Security measures to change if you know OWASP

08"41Λ஌Ε͹มΘΔ ηΩϡϦςΟରࡦ 4FO6&/0 08"41+BQBO$IBQUFS-FBEFS 5SJDPSEFS$P-UE

1SPGJMF্໺ એ 4FO6&/0 גࣜձࣾτϥΠίʔμ ୅දऔక໾ ಸྑઌ୺Պֶٕज़େֶӃେֶͰ৘ใηΩϡϦςΟΛઐ߈ɺ೥ʹαΠόʔηΩϡϦ ςΟڭҭɺ੬ऑੑ਍அɺϖωτϨʔγϣϯςετͳͲΛఏڙ͢ΔגࣜձࣾτϥΠίʔμ Λઃཱ 08"41+BQBO୅දɺ৘ใηΩϡϦςΟઐ໳ࢽʰ4DBO/FU4FDVSJUZʱฤू௕ɺ )BSEFOJOH1SPKFDU࣮ߦҕһɺ+/4"*40(+8(Ϧʔμʔɺ4&$$0/࣮ߦҕһɺ
৘ใॲཧ҆શ֬อࢧԉ࢜ ू߹ߨशߨࢣɺηΩϡϦςΟΩϟϯϓ(.ͳͲΛ຿ΊΔ *4$ ʹΑΔ೥ΞδΞɾύγϑΟοΫ৘ใηΩϡϦςΟɾϦʔμʔγοϓɾΞνʔ ϒϝϯτ *4-" Λड৆ ओͳஶॻ 8FCηΩϡϦςΟ୲౰ऀͷͨΊͷ੬ऑੑ਍அελʔτ ΨΠυ ্໺એ͕ڭ͑Δ৘ใ࿙͍͑Λ๷͙ٕज़ɺ )551ͷڭՊॻɺΊΜͲ͏͍͘͞8FCηΩϡϦςΟɺ ࠓ໷Θ͔ΔγϦʔζ 5$1*1 )551 ϝʔϧ ଞଟ਺ 5SJDPSEFS$P-UE

8FCαΠτΛηΩϡΞʹ͢Δͭಓ۩

҆શʹ͢ΔͨΊͷಓ۩͸ἧ͍ͬͯΔ • 8FCαΠτͷηΩϡϦςΟͷ໰୊͸Ұ௨Γग़ ἧ͍ͬͯΔ • 08"415PQ – ࠷΋ΫϦςΟΧϧͩͱߟ͑ΒΕΔ8FCΞϓϦέʔ γϣϯͷηΩϡϦςΟϦεΫͷτοϓ –
IUUQTXXXPXBTQPSHJOEFYQIQ$BUFHPSZ0 8"41@5PQ@5FO@1SPKFDU 5SJDPSEFS$P-UE

8FCαΠτΛηΩϡΞʹ͢Δ̓ͭಓ۩ αΠόʔηΩϡϦςΟܦӦΨΠυϥΠϯ 08"41ΞϓϦέʔγϣϯηΩϡϦςΟݕূඪ४ʢ"474ʣ 8FCγεςϜʗ8FCΞϓϦέʔγϣϯηΩϡϦςΟཁ݅ॻ ҆શͳ΢ΣϒαΠτͷ࡞Γํ
8FCΞϓϦέʔγϣϯ੬ऑੑ਍அΨΠυϥΠϯ 8FC"QQMJDBUJPO'JSFXBMMʢ8"'ʣ άουɾϓϥΫςΟεɾΨΠυ ύον؅ཧ 5SJDPSEFS$P-UE

8FCαΠτΛηΩϡΞʹ͢Δ̓ͭಓ۩ αΠόʔηΩϡϦςΟܦӦΨΠυϥΠϯ – αΠόʔηΩϡϦςΟΛܦӦ՝୊ͱ͢ΔͨΊʹ 08"41ΞϓϦέʔγϣϯηΩϡϦςΟݕূඪ४ʢ"474ʣ – ࣗ෼ͨͪʹඞཁͳηΩϡϦςΟϨϕϧΛ஌ΔͨΊʹ
8FCγεςϜʗ8FCΞϓϦέʔγϣϯηΩϡϦςΟཁ݅ॻ – ҆શͳ8FCΞϓϦέʔγϣϯ͸Ͳ͏ઃܭ͢΂͖͔ ҆શͳ΢ΣϒαΠτͷ࡞Γํ – ҆શͳ8FCΞϓϦέʔγϣϯ͸Ͳ͏࣮૷͢΂͖͔ 8FCΞϓϦέʔγϣϯ੬ऑੑ਍அΨΠυϥΠϯ – 8FCΞϓϦέʔγϣϯΛͲ͏ςετ͢΂͖͔ 8FC"QQMJDBUJPO'JSFXBMMʢ8"'ʣ – 8FCΞϓϦέʔγϣϯ΁ͷ߈ܸͷແޮԽɺ·ͨ͸ϩΪϯά άουɾϓϥΫςΟεɾΨΠυ ύον؅ཧ – ਖ਼͘͠ύονΛద༻ͯ͠8FCαΠτΛ҆શʹอͭ 5SJDPSEFS$P-UE

