アジャイル開発で役立つセキュリティプラクティス / Agile Security Practice

ΞδϟΠϧ։ൃͰ໾ཱͭ ηΩϡϦςΟϓϥΫςΟε BLJN !"[email protected]@ 3FHJPOBM4DSVN(BUIFSJOH5PLZP

ൃද౰೔ͷεϥΠυʹվఆΛՃ͍͑ͯ·͢

վఆͨ͠෦෼ w Կͷུশ͔Θ͔ΔΑ͏ʹमਖ਼ w εϥΠυ࡟ݮ ΞχϝʔγϣϯతͳܗͰ࢖͍ͬͯͨεϥΠυ΍ൃද౰೔ͷΈҙ ຯ͕͋ͬͨΞϯέʔτͷεϥΠυΛҰ෦࡟ݮ͠·ͨ͠ w ࢿྉͷ࠷ޙʹࢀߟจݙΛ௥Ճ
w εϥΠυΛݟΔࡍʹҰఆͷલఏ஌͕ࣝඞཁͦ͏ͳ෦෼ʹؔͯ͠͸લఏ஌ࣝΛ ิ͑ͦ͏ͳهࣄ΍ຊΛ୳ͯ͠εϥΠυʹ௥Ճ w ޡࣈ୤ࣈमਖ਼

ࣗݾ঺հ

ࣗݾ঺հ w ໊લBLJN !"[email protected]@ w ࢓ࣄ࠷ۙ͸ΞδϟΠϧίʔν w झຯษڧձ ೥͸ճࢀՃ
w ϒϩάIUUQTBLJNIBUFOBEJBSZDPN

ΞδϟΠϧ։ൃͱηΩϡϦςΟ͸૬ੑ͕ѱ͍ʁ

4/4ͷ੠ ˞ಛఆͰ͖ͳ͍Α͏ʹҰ෦Ճ޻͍ͯ͠·͢

4/4ͷ੠ ΞδϟΠϧ։ൃͱηΩϡϦςΟ͸૬ੑ͕ѱ͍ʁ ηΩϡϦςΟͱΞδϟΠϧΛηοτͰχϡʔτϥϧPSߠఆతʹ࿩͍ͯ͠Δҙݟ͕গͳ͍ʜ ηΩϡϦςΟΛॏࢹ͢ΔγεςϜͰ ΞδϟΠϧ։ൃΛબΜͩͷ͕ࣦഊ ηΩϡΞͳγεςϜߏங͕ ඞਢͳͷͰΞδϟΠϧ։ൃ͸ఘΊͨ

৘ใηΩϡϦςΟेେτϨϯυ

৘ใηΩϡϦςΟेେτϨϯυ ΞδϟΠϧ։ൃͱηΩϡϦςΟ͸૬ੑ͕ѱ͍ʁ IUUQTXXXKBTBKQTFNJOBSTFD@USFOE

ܾͯ͠૬ੑ͕ѱ͍Θ͚Ͱ͸ͳ͍͸ͣ

ηΩϡϦςΟͷཁ఺͸։ൃख๏ʹґଘ͠ͳ͍ ΞδϟΠϧ։ൃͱηΩϡϦςΟ͸૬ੑ͕ѱ͍ʁ ΞδϟΠϧܕͷ։ൃϓϩηεͰ͋ͬͯ΋ηΩϡϦςΟରԠͷཁ఺͸มΘΓ·ͤ Μɻ͔͠͠ɺʮΞδϟΠϧͱηΩϡΞ։ൃ͸૬ੑ͕ѱ͍ʯͱ͍͏ײ૝͸Α͘໨ ʹ͢Δͱ͜ΖͰ͢ɻ ҆શͳ8FCΞϓϦέʔγϣϯͷ࡞Γํୈ൛ΑΓ

ൃදഎܠ

ൃදഎܠ w ΞδϟΠϧ։ൃʹηΩϡϦςΟΛ૊ΈࠐΉ޻෉Λઆ໌͍ͨ͠ w ૊৫จԽతͳ໘Ͱͷ޻෉ͷ࿩͸ൺֱతଟ͍ w ʮηΩϡϦςΟ୲౰ऀ΋εΫϥϜνʔϜʹೖͬͯҰॹʹಇ͜͏ʯ w ʮηΩϡϦςΟҙࣝΛ։ൃऀશମͰߴΊΑ͏ʯ w
ٕज़ϓϥΫςΟεతͳ؍఺Ͱͷ࿩͕޿͕ͬͯ΄͍͠

