既存のWebアプリをセキュアにするためにやったこと / Student-LT-WebSec

学生LT#11, @DMM

1. طଘͷ8FCΞϓϦΛ
 ηΩϡΞʹ͢ΔͨΊʹ
 ΍ͬͨ͜ͱ 
   
   5PNPZVLJ
   ,0:"."
   ֶੜ-5
2. ࣗݾ঺հ w /BNF
   ίϠϚ
   τϞϢΩ
   w (SBEF
   ཧ޻ܥେֶ
   #
   w 5XJUUFS
   !UNZL@LZN
   w #MPH
   IUUQTCMPHLPZBNBNF
   w 5BHT
   /FUXPSL
   
   8FC
   
   4FSWFS
   
   4FDVSJUZ
3. ҳൠͷޡՈఉ ϠϑΦΫͰதݹͷωοτϫʔΫػثΛߪೖ
4. ۙگ w ٕज़ॻయʹߦͬͨ
   w ొ࿥ηΩεϖΛड͚ͨ
   w ๭IBDLʹམͪͨ
   w ֶੜ-5ʹؒʹ߹ͬͨɹˡ/&8
5. 8FCηΩϡϦςΟ
 ͷجૅ
6. 944 w ΫϩεɾαΠτɾεΫϦϓςΟϯά
   w )5.-಺ʹεΫϦϓτ͕ૠೖ͞ΕΔ͜ͱͰɺ೚ ҙͷॲཧ͕࣮ߦ͞ΕΔ
   w $8&
   *NQSPQFS
   /FVUSBMJ[BUJPO
   PG
   *OQVU
   %VSJOH
   8FC
   1BHF
   (FOFSBUJPO
   $SPTTTJUF
   4DSJQUJOH
   
   
7. 944 EPDUZQF
   IUNM
   NFUB
   DIBSTFUVUG
   UJUMF944
   4BNQMFUJUMF
   I QIQ
   FDIP
   @(&5<NPEF>
   I EPDUZQF
   IUNM
   NFUB
   DIBSTFUVUG
   UJUMF944
   4BNQMFUJUMF
   IIFMMPI ม਺
   @(&5<bNPEF`>
   ʹIFMMP͕ઃఆ͞Ε͍ͯΔͱʜ
   
   
   
   
   4BGF
8. 944 EPDUZQF
   IUNM
   NFUB
   DIBSTFUVUG
   UJUMF944
   4BNQMFUJUMF
   I QIQ
   FDIP
   @(&5<NPEF>
   I EPDUZQF
   IUNM
   NFUB
   DIBSTFUVUG
   UJUMF944
   4BNQMFUJUMF
   ITDSJQUBMFSU TDSJQUI ม਺
   @(&5<bNPEF`>
   ʹTDSJQUBMFSU TDSJQU͕
 ઃఆ͞Ε͍ͯΔͱʜ
   
   
   VO4BGF
9. 'SBNF8PSLʹཔΔͱʜ w 'SBNF8PSL͕ࣗಈͰΤεέʔϓͯ͘͠ΕΔ
   w ηΩϡϦςΟΛҙࣝͤͣʹ։ൃՄ
   w 3VCZ
   PO
   3BJMT
   'MBTL
   $BLF1)1
   FUDʜ
10. طଘͷ8FCΞϓϦΛ
 ηΩϡΞʹ͢ΔͨΊʹ
 ΍ͬͨ͜ͱ
11. ܦҢ w ͱ͋Δ8FCΞϓϦ ൿ఻ͷιʔε Λಈ͔͢ґཔΛ ड͚Δ
    w ѻ͏σʔλ͸ݸਓ৘ใ
    w ηΩϡϦςΟΛݟ௚ͯ͠Έͨ
12. ΍ͬͨ͜ͱ
13. 44-Խ w )551
    ˠ
    )5514
    w 44-ূ໌ॻΛ-FU`T
    &ODSZQUͰऔಘ
    w ैདྷ͸ݸਓ৘ใΛฏจͰ΍ΓऔΓ
14. ͓͠·͍
15. ΍ͬͨ͜ͱ w ॳڃ
    w 44-Խ
    w தڃ
    w ্ڃ
16. ΍ͬͨ͜ͱதڃ w $PPLJF΁
    IUUQPOMZଐੑ
    TFDVSFଐੑΛ෇༩
    w Ϩεϙϯεϔομ΁ҎԼΛ෇༩
    w 99441SPUFDUJPO
    
    NPEFCMPDL
    w 9'SBNF0QUJPOT
    4".&03*(*/
    w 9$POUFOU5ZQF0QUJPOT
    OPTOJ⒎
17. $PPLJF΁IUUQPOMZଐੑ
    TFDVSFଐੑΛ෇༩
18. 99441SPUFDUJPO
    
    NPEFCMPDL w 8FCϒϥ΢βͷ944ϑΟϧλʔΛڧ੍0/
    w 944Λݕ஌͢ΔͱϒϩοΫ͢Δ IUUQFYBNQMFDPNTFBSDI TDSJQUBMFSU TDSJQU
19. 9'SBNF0QUJPOT
 9$POUFOU5ZQF0QUJPOT w 9'SBNF0QUJPOT
    4".&03*(*/
    w ΫϦοΫɾδϟοΩϯάରࡦ
 JGSBNFͰͷผαΠτ͔ΒຒΊࠐΈΛېࢭ
    w 9$POUFOU5ZQF0QUJPOT
    OPTOJ⒎
    w FͷΞΠίϯͳϒϥ΢βͰͷ944Λ๷ࢭ
20. ΍ͬͨ͜ͱ্ڃ w ηογϣϯɾλΠϜΞ΢τ
    w Ϩεϙϯεϔομ΁ҎԼΛ෇༩
    w $BDIF$POUSPM
    QSJWBUF
    OPTUPSF
    w 4USJDU5SBOTQPSU4FDVSJUZ
    NBY BHF
    JODMVEF4VCEPNBJOT
21. ηογϣϯɾλΠϜΞ΢τ $PPLJFͷ&YQJSFଐੑͰ༗ޮظݶΛઃఆ
22. $BDIF$POUSPM
    
 QSJWBUF
    OPTUPSF w ϚΠϖʔδ ݸਓ৘ใ ͳͲΛ1SPYZ$%/ͰΩϟο γϡͰอ࣋͠ͳ͍
    w ࢀߟʮϝϧΧϦɹݸਓ৘ใྲྀग़ʯ
23. 4USJDU5SBOTQPSU4FDVSJUZ
    NBY BHF
    JODMVEF4VCEPNBJOT w )454 )551
    4USJDU
    5SBOTQPSU
    4FDVSJUZ
    w IUUQˠIUUQT΁ஔ͖׵͑ͯϦΫΤετΛૹ৴
    w <T>
    
    <EBZ>
24. ·ͱΊ w 8FCΞϓϦΛެ։͢Δͱ͖͸44-Խ͠Α͏
    w $PPLJF΍Ϩεϙϯεɾϔομʹ஫ҙ͠Α͏
    w ແঈεΩϟφͷ08"41
    ;"1͸Φεεϝ
25. ݁Ռ
26. ΍Γ͕͍(&5
    ใु;&30
27. ࡉ͔͍͜ͱ͸࠙਌ձͰ ั·͑ͯฉ͍ͯω
    5IBOLT