"844FDVSJUZ)VCΛ͍͜ͳͤͳࣦͯ͘ഊͯ͠͠·͏ΞϯνϨγϐถᖒ
View Slide
ถᖒ 5BLVZB:POF[BXBʹ4*FSʹ৽ଔೖࣾɻݱࡏ࢈ۀۀքͷ͓٬༷͚ʹ"84ڥશൠͷઃܭߏஙΛ୲ɻ8։ൃ͔Β"84౷੍ɺΫϥυΨΠυϥΠϯࡦఆͳͲ ԿͰzࢲͷࣄ4FDVSJUZ)VCʹΑͬͯΓཱ͍ͬͯ·͖͢ͳ"84αʔϏε 4". "QQMJDBUJPO$PNQPTFS $PEF1JQFMJOF͖ͳٕज़ /FYUKT /FTU+4 5BJMXJOE$44 %PDLFS LTझຯ ֨ಆٕʢରઓΑΖ͓͘͠ئ͍͠·͢ʣɺ͓ՈLIUUQTUXJUUFSDPNUBLVZB@ZOF
͡Ίʹ§ /*45ͷ$ZCFS4FDVSJUZ'SBNFXPSL $4'ͱ "84αʔϏε識別- Identity -防御- Protect -検知- Detect -対応- Respond -復旧- Recover -AWS Config AWS Security HubAWS Shield Amazon GuardDutyAmazonInspectorAmazonMacieAWS WAF Amazon DetectiveIAMAWS KMSAWSNetwork FirewallAmazonVerifiedPermissionsAWSSystems ManagerAWS LambdaAWSSystems ManagerAWS CloudFormationAWS BackupAWSElastic Disaster Recovery(AWS DRS)
͡Ίʹ§ /*45ͷ$ZCFS4FDVSJUZ'SBNFXPSL $4'ͱ "84αʔϏε識別- Identity -防御- Protect -検知- Detect -対応- Respond -復旧- Recover -AWS Config AWS Security HubAWS Shield Amazon GuardDutyAmazonInspectorAmazonMacieAWS WAF Amazon DetectiveIAMAWS KMSAWSNetwork FirewallAmazonVerifiedPermissionsAWSSystems ManagerAWS LambdaAWSSystems ManagerAWS CloudFormationAWS BackupAWSElastic Disaster Recovery(AWS DRS)lݕzքͷେޚॴ4FDVSJUZ)VC༷ͷ͓Ͱ͢
ͬͦ͘͞ຊɻɻ4FDVSJUZ)VC҄ϲۼ͞ΜηογϣϯͰղઆࡁΈͳͷͰ
BBTEGBGB§ BBBBB▸BBBBBB− CCCCC§ BBBBB▸BETBGBEGείΞʁग़དྷΒ͋ͬʂ͡Όͳ͍ʂʁةݥ͔ͩΒૣ͘ੋਖ਼͠ΖʂౖΒΕΔ͔Β͜ͷϧʔϧΛ0''ʹͯͬ͠ͱɻɻͦͷ
ग़དྷ·ͤΜͰͨ͠ʜ§ ࡶʹ4FDVSJUZ)VCΛσϑΥϧτઃఆͰ༗ޮԽ͢Δͱʜ▸$*4Wʢݸʣͱ "84جૅηΩϡϦςΟͷϕετϓϥΫςΟεWʢݸʣ͕༗ޮԽɺʢେମͷ߹ʣͱΜͰͳ͍είΞ͕ग़Δ:"7":ʂ