ൃදͷલఏ

w ΞδϟΠϧ։ൃҎ֎Ͱ΋໾ʹཱͭ w ηΩϡϦςΟϨϕϧΛҰఆҎ্ʹҾ্͖͛ͨޙʹ༗ޮ w ΞδϟΠϧϓϥΫςΟεʹऔΓ૊ΜͰ͍Δ͜ͱΛ૝ఆ ɹɹൃදͷલఏ

w ̋ΞδϟΠϧ։ൃͰಛʹ໾ʹཱͭ w ✕ΞδϟΠϧ։ൃͰ͔͠໾ʹཱͨͳ͍ ɹɹൃදͷલఏ ΞδϟΠϧ։ൃҎ֎Ͱ΋໾ʹཱͭ

w ٕज़ྗ͕଍Γͳ͍ঢ়ଶͰΞδϟΠϧ։ൃΛͯ͠΋͏·͍͔͘ͳ͍ w ಉ༷ʹɺηΩϡϦςΟϨϕϧ͕Ұఆͳ͍ঢ়ଶͰϓϥΫςΟεΛಋೖͯ͠΋͏· ͍͔͘ͳ͍ w ैདྷͷηΩϡϦςΟ஌͕ࣝΞδϟΠϧ։ൃͩͱෆཁʹͳͬͨΓॏཁ౓͕Լ͕ ΔΘ͚Ͱ͸ͳ͍ ɹɹൃදͷલఏ ηΩϡϦςΟϨϕϧΛҰఆҎ্ʹҾ্͖͛ͨޙʹ༗ޮ

w ϖΞϓϩϞϒϓϩͳͲ޿͘஌ΒΕ͍ͯΔϓϥΫςΟε͸ΞδϟΠϧ։ൃʹη ΩϡϦςΟΛ૊ΈࠐΉ্Ͱ༗ޮ w ͦ͏͍ͬͨϓϥΫςΟεΛ΍͍ͬͯͳ͍ͳΒ·ͣ͸ͦͪΒ͔Βࢼͯ͠΄͍͠ ɹɹൃදͷલఏ ΞδϟΠϧϓϥΫςΟεʹऔΓ૊ΜͰ͍Δ͜ͱΛ૝ఆ ΞδϟΠϧϓϥΫςΟεΛֶͿͳΒˠ

ϓϥΫςΟε঺հ

঺հ͢ΔϓϥΫςΟεҰཡ

ϓϥΫςΟε঺հ w ܧଓతͳηΩϡϦςΟ׆ಈ 08"41%FW4FD0QTMJGFDZDMFT w ςεςΟϯά w ରԠͷ༏ઌॱҐ෇͚ w
ηΩϡϦςΟઐ໳ՈͱνʔϜεςʔΫϗϧμʔͷڠಇΛิॿ

%FW0QTMJGFDZDMFT

08"41%FW4FD0QTMJGFDZDMFTͱ͸ ܧଓతͳηΩϡϦςΟ׆ಈ 08"41%FW4FD0QTMJGFDZDMFT IUUQTPXBTQPSHXXXQSPKFDUEFWTFDPQTHVJEFMJOFMBUFTUB0WFSWJFX

08"41%FW4FD0QTMJGFDZDMFT

08"41%FW4FD0QTMJGFDZDMFTͱ͸ ܧଓతͳηΩϡϦςΟ׆ಈ 08"41%FW4FD0QTMJGFDZDMFT IUUQTPXBTQPSHXXXQSPKFDUEFWTFDPQTHVJEFMJOFMBUFTUB0WFSWJFX

%FW4FD0QTMJGFDZDMFTΛ 34(5Ͱ঺հ͢Δཧ༝

%FW4FD0QTMJGFDZDMFTΛ34(5Ͱ঺հ͢Δཧ༝ ܧଓతͳηΩϡϦςΟ׆ಈ 08"41%FW4FD0QTMJGFDZDMFT ࢀߟˠIUUQTEBJQSFTFOUTDPNTIJGUMFGUBOEDPOUJOVPVTUFTUJOH

ܧଓతςετϞσϧ͕೦಄ʹ͋Δͱ 5FTUϑΣʔζʹࠞཚͦ͠͏

08"41%FW4FD0QTMJGFDZDMFT վ ܧଓతͳηΩϡϦςΟ׆ಈ 08"41%FW4FD0QTMJGFDZDMFT TEXT HERE TEXT HERE 01 01
02 03 04 DPEF CVJME SFMFBTF EFQMPZ PQFSBUF NPOJUPS QMBO

ڴҖϞσϦϯά QMBO w γεςϜΛϗϫΠτϘοΫεԽͯ͠ΞϓϦέʔγϣϯʹજΉڴҖΛಛఆ͢Δ w ڴҖͷϦετɺ͋Δ͍͸Մೳੑͷ͋ΔڴҖͷγφϦΦΛΞ΢τϓοτͱ͢Δ w ηΩϡϦςΟ୲౰ऀͷΈͰ͸ͳ͘νʔϜͰڠಇͯ͠࡞Δ w ϞσϧΛ࡞੒͢Δํ๏
ڴҖͷಛఆํ๏ ͸ෳ਺͋Δ w ϦϑΝΠϯϝϯτͳͲͰ࣮ࢪͰ͖ΔͱΑ͍ 5ISFBU.PEFMJOH%FTJHOJOHGPS4FDVSJUZ

