プロダクトセキュリティの「共通言語」を作る ― 技術教育と Policy as Code を例に ― 株式会社Flatt Security 米内 貴志 (@lmt_swallow) 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP dbaY`WcX ihbgeb†b‚…ƒ€ywusrbtWqWxYX n hmWllbjgkq“Xlpbf˜—bwt™ n ”–b‘”d‰ˆ‡ 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP hfaigcYbeg`dXWd Ybetrvqp ‰ ˜—•”†…ƒ‚‡ ‰ “’€ y‘–ˆ†„x‚† kjh’€ fd™e urqpotmnnsl 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP uqtfhgsrprdbair`ruqtfceYXW WydYv ‚i—fb–„ygd“e ’‘“Y‰ˆ™‡”s…ƒf WonmydYv …nb|€f†~“z ‚i—vtb{sb…ƒf 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP uqtfhgsrprdbair`ruqtfceYXW WydYv ‚i—fb–„ygd“e ’‘“Y‰ˆ™‡”s…ƒf WonmydYv …nb|€f†~“z ‚i—vtb{sb…ƒf WŠf bŒ‰ˆe •g“’‘• ŸŸŸr¡Wžš›˜™œ”– 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP ieh`bagfdfYXWc utusYrp v™‘–Xxs—”‡• †…‡rƒ‚“ˆgyw` utihgsYrp h{Xvz`€yx‡t v™‘pnXumXyw` 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP qihedbapcg`fYXW ‡‚†uwƒy x„v„s…tr€ ˆ 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP qihedbapcg`fYXW xwvyus€ryuxt —’–…‡“‰ ˆ”†”ƒ•„‚‘ ˜ 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP fecb`YXadW ‚wprxt syqyh€igvu ƒ fecnkf”jagaf”doam — –•’e˜‰“ˆ‰‡†‘™…„ˆ src 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP „ctiuxpfbqedwya‚v`Ytst€gƒXrWXhƒu e‡—”“‘ddd™–ˆ’˜•…™‰ˆ’ˆ† 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP afdcbf`eYXW ‚wprxt syqyh€igvu ƒ –“‰”g’†‡‘…q“„ v‚y…idf™e—…q 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP fecaYXW`db ‚wprxt syqyh€igvu ƒ –“‰”g’†‡‘…q“„ v‚y…idf™e—…q xc~{m}€ts|ywƒv urq`o}y nzl ‰‡†…ˆ„ ¸²›«¯o©®¥†¨£¡œfecš†ªl±¶ m³ž–§­“¡¬•’yo™™µƒnŽxo~W°Š{ 

G8V4I3RPH9FCE5S@7F"C6A2 G8V4)I3'&#Q%0!2 G8V4(I3'&BU#Q%0!2 G8V4I34TÉÈÇ$DÆÅÉ4ÄÃÂÁÀ !1 G8V4I3RPH9FCE5S@7F"C6A2 G8V4)I3'&#Q%0!2 G8V4(I3'&BU#Q%0!2 G8V4I34TÉÈÇ$DÆÅÉ4ÄÃÂÁÀ !1 h5Cc5`dbXa6fWWW h5Cc5` ÄÃd’0!„€x "ut7c5HPi„p tmsz}ov{xuwpyqnll4|gfekdlr™˜j—–•”i 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP tuyxtugrxavqp‚ifedcdbw`YcshX€W‚ ˆ†…‚ƒ‡‰ †…‚olinhfd˜™ —m–€p”p“’€kp‘ dcvutbw`Y Œuˆ‚ƒ‡Š†ƒ„ ‰~}{‚‚z‚€|Š 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP gtrfisebapcqr`YXWhd ‚€xwWuy xwWgd—f–”’‘ ‰eˆec†c…„e™cƒ qr`YXokji „Y€W{‚…~ufy wvusWzrWxt‚ 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP hxwt‚srygbeucaptvfY`iYd`€tXWq e“‘—–d•˜’ˆ ‡…”‰„–ƒ†™ f 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP hxwt‚srygbeucaptvfY`iYd`€tXWq e“‘—–d•˜’ˆ ‡…”‰„–ƒ†™ f …u‚~wmy}—t€sx}ˆ pƒ|r{zonlkj‚„ihg 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP tsri`fgbdahece`fgbqaYhecWpX ”•w’‘‰–‚˜†…ƒ €„˜yx„ˆ‘ƒvƒu‡—v“ ™ 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP tsri`fgbdahece`fgbqaYhecWpX ”•w’‘‰–‚˜†…ƒ €„˜yx„ˆ‘ƒvƒu‡—v“ ™ zs}wx{˜u~€qvƒnrl kv|„v•‚pt|„•gfheod 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP fecb`XWadY †‡i‚„ƒˆtxwus rvqpv€ƒuhugy‰h… ‘ glmkjh™enid˜—–i”“’•f †•‹wˆŠŒ“~ˆ—ƒŽ—b‡ff{—zxvƒiut |‰€‡s‚rf…„k”kqi’pWf– 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP w‘ˆy†€‡„et€‡‚sqiv‚‰uh†„fdpcgb…ƒa`cYXc…rWx ” e – ™ ˜ — g “ f •d •” •e •– •™ •˜ •— •g •’ qjtsrspnr qsrm kiipojq q tlh tlh “ ‡œ— › œœ koržkttpnmr“Šˆ › œœ tipqƒ€pnmžqsrm€sšmspnr“Š† › œœkrŠqjlkimŠ€ppmŠpš{jtm tpnlshx › œœ— ›› œ v ›– • krŠqjlkimŠ€ppmŠpš{jtm wœ— ›qjlkimŠ€ppmŠpš{jtm wœuœ ”œ œœ qjlkimŠ€ppmŠpš{jtm wœœ qjlkimzppm‚š{jtmœ— › qjlkimzppm‚š{jtmœuœni… › qjlkimzppm‚š{jtmœuœ™˜ ”œjirjœœ™™ q kttpnm sn§m kttpnm qsrm kiipojq tlh tlh jirj lkir« tlh tlh ž ž ž ž ž ž ™kiipojq™ ™˜ ¾Èd‚À»iÃÆ¿ɼ¹Å ¿‘º·¶´³Çɲµ½°Ä ¾Èd‚À»iÃÆ¿ɼ¹Å ¿‘º·¶´³Çɲµ½°Ä 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP †gcyƒ€v„ƒ‚qxetƒsirfƒ€v„ƒpwdbh…auƒ`Yƒ‚qXW p•mnkhfeƒ„lx–`’ ‘opwdbm”isˆ‡ 

È Å Ã Ä Â Á Ç À Æ   ÉÉ  E 3QH P QA'Q S9E64 P QA'Q É90(S(I9 P QA'QR6$9É6(6I#B P QA'QH PP AQ PG F  9 `9 9  ÉÉ S S tÉÉt –“’•” –‘’ˆ•†ƒ‰‚€ wy…vyu‚‡„x 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP bƒpewxuerywt‚sgwdeuƒcia`paxey€wfYhqXvW u”pe”r•mnrkj•gil™d ˜—qt“sY–hg’‘‰gˆg‡†t„g u”pe”r•mnrkj•gil™d ˜—qt“sY–hg’‘‰gˆg‡†t„g 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP bƒpewxuerywt‚sgwdeuƒcia`paxey€wfYhqXvW €zxlz~{uv~rq{npgjk ep™n}˜tpshyfX”“Y|Y—d’‰i•ˆt‡go†…~„ 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP bƒpewxuerywt‚sgwdeuƒcia`paxey€wfYhqXvW x„ƒt„…m}€…lkmvz|so ˆq™‡npt‰r”i~yh—‡e˜f–“–’gw~•sg†ˆgY{‡†n…e„j’g Žw‹ˆŠY ¤‘—“¢†‹~š‡wsn…ew¡€ ewžˆ{Y~‹ˆŠ « ² ­ ° ¯ ® ´ © ³ ¬± ¬« ¬² ¬­ ¬° ¬¯ ¬ª ŽÁÃÀ»¿ À ¿¾¼½ ºÁÀ¹¹½Áà ø·½Â¶µ½ ¸Á»¿ ºÁÀ¾¹½ ½Å½¿º ú¾º¶Ãĸ·¾¿¹½Âĺ» ÉË ÉË ÉË Ê ËË Ê ËËËÈË ÉË ËË Ê ËËËËÈË ÉËÇ Æ ËËËËËË Ê ËËËËËËËË ËËËËËËËËÈË ËËËËËËËË ËËËËËËËËÈË ÏͬÍÎ æõÁ½è¶¿Âµ½È¾äÃȸµ»¶ÂÚÁ»¿ºç æâÁ½è¶¿Âµ½ÉËÛ½ÅÀ½äË×ÖÙËÕµ»¶ÂÔÁ»¿ºËõ»Ãº¶Á½å æÏËëð¬ËëËëËëå ¶õ¾º½Â ¾ä¾ÀºÀ¿¹ÄÁ½ÅÀ½ã ¾¸Ð¿»äµ½Â¹½Â ˺·½ËÀÃö½ËÀÃ˸¾µµÀ¿¹ËÇ»¶ÁËÁ½ÅÀ½äà ˺·½ËÀÃö½ËÀÃ˾¸Ð¿»äµ½Â¹½À (Ž&Y$"# UY3YTQzwGR`@8VwX9ˆtEh4HC&Y$"# « ² ­ ° ¯ ® ´ © ³ ¬± ¬« ¬² ¬­ ¬° ¬¯ ¬® ¬g s¶½ÁÇËu ËË Ëu ËËËË Ëu ËËËËËË Ëu ËËËËËËËË Ëu ËËËËËËËËËË Ëu ËËËËËËËËËËËË ËËËËËËËËËËt ËËËËËËËËËË Ëu ËËËËËËËËËËËË ËËËËËËËËËËt ËËËËËËËËt ËËËËËËt ËËËËt ËËt t ¾äà ¾¸¸»¶¿ºÃ ¸µ»¶ÂÔÁ»¿º ÂÀúÁÀ趺À»¿Ã ¼½º¾Â¾º¾ ÀÀ ¸»¿ÚÀ¹ ½ھ¶µºÛ»»ºwèy½¸… jŽwžˆ{Yed UY3YTQw¡€ ewžˆ{Y~"#s&Y$~oqn…eed « ² ­ ° ¯ ® ´ © ³ ¬± ¬« ¬² ¬­ ¬° ¬¯ ¬ª ½¸ÀÃÀ»¿Ã ÂÀú ¾µµ»ä½Â  ¸Ú¹ ¸Ú¹ Ç ™Ëu ¬ ËÉ‘Ë ¾äÃ;¸¸»¶¿ºÃÇÄÆ ¬ ËÉ‘Ë ¸µ»¶ÂÔÁ»¿ºÍÂÀúÁÀ趺À»¿ÃÇĘ ¬ Ëɑ˷¾ÃĽھ¶µºÄÁ»»ºÄ»èy½¸º¢ ¸»¿ÚÀ¹Š ¬ ËɑËu ¬¬ ÉË ˆ ¬t t ·¾ÃĽھ¶µºÄÁ»»ºÄ»èy½¸º¢ ‰Ëu ¬Â½Ú¾¶µºÄÁ»»ºÄ»èy½¸º¢ ‰Ë‡‘Ë ¦Ë ËÉ‘Ë Â½Ú¾¶µºÄÁ»»ºÄ»èy½¸º¢ ‰ËÉ‘Ë Â½Ú¾¶µºÛ»»ºwèy½¸ºËu ¬ ½ھ¶µºÛ»»ºwèy½¸ºË‡‘Ë¿¶µ— ¬ ½ھ¶µºÛ»»ºwèy½¸ºË‡‘Ëæç ¦Ë½µÃ½ËɑËææ  ¾¸¸»¶¿º À¿õ¶º ¾¸¸»¶¿º ÂÀú ¾µµ»ä½Â ¸Ú¹ ¸Ú¹ ½µÃ½ Ú¾µÃ¼ ¸Ú¹ ¸Ú¹ Í Í Í Í Í Í æ¾µµ»ä½Âæ æç 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP xwviutghsqesrgfcrd`gbpaYXW g‘t™jiˆv™jxw“’˜‰f‡– †„ƒ‚hYXWxwy 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP w‡ˆ†qh…‚€yvs‰igydeyxs„pywrƒbufa`ctYXW ˜–”“W‘•q ”“W‡tqvpnljk iuhYyfyedYsy™ ƒ€W}Y|{~zy vs‰igydeyxs„pyW‡†k …e‘rr h Ÿž•™›š 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP pqhfqgedc`abXiYW iYWvtxsr ‘ d™—–ˆ‡…’„‰ ‘ •ƒ”‚ “˜ˆ†€’„ˆ mlj”‚ hfeg wtsrevoppun 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP urqsihfpeicbgda`iYXWte ƒyxev€‚ yxehe˜g—•“‘’ cf‰Wi‡i†…W`i„ tqenWmplokj |‰Œˆƒi…„i‚‰ie€}’ {†zŠŠ†Ž€~v‹u‡ 

ÆÉÆÅÅÄÈÇÇÃÅÅÂÅÁÀ HRTDSQG1E7VBCI@86FU53Æ0Æ(&9%$Æ)"! ÀÆÆ'"#ÁÆUP ‡‚‘†ˆvƒ…s„€xuwht‰pxrixiqxgf dcbv va`eYyXW g˜™fd—–”vg“ˆ˜˜• qorl hskpj min †ƒ…€|ˆ}z‡y{xv‚uw~vt„ “ˆ z¤›w—šž£‘”’‹ŒŽ•¢Š™xv˜¤– šž£‘”’‹ŒŽ•ñíèÎÝÙ~vt„†ƒ…€ ڈìæŘÈ×弹¼˜ƒÁ…Ťxv˜ ò·‡Í߂뻴³t²±çšž£‘”’‹ŒŽ•Ùé ³°ïñÓ¯‚½®Ñ˜­¢«ºª©Õ³¨§Ì¦ õüøööúôûsù÷s õöÁÃÀÅ ÉÈÆÇ y{x …zˆ ”(’& #%|ˆ}z 210 #%|ˆ}6 y{xv EDC 

 ÉÈÇÆÅÄÃÂÁÀ 1)'&&%!#("$0&