ఘΊͳ͍Ͱʂ§ ͓͖͍ͬͯͨ4FDVSJUZ)VCείΞࢉग़ϧʔϧhttps://docs.aws.amazon.com/ja_jp/securityhub/latest/userguide/standards-security-score.html
ఘΊͳ͍Ͱʂ§ ͓͖͍ͬͯͨ4FDVSJUZ)VCείΞࢉग़ϧʔϧhttps://docs.aws.amazon.com/ja_jp/securityhub/latest/userguide/standards-security-score.htmlείΞʹίϯτϩʔϧͷ߹֨༗ޮίϯτϩʔϧॏཁ $SJUJDBM)JHI.FEJVN-PXߟྀ֎ͳͷͰείΞʹ:"7": Ͱͳ͍
ఘΊͳ͍Ͱʂ§ ͔ͱ͍ͬͯɺԿݟͳ͍͍ͯ͘zͰͳ͍zͰ͢ʂ▸ॏཁɿ$SJUJDBMΘΓ͔͠ΞτؾຯͳͷͰɺඞͣνΣοΫΛ▸্هʹ߹Θͤͯ(VBSE%VUZͷݕग़݁ՌΛ֬ೝ͓ͯ͘͠ͱ٢
BBTEGBGB§ BBBBB▸BBBBBB− CCCCC§ BBBBB▸BETBGBEGͱΓ͋͑ͣશϧʔϧνΣοΫͳΜ͔͍ͬͺ͍ج४͕͋Δ͔Β༗ޮԽͪ͠Ό͑ʂͨ͘͞ΜνΣοΫͯ͠ࠔΔ͜ͱͳ͍ͩΖ͏ʜͦͷ
4FDVSJUZ)VCΛ௨͢Δͷͱͯ؆୯§ ͓खܰ௨ύλʔϯूAmazonEventBridgeAWS Security HubEvent RuleAmazon SNSIncidentManagerAWSSystems ManagerAWS ChatbotAmazon SNSͯ͢ίʔσΟϯάແ͠Ͱ࣮ݱՄೳ 👏
4FDVSJUZ)VCΛ௨͢Δͷͱͯ؆୯§ ͓खܰ௨ύλʔϯूIncidentManagerAWSSystems ManagerAWS ChatbotAmazon SNSͯ͢ίʔσΟϯάແ͠Ͱ࣮ݱՄೳ 👏Amazon SNSAmazonEventBridgeAWS Security HubEvent Rule
4FDVSJUZ)VCΛ௨͢Δͷͱͯ؆୯§ ͓खܰ௨ύλʔϯूIncidentManagerAWSSystems ManagerAWS ChatbotAmazon SNSͯ͢ίʔσΟϯάແ͠Ͱ࣮ݱՄೳ 👏Amazon SNSAmazonEventBridgeAWS Security HubEvent Rule🤢 ੜ+40/ "4''ΛύʔεͰ͖Δ࿉͞Εͨ4FDVSJUZ)VCϢʔβͷΈͷબΕ͠௨ํ๏
4FDVSJUZ)VCΛ௨͢Δͷͱͯ؆୯§ ͓खܰ௨ύλʔϯूAmazon SNSIncidentManagerAWSSystems Managerͯ͢ίʔσΟϯάແ͠Ͱ࣮ݱՄೳ 👏AWS ChatbotAmazon SNSAmazonEventBridgeAWS Security HubEvent Rule
4FDVSJUZ)VCΛ௨͢Δͷͱͯ؆୯§ ͓खܰ௨ύλʔϯूAmazon SNSIncidentManagerAWSSystems Managerͯ͢ίʔσΟϯάແ͠Ͱ࣮ݱՄೳ 👏AWS ChatbotAmazon SNSAmazonEventBridgeAWS Security HubEvent Rule👍4MBDL5FBNTʹ௨͕ྲྀΕΔͷͰ͙͢ؾ͚Δ👍Πϕϯτ༰͕αϚΒΕ͍ͯΔͷͰݟ͍͢👍$IBU#PU͔ΒίϚϯυ3VOCPPL͕࣮ߦͰ͖ΔͷͰ͍͜ͳͤΕշదͳ$IBU0QT