࣮ྫϚοϐϯά QMBO ࢀߟˠIUUQTOJIPOCVTPOIBUFOBEJBSZKQFOUSZ&YBNQMF.BQQJOH w ηΩϡϦςΟ؍఺Ҏ֎ͷQMBOͰ΋࢖͑Δ w ΞλοΧʔετʔϦʔ ޙड़ ͷΠϯϓοτʹͰ͖Δ w
ڴҖϞσϦϯάΑΓϥΠτʹऔΓ૊ΊΔ

޿͘ීٴ͍ͯ͠ΔΞδϟΠϧϓϥΫςΟεΛ׆༻ w -JOUFS w 5%%XJUIOFHBUJWFDBTF w ϖΞϓϩϞϒϓϩ w ٖࣅίʔυϓϩάϥϛϯά w
45%% ޙड़ DPEF

$*$%΁ͷ૊ΈࠐΈ CVJME w 4$" w (JU)VCEFQFOEBCPU4OZL0QFO4PVSDFʜ w 4"45 w ແঈπʔϧ
#BOEJU#SBLFNBOʜ w ༗ঈπʔϧ 4OZL$PEF 4FNHSFQʜ w %"45 w ;"1#VSQ4VJUFʜ ˞4$"4"45͸DPEFʹ͋ͨΔؾ͕͢Δ͕ɺ08"41%FW4FD0QT(VJEFMJOFʹԊͬͯCVJMEͰ঺հ w *"45 w $POUSBTU$PNNVOJUZ&EJUJPO TFFLFSʜ w *74 w /FTTVT w $74 w 5SJWZ ཧղͷิ଍ϦϯΫ͕࣍ϖʔδʹ͋Γ·͢

4$"4"45%"45*"45*74$74ͷิ଍ CVJME w ͦΕͧΕ͕ԿΛ͔ࣔ͢ͷ֓ཁΛ௫Έ͍ͨํ޲͚ w IUUQTPXBTQPSHXXXQSPKFDUEFWTFDPQTHVJEFMJOFMBUFTUB4UBUJD"QQMJDBUJPO4FDVSJUZ5FTUJOH 4"45 w IUUQTPXBTQPSHXXXQSPKFDUEFWTFDPQTHVJEFMJOFMBUFTUC%ZOBNJD"QQMJDBUJPO4FDVSJUZ5FTUJOH
%"45 w IUUQTPXBTQPSHXXXQSPKFDUEFWTFDPQTHVJEFMJOFMBUFTUD*OUFSBDUJWF"QQMJDBUJPO4FDVSJUZ 5FTUJOH *"45 w IUUQTPXBTQPSHXXXQSPKFDUEFWTFDPQTHVJEFMJOFMBUFTUE4PGUXBSF$PNQPTJUJPO"OBMZTJT 4$" w IUUQTPXBTQPSHXXXQSPKFDUEFWTFDPQTHVJEFMJOFMBUFTUF*OGSBTUSVDUVSF7VMOFSBCJMJUZ4DBOOJOH *74 w IUUQTPXBTQPSHXXXQSPKFDUEFWTFDPQTHVJEFMJOFMBUFTUG$POUBJOFS7VMOFSBCJMJUZ4DBOOJOH $74

4"454$"

4"454$" $*$%΁ͷ૊ΈࠐΈ CVJME w ࣮ࢪ଎౓͕଎͘ૣظʹϑΟʔυόοΫΛಘΕΔ w ِཅੑِӄੑ͕Ұఆଘࡏ͢Δ w ࣗ෼͕ͨͪ࡞͍ͬͯΔϓϩμΫγϣϯίʔυˠ4"45 w
044Λ͸͡Ίͱͨ͠֎෦ͷιʔείʔυˠ4$"

4"454$" $*$%΁ͷ૊ΈࠐΈ CVJME w ϓϩάϥϛϯάݴޠ΍ϑϨʔϜϫʔΫͱ࢖͑Δ༧ࢉͰ૊ΈࠐΉπʔϧΛબఆ w ্ه؍఺ͰߜΓࠐΜ্ͩͰɺҎԼͷΑ͏ͳ؍఺΋ؚΊΔ w ݕग़Մೳͳ੬ऑੑҰཡͱͦͷਫ਼౓ ແঈπʔϧ͸ޡݕ஌཰ߴΊ
w πʔϧͷ࢖͍΍͢͞ w ϢʔβʔίϛϡχςΟͷॆ࣮౓ w υΩϡϝϯτͷॆ࣮౓