αΠόʔηΩϡϦςΟܦӦΨΠυϥΠ ϯ

αΠόʔηΩϡϦςΟܦӦΨΠυϥΠϯ • ܦӦऀࣗΒʹαΠόʔηΩϡϦςΟ͸ܦӦ՝୊Ͱ͋ Δ͜ͱΛ஌ͬͯ΋Β͍ɺͦΕΛ$*40ͳͲ͕࣮ફ͢ ΔͨΊͷΨΠυϥΠϯ • αΠόʔηΩϡϦςΟܦӦΨΠυϥΠϯ ܦࡁ࢈ۀ ল –
IUUQXXXNFUJHPKQQPMJDZOFUTFDVSJUZNOH@HVJE FIUNM • αΠόʔηΩϡϦςΟܦӦΨΠυϥΠϯղઆॻ *1"ಠཱߦ੓๏ਓ ৘ใॲཧਪਐػߏ – IUUQTXXXJQBHPKQTFDVSJUZFDPOPNJDTDTNHM LBJTFUTVTIPIUNM 5SJDPSEFS$P-UE

αΠόʔηΩϡϦςΟܦӦݪଇ ᶃ ܦӦऀͷϦεΫೝࣝͱϦʔμʔγοϓ͕ॏཁ ᶄ ࣗࣾҎ֎ʢҕୗઌ΍ϏδωεύʔτφʔͳͲʣ ʹ΋഑ྀ ᶅ ฏ͔࣌Βͷରࡦ΍৘ใ։ࣔͳͲɺؔ܎ऀͱͷί ϛϡχέʔγϣϯɾ৘ใڞ༗ 5SJDPSEFS$P-UE

ॏཁ߲໨ αΠόʔηΩϡϦςΟରԠํ਑ͷࡦఆ ϦεΫ؅ཧମ੍ͷߏங ϦεΫͷ೺Ѳɺ໨ඪͱରԠܭըࡦఆ 1%$"αΠΫϧͷ࣮ࢪͱରࡦͷ։ࣔ
ܥྻاۀɾϏδωεύʔτφʔͷରࡦ࣮ࢪٴͼঢ়گ೺Ѳ ༧ࢉ֬อɾਓࡐ഑ஔٴͼҭ੒ *5γεςϜ؅ཧͷ֎෦ҕୗ ৘ใऩूͱ৘ใڞ༗ ۓٸ࣌ରԠମ੍ͷ੔උͱԋशͷ࣮ࢪ ඃ֐ൃ֮ޙͷඞཁͳ৘ใͷ೺Ѳɺ։ࣔମ੍ͷ੔උ 5SJDPSEFS$P-UE

ܦӦऀ͕੹຿ΛՌ͍ͨͯ͠Δ͔Ͳ͏͔͕൑ Δ໰͍ ᶃ ωοτϫʔΫ͕िؒःஅ͞Εͨ৔߹ͷϏδωε΁ ͷӨڹ౓͕Θ͔Γ·͔͢ʁ – ඃ֐͕ੜͨ͡৔߹ʹɺௐࠪͷͨΊʹωοτϫʔΫΛःஅ ͢Δඞཁ͕ੜ͡Δ͜ͱ΋͋Δ – ༏ઌ͢Δͷ͸ηΩϡϦςΟରࡦʁࣄۀܧଓʁ
ᶄ ࣗࣾ΁ͷඃ֐͕૝ఆ͞ΕΔαΠόʔ߈ܸʹ͍ͭͯɺ ࣾ಺ʹฉ͚Δਓ͕͍·͔͢ʁ – αΠόʔ߈ܸ৘ใΛऩूͰ͖Δ$*40΍$*40Λิࠤ͢Δ ໾ׂͱͯ͠ద೚ऀͷਓࡐΛ஌͓ͬͯ͘ ᶅ ࿙͍͑ࣄނ΍ࣄ݅ൃੜޙʹͲͷΑ͏ʹঢ়گΛใࠂ ͠ɺ৴པΛҡ࣋ɾճ෮͠·͔͢ʁ – αΠόʔ߈ܸൃੜ࣌ͷઆ໌੹೚͸ܦӦऀʹ͋Δ 5SJDPSEFS$P-UE

