外よりも中からの攻撃・ 事故がヤバイ、今やるべきクラウドセキュリティ対策

֎ΑΓ΋த͔Βͷ߈ܸɾ 
ࣄނ͕ϠόΠɺࠓ΍Δ΂͖
Ϋϥ΢υηΩϡϦςΟରࡦ
Ϋϥ΢υ࢖͏ͱϦεΫ͸Ͳ͏ͳΔʁͦΕͰ΋ศར
ͳΫϥ΢υαʔϏεɺਖ਼҆͘͠શʹ࢖͏ํ๏Λ͝
঺հ͠·͢ɻ

View Slide

ͬͦ͘͞Ͱ͕͢
͝ΊΜͳ͍͞

View Slide

͜ͷεϥΠυ͸
߹ܭ
365εϥΠυ͋Γ·͢
͔͠΋Webެ։͠·ͤΜ
ʢͨͿΜʣ
ͲΜͲΜߦ͖·͢

View Slide

ࣗݾ঺հ

View Slide

ᴡ౻ ጏਔ
αΠτ΢ γϯδ

ΞΠϨοτגࣜձࣾ
cloudpackࣄۀ෦
2013೥8݄ೖࣾ
ʲϒϩάʳ
ϩʔυόϥϯεͩͪ͘͢Μ
http://blog.animereview.jp/

View Slide

ϒϩά
ׂͱ͍Ζ͍Ζॻ͍ͯ·ͯ͠

View Slide

ݸਓϒϩά͚ͩͲ40ສPV
̍೔ฏۉ1500PV

View Slide

ͦͷલ͸HPC΍ͬͯ·ͨ͠
ʢϋΠɾύϑΥʔϚϯεɾίϯϐϡʔςΟϯάʣ

View Slide

GPU͍ͬͺ͍ͷͤͯ

View Slide

Ϋϥελ
૊ΜͩΓ
͢ΔΘ͚Ͱ͢

View Slide

ͦͷલ͸2೥͘Β͍
χʔτͯ͠·ͨ͠
ʢ24/365ۈ຿ʣ
ʢͣͬͱήʔϜͯͨ͠ʣ

View Slide

ߋʹͦͷલ͸
υεύϥͷ
๏ਓ෦ୂʹ͍·ͨ͠

View Slide

2009೥ʹ
GMO͞Μͷ
αʔόʔ࡞ͬͨ࣌ͷ
هࣄ
ʢITmedia͞Μʣ

View Slide

͋Δ೔γϯδ͸
໨֮ΊΔͷͰ͢

View Slide

࣌୅͸Ϋϥ΢υ͡ΌͶʁ

View Slide

ͦͯ͠ΞΠϨοτʹ
ඈͼࠐΉ

View Slide

·ͣ୲౰ͨ͠ͷ͸
ϓϩδΣΫτϚωʔδϟʔ

View Slide

ͦͯࣗࣾ͠Webߋ৽

View Slide

͔Βͷ٬ઌৗற

View Slide

΋͸΍ԿͰ΋԰

View Slide

ݱࡏͷݞॻ͖

View Slide

৘ใηΩϡϦςΟ؅ཧ੹೚ऀ

View Slide

ݸਓ৘ใ؅ཧ੹೚ऀ

View Slide

PCI DSS؅ཧ੹೚ऀ

View Slide

ܦྺͱηΩϡϦςΟͷ
γϯΫϩ཰͕ઈ๬త

View Slide

͖͔͚ͬ͸
৽ͨͳ؂ࠪରԠͱ
લ೚ͷୀ৬

View Slide

CTOླ໦
ʮγϯδ܅ηΩϡϦςΟ΍ͬͯʔʯ

View Slide

͍͍ͬ͢Αʔ

View Slide

1͔Βݱ৔Ͱୟ͔Εͯ
ࠓʹࢸΓ·͢

View Slide

ͦͯ͠ޛͬͨ

View Slide

ٕज़ྗʢITϦςϥγʔʣͱ
ηΩϡϦςΟϦςϥγʔ͸
શ͘΋ͬͯൺྫ͠ͳ͍

View Slide

cloudpackࣄۀ෦
͝঺հ

View Slide

ઃཱ
ࢿຊۚ
୅දऀ
ैۀһ਺
ࣄۀ಺༰ γεςϜ։ൃɾอक
ϚωʔδυϗεςΟϯά
2003೥10݄15೔
7,000ສԁ
ᜊ౻ কฏ
117໊ʢ2016೥3݄ݱࡏʣ

View Slide

AWSΛ׆༻͠ͳ͕ΒϏδωεʹूதͰ͖Δ
ίϯγΣϧδϡαʔϏε

View Slide

4 ࣾ
ࣾ
600
6೥
6 ೥ؒAWSͷΈͰ
2 0 1 0
2 0 1 6

View Slide

AWSϓϨϛΞίϯα
ϧςΟϯά
ύʔτφʔ
ΞδΞ஍Ҭ5ࣾ
࠷্Ґύʔτφʔ 4೥࿈ଓ͸2ࣾͷΈ
Premier > Advanced > Standard > Registered
શੈք2331ࣾத

