ϕʔεʹͳΔͨΊɺଞ ͷΩʔϝτϦΫεͱ࿈ܞ͠ͳ͕ΒɺΠϯύΫτ ͷେ͖͍ࢪࡦʹྗ͢Δ • ҙ • ߴͳઐࣝΛඞཁͱ͢Δࢪࡦ͕ଟ͍ͨΊɺ վળ׆ಈࣗମ͕ଐਓԽ͠ͳ͍Α͏ʹҙ͢Δ 34
Slide 35
Slide 35 text
ख़ϞσϧΛΑΓޮՌతʹ׆༻͢ΔͨΊʹ • ࠓճͷϞσϧΛ͖ͨͨͱͯ͠ɺࣗ৫͚ʹվมͯ͠ར༻͢ Δ • ex. ߲ΛݮΒ͢/૿͢ɺҰஈ֊ͣͭϨϕϧΛͣΒ͢ • ۩ମతͳΞΫγϣϯϓϥϯ͕ఆͰ͖Δ߹ه͢Δ • ৫ͷϚΠϯυηοτΛϑΣʔζϚΠάϨʔγϣϯ͢ΔͨΊʹ ɺΠϯγσϯτϨεϙϯεҎ֎ͷྖҬͷվળॏཁ 35
Slide 36
Slide 36 text
ҙ: దͳशख़Ϩϕϧͷݕ౼ • ͯ͢ͷ৫͕ Strategic Λࢦ͢ඞཁͳ͍ • ৴པੑͷϚΠϯυηοτಉ༷ɺϓϩμΫτͷεςʔδ৫ͷ ΧϧνϟʔʹΑͬͯɺదͳϨϕϧҟͳΔ • ex. ϦϦʔεલͷϓϩμΫτ => ৴པੑͷ༏ઌ͕ஶ͍͘͠ ͨΊ Absent Ͱͳ͠ 36
Slide 37
Slide 37 text
ख़ϞσϧʹΑͬͯಘΒΕͨͷ • ؇͔ʹྨ্ͨ͠ͰɺதظతͳվળͷํੑΛࣔͤΔΑ͏ʹͳΓ͍ͨ • → ख़ϨϕϧΛϕʔεʹඪΛఆΊΔ͜ͱͰɺํੑΛڞ༗͠ͳ͕Βվળ͕ਐΊ ΒΕΔΑ͏ʹͳͬͨ • ৫Λר͖ࠐΈ͘͢͢ΔͨΊʹɺஈ֊తͳվળͷεςοϓΛͭ͘Γ͍ͨ • → 9ͭͷϓϩηε͝ͱʹஈ֊తʹਐΊΔ͜ͱ͕Ͱ͖ΔΑ͏ʹͳͬͨ • ख़ͨ͠اۀ͕ࢦ͢ཧঢ়ଶؚΊͯݴޠԽ͢Δ • → StrategicͷఆٛʹΑͬͯɺ(ࠓ·ͰΑΓ)ΑΓൃలతͳվળఏҊͰ͖ͦ͏(ະݕূ) 37
Slide 38
Slide 38 text
·ͱΊ • ΠϯγσϯτϨεϙϯεͷख़ϞσϧΛఏҊ͠·ͨ͠ • ख़ϞσϧΛ׆༻͢Δ͜ͱͰɺϓϩηε୯ҐͰͷվળͪ ΖΜɺํੑΛࣔ͠ͳ͕Βվળ͢Δํ๏Λࣔ͠·ͨ͠ • ख़ϞσϧΛΑΓ࣮ફతʹ͢ΔͨΊʹɺΑΓৄࡉͳυΩϡϝ ϯτͷඞཁੑʹݴٴ͠·ͨ͠ 38
Slide 39
Slide 39 text
͋Γ͕ͱ͏͍͟͝·ͨ͠ 39