08"41ΞϓϦέʔγϣϯηΩϡϦ ςΟݕূඪ४ʢ"474ʣ 5SJDPSEFS$P-UE

08"41ΞϓϦέʔγϣϯηΩϡϦςΟ ݕূඪ४ʢ"474ʣ • ۀքඪ४ͷΞϓϦέʔγϣϯݕূج४ – ઃܭɾ։ൃɾςετʹඞཁͳηΩϡϦςΟཁ͓݅Αͼ؅ཧ ࡦͷϑϨʔϜϫʔΫͷඪ४Խ – ηΩϡΞͳ։ൃϥΠϑαΠΫϧ
– ཁٻ͞ΕΔηΩϡϦςΟϨϕϧʹԠͯ͡ఆٛ • 08"41ΞϓϦέʔγϣϯηΩϡϦςΟݕূඪ४ 08"41೔ຊޠ༁ +1$&35$$ – IUUQTXXXKQDFSUPSKQTFDVSFDPEJOHNBUFSJBMT PXBTQBTWTIUNM – IUUQTXXXPXBTQPSHJOEFYQIQ$BUFHPSZ08"4 1@"QQMJDBUJPO@4FDVSJUZ@7FSJGJDBUJPO@4UBOEBSE@1SPKFD U 5SJDPSEFS$P-UE

"474Ϩϕϧ • Ϩϕϧ̍ ಋೖʢ0QQPSUVOJTUJD೔࿨ݟతͳʣ – ͢΂ͯͷιϑτ΢ΣΞΛର৅ – ࠷௿ݶຬͨ͢΂͖Ϩϕϧ • Ϩϕϧ̎
ඪ४ʢ4UBOEBSEʣ – ࠓ೔ͷιϑτ΢ΣΞ͕௚໘͢Δ΄ͱΜͲͷϦεΫʹదԠ͢ ΔΞϓϦέʔγϣϯ͕ର৅ – อޢΛඞཁͱ͢ΔػඍͳσʔλΛؚΉΞϓϦέʔγϣϯΛ ର৅ • Ϩϕϧ̏ ্ڃʢ"EWBODFEʣ – ࠷ߴϨϕϧͷ৴པੑΛඞཁͱ͢ΔΞϓϦέʔγϣϯΛର৅ – ߴ͍Ձ஋Λ൐͏औҾΛߦ͏΋ͷ΍ػඍͳҩྍσʔλΛؚΉ ΋ͷͳͲ 5SJDPSEFS$P-UE

ݕূཁ݅ͷৄࡉ ΞʔΩςΫνϟɺઃ ܭɺڴҖϞσϦϯά ೝূ ηογϣϯ؅ཧ ΞΫηε੍ޚ
ѱੑೖྗͷॲཧ ҉߸Խ Τϥʔॲཧͱϩάͷ อଘ σʔλͷอޢ ௨৴ )551ʹؔ͢Δη ΩϡϦςΟઃఆ ѱੑ׆ಈͷ؅ཧ ϏδωεϩδοΫ ϑΝΠϧͱϦιʔε ϞόΠϧ 8FCαʔϏε ߏ੒ 5SJDPSEFS$P-UE

ྫɿ7ΞʔΩςΫνϟɺઃܭɺڴҖϞσ Ϧϯά <ཁ݅> 5SJDPSEFS$P-UE

8FCγεςϜʗ8FCΞϓϦέʔγϣϯ ηΩϡϦςΟཁ݅ॻ 5SJDPSEFS$P-UE

8FCγεςϜʗ8FCΞϓϦέʔγϣϯ ηΩϡϦςΟཁ݅ॻ • ҆શͳ8FCΞϓϦέʔγϣϯ։ൃͷ۩ମతͳη ΩϡϦςΟཁ݅ॻ – ҆શͳΞϓϦέʔγϣϯͷ։ൃ – ։ൃձࣾͱൃ஫ऀͷᘥᙪ୲อܖ໿ͷ੹೚෼ղ఺Λ໌ ֬ʹ͢Δ
– ཁٻ࢓༷΍3'1ʢఏҊґཔॻʣͱͯ͠׆༻ • 8FCΞϓϦέʔγϣϯηΩϡϦςΟཁ݅ॻ 08"41+BQBO – IUUQTHJUIVCDPNVFOPTFDSFR 5SJDPSEFS$P-UE