View Slide

AWSίϯϐςϯγʔೝఆ
AWSͷӡ༻อक
ϏοάσʔλͷऔΓѻ͍

View Slide

AWSύʔτφʔΞϫʔυ
࠷ߴӫ༪ͷ
APN Partner of the Year 2೥࿈ଓड৆

View Slide

ཁ͢Δʹ
ಛʹAWSͷߏஙӡ༻อक͕
ಘҙͳձࣾͰ͢

View Slide

ͳͷͰ͕͢

View Slide

ࠓ೔͸AWSʹݶΒͣ
Ϋϥ΢υͱ͍͏෼໺Ͱ
ηΩϡϦςΟతͳ͓࿩Λ
͍ͨ͠ͱࢥ͍·͢

View Slide

Ϋϥ΢υͷ
ηΩϡϦςΟʹ͍ͭͯߟ͑Δ

View Slide

ࢢ৔͸Ϋϥ΢υ΁ෆ͕҆͋Δ
ͦͷ1Ґ͕ηΩϡϦςΟ

View Slide

ͳ͔ͥ

View Slide

ͳΜ͔ͩΑ͘෼͔Βͳ͍͔Β

View Slide

͍΍͍΍
ΦϯϓϨͩΖ͏͕
Ϋϥ΢υͩΖ͏͕
΍Δ͜ͱ͸ҰॹͰ͠ΐ

View Slide

ͱɺࢥ͍ͬͯͨ࣌ظ͕
ࢲʹ΋͋Γ·ͨ͠

View Slide

ྫ͑͹AWS

View Slide

੹೚ڞ༗Ϟσϧ

View Slide

View Slide

ͬͦͪ͘͞ΐͬͱ
ಠಛͳײ͡͠·͢ΑͶ

View Slide

͡Ό͋΋ͬͱΧδϡΞϧͳ
αʔϏεΛݟͯΈ·͠ΐ͏

View Slide

Dropboxͱ͔
Evernoteͱ͔
Google Appsͱ͔

View Slide

͜ΕΒ΋શ෦
Ϋϥ΢υαʔϏεͰ͢ΑͶ

View Slide

தʹ͸ۀ຿Ͱ
ར༻͞Ε͍ͯΔํ΋
͍Βͬ͠ΌΔ͔΋͠Ε·ͤΜ

View Slide

ͦͷ࣌ͷબఆج४ͬͯ
ԿͰ͔͢ʁ

View Slide

ศར͔ͩΒʁ
͔͔҆ͬͨΒʁ

View Slide

ηΩϡϦςΟͷଆ໘Ͱ
ධՁ͠·͔ͨ͠ʁ

View Slide

ԿΛ࣋ͬͯͯ͠
ʮ҆શʯ
ͱ͢Δ͔

View Slide

೉͍͠Ͱ͢ΑͶ

View Slide

cloudpackͰ͸
Ͳ͏͍ͯ͠Δ͔ͱ͍͏ͱ

View Slide

ύεϫʔυΛೖྗͤ͞Δ
αʔϏε͸
શͯ੬ऑͱ͍͏ߟ͑ํ

View Slide

ͦΜͳ͜ͱݴͬͨΒͳΜʹ΋
࢖͑ͳ͍͡Όͳ͍͔ʂ
ͱ͍͏ͷ͸ͦͷ௨Γ
ͳͷͰ͕͢ɺ

View Slide

ࣗࣾͷActive Directory͔Β
SSOʢγϯάϧαΠϯΦϯʣ
Ͱ͖ͳ͍αʔϏε͸
ݪଇ࠾༻͠ͳ͍΋Μʂ
ͱ͍͏ϙϦγʔΛ
͍࣋ͬͯ·͢

View Slide

ͱ͍͏Θ͚Ͱ

View Slide

cloudpack͸ݪଇɺ
AWSͳͲ΁ͷϩάΠϯʹ
ΞΧ΢ϯτ໊΋
ύεϫʔυ΋࢖͍·ͤΜ

View Slide

ࣾ಺Ͱ͸ύεϫʔυΛ࢖͏
γνϡΤʔγϣϯ͸ɺ
ύιίϯʹ
ϩάΠϯ͢Δͱ͖ͱɺ
SSO͢Δͱ͖ͷΈ

View Slide

΋ͪΖΜSSOͳͷͰɺ
Active Directoryʹ
ొ࿥͞Ε͍ͯΔ
ΞΧ΢ϯτ໊ͱ
ύεϫʔυΛ༻͍·͕͢

View Slide

υϝΠϯͱಉ͡
໊લɺύεϫʔυͰ
֤छΫϥ΢υαʔϏεʹ
ొ࿥͍ͯ͠Δ
ͱ͔͍͏
མͪͰ͸ͳ͍Ͱ͢

View Slide

SAMLʢαϜϧʣΛ
࢖͍ͬͯ·͢
͋ͱKerberosೝূͰ͢Ͷ

View Slide

ͳͷͰ
ࣾ಺ͷดҬʹ͋Δ
Active DirectoryΛ
ઈରʹܦ༝͠ͳ͍ͱ
֤छαʔϏεʹ
ϩάΠϯग़དྷͳ͍ͷͰɺ

View Slide

ୈࡾऀ͕Πϯλʔωοτܦ༝
ͰΞΧ΢ϯτΛ৐ͬऔΔ͜ͱ
͕ઈରʹग़དྷͳ͍࢓૊Έ
Ͱ͢

View Slide

΋͠΋ɺ΋͠΋ɺ͋Γ͑ͳ͍
ͱ͸ࢥ͏͚Ͳ

View Slide

ࣾ಺ͷωοτϫʔΫʹ
ܨ͕Εͯ

View Slide

ΞΧ΢ϯτ໊΋όϨͯͯ

View Slide

ύεϫʔυ΋
࿙Εͯͨͱͨ͠Β

View Slide

ϩάΠϯͰ͖ͪΌ͏͡ΌΜ
ͬͯ͜ͱͰ

View Slide

શαʔϏεʹ
ରԠग़དྷΔΑ͏ͳ
ଟཁૉೝূ΋
ೖΕͯ·͢

View Slide

1. ϋʔυ΢ΣΞೝূ
2. ΞΧ΢ϯτೝূ
3. ଟཁૉೝূ
͜ͷ3ͭΛ࢖͍ͬͯ·͢

View Slide

ͱ͸͍͑

View Slide

ΈΜͳ͕ΈΜͳ
SSOͳ؀ڥΛ࡞ΕΔ
Θ͚Ͱ͸ͳ͍Ͱ͢͠

View Slide

ͦ͜·Ͱ͍ΒͶʔ͢
ͬͯձࣾ͞Μ΋
͍Βͬ͠ΌΔͷͰ

View Slide

࠷௿ݶɺ͜Ε͚ͩ͸
΍ͬͯཉ͍͠ͳͱ
ࢥ͏͜ͱ͕͋Γ·͢

View Slide

αʔϏεͷص্ධՁ

