既存のWebアプリをセキュアにするためにやったこと / Student-LT-WebSec

学生LT#11, @DMM

Transcript

1. طଘͷ8FCΞϓϦΛ

   ηΩϡΞʹ͢ΔͨΊʹ

   ΍ͬͨ͜ͱ
   
   5PNPZVLJ,0:"."
   ֶੜ-5
   

   View Slide

2. ࣗݾ঺հ
   w /BNFίϠϚτϞϢΩ
   w (SBEFཧ޻ܥେֶ#
   w 5XJUUFS!UNZL@LZN
   w #MPHIUUQTCMPHLPZBNBNF
   w 5BHT/FUXPSL8FC4FSWFS4FDVSJUZ
   

   View Slide

3. ҳൠͷޡՈఉ
   ϠϑΦΫͰதݹͷωοτϫʔΫػثΛߪೖ
   

   View Slide

4. ۙگ
   w ٕज़ॻయʹߦͬͨ
   w ొ࿥ηΩεϖΛड͚ͨ
   w ๭IBDLʹམͪͨ
   w ֶੜ-5ʹؒʹ߹ͬͨɹˡ/&8
   

   View Slide

5. 8FCηΩϡϦςΟ

   ͷجૅ
   

   View Slide

6. 944
   w ΫϩεɾαΠτɾεΫϦϓςΟϯά
   w )5.-಺ʹεΫϦϓτ͕ૠೖ͞ΕΔ͜ͱͰɺ೚
   ҙͷॲཧ͕࣮ߦ͞ΕΔ
   w $8&*NQSPQFS/FVUSBMJ[BUJPOPG*OQVU
   %VSJOH8FC1BHF(FOFSBUJPO $SPTTTJUF
   4DSJQUJOH
   
   
   

   View Slide

7. 944
   EPDUZQFIUNM
   NFUBDIBSTFUVUG
   UJUMF9444BNQMFUJUMF
   I QIQFDIP@(&5<NPEF> I
   EPDUZQFIUNM
   NFUBDIBSTFUVUG
   UJUMF9444BNQMFUJUMF
   IIFMMPI
   ม਺@(&5ʹIFMMP͕ઃఆ͞Ε͍ͯΔͱʜ
   4BGF
   

   View Slide

8. 944
   EPDUZQFIUNM
   NFUBDIBSTFUVUG
   UJUMF9444BNQMFUJUMF
   I QIQFDIP@(&5<NPEF> I
   EPDUZQFIUNM
   NFUBDIBSTFUVUG
   UJUMF9444BNQMFUJUMF
   ITDSJQUBMFSU
   TDSJQUI
   ม਺@(&5ʹTDSJQUBMFSU
   TDSJQU͕

   ઃఆ͞Ε͍ͯΔͱʜ
   VO4BGF
   

   View Slide

9. 'SBNF8PSLʹཔΔͱʜ
   w 'SBNF8PSL͕ࣗಈͰΤεέʔϓͯ͘͠ΕΔ
   w ηΩϡϦςΟΛҙࣝͤͣʹ։ൃՄ
   w 3VCZPO3BJMT 'MBTL $BLF1)1 FUDʜ
   

   View Slide

10. طଘͷ8FCΞϓϦΛ

    ηΩϡΞʹ͢ΔͨΊʹ

    ΍ͬͨ͜ͱ
    

    View Slide

11. ܦҢ
    w ͱ͋Δ8FCΞϓϦ ൿ఻ͷιʔε
    Λಈ͔͢ґཔΛ
    ड͚Δ
    w ѻ͏σʔλ͸ݸਓ৘ใ
    w ηΩϡϦςΟΛݟ௚ͯ͠Έͨ
    

    View Slide

12. ΍ͬͨ͜ͱ
    

    View Slide

13. 44-Խ
    w )551ˠ)5514
    w 44-ূ໌ॻΛ-FU`T&ODSZQUͰऔಘ
    w ैདྷ͸ݸਓ৘ใΛฏจͰ΍ΓऔΓ
    

    View Slide

14. ͓͠·͍
    

    View Slide

15. ΍ͬͨ͜ͱ
    w ॳڃ
    w 44-Խ
    w தڃ
    w ্ڃ
    

    View Slide

16. ΍ͬͨ͜ͱதڃ
    w $PPLJF΁IUUQPOMZଐੑ TFDVSFଐੑΛ෇༩
    w Ϩεϙϯεϔομ΁ҎԼΛ෇༩
    w 99441SPUFDUJPONPEFCMPDL
    w 9'SBNF0QUJPOT4".&03*(*/
    w 9$POUFOU5ZQF0QUJPOTOPTOJ⒎
    

    View Slide

17. $PPLJF΁IUUQPOMZଐੑ
    TFDVSFଐੑΛ෇༩
    

    View Slide

18. 99441SPUFDUJPO
    NPEFCMPDL
    w 8FCϒϥ΢βͷ944ϑΟϧλʔΛڧ੍0/
    w 944Λݕ஌͢ΔͱϒϩοΫ͢Δ
    IUUQFYBNQMFDPNTFBSDI
    TDSJQUBMFSU
    TDSJQU
    

    View Slide

19. 9'SBNF0QUJPOT

    9$POUFOU5ZQF0QUJPOT
    w 9'SBNF0QUJPOT4".&03*(*/
    w ΫϦοΫɾδϟοΩϯάରࡦ

    JGSBNFͰͷผαΠτ͔ΒຒΊࠐΈΛېࢭ
    
    w 9$POUFOU5ZQF0QUJPOTOPTOJ⒎
    w FͷΞΠίϯͳϒϥ΢βͰͷ944Λ๷ࢭ
    

    View Slide

20. ΍ͬͨ͜ͱ্ڃ
    w ηογϣϯɾλΠϜΞ΢τ
    w Ϩεϙϯεϔομ΁ҎԼΛ෇༩
    w $BDIF$POUSPMQSJWBUF OPTUPSF
    w 4USJDU5SBOTQPSU4FDVSJUZNBY
    BHFJODMVEF4VCEPNBJOT
    

    View Slide

21. ηογϣϯɾλΠϜΞ΢τ
    $PPLJFͷ&YQJSFଐੑͰ༗ޮظݶΛઃఆ
    

    View Slide

22. $BDIF$POUSPM

    QSJWBUF OPTUPSF
    w ϚΠϖʔδ ݸਓ৘ใ
    ͳͲΛ1SPYZ$%/ͰΩϟο
    γϡͰอ࣋͠ͳ͍
    w ࢀߟʮϝϧΧϦɹݸਓ৘ใྲྀग़ʯ
    

    View Slide

23. 4USJDU5SBOTQPSU4FDVSJUZNBY
    BHFJODMVEF4VCEPNBJOT
    w )454 )5514USJDU5SBOTQPSU4FDVSJUZ
    
    w IUUQˠIUUQT΁ஔ͖׵͑ͯϦΫΤετΛૹ৴
    w
    

    View Slide

24. ·ͱΊ
    w 8FCΞϓϦΛެ։͢Δͱ͖͸44-Խ͠Α͏
    w $PPLJF΍Ϩεϙϯεɾϔομʹ஫ҙ͠Α͏
    w ແঈεΩϟφͷ08"41;"1͸Φεεϝ
    

    View Slide

25. ݁Ռ
    

    View Slide

26. ΍Γ͕͍(&5
    ใु;&30
    

    View Slide

27. ࡉ͔͍͜ͱ͸࠙਌ձͰ
    ั·͑ͯฉ͍ͯω
    5IBOLT
    

    View Slide