ࣄྫɿରࡦ࿙Εͷ੹೚Λ։ൃձࣾʹ໰͏൑ܾ • 9͕ࣾӡӦ͢Δ&$αΠτʹɺ֎෦͔Βͷෆਖ਼Ξ ΫηεʹΑΓ࠷େ݅ͷΫϨδοτΧʔυ৘ ใ͕࿙Ӯ • 9ࣾ͸:ࣾʹରͯ͠ҕୗܖ໿ͷ࠴຿ෆཤߦʹجͮ ͖ଛ֐ഛঈΛ੥ٻ – ݪࠂɿ9ࣾ
௨৴ൢചۀऀɺඃࠂɿ:ࣾ γεςϜ։ൃ ձࣾ • ݪࠂ͕উૌ͠໿ສԁͷଛ֐ഛঈۚΛࢧ෷͏ Α͏ඃࠂʹ໋ͨ͡ʢ೥݄೔ʣ $ 5SJDPSEFS$P-UE ൑ྫ࣌ใ߸

҆શͳ8FCΞϓϦέʔγϣϯͷ։ൃʹ͸ ཁ݅ఆٛͱઃܭ͕ॏཁ • ҆શͳ8FCαΠτΛ࡞Δʹ͸ઃܭҎલ͕ॏཁ • ૣ͍ஈ֊ͰରԠ͢Δํ͕ίετ͕গͳ͍ – ཁ݅ఆٛ΍ઃܭͷෆඋ͸ɺޙͷશϑΣʔζʹӨڹ 5SJDPSEFS$P-UE
Ӧۀɾاը ཁٻ࢓༷ɾ ཁ݅ఆٛ ઃܭ ࣮૷ ςετ ӡ༻։࢝

ηΩϡϦςΟϗʔϧΛमਖ਼͢Δ ίετʢϑΣʔζผʣ 5SJDPSEFS$P-UE ࢀߟɿ,FWJO4PP )PP l5BOHJCMF30*UISPVHI4FDVSF4PGUXBSF&OHJOFFSJOHz4FDVSJUZ #VTJOFTT2VBSUFSMZ 7PM
/P 'PVSUI2VBSUFS ཁٻ࢓༷ɾઃܭ࣌ ࣮૷࣌ ςετ࣌ ӡ༻։࢝ޙ ίετ

ཁٻ࢓༷߲໨ ೝূɾೝՄ ηογϣϯ؅ཧ ύϥϝʔλʔ ग़ྗॲཧ
)5514 DPPLJF ը໘ઃܭ ͦͷଞ ఏग़෺ $ 5SJDPSEFS$P-UE

5SJDPSEFS$P-UE

҆શͳ΢ΣϒαΠτͷ࡞Γํ 5SJDPSEFS$P-UE

҆શͳ΢ΣϒαΠτͷ࡞Γํ • ηΩϡϦςΟΛॳΊͯҙࣝ͢Δ8FCΞϓϦέʔ γϣϯ։ൃऀ޲͚υΩϡϝϯτ – 8FCΞϓϦέʔγϣϯͷ੬ऑੑͷཧղͱରࡦͷͨΊ ͷ࣮૷ํ๏ɺࣦഊྫ – 8FCαʔόʔ΍%/4ͳͲͷରࡦ •
҆શͳ΢ΣϒαΠτͷ࡞Γํ *1"ಠཱߦ੓๏ ਓ ৘ใॲཧਪਐػߏ – IUUQTXXXJQBHPKQTFDVSJUZWVMOXFCTFDVSJ UZIUNM 5SJDPSEFS$P-UE

੬ऑੑରࡦʹ͍ͭͯ • ࠜຊతղܾ – ੬ऑੑΛ࡞Γࠐ·ͳ͍࣮૷ – ͦͷ੬ऑੑΛૂͬͨ߈ܸΛແޮԽ • อݥతରࡦʢηʔϑςΟωοτʣ –
߈ܸʹΑΔӨڹΛܰݮ͢Δରࡦ – ߈ܸ͞ΕΔՄೳੑͷܰݮ – ੬ऑੑΛಥ͔ΕΔՄೳੑͷܰݮ – ඃ֐ൣғΛ࠷খԽ͢Δ – ඃ֐͕ੜͨ͡৔߹ʹૣظʹ஌Δ 5SJDPSEFS$P-UE

ηΩϡϦςΟ࣮૷ 42-ΠϯδΣΫγϣϯ 04ίϚϯυɾΠϯδΣΫγϣϯ ύε໊ύϥϝʔλͷະνΣοΫʗσΟϨΫτϦɾτϥόʔ αϧ ηογϣϯ؅ཧͷෆඋ
ΫϩεαΠτɾεΫϦϓςΟϯά $43'ʢΫϩεαΠτϦΫΤετϑΥʔδΣϦʣ )551ϔομɾΠϯδΣΫγϣϯ ϝʔϧϔομɾΠϯδΣΫγϣϯ ΫϦοΫδϟοΩϯά όοϑΝΦʔόʔϑϩʔ ΞΫηε੍ޚ΍ೝՄ੍ޚͷܽམ 5SJDPSEFS$P-UE

