Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Amazon inspector で自動セキュリティ診断 / Automatic secur...
Search
Ryo Shibayama
November 20, 2016
Technology
0
68
Amazon inspector で自動セキュリティ診断 / Automatic security diagnostics with Amazon inspector
Ryo Shibayama
November 20, 2016
Tweet
Share
More Decks by Ryo Shibayama
See All by Ryo Shibayama
技術広報の集い #3 Lightning Talk - LayerX
serima
0
380
採用は全員で | Chuo TECH #1
serima
4
1.4k
高専 5 年時に 7 泊 8 日の合宿型ビジコンに参加したら人生が変わった
serima
0
420
カジュアル面談を通して “自社”のことを知る
serima
0
250
倒れても進捗 / Progress even if I fall
serima
1
780
CircleCI 導入への入門 / Introduction to CircleCI
serima
0
94
GameWithを支えるインフラ基盤 - スケールイン・アウト戦略編 / GameWith infrastructure - Scale in and out strategy
serima
0
56
エンジニア採用と PHP / Engineer Recruitment and PHP
serima
0
87
できることから始める OSS Contribution / Start OSS Contribution With What You Know
serima
1
210
Other Decks in Technology
See All in Technology
All About Sansan – for New Global Engineers
sansan33
PRO
1
1.2k
claude codeでPrompt Engineering
iori0311
0
210
Amazon SNSサブスクリプションの誤解除を防ぐ
y_sakata
3
200
AI時代にも変わらぬ価値を発揮したい: インフラ・クラウドを切り口にユーザー価値と非機能要件に向き合ってエンジニアとしての地力を培う
netmarkjp
0
190
20150719_Amazon Nova Canvas Virtual try-onアプリ 作成裏話
riz3f7
0
110
Bliki (ja), and the Cathedral, and the Bazaar
koic
6
840
20250708オープンエンドな探索と知識発見
sakana_ai
PRO
5
1.2k
室長の逆襲 :データ活用の陣地を増やすためのヒント
masatoshi0205
0
150
Introduction to Sansan, inc / Sansan Global Development Center, Inc.
sansan33
PRO
0
2.7k
OpenTelemetry の Log を使いこなそう
biwashi
1
460
Data Engineering Study#30 LT資料
tetsuroito
1
490
Talk to Someone At Delta Airlines™️ USA Contact Numbers
travelcarecenter
0
170
Featured
See All Featured
Chrome DevTools: State of the Union 2024 - Debugging React & Beyond
addyosmani
7
760
GraphQLとの向き合い方2022年版
quramy
49
14k
jQuery: Nuts, Bolts and Bling
dougneiner
63
7.8k
Practical Orchestrator
shlominoach
189
11k
Optimizing for Happiness
mojombo
379
70k
GitHub's CSS Performance
jonrohan
1031
460k
BBQ
matthewcrist
89
9.7k
How to Think Like a Performance Engineer
csswizardry
25
1.8k
Building Better People: How to give real-time feedback that sticks.
wjessup
367
19k
Making the Leap to Tech Lead
cromwellryan
134
9.4k
Java REST API Framework Comparison - PWX 2021
mraible
31
8.7k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
kevinliebholz
34
5.9k
Transcript
Amazon Inspector Ͱ ࣗಈηΩϡϦςΟஅ גࣜձࣾβούϥε @serima / ࣲࢁ ྮ
ࣗݾհ • ىۀˠ·͙·͙ˠάϦʔˠβούϥε • βούϥεೖࣾ 1 ܦͬͨ • αʔόαΠυΤϯδχΞ •
Πϯϑϥ͍ͬͯ·͢
Rint
AWS ͬͯ·͢ • βούϥεͰɺҰ෦αʔϏεͰ AWS Λར༻ • EC2/ELB/Route 53/S3/RDS/ElastiCache
• ελϯμʔυͳߏ
੬ऑੑ ಡΊͳ͍
੬ऑੑ • γεςϜͷ҆શ্ͷܽؕ • ηΩϡϦςΟϗʔϧ • ์͓ͬͯ͘ͱɺ͜ΕΛಥ͔ΕͯඃΛड͚Δ Մೳੑ͕͋Δ
ຖिͷΑ͏ʹݟ͔ͭΔ੬ऑੑ
ใݯ • JPCERT • IPA • Wordpress ެࣜαΠτ • PHP
ެࣜαΠτ • ଞʹ͍Ζ͍Ζ…
None
CVE • Common Vulnerabilities and Exposures • ڞ௨੬ऑੑࣝผࢠ • ถࠃͷMITRE͕ࣾఏڙ͍ͯ͠Δ੬ऑੑใ
σʔλϕʔε • CVE-ID ҰҙʹৼΒΕɺੈքڞ௨
ηΩϡϦςΟνΣοΫɺ ͯ͠·͔͢ʁ
Amazon Inspector • 20165݄ʹҰൠར༻։࢝ • EC2 Πϯελϯεͷ੬ऑੑΛݕͯ͘͠ΕΔ αʔϏε
None
None
ԿͷνΣοΫ͕Ͱ͖Δͷ͔ • Common Vulnerabilities and Exposures • CIS Operating System
Security Configuration Benchmarks • Security Best Practices • Runtime Behavior Analysis
खॱ • Inspector ༻ͷϩʔϧΛ࡞͢Δ • ରͱ͢Δ EC2 ΠϯελϯεʹλάΛઃఆ • σʔϞϯΛΠϯετʔϧ
• ධՁςϯϓϨʔτͷ࡞ • Ͳͷλά͕͍ͭͨΠϯελϯεʹ͍࣮ͭͯߦ͢Δͷ͔ • ԿͷηΩϡϦςΟνΣοΫΛߦ͏ͷ͔ • ࣮ߦ
None
$ curl -O https:// d1wk0tztpsntt1.cloudfront. net/linux/latest/install $ sudo bash install
None
ࢼݧ༻ʹ OpenSSL ͷ όʔδϣϯ͕গ͠ݹ͍ ΠϯελϯεΛ༻ҙ
None
݁Ռ
ͦΕͧΕʹ͍ͭͯৄࡉઆ໌ͱରॲ๏͕ࢀরͰ͖Δ
Ϧϕϯδ ͱΓ͋͑ͣॏཁ High ͷͷͳ͘ͳͬͨ
֦͕Γͱͯ͠ • Amazon SNS ରԠ͍ͯ͠ΔͷͰɺྃ࣌ʹ Slack ͳͲʹ௨ • ͪΖΜ SDK
ެ։͞Ε͍ͯΔͷͰɺఆظత ʹࣗಈ࣮ߦͤ͞Δ͜ͱՄೳ ʢࠓͷͱ͜Ζίϯιʔϧ͔ΒͰ͖Δػೳͳ ͛͞ʣ
҆৺ɾ҆શͳ։ൃΛ • ͱ͍͑ɺ͜Ε͚ͩͰෆे • ੬ऑੑʹରͯ͠ɺҰఆͷอݥΛ͔͚Δ • χϡʔεΛνΣοΫͯ͠ɺదͳରԠΛʂ