4"45 4UBUJD"QQMJDBUJPO4FDVSJUZ5FTUJOH

πʔϧҰཡ

4"45ʙπʔϧީิʙ $*$%΁ͷ૊ΈࠐΈ CVJME ໊শ ༗ঈແঈ ݴޠϑϨʔϜϫʔΫ #BOEJU ແঈ 1ZUIPO #SBLFNBO
ແঈ 3VCZPO3BJMT 'JOE4FD#VHT ແঈ +BWB &4-JOU ແঈ +BWB4DSJQU 3*14 ແঈ 1)1 (PTFD ແঈ (P *OGFS ແঈ $ 0CKFDUJWF$ +BWB 1.% ແঈ +BWB +BWB4DSJQU ,PUMJO 4DBMBʜ 4OZL 4OZL$PEF ༗ঈ +BWB +BWB4DSJQU 5ZQF4DSJQU 1ZUIPO 1)1 $ (P 4FNHSFQ ༗ঈ +BWB +BWB4DSJQU 5ZQF4DSJQU 1ZUIPO 1)1 $ (P 3VCZ 3VTU ,PUMJO 4DBMBʜ (JU)VC"EWBODFE4FDVSJUZ ༗ঈ +BWB +BWB4DSJQU 5ZQF4DSJQU 1ZUIPO ,PUMJO $ (Pʜ

༗ঈπʔϧൺֱ

4"45ʙ༗ঈπʔϧ 4OZL$PEF ʙ $*$%΁ͷ૊ΈࠐΈ CVJME w ೥݄ͷUIPVHIUXPSLT5FDIOPMPHZ3BEBSͰ"EPQUධՁ w ࣮ߦ଎౓͕ߴ଎ w
೔ຊޠͷυΩϡϝϯτ͕ॆ࣮

4"45ʙ༗ঈπʔϧ 4FNHSFQ ʙ $*$%΁ͷ૊ΈࠐΈ CVJME w ϓϩάϥϚʔϑϨϯυϦʔͳݕࠪϧʔϧͷه๏ w ׆ൃͳϢʔβʔίϛϡχςΟ

4"45ʙ༗ঈπʔϧ (JU)VC"EWBODFE4FDVSJUZ ʙ $*$%΁ͷ૊ΈࠐΈ CVJME w ଟ͘ͷਓ͕࢖͍׳Ε͍ͯΔͰ͋Ζ͏6* w (JU)VC&OUFSQSJTFΛ࢖͍ͬͯΔͳΒ͓ͦΒ͘༗ঈπʔϧͰ࠷҆஋ w
1VTI1SPUFDUJPO͕ڧྗ

4$" 4PGUXBSF$PNQPTJUJPO"OBMZTJT

4$" (JU)VCEFQFOEBCPU $*$%΁ͷ૊ΈࠐΈ CVJME w (JU)VCΛ࢖͍ͬͯΔͳΒແྉ w ϓϥΠϕʔτϦϙδτϦ΋εΩϟϯՄೳ w 13࡞੒·ͰࣗಈͰ࣮ࢪ

4$" 4OZL0QFO4PVSDF $*$%΁ͷ૊ΈࠐΈ CVJME w 4"45Ͱ঺հͨ͠ͷͱಉ༷ͷϝϦοτ w 4"454$"ΛҰͭͷπʔϧͰ׬݁

4$" ͦͷଞ $*$%΁ͷ૊ΈࠐΈ CVJME w ೔ຊࠃ಺࢈ʜZBNPSZ w 08"41࢈08"41%FQFOEFODZ$IFDL

%"45 %ZOBNJD"QQMJDBUJPO4FDVSJUZ5FTUJOH

%"45ʙ֓ཁʙ $*$%΁ͷ૊ΈࠐΈ CVJME w ೝূ҉߸ԽΛ͸͡Ίͱͨ͠4"454$"Ͱݟ͚ͭΒΕͳ͍੬ऑੑΛൃݟ w ϓϩάϥϛϯάݴޠʹඇґଘ w ࣗಈԽ΋Մೳ͕ͩɺ࣮ߦʹίετ͕͔͔ΔͨΊແҋʹ$*$%ʹ૊ΈࠐΉͱ։ ൃޮ཰ͷ௿ԼΛট͘

πʔϧީิ

%"45ʙπʔϧީิʙ $*$%΁ͷ૊ΈࠐΈ CVJME w ;"1 w #VSQ4VJUF

%"45ʙ;"1ʙ $*$%΁ͷ૊ΈࠐΈ CVJME w ແঈͰར༻Մೳ w چ08"41;"1࣌୅͔Β௕͘ར༻͞Ε͍ͯΔͨΊ஌ݟ͕๛෋ w ;"1#BTFMJOF4DBO