ྫɿ 5SJDPSEFS$P-UE

8FCΞϓϦέʔγϣϯ੬ऑੑ਍அΨΠ υϥΠϯ 5SJDPSEFS$P-UE

8FCΞϓϦέʔγϣϯ੬ऑੑ਍அΨΠ υϥΠϯ • ࠷௿ݶඞཁͳϨϕϧͷ8FCΞϓϦέʔγϣϯ ੬ऑੑ਍அΛߦ͏ͨΊͷΨΠυϥΠϯ • ੬ऑੑ਍அ࢜εΩϧϚοϓϓϩδΣΫτ 08"41+BQBO – IUUQTXXXPXBTQPSHJOEFYQIQ1FOUFTUFS@4
LJMMNBQ@1SPKFDU@+1 5SJDPSEFS$P-UE

੬ऑੑͱηΩϡϦςΟػೳͷෆ଍ • ੬ऑੑͱηΩϡϦςΟػೳͷෆ଍Λݟ͚ͭΔͷ ͕੬ऑੑ਍அ – ηΩϡϦςΟςετ • ੬ऑੑ – ϓϩάϥϜͷόά
– όάͷதͰѱ༻Մೳͳ΋ͷ͕੬ऑੑ • ηΩϡϦςΟػೳͷෆ଍ – ࣮૷͢Ε͹ηΩϡϦςΟϨϕϧ͕޲্͢ΔରࡦΛ࣮ ࢪ͍ͯ͠ͳ͍ – ҆શͰͳ͍ϓϩτίϧ΍ऑ͍ύεϫʔυͷར༻ͳͲ 5SJDPSEFS$P-UE

8FCΞϓϦͷ੬ऑੑ਍அ͸θϩσΠ୳͠ • 8FCΞϓϦέʔγϣϯʢϓϩμΫτ΍ύοέʔδ Λআ͘ʣ͸θϩσΠ੬ऑੑΛ୳͢͜ͱʹͳΔ – θϩσΠ੬ऑੑɿެʹ͸प஌͞Ε͍ͯͳ͍੬ऑੑ – ߈ܸऀҎ֎͸୭΋੬ऑੑΛൃݟͯ͘͠Εͳ͍ ϓϥοτϑΥʔϜͰରࡦ͢΂͖ࣄ߲ •
ط஌ͷ੬ऑੑ – όʔδϣϯ͕ݹ͘੬ऑੑ͕ଘࡏ͢Δ – ͢ͰʹϓϩμΫτͷαϙʔτ͕ऴ͍ྃͯ͠ΔͨΊ੬ऑੑ͕ मਖ਼͞Εͳ͍ • ઃఆͷෆඋ – ࠷৽όʔδϣϯͰ͋ͬͯ΋ηΩϡϦςΟʹؔΘΔઃఆͷෆ උʹΑΔ੬ऑੑ͕ଘࡏ͢Δ 5SJDPSEFS$P-UE

ࣗಈͱखಈͷ਍அख๏ • ࣗಈతʹ੬ऑੑΛൃݟ͢Δ਍அ – ࣗಈ਍அπʔϧʹΑΔ਍அ • ख࡞ۀͰ੬ऑੑΛൃݟ͢Δ਍அ – खಈ਍அิॿπʔϧΛ࢖͏ख࡞ۀʹΑΔ਍அ •
ࣗಈ਍அπʔϧͰ͸ൃݟ͕೉͍͠੬ऑੑ΍ɺࣗ ಈతʹ୳͢͜ͱ͕ࠔ೉ͳػೳ΍Օॴ͕͋ΔͨΊɺ ࣮֬ʹ੬ऑੑ਍அΛߦ͏ͨΊʹ͸ख࡞ۀʹΑΔ ਍அΛ߹Θͤͯߦ͏͜ͱ͕ඞཁ – ࣗಈ਍அπʔϧʹ͔͠ൃݟͰ͖ͳ͍੬ऑੑ͸ͳ͍ 5SJDPSEFS$P-UE

੬ऑੑ਍அʹ࢖༻͢Δπʔϧ • 1SPYZπʔϧ – 8FCϒϥ΢βͱ8FCαʔόʔͷؒʹ1SPYZͱͯ͠ೖ ΓɺϦΫΤετɾϨεϙϯεʹհࡏ͢Δ – औಘ΍อଘɺॻ͖׵͑ɺ࠶ੜͳͲΛߦ͏ 5SJDPSEFS$P-UE
IUUQ #SPXTFS γϣοϐϯάαΠτ 8FCαʔόʔ 1SPYZπʔϧ 8FCϒϥ΢β