View Slide

ಠཱߦ੓๏ਓ
৘ใॲཧਪਐػߏ
ηΩϡϦςΟηϯλʔ͔Β
ൃߦ͞Ε͍ͯΔɺ
தখاۀͷͨΊͷ
Ϋϥ΢υαʔϏε҆શར༻ͷ
खҾ͖

View Slide

View Slide

͜Ε͕͘͢͝ྑ͘ग़དྷ͍ͯͯ
cloudpackͷ಺෦؂ࠪ΍
֎෦؂ࠪͰ΋࢖͍ͬͯ·͢

View Slide

1߲໨ͣͭݟͯΈ·͢

View Slide

Google AppsΛ
ධՁͯ͠Έ·͠ΐ͏

View Slide

1. ར༻ൣғͷ໌֬Խ
Ϋϥ΢υαʔϏεͰͲͷۀ຿ɺ
Ͳͷ৘ใΛѻ͏͔ݕ౼͠ɺ
ۀ຿ͷ੾Γ෼͚΍ӡ༻ϧʔϧ
ͷઃఆΛߦ͍·͔ͨ͠ʁ

View Slide

ిࢠϝʔϧɺϑΝΠϧڞ༗ɺ
εέδϡʔϧ؅ཧͱͯ͠
ར༻͢Δɻ

View Slide

2. αʔϏεͷछྨͱίετ
ۀ຿ʹ߹͏Ϋϥ΢υαʔϏε
Λબఆ͠ɺίετʹ͍ͭͯ
֬ೝ͠·͔ͨ͠ʁ

View Slide

໾һձঝೝࡁΈ

View Slide

3. ѻ͏৘ใͷॏཁ౓
Ϋϥ΢υαʔϏεͰऔΓѻ͏ɺ
৘ใͷ؅ཧϨϕϧʹ͍ͭͯ
֬ೝ͠·͔ͨ͠ʁ

View Slide

ݸਓ৘ใɺސ٬৘ใɺ
ސ٬؀ڥ৘ใͳͲɺ
ॏཁͳ৘ใΛऔΓѻ͏

View Slide

4. ϙϦγʔ΍ϧʔϧͱͷ
੔߹ੑ
ηΩϡϦςΟ্ͷϧʔϧͱ
Ϋϥ΢υαʔϏεͷ
׆༻ͷؒʹ
ໃ६΍ෆҰக͕
ੜ͡·ͤΜ͔

View Slide

ࣾ಺ͷ౷߹ೝূج൫ʹ
ΞαΠϯՄೳ͔ͭɺ
୯ಠͰ΋
ଟཁૉೝূʹରԠ͍ͯ͠Δ

View Slide

5. ར༻؅ཧ୲౰ऀ
Ϋϥ΢υαʔϏεͷಛੑΛ
ཧղͨ͠ར༻؅ཧ୲౰ऀΛ
ࣾ಺ʹ֬อ͠·͔ͨ͠ʁ

View Slide

ద੾ͳ؅ཧऀΛ֬อͨ͠

View Slide

6. Ϣʔβ؅ཧ
Ϋϥ΢υαʔϏεͷϢʔβʹ
͍ͭͯద੾ʹ؅ཧग़དྷ·͔͢ʁ

View Slide

ࣾ಺ͷ౷߹ೝূج൫ʹͯ
؅ཧՄೳ

View Slide

7. ύεϫʔυ
ύεϫʔυͷద੾ͳ
ઃఆɾ؅ཧ͸࣮ࢪͰ͖·͔͢ʁ

View Slide

ࣾ಺ͷ౷߹ೝূج൫ʹͯ
؅ཧՄೳ

View Slide

8. σʔλͷෳ੡
αʔϏεఀࢭ౳ʹඋ͑ͯɺ
ॏཁ৘ใΛखݩʹ֬อͯ͠
ඞཁͳ࣌ʹ࢖͑ΔͨΊͷ
උ͑͸͋Γ·͔͢ʁ

View Slide

αʔυύʔςΟ੡πʔϧ΍
αʔϏεΛར༻͢Δ
ඞཁ͕͋Δ

View Slide

9. ࣄۀऀͷ৴པੑ
Ϋϥ΢υαʔϏεΛఏڙ͢Δ
ࣄۀऀ͸
৴པग़དྷΔࣄۀऀͰ͔͢

View Slide

ੈքత༗໊اۀͰ͋Δɻ
ISAE 3402 Type II ͱ SSAE
16 ೝূ ͱ ISO27001 ͳͲΛ
औಘ͍ͯ͠Δɻ

View Slide

10. αʔϏεͷ৴པੑ
αʔϏεͷՔಇ཰ɺ
ো֐ൃੜස౓ɺ
ো֐࣌ͷճ෮໨ඪ࣌ؒͳͲͷ
αʔϏεϨϕϧ͸
ࣔ͞Ε͍ͯ·͔͢ʁ

View Slide

อূ͢ΔՔಇ཰͸99.9%

View Slide

11. ηΩϡϦςΟରࡦ
Ϋϥ΢υαʔϏεʹ͓͚Δ
ηΩϡϦςΟରࡦ͕
۩ମతʹެ։͞Ε͍ͯ·͔͢ʁ

View Slide

ԼهWebαΠτͰ֬ೝͰ͖Δ
https://support.google.com/
a/answer/60762?hl=ja

View Slide

12. ར༻ऀαϙʔτ
αʔϏεͷ࢖͍ํ͕
Θ͔Βͳ͍ͱ͖ͷࢧԉ
ʢϔϧϓσεΫ΍FAQʣ͸
ఏڙ͞Ε͍ͯ·͔͢ʁ

View Slide

FAQɺϝʔϧɺ24࣌ؒ365೔
ରԠͷి࿩αϙʔτ͕͋Δ

View Slide

13. ར༻ऴྃ࣌ͷ
σʔλͷ֬อ
αʔϏεར༻͕
ऴྃͨ͠ͱ͖ͷɺ
σʔλͷऔѻ৚݅ʹ͍ͭͯ
֬ೝ͠·͠ΐ͏ɻ

View Slide

Google ͷ
ϓϥΠόγʔ ϙϦγʔʹ
ैͬͯɺ
͢΂ͯͷσʔλ͕
Google ͷαʔόʔ͔Β
࡟আ͞ΕΔ

View Slide

14. ܖ໿৚݅ͷ֬ೝ
Ұൠతܖ໿৚݅ͷ֤߲໨ʹͭ
͍ͯ֬ೝ͠·͠ΐ͏ɻ

View Slide

ར༻ن໿Λ֬ೝͨ͠ɻ
http://www.google.com/
apps/intl/ja/terms/
premier_terms.html

View Slide

൑ఆ

View Slide

߹֨

View Slide

߹൱ཧ༝
cloudpackαʔϏεͷఏڙʹ
͓͍ͯॏཁͳπʔϧͱͳΔɻ
े෼ͳSLA΍ɺ؅ཧऀػೳ͕
ఏڙ͞Ε͓ͯΓɺߋʹ͸
౷߹ೝূج൫΁ͷ౷߹͕
Մೳͳ఺͔Βɺ߹֨ͱ͢Δɻ

