Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
カンムにおけるプロダクトセキュリティのこれまでとこれから
Search
Moto Ishizawa
September 30, 2022
Technology
1
2.9k
カンムにおけるプロダクトセキュリティのこれまでとこれから
Moto Ishizawa
September 30, 2022
Tweet
Share
More Decks by Moto Ishizawa
See All by Moto Ishizawa
LLM エージェントを使った実験
summerwind
0
1.3k
Sharing test cases of internet protocols with Go and OCI Artifacts
summerwind
0
1.1k
Using Thanos as a long-term storage for your Prometheus metrics
summerwind
1
12k
Using Kubernetes as a datastore for SPIRE
summerwind
1
1.1k
Whitebox Controller
summerwind
5
1.8k
Managing Kubernetes manifests with Spruce
summerwind
2
4.4k
Understanding HTTP/2 prioritization
summerwind
16
6.3k
HTTP/2 Deep Dive: Priority & Server Push
summerwind
17
3.5k
HTTP/2 Server Push Considered Harmful
summerwind
1
2.1k
Other Decks in Technology
See All in Technology
Modern_Data_Stack最新動向クイズ_買収_AI_激動の2025年_.pdf
sagara
0
190
20250929_QaaS_vol20
mura_shin
0
110
組織観点からIAM Identity CenterとIAMの設計を考える
nrinetcom
PRO
1
160
o11yで育てる、強い内製開発組織
_awache
3
110
KAGのLT会 #8 - 東京リージョンでGAしたAmazon Q in QuickSightを使って、報告用の資料を作ってみた
0air
0
200
バイブコーディングと継続的デプロイメント
nwiizo
2
410
Access-what? why and how, A11Y for All - Nordic.js 2025
gdomiciano
1
110
[2025-09-30] Databricks Genie を利用した分析基盤とデータモデリングの IVRy の現在地
wxyzzz
0
450
about #74462 go/token#FileSet
tomtwinkle
1
280
業務自動化プラットフォーム Google Agentspace に入門してみる #devio2025
maroon1st
0
180
Oracle Base Database Service 技術詳細
oracle4engineer
PRO
11
77k
AIAgentの限界を超え、 現場を動かすWorkflowAgentの設計と実践
miyatakoji
0
130
Featured
See All Featured
Art, The Web, and Tiny UX
lynnandtonic
303
21k
GraphQLの誤解/rethinking-graphql
sonatard
73
11k
Building a Modern Day E-commerce SEO Strategy
aleyda
43
7.7k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
marktimemedia
31
2.5k
Visualization
eitanlees
148
16k
Speed Design
sergeychernyshev
32
1.1k
Navigating Team Friction
lara
189
15k
No one is an island. Learnings from fostering a developers community.
thoeni
21
3.5k
Principles of Awesome APIs and How to Build Them.
keavy
127
17k
Code Review Best Practice
trishagee
72
19k
Designing for humans not robots
tammielis
254
25k
Music & Morning Musume
bryan
46
6.8k
Transcript
ΧϯϜʹ͓͚Δ ϓϩμΫτηΩϡϦςΟͷ ͜Ε·Ͱͱ͜Ε͔Β -BZFS9ͱ,BONV'JO5FDIελʔτΞοϓηΩϡϦςΟࣄ
Moto Ishizawa Software Engineer, Kanmu, Inc.