੬ऑੑ਍அʹ࢖༻͢Δπʔϧ • ࣗಈ਍அπʔϧ – 08"41;"1 • 08"41ɿ8FCΞϓϦέʔγϣϯηΩϡϦςΟͷυΩϡϝ ϯτ΍πʔϧͳͲΛ࡞͍ͬͯΔ/10 – *#.4FDVSJUZ"QQ4DBO
)18FC*OTQFDU 7&9 • खಈ਍அิॿπʔϧ – #VSQ4VJUF$PNNVOJUZ&EJUJPO • 1SPGFTTJPOBM൛ʹ͸ࣗಈ਍அπʔϧ΋౥ࡌ͞Ε͍ͯΔ – 'JEEMFS 5SJDPSEFS$P-UE

8FCΞϓϦέʔγϣϯ੬ऑੑ਍அΨΠυ ϥΠϯ • खಈ਍அิॿπʔϧΛ࢖ͬͯ੬ऑੑ਍அΛߦ͏ࡍͷ ΨΠυϥΠϯ – ࣗಈ਍அπʔϧʹΑΔ੬ऑੑ਍அͷݕূʹ΋׆༻ • ΨΠυϥΠϯͷهࡌࣄ߲ –
਍அΛ࣮ࢪ͢΂͖Օॴ – ϖΠϩʔυɾݕग़ύλʔϯ – ૢ࡞Λߦ͏ର৅ – ਍அํ๏ – ੬ऑੑ͕͋Δʗͳ͍৔߹ͷ݁Ռ • ʮΨΠυϥΠϯར༻ͷͨΊͷυΩϡϝϯτʯ΍੿ஶ ʮ੬ऑੑ਍அελʔτΨΠυʯͱซ༻ 5SJDPSEFS$P-UE

8FC"QQMJDBUJPO'JSFXBMMʢ8"'ʣ 5SJDPSEFS$P-UE

8FC"QQMJDBUJPO'JSFXBMMʢ8"'ʣ • 8FCΞϓϦέʔγϣϯઐ༻ϑΝΠΞ΢Υʔϧ – ෆਖ਼ͳ߈ܸ͔ΒकΓɺ੬ऑੑΛແ֐Խ – ߈ܸΛݕ஌͠ɺϩάʹه࿥ • 8FCΞϓϦέʔγϣϯʹηΩϡϦςΟ্ͷ໰୊͕ ͋ͬͯ΋ແ֐ԽͰ͖Δ
– ৽ͨʹൃݟ͞Εͨ੬ऑੑʹରͯ͠ਝ଎ʹରԠ – ࠜຊతͳηΩϡϦςΟରࡦ͕ෆཁͳΘ͚Ͱ͸ͳ͍ – ޡݕ஌ͳͲͷ໰୊͔ΒϩάΛऔಘ͢Δ໨తͷΈͰӡ༻͢Δ ͜ͱ΋ • ߈ܸͷࠟ੻Λه࿥͢ΔͨΊʹ΋ඞཁ – ௨ৗͷ8FCαʔόʔ͕ه࿥͍ͯ͠Δϩά͚ͩͰ͸ɺΠϯ γσϯτൃੜ࣌ʹे෼ͳௐ͕ࠪͰ͖ͳ͍ 5SJDPSEFS$P-UE

8FC"QQMJDBUJPO'JSFXBMMʢ8"'ʣ • ιϑτ΢ΣΞܕ – 8FCαʔόʔʹΠϯετʔϧ͢ΔλΠϓ – ϋʔυ΢ΣΞͳͲͷඅ༻Λ཈͑Δ͜ͱ͕Ͱ͖Δ – ઃఆ΍ӡ༻ɺো֐ͷ੾Γ෼͚Λߦ͏ඞཁ͕͋Δ •
ΞϓϥΠΞϯεܕ – ϋʔυ΢ΣΞͱͯ͠ωοτϫʔΫ಺ʹಋೖ͢ΔλΠϓ – େ༰ྔͷ௨৴ΛॲཧͰ͖Δ΋ͷ΋͋Δ – ػີ৘ใͳͲΛ֎෦ʹग़͢ඞཁ͕ͳ͍ • Ϋϥ΢υܕ – Ϋϥ΢υ্ͷ8"'Λར༻ – ઃఆ΍ӡ༻ͳͲΛ೚ͤΒΕΔ͜ͱ΋͋Δ – $%/ͳͲͷػೳͱซͤͯఏڙ͞ΕΔ͜ͱ΋͋Δ 5SJDPSEFS$P-UE