View Slide

ঝೝ
೔෇ͱঝೝऀΛॻ͘

View Slide

View Slide

֤߲໨ʹ
ʮద߹͍ͯ͠ͳ͚Ε͹
࠾༻ग़དྷͳ͍ʯ
Ͱ͸ͳͯ͘

View Slide

ϦεΫΛચ͍ग़ͯ͠
ೝࣝ͠·͠ΐ͏ͱ͍͏ͷ͕
ओࢫͰ͢

View Slide

͖ͪΜͱϦεΫධՁ͢Ε͹
࢖͑ΔΫϥ΢υαʔϏε͔
൑அͰ͖·͢

View Slide

ͦͯ͠ϦεΫΛࣾ಺ʹ
ڞ༗͠·͠ΐ͏
ͦ͏͢Δ͜ͱͰ

View Slide

Ϋϥ΢υͷεϐʔυײΛ
อͪͭͭɺ
اۀͱͯ͠ͷࣄۀܧଓੑΛ
ߴΊΔ͜ͱ͕
ग़དྷΔ͔΋͠Ε·ͤΜ

View Slide

΍ͬͺ؂ࠪ͸େࣄͩͳͬͯ

View Slide

ηΩϡϦςΟΫϥελʹ͸
3छྨͷਓ͕͍ؒΔͱ
ࢥ͍ͬͯ·͢

View Slide

؂ࠪܥ

View Slide

߈ܸܥ

View Slide

҉߸Խɾೝূٕज़ܥ

View Slide

γϯδ͸؂ࠪܥ͔ͳʁ
ͱ͍͏Θ͚Ͱ

View Slide

վΊͯ؂ࠪʹ͍ͭͯ
ߟ͑ͯΈ·ͨ͠

View Slide

զʑ͕ݴ͏ͱ͜Ζͷ
ηΩϡϦςΟͬͯͷ͸

View Slide

͓͏ͪʹ伴͔͚Δͱ͔

View Slide

໷஗͍ͱ͖͸ిؾ෇͚Δͱ͔

View Slide

ͦ͏͍͏ͷ͡Όͳͯ͘

View Slide

৘ใηΩϡϦςΟͷࣄ
Ͱ͢ΑͶ

View Slide

ͦ΋ͦ΋
৘ใηΩϡϦςΟͬͯ
ͳΜͷ͜ͱͰ͔͢

View Slide

৘ใͷ
ػີੑ
׬શੑ
Մ༻ੑ

View Slide

͜ͷ3ຊபͷࣄͰ͢

View Slide

ػີੑ

View Slide

ΞΫηεΛೝՄ͞Εͨऀ͚͕ͩ
৘ใʹ࣮֬ʹ
ΞΫηεͰ͖Δ͜ͱ

View Slide

׬શੑ

View Slide

৘ใࢿ࢈͕׬શͳ
ঢ়ଶͰอଘ͞Εɺ
಺༰͕ਖ਼֬Ͱ͋Δ͜ͱ

View Slide

Մ༻ੑ

View Slide

৘ใࢿ࢈͕ඞཁʹͳͬͨͱ͖ɺ
ར༻Ͱ͖Δঢ়ଶʹ͋Δ͜ͱ

View Slide

cloudpack͕औಘ͍ͯ͠Δ
֎෦؂ࠪɾೝূ͸
͍Ζ͍Ζ͋ΔͷͰ͕͢

View Slide

ʢެ։ग़དྷͳ͍ʣ

View Slide

γϯδ͸ཱ৔্
͍ΖΜͳ؂ࠪʹ
ཱͪձ͏ͷͰ͕͢

View Slide

࠷ۙࢥ͏͜ͱ͕͋Γ·͢

View Slide

ೝূऔ͔ͬͨΒͬͯ
ͳΜͳͷʁ

View Slide

ࠃ಺ج४
ࠃࡍج४
͍Ζ͍Ζ͋Γ·͚͢Ͳ

View Slide

ຊདྷ͸ɺࣗࣾͷηΩϡϦςΟ
ج४Λ໌֬ʹ͢Δͱ͔ɺηΩϡ
ϦςΟҙࣝΛ্͛ΔͨΊʹ͋
ΔͨΊͷೝূن֨

View Slide

Ͱ΋Կ೥͔΍ͬͯΔͱ
;ͱࢥ͏ΜͰ͢

View Slide

؂ࠪͷҝʹࢿྉ༻ҙͯ͠

View Slide

؂ࠪͷҝʹ͍Ζ͍Ζௐ੔ͯ͠

View Slide

؂ࠪͷҝ
؂ࠪͷҝ

View Slide

ηΩϡϦςΟͲ͍ͬͨ͜

View Slide

ಛʹࢥͬͨͷ͸
SOC2΍ͬͨͱ͖Ͱ͢

View Slide

SOC2ͱ͸ͳΜͳͷ͔

View Slide

ಛఆඇӦར׆ಈ๏ਓ
೔ຊηΩϡϦςΟ؂ࠪڠձ
JASA

View Slide

View Slide

SOC 2
ͱ
SOC 3
ͬͯҰ൪্ʹॻ͍ͯ͋Δ
ʢISMS͕෺଍Γͳ͍ͱ͔
ॻ͔Εͯ·͕͢ʣ

View Slide

Α͠ɺ͜ΕऔΖ͏

View Slide

SOC 2ͬͯͳʹ

View Slide

ถࠃެೝձܭ࢜ڠձ
ʢAICPAʣ͕ఆΊͨ
αʔϏε૊৫ʢService
Organization Controlʣͷ
౷੍ʹؔΘΔ
ධՁۀ຿ͷ࢓૊Έ

View Slide

ʁ

View Slide

SOC 3ͷํ͕Ғ͍ʁ
ʢ਺ࣈతʹʣ

View Slide

௚઀ɺ؂ࠪ๏ਓʹฉ͍ͯΈͨ

View Slide

·ͣ
SOC 1
SOC 2 
SOC 3
͕͋Γ·͢

View Slide

SOC1
ࡒ຿ධՁ

View Slide

SOC 2
ηΩϡϦςΟ
Մ༻ੑ
ॲཧͷΠϯςάϦςΟ
ػີอ࣋
ϓϥΠόγʔ
͜ΕͷͲΕ͔1ͭҎ্

View Slide

SOC 3
SOC 2ͷ಺༰Λ؆ૉʹͯ͠
ެ։จষʹͨ͠΋ͷ

View Slide

ͳΔ΄Ͳ
໾ׂ͕ҧ͏ͷ͔
ࠓճ͸ηΩϡϦςΟʹ
ϑΥʔΧε͍ͨ͠ͷͰ
SOC 2Ͱ͢Ͷʂ

View Slide

͍΍࣮͸΋͏1఺͋Γ·ͯ͠

View Slide

Type 1
ͱ
Type 2

View Slide

Type 1
͋Δ1೔Λ੾Γग़ͯ͠؂ࠪ͢Δ

View Slide

Type 2
3ϲ݄Ҏ্ͷظؒΛ੾Γग़ͯ͠
؂ࠪ͢Δ

View Slide

ͳΔ΄Ͳ
໨ࢦ͢͸SOC 2 Type 2
ͱ͍͏͜ͱͰ͢Ͷʂ

View Slide

؂ࠪ๏ਓ
ʮ͸͍ɺͰ͕͢
·ͣ͸Type 1͔Β
औಘ͞ΕΔͷ͕
ྑ͍ͱࢥ͍·͢ʯ

View Slide

Αʔ͠
͡Ό͋
SOC 2 Type 1ͩʂ

View Slide

ͦͯ͠
2೥΋ͷࡀ݄͕͔͔Γ

View Slide

ͳΜ΍͔Μ΍͋ͬͯ
2015೥8݄31೔
cloudpackࣄۀ෦
SOC2 Type1 डྖ
ʢηΩϡϦςΟͱՄ༻ੑʣ

View Slide

SOC2ͬͯɺ
ͨͩͷϨϙʔτͰ
ೝূͰ͸ͳ͍ΜͰ͢Ͷ

View Slide

Ͱ΋΍Δͱ෼͔ΔͷͰ͕͢
ͲΜͳೝূΑΓ΋
ج४͕ݫͯ͘͠
ਏͯ͘ਏͯ͘ਏͯ͘

View Slide

ߋʹ಺༰͕ެ։͞ΕΔ
͍ͬͯ͏

View Slide

ී௨ɺྫ͑͹ɺ
