Upgrade to Pro — share decks privately, control downloads, hide ads and more …

既存のWebアプリをセキュアにするためにやったこと / Student-LT-WebSec

既存のWebアプリをセキュアにするためにやったこと / Student-LT-WebSec

学生LT#11, @DMM

Tomoyuki KOYAMA

May 05, 2018
Tweet

More Decks by Tomoyuki KOYAMA

Other Decks in Technology

Transcript

  1. طଘͷ8FCΞϓϦΛ

    ηΩϡΞʹ͢ΔͨΊʹ

    ΍ͬͨ͜ͱ

    5PNPZVLJ,0:"."
    ֶੜ-5

    View Slide

  2. ࣗݾ঺հ
    w /BNFίϠϚτϞϢΩ
    w (SBEFཧ޻ܥେֶ#
    w 5XJUUFS!UNZL@LZN
    w #MPHIUUQTCMPHLPZBNBNF
    w 5BHT/FUXPSL8FC4FSWFS4FDVSJUZ

    View Slide

  3. ҳൠͷޡՈఉ
    ϠϑΦΫͰதݹͷωοτϫʔΫػثΛߪೖ

    View Slide

  4. ۙگ
    w ٕज़ॻయʹߦͬͨ
    w ొ࿥ηΩεϖΛड͚ͨ
    w ๭IBDLʹམͪͨ
    w ֶੜ-5ʹؒʹ߹ͬͨɹˡ/&8

    View Slide

  5. 8FCηΩϡϦςΟ

    ͷجૅ

    View Slide

  6. 944
    w ΫϩεɾαΠτɾεΫϦϓςΟϯά
    w )5.-಺ʹεΫϦϓτ͕ૠೖ͞ΕΔ͜ͱͰɺ೚
    ҙͷॲཧ͕࣮ߦ͞ΕΔ
    w $8&*NQSPQFS/FVUSBMJ[BUJPOPG*OQVU
    %VSJOH8FC1BHF(FOFSBUJPO $SPTTTJUF
    4DSJQUJOH


    View Slide

  7. 944
    EPDUZQFIUNM
    NFUBDIBSTFUVUG
    UJUMF9444BNQMFUJUMF
    I QIQFDIP@(&5<NPEF> I
    EPDUZQFIUNM
    NFUBDIBSTFUVUG
    UJUMF9444BNQMFUJUMF
    IIFMMPI
    ม਺@(&5ʹIFMMP͕ઃఆ͞Ε͍ͯΔͱʜ
    4BGF

    View Slide

  8. 944
    EPDUZQFIUNM
    NFUBDIBSTFUVUG
    UJUMF9444BNQMFUJUMF
    I QIQFDIP@(&5<NPEF> I
    EPDUZQFIUNM
    NFUBDIBSTFUVUG
    UJUMF9444BNQMFUJUMF
    ITDSJQUBMFSU
    TDSJQUI
    ม਺@(&5ʹTDSJQUBMFSU
    TDSJQU͕

    ઃఆ͞Ε͍ͯΔͱʜ
    VO4BGF

    View Slide

  9. 'SBNF8PSLʹཔΔͱʜ
    w 'SBNF8PSL͕ࣗಈͰΤεέʔϓͯ͘͠ΕΔ
    w ηΩϡϦςΟΛҙࣝͤͣʹ։ൃՄ
    w 3VCZPO3BJMT 'MBTL $BLF1)1 FUDʜ

    View Slide

  10. طଘͷ8FCΞϓϦΛ

    ηΩϡΞʹ͢ΔͨΊʹ

    ΍ͬͨ͜ͱ

    View Slide

  11. ܦҢ
    w ͱ͋Δ8FCΞϓϦ ൿ఻ͷιʔε
    Λಈ͔͢ґཔΛ
    ड͚Δ
    w ѻ͏σʔλ͸ݸਓ৘ใ
    w ηΩϡϦςΟΛݟ௚ͯ͠Έͨ