.PE4FDVSJUZ0QFO4PVSDF8FC "QQMJDBUJPO'JSFXBMM 5SJDPSEFS$P-UE IUUQTNPETFDVSJUZPSH

άουɾϓϥΫςΟεɾΨΠυ ύον؅ཧ 5SJDPSEFS$P-UE

άουɾϓϥΫςΟεɾΨΠυ ύον؅ཧ • ͢΂ͯͷγεςϜʹύονΛਖ਼͘͠ద༻͢ΔͨΊ ͷΨΠυϥΠϯ – ύονΛਖ਼͘͠ద༻͢ΔͨΊͷஈ֊ͷखॱ • ύονΛਖ਼͘͠ద༻͢Ε͹ϓϥοτϑΥʔϜͷ੬ऑ ੑ͸मਖ਼͢Δ͜ͱ͕Ͱ͖Δ
• άουɾϓϥΫςΟεɾΨΠυ ύον؅ཧ $1/* ೔ຊޠ༁ +1$&35$$ – IUUQTXXXKQDFSUPSKQJDTJOGPSNBUJPOIUNM – ೥ͱݹ͍υΩϡϝϯτ͕ͩجຊ͸มΘΒͳ͍ • ঺հ͞Ε͍ͯΔπʔϧ͸ݹ͍ 5SJDPSEFS$P-UE

ஈ֊ͷύον؅ཧϓϩηε ᶃ ࠪఆͱ୨Է͠ – ӡ༻؀ڥ͕ͲͷΑ͏ͳιϑτ΢ΣΞίϯϙʔωϯτͰߏ੒͞Ε ͍ͯΔ͔ – ৽͍͠ιϑτ΢ΣΞߋ৽ϓϩάϥϜʹରԠ͢ΔΑ͏ʹ४උͰ͖ ͍ͯΔ͔ –
͜ΕΒΛਖ਼֬ʹه࿥͢Δ ᶄ ύονͷࣝผ – ϦϦʔε͞ΕͨύονΛ೺Ѳ͠ɺద߹͢Δ͔Λ൑அɺߋ৽͕௨ ৗͳͷ͔ۓٸͳͷ͔Λ൑அ͢Δ ᶅ ධՁɺܭըɺ͓Αͼςετ – ӡ༻؀ڥʹύονΛల։͢Δ͔ܾఆ͠ɺ࣮ࢪܭըɺεςʔδϯ ά؀ڥͰͷςετΛ࣮ࢪ͠ɺ໰୊͕ͳ͍͔Λ֬ೝ ᶆ ల։ – ར༻ऀ΁ͷӨڹΛ࠷খݶʹ཈͑ͯӡ༻؀ڥʹύονΛల։ 5SJDPSEFS$P-UE

08"41%FQFOEFODZ$IFDL • 8FCΞϓϦέʔγϣϯʹ૊ΈࠐΜͩίϯϙʔω ϯτͷύονະద༻ΛՄࢹԽ͢Δπʔϧ – ΞϓϦέʔγϣϯ͕ར༻͍ͯ͠Δίϯϙʔωϯτͷ छྨɺόʔδϣϯΛௐࠪ͠ɺ࠷৽൛͔൱͔Λ൑அͰ ͖Δ – +BWB
/&5 ʹରԠʢ࣮ݧతʹ 1ZUIPO 3VCZ 1)1 /PEFKT $$ ʹ΋ରԠʣ • 08"41%FQFOEFODZ$IFDL 08"41 – IUUQTXXXPXBTQPSHJOEFYQIQ08"41@%F QFOEFODZ@$IFDL 5SJDPSEFS$P-UE

7VMT • αʔόʔ্ͷ੬ऑੑΛՄࢹԽ͢Δπʔϧ – γεςϜʹؔ܎͋Δ੬ऑੑͷΈڭ͑ͯ͘ΕΔ – ͦͷ੬ऑੑʹ֘౰͢ΔαʔόΛڭ͑ͯ͘ΕΔ – ࣗಈεΩϟϯͷͨΊ੬ऑੑݕ஌ͷ࿙ΕΛ๷͙͜ͱ͕ Ͱ͖Δ
– $30/ͳͲͰఆظ࣮ߦɺϨϙʔτ͢Δ͜ͱͰ੬ऑੑ ͷ์ஔΛ๷͙͜ͱͰ͖Δ • 7VMT – IUUQTHJUIVCDPNGVUVSFBSDIJUFDUWVMT 5SJDPSEFS$P-UE