ISMSऔ͔ͬͨΒͬͯ
ͲΜͳ؂ࠪ಺༰Ͱ
ࢦఠࣄ߲͕͜Μͳ಺༰Ͱ
͜ΜͳձࣾͰͨͬͯ͠

View Slide

ެ։͞Εͳ͍Ͱ͢ΑͶ

View Slide

SOC2͸ɺ
શ෦ެ։͞ΕͪΌ͏

View Slide

ฐ͓ࣾ٬༷ʹ͸
େखاۀ༷΋
͍Βͬ͠ΌΔͷͰ

View Slide

ηΩϡϦςΟઐ໳෦ୂ͕͍ͯ
͔ͳΓࡉ͔͘
ݟͯ͘ΔΜͰ͢Ͷ

View Slide

Լखͳ͜ͱॻ͔ΕͨΒ΋͏
΍͹͍
΍͹͍
΍͹͍

View Slide

ͦ͏͍͏ҙຯͰ͸
SOC2 ͕࠷΋ߟ͑ͤ͞ΒΕͨ
ͱࢥ͍·ͨ͠
ԿΛߟ͔͑ͨͬͯݴ͏ͱ

View Slide

ੑѱઆ

View Slide

͓ӄ༷Ͱγϯδ͸
୭΋৴༻͠ͳ͘ͳΓ·ͨ͠
ʢԿ

View Slide

ͱ͍͏ͷ͸

View Slide

ެ։͍ͯ͠Δ
WebαΠτͳͲ΁ͷ
߈ܸ͔Β৘ใ࿙Ӯ
ͱ͔΋͋Γ·͕͢

View Slide

ͦΕΑΓ΋

View Slide

USBϝϞϦૠͯ͠
σʔλ΋ͬͯͬͪΌ͏ͱ͔

View Slide

ࣗ෼ͷεϚϗܨ͍Ͱ

View Slide

Ոͷύιίϯͱ
Ϋϥ΢υαʔϏεʹܨ͍Ͱ

View Slide

தʹ͸ѱҙΛ΋ͬͯ΍Δਓ΋
͍ΔͷͰ͕͢

View Slide

͍͍ͩͨ͸
ʮͦΜͳͭ΋Γ͸ແ͔ͬͨʯ

View Slide

ʮࡴͭ͢΋Γ͸ແ͔ͬͨʯ

View Slide

1ճͷॏେΠϯγσϯτͰ

View Slide

ձࣾ͸ඈͼ·͢
ʢ࣮ࡍʹඈ͹ͳͯ͘΋
ͦΕ͘Β͍ͷ֮ޛ͸ඞཁʣ

View Slide

ͳͷͰɺੑળઆ͸ηΩϡϦςΟ
ͱ͍͏؍఺Ͱ͸੒Γཱͨͳ͍
ͱࢥ͍·ͨ͠

View Slide

ͱ͋Δ
େखήʔϜاۀ͞Μͱͷ
ҿΈձͰ

View Slide

ʮISMSࣙΊΑ͏ͱ
ࢥͬͯΔΜͰ͢ΑͶʯ

View Slide

͍͍ͱࢥ͏ɻ

View Slide

ISMSΑΓ΋ང͔ʹ
ࠓ࣌ͳݱ࣮తͳ
ΑΓ࣮ફతͳ
ηΩϡϦςΟӡ༻͕
PDCAͰճͬͯΔΜͰ͢΋ͷ

View Slide

͜ͷล͸ɺͱ͋Δࠃࡍج४ͷ
؂ࠪһͱ࿩ͯͯ͠΋
ಉ͡Α͏ͳ࿩୊ʹͳΓ

View Slide

ʮن͕֨࣌୅ʹ௥͍͍͍ͭͯ
ͳ͍ͷͰɺࡉ͔͍͜ͱ͸ྟػ
ԠมʹਐΊ͍ͨͰ͢ʯ

View Slide

;Ήʔͦ͏Ͱ͔͢ʔ

View Slide

͡Ό͋ࠓ࣌ͷن֨ͬͯ
Ͳ͏ͳͷʁͱࢥͬͯ

View Slide

ISO27017
ͬͯΏʔࠓ࣌ͬΆ͍ͷ͕
͋ΔΜͰ͕͢

View Slide

΋ͪΖΜ৽͍͠෺޷͖ͳ
γϯδͱͯ͠͸ɺ
͜Ε΋ߦ͘༧ఆͰ͸
͋Δ΋ͷͷ

View Slide

ͱ͋Δେख
๭؂ࠪһͷ
ൃݴ

View Slide

ʮޚࣾͷ৔߹͸ҙຯͳ͍Ͱ͢Αʯ

View Slide

·͔͡

View Slide

ηΩϡϦςΟʹ
׬ᘳͬͯ
ઈରʹ
ͳ͍͡Όͳ͍Ͱ͔͢

View Slide

͔ͩΒԿࣄʹ΋
ج४͕ඞཁͩͱࢥ͏ΜͰ͢

View Slide

૊৫ʹԿͷج४΋ͳ͍ͱ͔ɺ
औҾઌͷؔ܎Ͱ࢓ํແ͘ͱ͔
ͦʔΏʔͱ͖
ೝূܥ͸ศརͩͱࢥ͍·͕͢

View Slide

͡Ό͋ϓϥΠόγʔϚʔΫ
࣋ͬͯΔ͔Βͬͯ
ઈରʹݸਓ৘ใ
࿙Εͳ͍͔ͬͯ
ͦ͏͡Όͳ͍͠

View Slide

IPS/IDS/WAF
࢖ͬͯΔ͔Βͬͯ
ઈର҆શͱ͸ݴ͑ͳ͍͠

View Slide

PCIDSS Ϩϕϧ1·Ͱ΍ͬͯ
ӡ༻ճͯ͠Δ͔Βͬͯ
ઈରʹΫϨδοτΧʔυ৘ใ
͕࿙Εͳ͍ͬͯ༁͡Όͳ͍͠

View Slide

ηΩϡϦςΟʹઈରͬͯ
ͳ͍ͱࢥ͏ΜͰ͢

View Slide

࣌୅͸ͲΜͲΜมΘΔ͠
ηΩϡϦςΟͷ͋Γ͔ͨ΋
໨·͙Δ͘͠มΘΓ·͢ΑͶ

View Slide

͔ͩΒେࣄͳͷ͸ࣗࣾج४
Λ
ެ։ग़དྷΔ͘Β͍ʹ
ಁ໌ੑΛߴΊΔ͜ͱ
ͩͱࢥ͏ΜͰ͢

View Slide

Ϋϥ΢υΫϥ΢υݴ͍ͬͯΔ
͜ͷ࣌୅ʹٻΊΒΕΔ
ηΩϡϦςΟͱ͸
ಁ໌ੑͷࣄͩͱࢥ͍·͢

View Slide

͜ͷลΓ͸ւ֎ͷํ͕
ਐΜͰΔͳ͊ͱ͍͏
ҹ৅͕͋ͬͯ

View Slide

ͱ͍͏͔ITશൠ͕
೔ຊ஗Εؾຯͬͯ
ײ͡΋൱Ί·ͤΜ͕
ʢશͯͰ͸ͳ͍Ͱ͕͢ʣ

View Slide

ͱ͋ΔIDaaSͰ
৘ใ࿙Ӯࣄ͕݅͋Γ·ͨ͠

View Slide

LastPass
͝ଘ͡Ͱ͔͢ʁ

View Slide

Ϋϥ΢υ্ʹࣗ෼ͷϩάΠϯ
ύεϫʔυΛอ؅͢Δͱ͍͏
͚ͩ͜͜ฉ͘ͱ
ڪΖ͍͠αʔϏεͰ͕͢ɺ
࣮ࡍ࢖͏ͱ௒ศར

View Slide

Ϛελʔύεϫʔυ
ͱ͍͏ͷΛઃఆͯ͠ɺ
ͦΕ͚͓͚֮ͩ͑ͯ͹ɺ
ଞͷαʔϏεͷύεϫʔυ͸
֮͑ͳͯ͘΋͍͍Α͍ͬͯ͏
αʔϏεͳͷͰ͕͢ɺ

View Slide

֎෦͔Βͷ߈ܸͰ
͜ͷϚελʔύεϫʔυ͕
ྲྀग़͢Δͱ͍͏
க໋తͳࣄނ͕ى͖·ͨ͠

View Slide

݁Ռతʹ͸ͦͷύεϫʔυ͸
҉߸Խ͞Εͨঢ়ଶͩͬͨͷͰɺ
߈ܸऀ͕෮߸Խͯ͠ར༻͢Δ
͜ͱ͸ग़དྷͳ͍ͱ͍͏݁࿦Ͱ
ऴΘͬͨͷͰ͕͢

View Slide

ར༻ऀ͔Βͨ͠Βؔ܎ແ͘
Ѩඓڣש
൷൑ͷཛྷ

View Slide

ͦͷதͰ΋ɺ
ͳΔ΄Ͳͱࢥͬͨίϝϯτ͕
͋Γ·ͯ͠ɺ

View Slide

ෆຬ͕͋ΔͳΒ͹ɼαʔϏεͷར༻
ΛࢭΊͨํ͕Α͍Ͱ͠ΐ͏ … ࢲͨ
ͪͷΠϯλʔωοτ͸ɼࠃՈϨϕϧ
ͷࢧԉΛड͚ͨ߈ܸʹࡽ͞Ε͍ͯ·
͢ɻ͢΂ͯͷߦಈɼσδλϧσόΠ
ε಺ͷ͢΂ͯͷΤϯτϦɼ઀ଓ͢Δ
Πϯλʔωοτͷ͢΂ͯ͸੬ऑͰ͢ɻ
ͦͷதͰՄೳͳ࠷ળͷࡦ͕ɼࠓճى
ͬͨ͜͜ͱͳͷͰ͢ …