4FDVSJUZ)VCΛ௨͢Δͷͱͯ؆୯§ ͓खܰ௨ύλʔϯूAmazon SNSAWS ChatbotAmazon SNSͯ͢ίʔσΟϯάແ͠Ͱ࣮ݱՄೳ 👏IncidentManagerAWSSystems ManagerAmazonEventBridgeAWS Security HubEvent Rule
4FDVSJUZ)VCΛ௨͢Δͷͱͯ؆୯§ ͓खܰ௨ύλʔϯूAmazon SNSAWS ChatbotAmazon SNSͯ͢ίʔσΟϯάແ͠Ͱ࣮ݱՄೳ 👏IncidentManagerAWSSystems ManagerAmazonEventBridgeAWS Security HubEvent Rule👍l୭͕z z͍ͭz ରԠΛ࢝Ί͔ͨྃͨ͠ͷτϥοΫ👍աڈͷྨࣅࣄͱͷؔ࿈͚👍ϝʔϧ4.4 5&-ͳͲ๛ͳνϟωϧ
44.*ODJEFOU.BOBHFS44.*ODJEFOU .BOBHFSͱͯԞ͕ਂ͍ͷͰ0QT+"84ͷԼهࢿྉΛνΣοΫʂhttps://speakerdeck.com/yoshiiryo1/aws-systems-manager-incident-manager-deshi-xian-suruinsidentoguan-li
ࢲͷۤखͳݴ༿Ͱ͢ͱΓ͋͑ͣϧʔϧ0/͔ΒͷͱΓ͋͑ͣ௨
Կ͕ݴ͍͍͔ͨʁhttps://www.oreilly.co.jp/books/9784873119847/lϊΠζͷଟ͍ΞϥʔτΞϥʔτർΕΛى͜͠ɺΞϥʔτΛʹཱͨͳ͍ͷʹͯ͠͠·͍·͢ɻlΞϥʔτγεςϜʹଟ͘ͷϊΠζΛൃੜͤͯ͞͠·͍ɺͦΕΒ͙͢ʹແࢹ͞ΕΔΑ͏ʹͳΓɺΞϥʔτ͕ൃੜ͍ͯ͠Δͷ͕ਖ਼ৗͩͱݟΒΕͯ͠·͏͜ͱͰ͢ɻষ ΞϥʔτർΕ ΑΓ
Կ͕ݴ͍͍͔ͨʁhttps://www.oreilly.co.jp/books/9784873119847/lϊΠζͷଟ͍ΞϥʔτΞϥʔτർΕΛى͜͠ɺΞϥʔτΛʹཱͨͳ͍ͷʹͯ͠͠·͍·͢ɻlΞϥʔτγεςϜʹଟ͘ͷϊΠζΛൃੜͤͯ͞͠·͍ɺͦΕΒ͙͢ʹແࢹ͞ΕΔΑ͏ʹͳΓɺΞϥʔτ͕ൃੜ͍ͯ͠Δͷ͕ਖ਼ৗͩͱݟΒΕͯ͠·͏͜ͱͰ͢ɻʘ͜͏ͳΓ·͢ʂʗϝʔϧະಡ݅ষ ΞϥʔτർΕ ΑΓ
Ε͍͚ͯͳ͍ίετ§ 4FDVSJUZ)VCͱ$POGJHχίΠν 4FDVSJUZ)VCϧʔϧΛ0O $POGJHϧʔϧ͕࡞͞ΕΔʢTFDVSJUZIVCIPHFʣ $POGJHͷධՁ݁ՌΛ4FDVSJUZ)VC࿈ܞAWS Config AWS Security HubEC2LambdaRDSVPC৭ʑͳ"84ϦιʔεϦιʔεͷมߋཤྺConfigRule$POGJHϧʔϧͷධՁ݁Ռ💰ϙΠϯτᶃ 💰ϙΠϯτᶄ💰ϙΠϯτᶅ
Ε͍͚ͯͳ͍ίετ§ ֤՝ۚϙΠϯτͷৄࡉʢWFSʣ▸ᶃ $POGJHϨίʔμʔͷϦιʔεه− Ϧιʔε͝ͱʹ▸ᶄ $POGJHϧʔϧͷධՁ▸ᶅ4FDVSJUZ)VCνΣοΫ݁ՌऔΓࠐΈhttps://aws.amazon.com/jp/security-hub/pricing/https://aws.amazon.com/jp/config/pricing/