࣌୅ʹԠͨ͡ηΩϡϦςΟରࡦ͕ඞཁ 5SJDPSEFS$P-UE

աڈͷ΋ͷʹͳΓͭͭ͋Δ΋ͷ • ύεϫʔυͷఆظมߋ – ఆظมߋ͸࿙͍͑ͨ͠ύεϫʔυ͕ແޮԽͰ͖Δఔ ౓ͰޮՌ͸ݶఆత – ҆શੑ͕޲্͢Δೝূػೳ΍࢓૊ΈΛఏڙ͢΂͖ – /*45
ถࠃࠃཱඪ४ٕज़ݚڀॴ ͷσδλϧೝূΨΠ υϥΠϯ 41# Ͱ͸ʮϢʔβʔʹύεϫʔυ มߋΛཁٻ͢΂͖Ͱ͸ͳ͍ʯͱ͋Δ ೥݄ 5SJDPSEFS$P-UE

աڈͷ΋ͷʹͳΓͭͭ͋Δ΋ͷ • 44- 44- 5-4͸ར༻ېࢭ – 44-ʢ೥݄ར༻ېࢭ 3'$ʣ – 44-ʢ೥݄ഇࢭΛٻΊΔ
3'$ʣ – 5-4ʢ೥݄೔ར༻ېࢭ 1$*%44ʣ • ύεϫʔυೖྗϑΥʔϜΛϚεΫ͢Δ – εϚʔτϑΥϯͷ୆಄Ͱɺೖྗͷͮ͠Β͔͞ΒϚε Ϋ͠ͳ͍ํ͕ڧݻͳύεϫʔυΛ࢖༻͠΍͍ͨ͢Ίɺ ϚεΫΛ֎͢Φϓγϣϯ͕෇͚ΒΕΔ͜ͱ΋͋Δ 5SJDPSEFS$P-UE

׬શ)5514Խ • ଟ͘ͷαʔϏε͕׬શ)5514ԽΛਐΊ͍ͯΔ – Ҏલ͸ɺೖྗϑΥʔϜ΍ॏཁͳՕॴ͚ͩ)5514Խ – (PPHMF 'BDFCPPL #JOH 5XJUUFS
:PV5VCF 8JLJQFEJB /FUGMJY :BIPP+"1"/ – )551͸)5514ར༻͕લఏ • ׬શ)5514ԽͷϝϦοτ – ౪ௌɾվ͟ΜɾͳΓ͢·͠ͷ๷ࢭ – 8FCαΠτͷ৴པੑ޲্ – ͲͷϖʔδΛ)5514Խ͢Δ͔ͱ͍͏ٞ࿦ෆཁ – γϯϓϧͳηογϣϯ؅ཧ – )551Λར༻Ͱ͖ΔͨΊ௨৴଎౓͕޲্ – -FUT&ODSZQUͳͲͷແྉͷূ໌ॻ΋͋Δ 5SJDPSEFS$P-UE

αΠόʔ߈ܸରࡦ͸ى͜Δ͜ͱΛલఏʹ • Ҏલ͸ɺ߈ܸΛˋ๷͝͏ͱ͍ͯͨ͠ • ηΩϡϦςΟɾΠϯγσϯτ͸ʮى͜Δ͜ͱΛ લఏʯʹߟ͑Δ – ׬શʹΠϯγσϯτΛ๷͙͜ͱ͸ෆՄೳͱ஌Δ – Πϯγσϯτͷ๷ࢭ͸ॏཁ͕ͩɺΠϯγσϯτͷඃ
֐࠷খԽ͕ٻΊΒΕ͍ͯΔ 5SJDPSEFS$P-UE

͍͞͝ʹ • ඞཁͳηΩϡϦςΟରࡦ͸࣌୅ʹΑͬͯ มΘΔ͜ͱ΋͋Δ – Ҏલ͸ޮՌ͕͋ͬͨରࡦ͕ɺҙຯ͕ͳ͘ͳΔ͜ͱ΋ ͋Δ – Ҏલ͸ਪ঑͞Ε͍ͯͨରࡦ͕ɺࠓ͸ਪ঑͞Εͳ͍ର ࡦʹͳΔ͜ͱ΋͋Δ
• ͦͷηΩϡϦςΟରࡦ͸ࠓͰ΋े෼ʹػೳͯ͠ ͍·͔͢ʁ – ૊৫΍γεςϜͷηΩϡϦςΟͷ૯߹ྗͷςετͳ ΒϖωτϨʔγϣϯςετ͕Φεεϝ 5SJDPSEFS$P-UE

Security measures to change if you know OWASP

Security measures to change if you know OWASP

More Decks by Sen UENO

Other Decks in Technology

Featured

Transcript