#VSQ4VJUF

%"45ʙ#VSQ4VJUFʙ $*$%΁ͷ૊ΈࠐΈ CVJME w ແঈ൛༗ঈ൛ͷ྆ํ͕ଘࡏ w ๛෋ͳΧελϚΠζػೳ w ༰қͳ1SPYZઃఆ

;"1WT#VSQ4VJUF

%"45ʙ;"1WT#VSQ4VJUFʙ $*$%΁ͷ૊ΈࠐΈ CVJME ˞ॻ੶Ͱ͸είΞϦϯάܗࣜͰධՁ͞Ε͍ͯ·͕͢ɺৄࡉΛຊͰݟͯ΋Β͏ͨΊʹҙਤతʹه߸ͰϚεΩϯά͍ͯ͠·͢ ؍఺ ;"1 #VSQ$PNNVOJUZ #VSQ1SPGFTTJPOBM ਍அର৅֬ೝ ̋
˚ ̋ ਍அର৅બఆ ˚ ˕ ˕ ਍அ࡞ۀ४උ ˚ ˕ ˕ ਍அ࡞ۀ࣮ࢪ ̋ ˚ ˕ ਍அ݁Ռߟ࡯ ˕ ✕ ˚ ਍அ݁Ռใࠂ ˕ ✕ ̋ ֎؍ ̋ ̋ ̋

*"45 *OUFSBDUJWF"QQMJDBUJPO4FDVSJUZ5FTUJOH

*"45ʙ֓ཁʙ $*$%΁ͷ૊ΈࠐΈ CVJME w 4"45ΑΓ௿͍ޡݕ஌཰Ͱ%"45ΑΓ࣮ߦ଎౓͕ߴ଎ w ରԠϓϩάϥϛϯάݴޠ͕ݶఆత w ࣮ߦ͍ͯ͠Δࡍʹ௨ΔίʔυΧόϨοδ͔͠୲อͰ͖ͳ͍ w
"*ͷൃలʹ൐͏ਐԽ͕ظ଴

πʔϧީิ

*"45ʙπʔϧީิʙ $*$%΁ͷ૊ΈࠐΈ CVJME w $POUSBTU$PNNVOJUZ&EJUJPO w 4FFLFS

*"45ʙπʔϧ $POUSBTU$PNNVOJUZ&EJUJPO ʙ $*$%΁ͷ૊ΈࠐΈ CVJME w αϙʔτ͕खް͍ w අ༻͕ൺֱత҆Ձ

*"45ʙπʔϧ 4FFLFS ʙ $*$%΁ͷ૊ΈࠐΈ CVJME w ࣮ߦ଎౓͕ߴ଎ w ϚΠΫϩαʔϏεΞʔΩςΫνϟͱͷ૬ੑ͕ྑ͍ w
ൺֱత๛෋ͳରԠݴޠ

*74 *OGSBTUSVDUVSF7VMOFSBCJMJUZ4DBOOJOH

*74 /FTTVT $*$%΁ͷ૊ΈࠐΈ CVJME w πʔϧͷୈҰީิ͸/FTTVT w ରԠ$7਺͕๛෋ w ޡݕ஌཰͕௿͍
w $*$%ʹ૊ΈࠐΈ΍͍͢

*74 0QFO7"4/FYQPTF $*$%΁ͷ૊ΈࠐΈ CVJME w 0QFO7"4 w খதن໛ͳιϑτ΢ΣΞͰ༧ࢉ͕௿͘཈͑ΒΕ΍͍͢ w /FYQPTF
w είΞϦϯάػೳ͕ڧྗͰ;Γ͔͑Γվળʹ࢖͍΍͍͢

$74 *OGSBTUSVDUVSF7VMOFSBCJMJUZ4DBOOJOH

$74 $POUBJOFS7VMOFSBCJMJUZ4DBOOJOH $*$%΁ͷ૊ΈࠐΈ CVJME w ೥ݱࡏͩͱ5SJWZΛੵۃతʹ࢖Θͳ͍ཧ༝͕͋·Γݟ౰ͨΒͳ͍ w ؀ڥߏஙύΠϓϥΠϯ΁ͷ૊ΈࠐΈ͕༰қ w ࣮ߦ଎౓͕ߴ଎
w ߴ͍εΩϟϯਫ਼౓

$PNQMJBODF7BMJEBUJPO SFMFBTF w ࣗಈϦϦʔε ࣗಈϩʔϧόοΫ w ຊ൪ઃఆݕূ w ϢʔβʔΞΫηε੍ޚ w
ϑΝΠΞ΢ΥʔϧΞΫηε੍ޚ w ۀքݻ༗ ϦϦʔεঝೝ༻υΩϡϝϯτͷࣗಈੜ੒