    View Slide

  12. ΍ͬͨ͜ͱ

    View Slide

  13. 44-Խ
    w )551ˠ)5514
    w 44-ূ໌ॻΛ-FU`T&ODSZQUͰऔಘ
    w ैདྷ͸ݸਓ৘ใΛฏจͰ΍ΓऔΓ

    View Slide

  14. ͓͠·͍

    View Slide

  15. ΍ͬͨ͜ͱ
    w ॳڃ
    w 44-Խ
    w தڃ
    w ্ڃ

    View Slide

  16. ΍ͬͨ͜ͱதڃ
    w $PPLJF΁IUUQPOMZଐੑ TFDVSFଐੑΛ෇༩
    w Ϩεϙϯεϔομ΁ҎԼΛ෇༩
    w 99441SPUFDUJPONPEFCMPDL
    w 9'SBNF0QUJPOT4".&03*(*/
    w 9$POUFOU5ZQF0QUJPOTOPTOJ⒎

    View Slide

  17. $PPLJF΁IUUQPOMZଐੑ
    TFDVSFଐੑΛ෇༩

    View Slide

  18. 99441SPUFDUJPO
    NPEFCMPDL
    w 8FCϒϥ΢βͷ944ϑΟϧλʔΛڧ੍0/
    w 944Λݕ஌͢ΔͱϒϩοΫ͢Δ
    IUUQFYBNQMFDPNTFBSDI
    TDSJQUBMFSU
    TDSJQU

    View Slide

  19. 9'SBNF0QUJPOT

    9$POUFOU5ZQF0QUJPOT
    w 9'SBNF0QUJPOT4".&03*(*/
    w ΫϦοΫɾδϟοΩϯάରࡦ

    JGSBNFͰͷผαΠτ͔ΒຒΊࠐΈΛېࢭ

    w 9$POUFOU5ZQF0QUJPOTOPTOJ⒎
    w FͷΞΠίϯͳϒϥ΢βͰͷ944Λ๷ࢭ

    View Slide

  20. ΍ͬͨ͜ͱ্ڃ
    w ηογϣϯɾλΠϜΞ΢τ
    w Ϩεϙϯεϔομ΁ҎԼΛ෇༩
    w $BDIF$POUSPMQSJWBUF OPTUPSF
    w 4USJDU5SBOTQPSU4FDVSJUZNBY
    BHFJODMVEF4VCEPNBJOT

    View Slide

  21. ηογϣϯɾλΠϜΞ΢τ
    $PPLJFͷ&YQJSFଐੑͰ༗ޮظݶΛઃఆ

    View Slide

  22. $BDIF$POUSPM

    QSJWBUF OPTUPSF
    w ϚΠϖʔδ ݸਓ৘ใ
    ͳͲΛ1SPYZ$%/ͰΩϟο
    γϡͰอ࣋͠ͳ͍
    w ࢀߟʮϝϧΧϦɹݸਓ৘ใྲྀग़ʯ

    View Slide

  23. 4USJDU5SBOTQPSU4FDVSJUZNBY
    BHFJODMVEF4VCEPNBJOT
    w )454 )5514USJDU5SBOTQPSU4FDVSJUZ

    w IUUQˠIUUQT΁ஔ͖׵͑ͯϦΫΤετΛૹ৴
    w

    View Slide

  24. ·ͱΊ
    w 8FCΞϓϦΛެ։͢Δͱ͖͸44-Խ͠Α͏
    w $PPLJF΍Ϩεϙϯεɾϔομʹ஫ҙ͠Α͏
    w ແঈεΩϟφͷ08"41;"1͸Φεεϝ

    View Slide

  25. ݁Ռ

    View Slide

  26. ΍Γ͕͍(&5
    ใु;&30

    View Slide

  27. ࡉ͔͍͜ͱ͸࠙਌ձͰ
    ั·͑ͯฉ͍ͯω
    5IBOLT

    View Slide