View Slide

ΫϨʔϚʔͨͪͷ΍͍ͬͯΔ
͜ͱ͸ɼྑ৺తͳاۀʹର͠
ͯɼ໰୊ͷൃදΛࢭΊͤ͞Δ
͜ͱʹͳΓ·͢ɻ୭ʹ΋ϝϦο
τ͸͋Γ·ͤΜɻ

View Slide

Կ͕ى͖͔ͨΛൃද͢Δ͜ͱ
ʹΑͬͯɼଞͷاۀ͸ɼपล
๷ޚͰͦΕʹԠ͑Δ͜ͱ͕Ͱ
͖ΔΑ͏ʹͳΓ·͢ …

View Slide

Πϯλʔωοτʹ઀ଓ͢Ε͹ɼ
୭΋߈ܸ͔Β҆શͰ͸͋Γ·
ͤΜɻใࠂͷಁ໌ੑʹΑͬͯ
ͷΈɼద੾ͳηΩϡϦςΟ͸
ୡ੒Ͱ͖ΔͷͰ͢ɻ

View Slide

͔ͩΒͦ͜
cloudpack͸
ύεϫʔυΛೖྗ͢Δͱ͍͏
ߦҝͦͷ΋ͷΛ
γεςϜͰΧόʔ͢Δ͜ͱͰ
ࣙΊͨͷͰ͕͢

View Slide

ͩͱͯ͠΋ಁ໌ੑ͸ॏཁͩ

View Slide

ͱ͍͏Θ͚Ͱ
͜Μͳͷ࡞Γ·ͨ͠

View Slide

View Slide

ηΩϡϦςΟϗϫΠτϖʔύʔ
ΛಡΜͰΈΔ

View Slide

ηΩϡϦςΟʹର͢Δಁ໌ੑ
Λ֬อ͢ΔͨΊʹɺ
SOC 2؂ࠪͰهड़͞Εͨ
಺༰Λ؆ૉԽͯ͠ɺ
؂ࠪһͷίϝϯτΛ
ল͍ͨ΋ͷ͕
ϕʔεͱͳ͍ͬͯ·͢ɻ

View Slide

ࣾ಺Ͱ࡞ͬͨಡΈ෺Ͱ͸
͋Δ΋ͷͷɺ؂ࠪ๏ਓ΍
֤ηΩϡϦςΟ؂ࠪһɺ
AWSJapan΍
τϨϯυϚΠΫϩͳͲͷ
اۀʹΑΔઐ໳తͳ
ϨϏϡʔ΋ߦΘΕ͍ͯ·͢

View Slide

ͦͷํ͕৴ጪੑ΋
ߴ·Γ·͢͠

View Slide

·ͣ࢝Ίʹ
ʮ੹೚ڞ༗Ϟσϧʯ
ʹ͍ͭͯղઆ͍ͯ͠·͢

View Slide

View Slide

͓٬༷͕ࣗ͝਎Ͱ࡞੒͞Εͨ
ϓϩάϥϜ΍σʔλͷηΩϡ
ϦςΟ͸ɺࣗ͝਎Ͱอޢͯ͠
͍ͩͨ͘ඞཁ͕͋Γ·͢

View Slide

ͪΐͬͱಥ͖์͍ͯ͠Δײ΋
͋Γ·͕͢ɺͦ͏Ͱ͸ͳͯ͘

View Slide

͜Ε·ͰΦϯϓϨϛε؀ڥͰ
͸શͯʹ͍ͭͯηΩϡϦςΟ
Λ֬อ͢Δඞཁ͕͋ͬͨ͜ͱ
ͱൺֱ͢Δͱɺ͓٬༷͕ηΩϡ
ϦςΟΛ֬อͯ͠௖͘ൣғ͕
ݶఆ͞Ε͍ͯ·͢ΑͶɺ
ͱ͍͏͜ͱͰ͢

View Slide

ͦͷޙɺ
ࣄۀ֓ཁͷઆ໌͕͋Γʔͷ

View Slide

֤ೝূͷ࿩͕͋Γʔͷ

View Slide

BCPରࡦͷ࿩͕͋Γʔͷ

View Slide

cloudpack CSIRT
ͷ࿩΋͍ͯ͠·͢

View Slide

CSIRTͱ͸ɺ੬ऑੑ৘ใΛ
ऩूͯ͠ɺͦͷӨڹͷ༗ແͱ
ۓٸ౓ʹ͍ͭͯ൑அͯ͠ɺ
ରԠΛߦ͏νʔϜͷࣄͰ͢

View Slide

ޙ΄Ͳࡉ͔͘આ໌͠·͢

View Slide

ͰɺηΩϡϦςΟ૊৫ͷઆ໌
͕͋Γʔͷ

View Slide

ڭҭମ੍ͷઆ໌͕͋Γʔͷ

View Slide

ਖ਼ࣾһʹΑΔӡ༻ۀ຿ͷ਱ߦ
಺෦͔Βͷ߈ܸϦεΫΛ࠷খ
ݶʹ཈͑ΔҰ؀ͱͯ͠ɺ
cloudpackӡ༻ۀ຿ʹؔΘΔ
ελοϑʹ͍ͭͯ͸ɺਖ਼ࣾһ
ޏ༻ܖ໿Λߦ͍ͬͯΔͱ
ॻ͍ͯ͋Γ·͢

View Slide

ଓ͍ͯ
ϑΝγϦςΟͷ࿩Ͱ͢
ݐ෺ɾ෦԰ͷηΩϡϦςΟ

View Slide

ΧʔυΩʔೝূͱ͔
؂ࢹΧϝϥͱ͔
ిݯ͕ແఀిͱ͔
ϩά͸ແظݶอଘͱ͔
ͦΜͳ࿩Ͱ͢

View Slide

࣍͸ωοτϫʔΫ෦෼

View Slide

View Slide

ೝূγεςϜ΍
ύεϫʔυϙϦγʔ
ೝূ৘ใͷҰݩ؅ཧ
ʹ͍ͭͯઆ໌

View Slide

ӡ༻ۀ຿୺຤ͷηΩϡϦςΟ
Ξϯν΢ΠϧεೖΕΔͱ͔
ϩάऔΔͱ͔
USBϝϞϦ͸࢖͑·ͤΜͱ͔
͋Γ͕͚ͪͩͲɺͪΌΜͱॻ
͍ͯެ։͢Δ

View Slide

࣍͸VPN୺຤
ϦϞʔτͰܨ͍Ͱ͘Δਓ΋͍Δ͚Ͳɺ
Ͳ͏΍ͬͯηΩϡϦςΟΛ
୲อ͍ͯ͠Δ͔͍ͬͯ͏
࿩Λॻ͍͍ͯ·͢
ূ໌ॻೝূͱ͔ɺঝೝ੍ͱ͔ɺ
୺຤ͷ҉߸Խͱ͔