$PEF4JHOJOH7BMJEBUJPO EFQMPZ w CVJMEϑΣʔζͰ࣮ࢪͨ͠ςετ΍εΩϟϯΛܧଓతʹ࣮ࢪ w $PEF4JHOJOH w (JU)VC"DUJPOT w (JU-BC

%FW4FD0QTMJGFDZDMFTͰ࣮࣭తʹ ·ͱΊΒΕ͍ͯΔͷͰ PQFSBUFNPOJUPSΛ߹Θͤͯ঺հ

؂ࢹ PQFSBUFNPOJUPS w ఆظతϞχλϦϯά Ξϥʔτ௨஌ w 1SPNFUIFVT"MFSU.BOBHFSͳͲ w ηΩϡϦςΟҎ֎ͷ؍఺΋ؚΊͯϞχλϦϯά͢Δ͜ͱ͕ଟ͍

ηΩϡϦςΟΠϯγσϯτରԠ PQFSBUFNPOJUPS w ίϥϘϨʔγϣϯޮ཰Խ w 5IF)JWFͳͲͷπʔϧ΋͋Δ͕ʮϓϩηε΍πʔϧΑΓ΋ݸਓͱର࿩Λʯ w ࣄલ४උ w JODJEFOUSFTQPOTFDZDMF
w վળ w ΧΦεΤϯδχΞϦϯά

طଘͷJODJEFOUSFTQPOTFDZDMFΛ ϕʔεʹͯ͠ΠϯγσϯτରԠ࣌ͷϑϩʔΛ੔උ

/*45JODJEFOUSFTQPOTFDZDMF

/*45JODJEFOUSFTQPOTFDZDMF ηΩϡϦςΟΠϯγσϯτରԠ PQFSBUFNPOJUPS IUUQTXXXOJTUHPWQSJWBDZGSBNFXPSLOJTUTQ

4"/4JODJEFOUSFTQPOTFDZDMF

4"/4JODJEFOUSFTQPOTFDZDMF ηΩϡϦςΟΠϯγσϯτରԠ PQFSBUFNPOJUPS 1SFQBSBUJPO *EFOUJ fi DBUJPO $POUBJONFOU &SBEJDBUJPO 3FDPWFSZ
-FTTPOT -FBSOFE IUUQTXXXTBOTPSHXIJUFQBQFST

ࢀߟॻ੶ JODJEFOUSFTQPOTFDZDMFͷ੔උࣄྫͷࢀߟ w "HJMF4FDVSJUZ0QFSBUJPOT w IUUQTXXXBNB[PODPKQ"HJMF4FDVSJUZ0QFSBUJPOT&OHJOFFSJOH EFUFDUJPOEQ

ηΩϡϦςΟΠϯγσϯτରԠ PQFSBUFNPOJUPS w ίϥϘϨʔγϣϯޮ཰Խ w 5IF)JWFͳͲͷπʔϧ΋͋Δ͕ʮϓϩηε΍πʔϧΑΓ΋ݸਓͱର࿩Λʯ w ࣄલ४උ w JODJEFOUSFTQPOTFDZDMF
w վળ w ΧΦεΤϯδχΞϦϯά

ΧΦεΤϯδχΞϦϯά ηΩϡϦςΟΠϯγσϯτରԠ PQFSBUFNPOJUPS w ຊ൪؀ڥͰҙਤతʹΠϯγσϯτΛى࣮͜͢ݧΛ͢Δ w ϓϩηε ఆৗঢ়ଶͷଌఆ
Ծઆઃఆ ࣮ݧͷܭը Ծઆͷ֬ೝ ΧΦεΤϯδχΞϦϯά

ςεςΟϯά w 45%% w #%% (BVOUMU#%%4FDVSJUZ w ςετϐϥϛου w
୳ࡧతςετ

45%% 4FDVSJUZ5FTU%SJWFO%FWFMPQNFOU ςεςΟϯά w ηΩϡϦςΟ൛5%% w ಘΒΕΔޮՌ͸5%%ͱಉ༷ w %"45ͷϑΟʔυόοΫ͕஗͘ͳΓ͕ͪͳͷͰ޻෉͕ඞཁ w
4"45Λઌʹճ͢ w ௥Ճͨ͠ςετ͕'BJMͨ͠Βɺ%"45Λճͭͭ͠ɹɹɹɹɹɹɹɹɹɹɹɹ ϓϩμΫγϣϯίʔυͷมߋΛฒྻͯ͠΍Δ

45%%ͷϓϩηε

45%%ͷϓϩηε ςεςΟϯά 4"45 ςετέʔε ௥Ճ 'BJM ϓϩμΫγϣϯ ίʔυมߋ %"45࣮ࢪ ςετ࣮ߦ
ϦϑΝΫλϦϯά %"45࣮ࢪ

୳ࡧతςετ

ηΩϡϦςΟ؍఺Ͱ#%%Λ࣮ࢪ͢ΔͨΊͷ044

#%% (BVOUMU#%%4FDVSJUZ ςεςΟϯά w ηΩϡϦςΟ؍఺Ͱ΋#%%͸༗ޮ w ͨͩ͠߈ܸͷৼΔ෣͍Λఆٛ͢ΔͨΊͷϥΠϒϥϦ͸ಋೖ͢Δඞཁ͕͋Δ w (BVOUMU w
#%%4FDVSJUZ