Ε͍͚ͯͳ͍ίετ§ $POGJHͷϧʔϧධՁλΠϛϯάhttps://docs.aws.amazon.com/ja_jp/config/latest/developerguide/evaluate-config-rules.html
Ε͍͚ͯͳ͍ίετ§ $POGJHͷϧʔϧධՁλΠϛϯάhttps://docs.aws.amazon.com/ja_jp/config/latest/developerguide/evaluate-config-rules.html&$&$4ͷ"VUP4DBMJOHͰᶃ $POGJHϧʔϧͷ࠶ධՁ՝ۚᶄ$POGJHͷΠϕϯτऔΓࠐΈ՝ۚ ͷμϒϧύϯνʂ
͡Ό͋ϧʔϧબఆͲ͏͢Εʁʁ
ύλʔϯᶃɿશϧʔϧཁ൱֬ೝ§ ར༻͍ͯ͠ΔαʔϏε4$1౿·͑ͯϧʔϧબఆ▸4&γεςϜΛࣗͷखͰ੍ޚ͍ͨ͠ੜ͖Ͱ͢ 4".1-&
4FDVSJUZ)VCͷϧʔϧΞοϓσʔτͱڞʹ૿͑Δ
4FDVSJUZ)VCΞοϓσʔτͷΥονhttps://docs.aws.amazon.com/ja_jp/securityhub/latest/userguide/securityhub-announcements.html
ύλʔϯᶃɿશϧʔϧཁ൱֬ೝ§ શϧʔϧཁ൱֬ೝ▸4&γεςϜΛࣗͷखͰ੍ޚ͍ͨ͠ੜ͖Ͱ͢ 4".1-&4FDVSJUZ)VCϧʔϧͷΞοϓσʔτैˠ ϧʔϧՃഇࢭڴҖͷมߋΛΥον͢Δମ੍ˠ ֤"84αʔϏε͕νϣοτϫΧͬͯϦεΫධՁͰ͖Δਓࡐఆظతͳϧʔϧ୨Է͠ͷϓϩηεཱ֬ˠ ॳظߏஙͯ͠೩͑ਚ͖͕ͪ͜ͷӡ༻Λճ͢ʹڧ͍ҙࢤɾମ੍͕ඞཁͰ͢ʢڭ܇ʣ
ڧ͍ҙࢤɾମ੍͕ͳ͍ͷͰ͋Εʜ
ύλʔϯᶄɿॏཁϕʔεͰ௨0/0''§ Ϛωʔδυͳ4FDVSJUZ)VCϧʔϧʹΛҕͶΔ▸4FDVSJUZ)VCϧʔϧఆظతʹ 6QEBUF͞ΕΔ 6QEBUFͯ͠Β͑Δɻ− αʔϏεΞοϓσʔτʹΑΓϧʔϧͷඞཁੑ͕ͳ͘ͳͬͨνΣοΫ༰ͷมߋɺॏཁʢ4FWFSJUZʣͷมߋ ɺͳͲhttps://docs.aws.amazon.com/ja_jp/securityhub/latest/userguide/controls-change-log.html
ύλʔϯᶄɿॏཁϕʔεͰ௨0/0''§ Ϛωʔδυͳ4FDVSJUZ)VCϧʔϧʹΛҕͶΔ▸4FDVSJUZ)VCϧʔϧఆظతʹ6QEBUF͞ΕΔɻ− αʔϏεΞοϓσʔτʹΑΓϧʔϧͷඞཁੑ͕ͳ͘ͳͬͨ− νΣοΫ༰ͷมߋɺॏཁͷมߋ ͳͲhttps://docs.aws.amazon.com/ja_jp/securityhub/latest/userguide/controls-change-log.html 4FDVSJUZ)VC͕ఆٛ͢Δॏཁʢ4FWFSJUZʣΛϕʔεʹ௨༰Λઃఆ͢Δύλʔϯ