None
ϓϩμΫτηΩϡϦςΟʜ 🤔 AWS API Go Python γεςϜߏ ੬ऑੑཧ WAF Logging
PCI DSS GitHub ݖݶཧ IAM VPC PKI TLS มߋཧ Monitoring σϓϩΠ ίϯςφ Linux Django
ϓϩμΫτηΩϡϦςΟʜ 🤔 AWS API Go Python γεςϜߏ ੬ऑੑཧ WAF Logging
PCI DSS GitHub ݖݶཧ IAM VPC PKI TLS มߋཧ Monitoring σϓϩΠ ίϯςφ Linux Django
ॳͷঢ়گ • ϓϩμΫτʮόϯυϧΧʔυʯͷΈ • ܾࡁͷΈΛఏڙ͍ͯ͠ΔͨΊɺηΩϡϦςΟ࠷ॏཁͳཁૉ • όοΫΤϯυΤϯδχΞ CTO ΛؚΊͯ4ਓ •
ϓϩμΫτηΩϡϦςΟͷྖҬओʹ CTO ͕୲ • ࠷ॳͷΠϯϑϥઐΤϯδχΞͱͯ͠ೖࣾ • AWS ԿΘ͔ΒΜϚϯ
ͻͱ·ͣͷઓུ • ϓϩμΫτ։ൃʹࢀՃͯ͠γεςϜͷมߋϑϩʔΛѲ͢Δ • AWS ͳͲͷΫϥυαʔϏεͷཧऀݖݶΛΒ͍ར༻ঢ়گΛѲ͢Δ • ։ൃӡ༻ʹؔΘΔ֤छαʔϏεͷݖݶཧͷঢ়گΛѲ͢Δ • ηΩϡϦςΟ໘Ͱͷ੍ΛѲ͢Δ
ݟ͖͑ͯͨ՝ϦεΫ • Վతͳ AWS ͷཧ • ͍͋·͍ͳݖݶཧมߋཧͷϓϩηε • ։ൃ࣌ظʹΑΓҟͳΔγεςϜߏ •
PCI DSS ʹΑΔ੍ͱଐਓతͳͦͷӡ༻ • Կ͔ى͖ͯؾ͚ͳ͍ɾௐࠪͰ͖ͳ͍ྖҬ͕͋Δ • ͳͲͳͲ…
1$*%44ͱ • Payment Card Industry (PCI) ͱ͍͏ΫϨδοτΧʔυͷۀքஂମ͕ࡦఆͯ͠ ͍Δ Data Security
Standard (DSS) ͱ͍͏ඪ४ͷ͜ͱ • ΧʔυใΛదʹཧ͢ΔͨΊͷηΩϡϦςΟج४͕ఆٛ͞Ε͍ͯΔ • ΧϯϜΫϨδοτΧʔυΛൃߦ͢Δཱͱͯ͠४ڌ͕ٻΊΒΕ͍ͯΔ • υΩϡϝϯτެࣜαΠτ͔Β୭ͰμϯϩʔυͰ͖Δ • https://www.pcisecuritystandards.org/document_library/
վળํʮϕʔεϥΠϯΛ͑Δʯ • ઃఆͷ౷ҰΨόφϯεͷڧԽ • ϚωʔδυαʔϏεΛ׆༻ͨ͠γεςϜߏͷཧ • Կ͔͕ى͖ͯͦΕʹؾ͖ͮɺௐࠪͰ͖ΔΑ͏ʹ͢Δ (ࠪੑͷ্) • ࠷খݖݶͷݪଇʹै͏
• CTO ʹλεΫ͕ूத͢Δঢ়ଶ͔Βͷ٫ • ։ൃऀͷମݧҰॹʹվળ͢Δ
"84ͷվળྫ • ϕετϓϥΫςΟεʹجͮ͘ઃఆͷಋೖ • AWS Organization ͱ AWS SSO (AWS
