20260928_登壇資料

Transcript

1. 身代金… _____________________ 株式会社JSOL 山内錬 _____________________
2. 1 怪しいメールが届く 2 添付ファイルを開くと感染 請求書…？ 開いてみよう 添付したファイル を起点に... 3 データが暗号化される ファイルが 開けない… 4 身代金を要求される 暗号化され、 業務で使えな くなります。 データを戻すには 身代金を支払え！ ¥ 「Ransom（身代金）」を 要求します。
3. 自己紹介 名前：山内 錬 所属：株式会社JSOL 経歴：5年目 セキュリティエンジニア （CNAPP : Cortex Cloud , Wiz） (ランサムウェア : Rubrik) 趣味：旅行、脱出ゲーム 2025 Japan AWS Jr. Champions 2025 Japan All AWS Certifications Engineers 2026 Japan AWS Top Engineers 2026 Japan All AWS Certifications Engineers
4. Guidance for Backup & Recovery on AWS Implementation steps 1 Standards for backup/recovery/tagging 2 Create central backup AWS account 3 Delegate AWS Backup in Organizations 4 Role-based access via IAM Identity Center 5 Deploy vaults with CloudFormation StackSets 6 Attach AWS Backup policies to OUs 7 SCP guardrails for AWS Backup resources 8 Central KMS key for AWS Backup 9 Centralize monitoring with Config & Audit Manager AWS Cloud AWS Organizations Management account 1 Backup and recovery planning Infrastructure organizational unit Backup account 2 Security organizational unit Log archive account Audit account 3 Centralized backup vault Backup & Recovery Standards 4 AWS IAM Idsentity Center Tagging Standards Backup valut Backup valut 6 AWS Backup Role-based access AWS Backup Audit Manager S3/CloudTrailAWS/Config 5 8 KMS key for AWS Backup AWS CloudFormation Workload organizational unit Stack Set Workload account 9 7 Audit ManagerAWS Config Report Bucket AWS CloudTrail Backup valut AWS Backup Audit Manager Backup plan
5. Guidance for Backup & Recovery on AWS Implementation steps 1 Standards for backup/recovery/tagging 2 Create central backup AWS account 3 Delegate AWS Backup in Organizations 4 Role-based access via IAM Identity Center 5 Deploy vaults with CloudFormation StackSets 6 Attach AWS Backup policies to OUs 7 SCP guardrails for AWS Backup resources 8 Central KMS key for AWS Backup 9 Centralize monitoring with Config & Audit Manager AWS Cloud AWS Organizations Management account 1 Backup and recovery planning Infrastructure organizational unit Backup account 2 Security organizational unit Log archive account Audit account 3 Centralized backup vault Backup & Recovery Standards 4 AWS IAM Idsentity Center Tagging Standards Role-based access AWS Backup Audit Manager S3/CloudTrailAWS/Config 5 8 KMS key for AWS Backup AWS CloudFormation Workload organizational unit Stack Set Workload account 9 7 1 Backup valut Backup valut 6 AWS Backup Audit ManagerAWS Config Report Bucket Backup valut StepAWS 1/9：標準化から始める CloudTrail 何を・どの粒度で・どのタグで守るかを、先に決めます。 AWS Backup Audit Manager Backup plan
6. Guidance for Backup & Recovery on AWS Implementation steps 1 Standards for backup/recovery/tagging 2 Create central backup AWS account 3 Delegate AWS Backup in Organizations 4 Role-based access via IAM Identity Center 5 Deploy vaults with CloudFormation StackSets 6 Attach AWS Backup policies to OUs 7 SCP guardrails for AWS Backup resources 8 Central KMS key for AWS Backup 9 Centralize monitoring with Config & Audit Manager AWS Cloud AWS Organizations Management account 1 Backup and recovery planning Infrastructure organizational unit Backup account 2 Security organizational unit Log archive account Audit account 3 Centralized backup vault Backup & Recovery Standards 4 AWS IAM Idsentity Center Tagging Standards Role-based access AWS Backup Audit Manager S3/CloudTrailAWS/Config 5 8 KMS key for AWS Backup AWS CloudFormation Workload organizational unit Stack Set Workload account 9 7 2 Backup valut Backup valut 6 AWS Backup Audit ManagerAWS Config Report Bucket Backup valut AWS Backup Audit Manager StepAWS 2/9：中央バックアップアカウントを作る CloudTrail バックアップをワークロードから分離し、守る場所を集約します。 Backup plan