View Slide

ଞʹ΋ɺۀ຿ωοτϫʔΫ
ͦͷ΋ͷͷ੬ऑੑݕࠪͱ͔
ϖωτϨςετͱ͔΋
΍ͬͯΔ࿩Λॻ͍͍ͯ·͢

View Slide

AWSͷӡ༻อकΛ͍ͯ͠Δ
cloudpackʹͱͬͯ
؊৺ͳͷ͸
͔͜͜ΒઌͰ͢

View Slide

cloudpack͔ΒAWS΁ͷ
ΞΫηεʹؔ͢ΔηΩϡϦςΟ

View Slide

ސ٬Linux΍Windows΁ͷ
ΞΫηε͸Ͳ͏ͯ͠Δ͔

View Slide

View Slide

શͯͷຊ൪؀ڥʹ͸
౿Έ୆ܦ༝Ͱͳ͍ͱ
ΞΫηεͰ͖ͳ͍
౿Έ୆΁͸ADೝূ͕ඞཁ
શͯͷૢ࡞͕ಈըͰ
ه࿥͞ΕΔ
ʢOCRͯ͠ςΩετԽ΋ͯ͠Δʣ

View Slide

ͳͷͰɺADͰແޮԽͨ͠
Ϣʔβʔ͸
ސ٬؀ڥʹ͸
ΞΫηεͰ͖ͳ͍

View Slide

AWSϚωδϝϯτίϯιʔϧ
͸Ͳ͏͔

View Slide

View Slide

ී௨͸ϒϥ΢βΛ։͍ͯ
ΞΧ΢ϯτ໊ͱ
ύεϫʔυΛೖྗ͠·͕͢

View Slide

ΞΧ΢ϯτ໊΋
ύεϫʔυ΋͋Γ·ͤΜͷͰ

View Slide

ࣾ಺ઐ༻WebαʔϏε
͔ΒͰͳ͍ͱ
ϩάΠϯͰ͖·ͤΜ
౰વɺ
ΞΫηεϩά͕࢒Γ·͢

View Slide

࣮ࡍʹͲ͏΍ͬͯ
ϩάΠϯ͢Δ͔
ಈըͰ͓໨ʹ͔͚·͢
ʢॳͷࢼΈͳͷͰ
Ұ࣌ఀࢭͱ͔Θ͔Γ·ͤΜ
͝ΊΜͳ͍͞ʣ

View Slide

https://www.youtube.com/watch?v=BUEvNrrrqnU
౰೔͸σϞ͠·͕ͨ͠
ҎԼͷURL͔ΒͲ͏ͧ

View Slide

ϩάͷ࿩
AWSͷૢ࡞ϩά͸
શͯऔಘ͍ͯ͠·͢
ʢCloudTrailϩάʣ

View Slide

͋·Γʹ΋๲େͳͷͰ
Splunk΍Logstorage
ͱ͍ͬͨαʔυύʔςΟ੡ͷ
πʔϧͰՄࢹԽ͍ͯ͠·͢

View Slide

ͦͯ͠CSIRTͷ͓࿩

View Slide

੹೚ڞ༗Ϟσϧͷ࿩͕
͋Γ·ͨ͠

View Slide

͓٬༷ͷ੹೚ൣғ෦෼Ͱ
੬ऑੑ͕
෼͔͍ͬͯͨͱͯ͠
ͦؔ͜܎ͳ͍͔Β
஌Βͳ͍ͽΐʔΜ
ͳΜͯ͜ͱ͸͋Γ·ͤΜʂ

View Slide

View Slide

͋ͱ͸αʔϏε঺հͳͲͳͲ
͋Γ·ͯ͠

View Slide

શ48ϖʔδ

View Slide

݁ߏαΫαΫಡΊ·͢ͷͰ
ͳʹ͔ͷࢀߟʹ
ͳͬͨΓͨ͠Β
خ͍͠Ͱ͢…

View Slide

2015೥ͷ6݄ࠒʹॻ͍ͨͷͰ
ͦΖͦΖ͍Ζ͍Ζ௚ͦ͏ͱ
࢛ۤീ͓ۤͯ͠Γ·͕͢

View Slide

ԿʹͤΑಁ໌ੑ͕େࣄ
ͱ͍͏͜ͱͰ

View Slide

cloudpackͰ͸
ϗϫΠτϖʔύʔࡇΓ
͕։࠵தͰ͢

View Slide

ηΩϡϦςΟͷΈͳΒͣ
MSP΍֤छαʔϏεͷ
ϗϫΠτϖʔύʔΛॻ͍ͯɺ
ͱʹ͔͘ެ։͍ͯ͘͠ͱ͍͏
ํ਑Ͱ͢

View Slide

΋͠ࣄނͬͯ΋
ٽ͔ͳ͍
ϏϏΒͳ͍
Ӆ͞ͳ͍ʂʂ

View Slide

ͱ͸͍͑

View Slide

ެ։͢Δ͜ͱͰඇ೉ΛཋͼΔ
͜ͱ΋͋Δ͔΋͠Ε·ͤΜ

View Slide

ͦͷఔ౓ͷରࡦͰ
େৎ෉ͩͱࢥͬͯΜͷʁ
ͬͯͳ۩߹Ͱ…
ؤுͬͨͷʹ͔ͳͽ͍…

View Slide

͍΍͍΍ɺͦ͏͡Όͳͯ͘

View Slide

׬ᘳͳηΩϡϦςΟͳΜͯ
͋Γ·ͤΜ͔Β

View Slide

ੵΈॏͶੵΈॏͶ

View Slide

1ͭͷେ͖ͳରࡦͰ
େৎ෉ʂ͍ͬͯ͏ͷ͸
΋͸΍ͦΕࣗ਎͕
ϘτϧωοΫʹͳΔࣄ͕͋ͬͯ
ӡ༻͕ਏ͍ΜͰ͢ΑͶ

View Slide

ബ͍૚ΛԿຕ΋Կຕ΋ॏͶͯ
ੵΈॏͶ͍ͯ͘
ΦχΦϯϨΠϠʔηΩϡϦςΟ
ۄͶ͗๷ޚ

View Slide

֎ଆ͚ͩ͡Όແͯ͘
಺ଆ͔Βͷ߈ܸ΍ࣄނ΋
͔ͬ͠ΓରॲɾରԠग़དྷΔΑ
͏ʹ͍ͨ͠Ͱ͢Ͷ
ΦχΦϯϨΠϠʔํࣜͳΒ
࣮૷͠΍͍͢ͱࢥ͍·͢Α

View Slide

AWSʹݶͬͨ࿩Λগ͠

View Slide

Ϋϥ΢υαʔϏεͬͯɺ
͍ΖΜͳηΩϡϦςΟରࡦΛ
֤͕࣮ࣾࢪ͍ͯ͠ΔͷͰ͕͢

View Slide

ྫ͑͹AWS͸Ͳ͏͔

View Slide

View Slide

ͳΜ͔͍ͬͺ͍͋ͬͨ

View Slide

• PCI DSS Ϩϕϧ 1
• SOC 1/ ISAE 3402
• SOC 2
• SOC 3
• FIPS 140-2
• CSA
• FedRAMP (SM)
• DIACAP ͓Αͼ FISMA
• ISO 27001
• MPAA
• ୈ 508 ৚/VPAT
• ITAR

• HIPAA
• DoD CSM Ϩϕϧ 1-2ɺ3-5
• ISO 9001
• CJIS
• FERPA
• G-Cloud
• IT-Grundschutz
• IRAPʢΦʔετϥϦΞʣ
• MTCS Tier 3 Certiﬁcation