#%% (BVOUMU#%%4FDVSJUZ ςεςΟϯά (BVOUMU#%%4FDVSJUZͲͪΒ΋͠͹Β͘VQEBUF͸ͳ͍

(BVOUMU

(BVOUMU #%% ςεςΟϯά w 3VCZϕʔεͷ#%%ϑϨʔϜϫʔΫ w $VDVNCFSͰهࡌՄೳ w BUUBDLϑΝΠϧʹ߈ܸΛఆٛ w
ಠࣗͷΧελϜ߈ܸΛఆٛՄೳ

#%%4FDVSJUZ

#%%4FDVSJUZ #%% ςεςΟϯά w +BWBϕʔεͷ#%%ϑϨʔϜϫʔΫ w $VDVNCFSͰهࡌՄೳ w 4FMFOJVNͱ౷߹Մೳ w
;"1Λ࢖ͬͯ΢ΣϒɾΞϓϦέʔγϣϯΛࣗಈతʹεΩϟϯ͢ΔͨΊʹ࢖༻ Ͱ͖ΔςϯϓϨʔτ͋Γ

୳ࡧతςετ

ςετϐϥϛου ςεςΟϯά IUUQTNBSUJOGPXMFSDPNCMJLJ5FTU1ZSBNJEIUNM

ηΩϡϦςΟ؍఺ͷςετϐϥϛου

ςετϐϥϛου ςεςΟϯά "HJMF"QQMJDBUJPO4FDVSJUZ 4"45Ͱݟ͔ͭΔ੬ऑੑ͸ςετʹճ͞ͳ͍ Ұൠతͳ6*ςετΑΓ΋࣮ߦ଎౓͕஗͍ ෆཁέʔεࣗಈԽʹΑΔίετ͕େ͖͍ #%%ͳͲΛ׆༻ͯ͠αʔϏεؒͷ ૬ޓ࡞༻ʹूத ɾπʔϧ͸ݴޠͰબ୒ ɾͷෆ۩߹͸6OJU૚Ͱ௵ͤΔ

ςετϐϥϛου ςεςΟϯά w ηΩϡϦςΟςετͷ৔߹࣮ߦ଎౓ͷ͕ࠩΑΓ޿͕Γ΍͍͢ͷͰςετϐϥϛ ου͸·ͩ·ͩ࢖͑Δ w ͋͘·Ͱ΋ϞσϧͷҰͭͰ͋Δ͜ͱʹ͸ηΩϡϦςΟςετͰ΋มΘΓͳ͍ w ൺ཰͕ϐϥϛουঢ়ʹͳ͍ͬͯΔ͔ΑΓ΋ͲΜͳ໨తͰͲΜͳςετΛ͍ͯ͠ Δ͔Λߟ͑Δ͜ͱͷํ͕ॏཁ

୳ࡧతςετ

ηΩϡϦςΟ؍఺ͷ୳ࡧతςετ͕ ༗ޮ͔͸ߠఆత൱ఆతͲͪΒͷҙݟ΋ଘࡏ͢Δ

ߠఆҙݟ

୳ࡧతςετʙߠఆҙݟʙ ςεςΟϯά w ੬ऑੑͷԣల։ʹ༗ޮ w ςετࣗಈԽ͍ͨ͠έʔεͷબఆ࡞ۀʹ׆༻Ͱ͖Δ w ߴ͍εΩϧΛ࣋ͬͨઐ໳Ո͕ߦ͑͹௿ίετͰ੬ऑੑΛݟ͚ͭΒΕΔ

൱ఆҙݟ

୳ࡧతςετʙ൱ఆҙݟʙ ςεςΟϯά w ୲อͰ͖ͨηΩϡϦςΟ؍఺Λ͋Δఔ౓໌֬ʹ͢Δඞཁ͕͋ΔηΩϡϦςΟ ςετͱͷ૬ੑ͕ѱ͍ w έʔε͋ͨΓͷ਱ߦʹ͕͔͔࣌ؒΔͨΊ୳ࡧͰ͖Δൣғ͕ہॴతʹͳΔ w ίϯϓϥΠΞϯε४ڌͷΤϏσϯεͱͯ͠࢖༻Ͱ͖ͳ͍ w
ଞྖҬΑΓ΋ԾઆΛཱͯʹ͍͘ ୳ࡧ͕೉͍͠