7. Guidance for Backup & Recovery on AWS Implementation steps 1 Standards for backup/recovery/tagging 2 Create central backup AWS account 3 Delegate AWS Backup in Organizations 4 Role-based access via IAM Identity Center 5 Deploy vaults with CloudFormation StackSets 6 Attach AWS Backup policies to OUs 7 SCP guardrails for AWS Backup resources 8 Central KMS key for AWS Backup 9 Centralize monitoring with Config & Audit Manager AWS Cloud AWS Organizations Management account 1 Backup and recovery planning Infrastructure organizational unit Backup account 2 Security organizational unit Log archive account Audit account 3 Centralized backup vault Backup & Recovery Standards 4 AWS IAM Idsentity Center Tagging Standards Role-based access AWS Backup Audit Manager S3/CloudTrailAWS/Config 5 8 KMS key for AWS Backup AWS CloudFormation Workload organizational unit Stack Set Workload account 9 7 3 Backup valut Backup valut 6 AWS Backup Audit ManagerAWS Config Report Bucket Backup valut AWS Backup Audit Manager StepAWS 3/9：Organizationsで委任管理する CloudTrail 各アカウントを個別運用せず、組織単位でバックアップ管理します。 Backup plan
8. Guidance for Backup & Recovery on AWS Implementation steps 1 Standards for backup/recovery/tagging 2 Create central backup AWS account 3 Delegate AWS Backup in Organizations 4 Role-based access via IAM Identity Center 5 Deploy vaults with CloudFormation StackSets 6 Attach AWS Backup policies to OUs 7 SCP guardrails for AWS Backup resources 8 Central KMS key for AWS Backup 9 Centralize monitoring with Config & Audit Manager AWS Cloud AWS Organizations Management account 1 Backup and recovery planning Infrastructure organizational unit Backup account 2 Security organizational unit Log archive account Audit account 3 Centralized backup vault Backup & Recovery Standards 4 AWS IAM Idsentity Center Tagging Standards Role-based access AWS Backup Audit Manager S3/CloudTrailAWS/Config 5 8 KMS key for AWS Backup AWS CloudFormation Workload organizational unit Stack Set Workload account 9 7 4 Backup valut Backup valut 6 AWS Backup Audit ManagerAWS Config Report Bucket Backup valut StepAWS 4/9：復旧権限をロールで分離する CloudTrail IAM Identity Centerで、誰が復旧できるかを明確にします。 AWS Backup Audit Manager Backup plan
9. Guidance for Backup & Recovery on AWS Implementation steps 1 Standards for backup/recovery/tagging 2 Create central backup AWS account 3 Delegate AWS Backup in Organizations 4 Role-based access via IAM Identity Center 5 Deploy vaults with CloudFormation StackSets 6 Attach AWS Backup policies to OUs 7 SCP guardrails for AWS Backup resources 8 Central KMS key for AWS Backup 9 Centralize monitoring with Config & Audit Manager AWS Cloud AWS Organizations Management account 1 Backup and recovery planning Infrastructure organizational unit Backup account 2 3 AWS Backup Backup & Recovery Standards 4 AWS IAM Idsentity Center Tagging Standards Log archive account Audit account 【StackSetsで標準化】 ・Backup Vault Backup valut Backup valut ・IAM Role 6 ・KMS Centralized backup・KeyVault vault Policy(Cross-account copy許可) ・Vault Lock(必要に応じて設定) Role-based access AWS Backup Audit Manager S3/CloudTrailAWS/Config 5 8 KMS key for AWS Backup AWS CloudFormation Workload organizational unit Stack Set Workload account 9 7 5 Security organizational unit Audit ManagerAWS Config Report Bucket Backup valut AWS Backup Audit Manager CloudTrail StepAWS 5/9：保管庫を標準展開する CloudFormation StackSetsで、複数アカウントへ同じ形を配ります。 Backup plan
10. Guidance for Backup & Recovery on AWS Implementation steps 1 Standards for backup/recovery/tagging 2 Create central backup AWS account 3 Delegate AWS Backup in Organizations 4 Role-based access via IAM Identity Center 5 Deploy vaults with CloudFormation StackSets 6 Attach AWS Backup policies to OUs 7 SCP guardrails for AWS Backup resources 8 Central KMS key for AWS Backup 9 Centralize monitoring with Config & Audit Manager AWS Cloud AWS Organizations Management account 1 Backup and recovery planning Infrastructure organizational unit Backup account 2 Security organizational unit Log archive account Audit account 3 Centralized backup vault Backup & Recovery Standards 4 AWS IAM Idsentity Center Tagging Standards Role-based access AWS Backup Audit Manager S3/CloudTrailAWS/Config 5 8 KMS key for AWS Backup AWS CloudFormation Workload organizational unit Stack Set Workload account 9 7 6 Backup valut Backup valut 6 AWS Backup Audit ManagerAWS Config Report Bucket Backup valut AWS Backup Audit Manager Backup plan CloudTrail StepAWS 6/9：OU単位でポリシーを適用する AWS Backupポリシーで、対象アカウントに一貫した保護をかけます。