View Slide

ͳΔ΄ͲΘ͔ΒΜ

View Slide

͖ͬ͞΋ݴ͍·ͨ͠
؂ࠪΛ໨తͱͯ͠͸͍͚ͳ͍

View Slide

࣮ࡍʹͲΜͳ
ηΩϡϦςΟରࡦ͕
औΕΔͷ͔ɺ
ͪΌΜͱධՁͯ͠ΈΔ͜ͱ͕
େࣄ

View Slide

ྫ͑͹AWSʹ͸
rootΞΧ΢ϯτ
ͱ
IAMΞΧ΢ϯτ
ͱ͍͏ΞΧ΢ϯτ͕͋Γ·͢
ࡉ͔͘ݴ͑͹APIΩʔͱ͔͋Γ·͕͢

View Slide

LinuxͰ
Α͘ݴΘΕ·ͤΜ͔ʁ

View Slide

root͸࢖ͬͪΌμϝͽΐΜ

View Slide

AWSͰ΋ͦͷ௨Γ

View Slide

جຊతʹ͸
IAM 
Identity and Access
Management
Λ࢖͍·͠ΐ͏
ͱ͍ͯ͠·͢

View Slide

ൃߦͨ͠ΞΧ΢ϯτʹରͯ͠
ͲΜͳݖݶΛ౉͔͢
ΊͪΌͪ͘Όࡉ͔͘
ઃఆͰ͖Δ
͠ɺ

View Slide

ʮݸʯΛಛఆͰ͖ΔͷͰ
ϩάʹՁ஋͕ग़Δ

View Slide

ࣄނͬͨͱ͖ʹ
ΞΧ΢ϯτ΋ఀࢭ͠΍͍͢

View Slide

ଞͷΫϥ΢υαʔϏε͸
Ͳ͏ͩΖ͏͔

View Slide

ଟཁૉೝূ͸
؆୯ʹઃఆग़དྷ·͔͢ʁ

View Slide

ඞཁͳਓʹ
ඞཁͳ͚ͩͷݖݶΛ
౉͢͜ͱ͕ग़དྷ·͔͢ʁ

View Slide

΋ͷʹΑͬͯ͸
ࣾ֎͔ΒͷΞΫηεΛ
ېࢭ͢Δ͜ͱ΋
ग़དྷΔͱ͍͍͔΋Ͱ͢ΑͶ

View Slide

ͦ͏ʂ
͔ͩΒͦ͜େࣄͳͷ͸

View Slide

ص্ධՁ
ʢྑͦ͞͏ͩͬͨΒ
࣮ࡍ࢖ͬͯΈΔʣ

View Slide

ࣗࣾʹΨΠυϥΠϯ͕
ແ͚Ε͹ɺ
ઌఔͷΨΠυϥΠϯΛࢀߟʹ
࡞Γ·͠ΐ͏

View Slide

͜ͷ࿩͸
ͩͪ͘͢Μϒϩάʹ΋
ॻ͖·͕ͨ͠

View Slide

௒ϕϯνϟʔͰ
3ਓ͘Β͍͔͍͠ͳ͔ͬͨ
্ཱͪ͛ؒ΋ͳ͍ձࣾʹ
͖ͬ͞ͷධՁγʔτͷ಺༰Λ
ؙ͝ͱฉ͍ͨ͜ͱ͕͋Γ·͢

View Slide

Կ͕͍ͬͯ͢͝

View Slide

ଈ೔Ͱશ෦ճ౴௖͖·ͨ͠

View Slide

༧૝௨Γ্ཱͪ͛ؒ΋ͳ͍
Ϋϥ΢υαʔϏε͕ͩͬͨ
ނʹ
ڧݻͳηΩϡϦςΟ
ͱ͸ݴ͑ͳ͍΋ͷͷ

View Slide

͖ͪΜͱճ౴͍͚ͯͨͩͨ͠ɺ
͔͠΋ެ։ͯ͠΋ྑ͍ͱ
ݴͬͯ௖͚ͨͷʹ͸
ײಈ͠·ͨ͠

View Slide

ͲΜͳαʔϏεΛ
ར༻͢Δʹ΋
ϦεΫ͕͋Δͷ͸
౰ͨΓલͰ͢

View Slide

ࣗࣾͷαʔϏεͩͬͨΒ
100%҆શ͔ͬͯ
ͦ͏Ͱ͸ͳ͍Ͱ͢ΑͶ

View Slide

Ϋϥ΢υʹͳΔͱ
ͲΜͲΜ෼͔Βͳ͘ͳΔ
ͱ͍͏ؾ͕ͯ͠͠·͏
͔ͩΒ͖ͪΜͱධՁͯ͠
ಁ໌ੑΛ֬อ͢Δ

View Slide

ߋʹ৘ใΛࣾ಺Ͱڞ༗ͯ͠
ԿʹؾΛ͚ͭΕ͹ྑ͍͔Λ
ߟ͑ͯ࢖͏

View Slide

Ϋϥ΢υ࣌୅ͷྲྀΕͷ଎͞ʹ
ηΩϡϦςΟ͸
௥͍ͭ͘Μ͡Όແͯ͘
Ҿͬு͍͔ͬͯͳ͖Ό
͍͚ͳ͍
ͱࢥ͏ΜͰ͢

View Slide

LastPassͷ݅Ͱ΋
࿩͠·͕ͨ͠

View Slide

ࣄۀऀؒͰ΋৘ใΛ
ڞ༗Ͱ͖ΔΑ͏ʹͳͬͯ
ΑΓྑ͍αʔϏεΛ
Έͳ͞ΜͱҰॹʹ࡞Γ্͛ͯ
͍͘͜ͱ͕ग़དྷͨΒ
ಁ໌ੑͷߴ͍
ૉ੖Β͍͠ະདྷ͕͋Δͳͱ
ࢥ͍·ͨ͠

View Slide

׬
ͳͷͰ͕͢

View Slide

એ఻

View Slide

T - :441 6 6 S
t i cf W n AC 3 1 1 2 rC vy
t t n l n D E n C r Sf po
Sf r S i ei CA C
a C E ei 1 1
s Sf r CA
W a A c
0 . .4. 6 /64 2 :441 6 6

View Slide

GET!
Twitter
…

View Slide

@awscloud_jp
@jawsdays
!0
+(
#jawsdays
#jawsphoto

*1
%",.2$! 3!

,
84-&!
17:009 )6 #3/5
9:00916:30 Tweet'7
Workshop

View Slide

AWSެࣜFacebookΛϑΥϩʔͯ͠
AWS

(&5
ެࣜFacebookͷ
ʰ͍͍Ͷʂʱ਺͕ ૿͑Ε
͹૿͑Δ΄Ͳɺ Ϗʔۄ
͕ͳ͘ͳΓɺ࠷ޙʹ
Ԡื༻Ϋʔϙϯ൪߸͕
ݱΕ·͢ʂ

View Slide

"84'BDFCPPL ϖʔδʹ
͍͍Ͷʂ͠Α͏ʂ
ΞϚκϯ ΢Σϒ αʔϏε
17࣌ʙͷ࠙਌ձʹͯɺԠื༻URLΛެ։͠·͢
http://bit.ly/AWS-JP-FB

View Slide

͞Βʹ

View Slide

ग़ுʰދ͸ͪձʱin HOOTERS ৽॓ʂ
ʢࢀՃඅແྉɾҿΈ์୊ʣ
͜ͷ͋ͱ19:00 - 21:00

View Slide

͜Μͳ͓ళͰձࣾઆ໌ձΛ͢Δͱ͍͏νϟϨϯδਫ਼ਆ

View Slide

/P ಺༰ ୲౰
-BNCEB ൺاɺଜओ
%FW0QT ݹ౉ʢൺاɺଜओʣ
৘γεɾηΩϡϦςΟ γϯδ

43&ʢ4JUF3FMJBCJMJUZ
&OHJOFFSJOHʣ
ۨᖒ
୤ൡ ޙ౻ɺ૿ా
ΤϯυϢʔβʔ੮ /55υίϞळӬ༷ɾകᖒ༷

View Slide

ࢀՃ৚݅

View Slide

cloudpackʹͪΐͬͱͰ΋
ڵຯ͕͋Ε͹ࢀՃOK
Ͱ΋ۭ͖੮͕࢒ΓΘ͔ͣ

View Slide

ࢀՃ͍ͨ͠ਓ͸
͜ͷ͋ͱ
γϯδͷͱ͜Ζʹ
͍Βͬ͠Ό͍·ͤʂ

View Slide

׬

View Slide

外よりも中からの攻撃・ 事故がヤバイ、今やるべきクラウドセキュリティ対策

外よりも中からの攻撃・ 事故がヤバイ、今やるべきクラウドセキュリティ対策

Sudachi-Kun

More Decks by Sudachi-Kun

Other Decks in Technology

Featured

Transcript

外よりも中からの攻撃・ 事故がヤバイ、今やるべきクラウドセキュリティ対策

外よりも中からの攻撃・ 事故がヤバイ、今やるべきクラウドセキュリティ対策

Sudachi-Kun

More Decks by Sudachi-Kun

Other Decks in Technology

Featured

Transcript

外よりも中からの攻撃・ 事故がヤバイ、今やるべきクラウドセキュリティ対策

外よりも中からの攻撃・ 事故がヤバイ、今やるべきクラウドセキュリティ対策