既存のWebアプリをセキュアにするためにやったこと / Student-LT-WebSec

Transcript

1. طଘͷ8FCΞϓϦΛ
 ηΩϡΞʹ͢ΔͨΊʹ
 ΍ͬͨ͜ͱ 
   
   5PNPZVLJ
   ,0:"."
   ֶੜ-5

2. ࣗݾ঺հ w /BNF
   ίϠϚ
   τϞϢΩ
   w (SBEF
   ཧ޻ܥେֶ
   #
   w 5XJUUFS
   !UNZL@LZN
   w #MPH
   IUUQTCMPHLPZBNBNF
   w

   5BHT
   /FUXPSL
   
   8FC
   
   4FSWFS
   
   4FDVSJUZ

3. ҳൠͷޡՈఉ ϠϑΦΫͰதݹͷωοτϫʔΫػثΛߪೖ

4. ۙگ w ٕज़ॻయʹߦͬͨ
   w ొ࿥ηΩεϖΛड͚ͨ
   w ๭IBDLʹམͪͨ
   w ֶੜ-5ʹؒʹ߹ͬͨɹˡ/&8

5. 8FCηΩϡϦςΟ
 ͷجૅ

6. 944 w ΫϩεɾαΠτɾεΫϦϓςΟϯά
   w )5.-಺ʹεΫϦϓτ͕ૠೖ͞ΕΔ͜ͱͰɺ೚ ҙͷॲཧ͕࣮ߦ͞ΕΔ
   w $8&
   *NQSPQFS
   /FVUSBMJ[BUJPO
   PG
   *OQVU
   %VSJOH
   8FC
   1BHF
   (FOFSBUJPO
   $SPTTTJUF
   

   4DSJQUJOH
   
   

7. 944 EPDUZQF
   IUNM
   NFUB
   DIBSTFUVUG
   UJUMF944
   4BNQMFUJUMF
   I QIQ
   FDIP
   @(&5<NPEF>
   I EPDUZQF
   IUNM
   NFUB
   DIBSTFUVUG
   UJUMF944
   4BNQMFUJUMF
   

   IIFMMPI ม਺
   @(&5<bNPEF`>
   ʹIFMMP͕ઃఆ͞Ε͍ͯΔͱʜ
   
   
   
   
   4BGF

8. 944 EPDUZQF
   IUNM
   NFUB
   DIBSTFUVUG
   UJUMF944
   4BNQMFUJUMF
   I QIQ
   FDIP
   @(&5<NPEF>
   I EPDUZQF
   IUNM
   NFUB
   DIBSTFUVUG
   UJUMF944
   4BNQMFUJUMF
   

   ITDSJQUBMFSU TDSJQUI ม਺
   @(&5<bNPEF`>
   ʹTDSJQUBMFSU TDSJQU͕
 ઃఆ͞Ε͍ͯΔͱʜ
   
   
   VO4BGF

9. 'SBNF8PSLʹཔΔͱʜ w 'SBNF8PSL͕ࣗಈͰΤεέʔϓͯ͘͠ΕΔ
   w ηΩϡϦςΟΛҙࣝͤͣʹ։ൃՄ
   w 3VCZ
   PO
   3BJMT
   'MBTL
   $BLF1)1
   FUDʜ

10. طଘͷ8FCΞϓϦΛ
 ηΩϡΞʹ͢ΔͨΊʹ
 ΍ͬͨ͜ͱ

11. ܦҢ w ͱ͋Δ8FCΞϓϦ ൿ఻ͷιʔε Λಈ͔͢ґཔΛ ड͚Δ
    w ѻ͏σʔλ͸ݸਓ৘ใ
    w ηΩϡϦςΟΛݟ௚ͯ͠Έͨ

12. ΍ͬͨ͜ͱ

13. 44-Խ w )551
    ˠ
    )5514
    w 44-ূ໌ॻΛ-FU`T
    &ODSZQUͰऔಘ
    w ैདྷ͸ݸਓ৘ใΛฏจͰ΍ΓऔΓ

14. ͓͠·͍

15. ΍ͬͨ͜ͱ w ॳڃ
    w 44-Խ
    w தڃ
    w ্ڃ

16. ΍ͬͨ͜ͱதڃ w $PPLJF΁
    IUUQPOMZଐੑ
    TFDVSFଐੑΛ෇༩
    w Ϩεϙϯεϔομ΁ҎԼΛ෇༩
    w 99441SPUFDUJPO
    
    NPEFCMPDL
    w 9'SBNF0QUJPOT
    4".&03*(*/
    

    w 9$POUFOU5ZQF0QUJPOT
    OPTOJ⒎

17. $PPLJF΁IUUQPOMZଐੑ
    TFDVSFଐੑΛ෇༩

18. 99441SPUFDUJPO
    
    NPEFCMPDL w 8FCϒϥ΢βͷ944ϑΟϧλʔΛڧ੍0/
    w 944Λݕ஌͢ΔͱϒϩοΫ͢Δ IUUQFYBNQMFDPNTFBSDI TDSJQUBMFSU TDSJQU

19. 9'SBNF0QUJPOT
 9$POUFOU5ZQF0QUJPOT w 9'SBNF0QUJPOT
    4".&03*(*/
    w ΫϦοΫɾδϟοΩϯάରࡦ
 JGSBNFͰͷผαΠτ͔ΒຒΊࠐΈΛېࢭ
    w 9$POUFOU5ZQF0QUJPOT
    OPTOJ⒎
    

    w FͷΞΠίϯͳϒϥ΢βͰͷ944Λ๷ࢭ

20. ΍ͬͨ͜ͱ্ڃ w ηογϣϯɾλΠϜΞ΢τ
    w Ϩεϙϯεϔομ΁ҎԼΛ෇༩
    w $BDIF$POUSPM
    QSJWBUF
    OPTUPSF
    w 4USJDU5SBOTQPSU4FDVSJUZ
    NBY

    BHF
    JODMVEF4VCEPNBJOT

21. ηογϣϯɾλΠϜΞ΢τ $PPLJFͷ&YQJSFଐੑͰ༗ޮظݶΛઃఆ

22. $BDIF$POUSPM
    
 QSJWBUF
    OPTUPSF w ϚΠϖʔδ ݸਓ৘ใ ͳͲΛ1SPYZ$%/ͰΩϟο γϡͰอ࣋͠ͳ͍
    w ࢀߟʮϝϧΧϦɹݸਓ৘ใྲྀग़ʯ

23. 4USJDU5SBOTQPSU4FDVSJUZ
    NBY BHF
    JODMVEF4VCEPNBJOT w )454 )551
    4USJDU
    5SBOTQPSU
    4FDVSJUZ
    w IUUQˠIUUQT΁ஔ͖׵͑ͯϦΫΤετΛૹ৴
    w <T>
    
    <EBZ>

24. ·ͱΊ w 8FCΞϓϦΛެ։͢Δͱ͖͸44-Խ͠Α͏
    w $PPLJF΍Ϩεϙϯεɾϔομʹ஫ҙ͠Α͏
    w ແঈεΩϟφͷ08"41
    ;"1͸Φεεϝ

25. ݁Ռ

26. ΍Γ͕͍(&5
    ใु;&30

27. ࡉ͔͍͜ͱ͸࠙਌ձͰ ั·͑ͯฉ͍ͯω
    5IBOLT