11. Guidance for Backup & Recovery on AWS Implementation steps 1 Standards for backup/recovery/tagging 2 Create central backup AWS account 3 Delegate AWS Backup in Organizations 4 Role-based access via IAM Identity Center 5 Deploy vaults with CloudFormation StackSets 6 Attach AWS Backup policies to OUs 7 SCP guardrails for AWS Backup resources 8 Central KMS key for AWS Backup 9 Centralize monitoring with Config & Audit Manager AWS Cloud AWS Organizations Management account 1 Infrastructure organizational unit Backup and recovery planning Backup account 2 Security organizational unit Log archive account Audit account 3 Centralized backup vault Backup & Recovery Standards 4 AWS IAM Idsentity Center Tagging Standards Role-based access AWS Backup Audit Manager S3/CloudTrailAWS/Config 5 8 AWS CloudFormation Stack Set KMS key for AWS Backup Workload organizational unit SCP Workload account 9 7 7 Backup valut Backup valut 6 AWS Backup Audit ManagerAWS Config Report Bucket Backup valut CloudTrail StepAWS 7/9：削除されないガードレールを作る SCPで、バックアップ資源の削除・無効化を抑止します。 AWS Backup Audit Manager Backup plan
12. Guidance for Backup & Recovery on AWS Implementation steps 1 Standards for backup/recovery/tagging 2 Create central backup AWS account 3 Delegate AWS Backup in Organizations 4 Role-based access via IAM Identity Center 5 Deploy vaults with CloudFormation StackSets 6 Attach AWS Backup policies to OUs 7 SCP guardrails for AWS Backup resources 8 Central KMS key for AWS Backup 9 Centralize monitoring with Config & Audit Manager AWS Cloud AWS Organizations Management account 1 Backup and recovery planning Infrastructure organizational unit Backup account 2 Security organizational unit Log archive account Audit account 3 Centralized backup vault Backup & Recovery Standards 4 AWS IAM Idsentity Center Tagging Standards Role-based access AWS Backup Audit Manager S3/CloudTrailAWS/Config 5 8 KMS key for AWS Backup AWS CloudFormation Workload organizational unit Stack Set Workload account 9 7 8 Backup valut Backup valut 6 AWS Backup Audit ManagerAWS Config Report Bucket Backup valut CloudTrail StepAWS 8/9：鍵も中央で守る KMS keyを分離し、暗号化と復旧権限をセットで考えます。 AWS Backup Audit Manager Backup plan
13. Guidance for Backup & Recovery on AWS Implementation steps 1 Standards for backup/recovery/tagging 2 Create central backup AWS account 3 Delegate AWS Backup in Organizations 4 Role-based access via IAM Identity Center 5 Deploy vaults with CloudFormation StackSets 6 Attach AWS Backup policies to OUs 7 SCP guardrails for AWS Backup resources 8 Central KMS key for AWS Backup 9 Centralize monitoring with Config & Audit Manager AWS Cloud AWS Organizations Management account 1 Backup and recovery planning Infrastructure organizational unit Backup account 2 Security organizational unit Log archive account Audit account 3 Centralized backup vault Backup & Recovery Standards 4 AWS IAM Idsentity Center Tagging Standards 9 Backup valut Backup valut 6 AWS Backup Role-based access AWS Backup Audit Manager S3/CloudTrailAWS/Config Step 9/9：監査と可視化を中央集約する 5 ConfigとAudit Managerで、守れている状態を説明できるようにします。 8 KMS key for AWS Backup AWS CloudFormation Workload organizational unit Stack Set Workload account 9 7 Audit ManagerAWS Config Report Bucket AWS CloudTrail Backup valut AWS Backup Audit Manager Backup plan