ύλʔϯᶄɿॏཁϕʔεͰ௨0/0''§ ͨͩ͠ɺ4FWFSJUZʹԠͨ͡௨νϟωϧͷΓସ͑.645▸௨खஈɺνϟοτπʔϧͷνϟωϧͳͲAmazonEventBridgeAWS Security HubRuleAmazon SNSIncidentManagerAWSSystems ManagerAWS ChatbotAmazon SNSGuardDutyDetective IAM AAFirewallManagerRuleRuleAWS ChatbotEventSeverity : HIGHStatus : NEWSeverity : CRITICALStatus : NEWSeverity : MEDIUMStatus : NEWSeverity : LOWは一括OFF4".1-&
ύλʔϯᶄɿॏཁϕʔεͰ௨0/0''§ ͨͩ͠ɺॏཁʹԠͨ͡௨νϟωϧͷΓସ͑.645▸௨खஈɺνϟοτπʔϧͷνϟωϧͳͲAmazonEventBridgeAWS Security HubRuleAmazon SNSIncidentManagerAWSSystems ManagerAWS ChatbotAmazon SNSGuardDutyDetective IAM AAFirewallManagerRuleRuleAWS ChatbotEventSeverity : HIGHStatus : NEWSeverity : CRITICALStatus : NEWSeverity : MEDIUMStatus : NEWSeverity : LOWは一括OFF4".1-&৫ମ੍ϙϦγʔʹΑͬͯϧʔϧઃܭରԠϑϩʔେ͖͘มΘΔ4FDVSJUZ)VCͱ͏·͖͘߹͏͜ͱͰαεςφϒϧͳӡ༻Λ
·ͱΊ§ 4FDVSJUZ)VCͷείΞਅʹड͚ͳ͍▸͋͘·Ͱͭͷࢦඪͱ͍͏ελϯεͰ▸lείΞΛʹ͢Δ͜ͱzΛతͱ͠ͳ͍§ ࡶͳશϧʔϧ௨μϝઈର▸ΦΦΧϛগΞϥʔτͷແҙຯԽʹ▸ԿΑΓਫ਼ਆతʹΑΖ͘͠ͳ͍▸4FDVSJUZ)VCʹৼΓճ͞ΕΔཁҼʹ§ ͖ͪΜͱΞϥʔτʹؾ͍ͯϓϩΞΫςΟϒʹΧΠθϯͰ͖Δମ੍ɾϑϩʔͷඋΛ▸ηΩϡϦςΟzશһࢀՃzͰ͢§ ϚϧνΞΧϯτڥԼͩͱߋʹෳࡶ͕૿͠·͢▸༰͕ؾʹͳΔํ࠙ձͳͲͰֻ͓͚͍ͩ͘͞
͓·͚ͨͱ͑ۓٸੑͷ͍༰Ͱ͋ͬͯɺిɾςΩετΞϥʔτɾதͷϓογϡ௨ͱ͍ͬͨݺͼग़ͯ͢͠ɺΦϯίʔϧΤϯδχΞͷετϨεཁҼͱͳΓ·͢ɻ͜ΕΒͷετϨεཁҼΑΓଟ͘ͷϑϥετϨʔγϣϯͱͳΓɺࣄͷຬԼ͠ɺ-JOLFE*OͰϦΫϧʔλ͔Βͷϝοηʔδʹฦ͢ΔΑ͏ʹͳͬͯ͠·͍·͢ɻhttps://www.oreilly.co.jp/books/9784873119847/ΞϥʔτͲͷΑ͏ʹ௨͞Ε͍ͯΔ͔ʁΑΓ
5IBOL:PV
takuyay0ne
coconala_engineer
rynsuke
ikumatadokoro
sajikix
tomoaki25
minorun365
mottox2
yokawasa
dahatake
rdlabo
naohachi89
hokaccha
marcelosomers
speakerdeck
philhawksworth
lara
samanthasiow
hannesfritz
sachag
tanoku
orderedlist
ufuk
aki_iinuma
kneath