IAM Identity Center) ͷಋೖ • CloudTrail ͱ AWS Con fi g ͷ༗ޮԽͱϩάઐ༻ΞΧϯτͰͷҰݩཧ • GuardDuty ͱ Security Hub ͷಋೖ • վળޮՌ • ଟ͘ଘࡏ͍ͯͨ͠ IAM User Λશʹഇࢭ • SSO ʹΑΓෳͷ AWS ΞΧϯτͷϩάΠϯ͕༰қʹ • Կ͔ҟৗ͕͋ͬͯͦΕʹؾ͍ͮͯௐ͕ࠪͰ͖Δঢ়ଶʹ
(JU)VCͷվળྫ • ϕετϓϥΫςΟεʹجͮ͘ઃఆͷಋೖ • ݖݶͷ୨Է͠ͱ Team Permission ͷඋ •
CODEOWNERS Branch Protection ͷઃఆ • ࣗಈΞαΠϯ Slack ௨ͷ༗ޮԽ • վળޮՌ • ѱҙͷ͋Δมߋվ͟ΜΛ࠷ݶࢭ • มߋݖݶΛ࣋ͭਓͷ໌֬Խ • Slack ͰΓͱΓ͍ͯͨ͠ϨϏϡʔґཔͷࣗಈԽ
γεςϜߏͷվળྫ • ϚωʔδυαʔϏεͷஔ͖͑ΞΫηε੍ޚͷݟ͠Λ࣮ࢪ • Session Manager Λಋೖ͠ɺ2िؒʹ1ճ͙Β͍յΕΔ LDAP Λൃഁղମ •
Cloud One Λಋೖ͠ɺಠࣗӡ༻͍ͯͨ͠ OSSEC Λൃഁղମ • վળޮՌ • ӡ༻ෛՙͷܰݮ • ϞχλϦϯά͓Αͼࠪੑͷ্ • SSO ʹΑΓ EC2 ΠϯελϯεͷΞΫηε͕༰қʹ
1$*%44ؔ࿈ͷվળྫ • ཁ݅ͷཧղͱӡ༻໘ͷඋ • ࠪʹରԠ͢ΔϝϯόʔͰશ12ཁ݅ͷಡΈ߹ΘͤձΛ࣮ࢪ • ఆظతʹඞཁͳӡ༻λεΫΛચ͍ग़͠ͱͦͷλεΫͷ࣮ࢪ • ཁ݅ͱ࣮ࡍͷγεςϜʹ͋ΘͤͨࣾϙϦγʔͷݟ͠ •
վળޮՌ • CTO ͕ରԠ͍ͯͨ͠ӡ༻ΛνʔϜͰͰ͖ΔΑ͏ʹͳͬͨ • 3.5ਓఔͰ2ͭͷϓϩμΫτͷ PCI DSS ४ڌΛୡ
৽ϓϩμΫτ1PPMͷϦϦʔε • ϦϦʔεલʹϕʔεϥΠϯ͓͖͍͑ͯͨ • AWS γεςϜશମͷઃఆͷϨϏϡʔ • PCI DSS ཁ݅ͷ४ڌʹؔΘΔઃఆͳͲͷϨϏϡʔ
• όϯυϧΧʔυͰݟ͔ͭͬͨطͷ੬ऑੑͷରԠ • վળޮՌ • طͷ੬ऑੑʹ͍ͭͯϦϦʔεલʹରࡦͰ͖ͨ • ϦϦʔε࣌ͷߏͰ PCI DSS ͷ४ڌΛୡ
͜͜·Ͱͷঢ়گ • ϓϩμΫτηΩϡϦςΟͷϕʔεϥΠϯ͖ͬͯͨ • େ͖ͳ੍ͱͳΔ PCI DSS ͷӡ༻ࠪνʔϜͰରԠͰ͖͍ͯΔ • ࠓޙࣗಈԽͷਪਐ৽ٕज़ͷಋೖɺ͞ΒͳΔϦεΫܰݮࡦͷ࣮ΛਐΊΔ
• ηΩϡϦςΟΛιϑτΣΞͰ࣮͍ͯ͘͠ɺ৭ʑͱָ͘͠ͳΔϑΣʔζ
ࠓޙ͍͖͍ͬͯͨ͜ͱ • EC2 ΛՄೳͳݶΓഇࢭͯ͠ίϯςφҠߦ (ਐߦத) • ηΩϡΞͰͳ͍ Go ͳͲͷίʔυͷࣗಈݕ •
੬ऑੑ͓ΑͼαϓϥΠνΣʔϯؔ࿈ͷϞχλϦϯάͱͦͷରԠͷڧԽ • AWS GitHub ͳͲͷઃఆͷܧଓతͳݕূͱͦͷରԠͷࣗಈԽ • PCI DSS ͓ΑͼίϯϓϥΠΞϯεؔ࿈ӡ༻ͷࣗಈԽ • PCI DSS v4 ͷ४ڌ
ҰॹʹΓ·ͤΜ͔ʂ https://team.kanmu.co.jp/
Thanks!