ରԠͷ༏ઌॱҐ෇͚ w ॏେ౓ͷଌఆ w ѱ༻Մೳੑͷଌఆ w मਖ਼ίετͷଌఆ

ॏେ౓ͷଌఆ ରԠͷ༏ઌॱҐ෇͚ w ॏେ౓͕ߴ͚Ε͹ରԠͷ༏ઌॱҐ͸ߴ͍ w $744είΞ͕׆༻Մೳ

$744είΞ

$744είΞ ॏେ౓ͷଌఆ ରԠͷ༏ઌॱҐ෇͚ w '*345 'PSVNPG*ODJEFOU3FTQPOTFBOE4FDVSJUZ5FBNT ͷ$744 4*( 4QFDJBM*OUFSFTU(SPVQ ͕؅ཧ͢ΔΦʔϓϯϑϨʔϜϫʔΫ
w ʹW͕ϦϦʔε w #BTFɺ5ISFBUɺ&OWJSPONFOUBMɺ4VQQMFNFOUBMͷཁૉ͔Βιϑτ΢ΣΞ ͷ੬ऑੑΛଌఆ w ޙड़͢Δ&144είΞͱηοτͰ࢖༻͢ΔͱޮՌత $744είΞ୯ମͰϦεΫ ධՁͯ͠͸͍͚ͳ͍

$744είΞͰදݱͰ͖ͳ͍؀ڥཁҼ΋ ଘࡏ͢ΔͨΊࢀߟࢦඪͷҰͭͱͯ͠༻͍Δ

ѱ༻Մೳੑͷଌఆ ରԠͷ༏ઌॱҐ෇͚ w ѱ༻Մೳੑ͕ߴ͚Ε͹ରԠͷ༏ઌॱҐ͸ߴ͍ w &144είΞ͕׆༻Մೳ

&144είΞ

&144είΞ ѱ༻Մೳੑͷଌఆ ରԠͷ༏ઌॱҐ෇͚ w '*345 'PSVNPG*ODJEFOU3FTQPOTFBOE4FDVSJUZ5FBNT ͷ$744 4*( 4QFDJBM*OUFSFTU(SPVQ ͕؅ཧ͢ΔΦʔϓϯϑϨʔϜϫʔΫ
w ࠓޙ೔ؒʹͦͷ੬ऑੑ͕ѱ༻͞ΕΔ֬཰ΛͰදݱ w $7&͕ެ։͞Ε͔ͯΒͷ೔਺΍ηΩϡϦςΟϕϯμʔͷϨϙʔτͳͲଟ͘ͷࢿ ྉΛΠϯϓοτͱ͍ͯ͠Δ w ֤$7&ʹରͯ͠&1441SPCBCJMJUZͱ1FSDFOUJMFΛఏڙ

ਅͷѱ༻Մೳੑ͸γεςϜͷιʔείʔυΛ ௥Θͳ͍ͱ෼͔Βͳ͍

-PHKͷ੬ऑੑ͔ΒݟΔਅͷѱ༻Մೳੑ ѱ༻Մೳੑͷଌఆ ରԠͷ༏ઌॱҐ෇͚ IUUQTXXXEBSLSFBEJOHDPNBQQMJDBUJPOTFDVSJUZPQFOTPVSDFTPGUXBSFCVHTBUUBDLBCJMJUZ ೥ʹग़͞Εͨ"QQ4FD4IJGU-FGU1SPHSFTT3FQPSUͰ͸ɺਅͷҙຯͰ -PHKͷ੬ऑੑ͕͋ͬͨγεςϜ͸ͷΈͩͬͨͱ঺հ

$744είΞ&144είΞͷ౷߹

$744είΞ&144είΞͷ౷߹ ѱ༻Մೳੑͷଌఆ ରԠͷ༏ઌॱҐ෇͚ IUUQTXXX fi STUPSHFQTTVTFS HVJEF IUUQTXXX fi STUPSHFQTTVTFSHVJEF

࠷༏ઌͰରԠ

मਖ਼ίετͳͲଞཁҼ΋ۛຯ

ޙճ͠

मਖ਼ίετͷଌఆ ରԠͷ༏ઌॱҐ෇͚ w ॏେ౓ѱ༻Մೳੑ͕྆ํߴ͍৔߹͸मਖ਼ίετ͸౓֎ࢹ͢Δ͜ͱ͕ଟ͍ w ίʔυҎ֎ͷमਖ਼ίετΛߟ͑Δ͜ͱ΋ଟ͍ Ϩϐϡςʔγϣϯ͕ଛͳΘΕͨ ৔߹ͷϦΧόϦʔίετʜ w
ଌఆ͸γεςϜߏ੒΍ن໛ʹେ͖͘ґଘ͢ΔͷͰΤϯδχΞͷௐࠪˍݟੵ΋Γ ͷଌఆΛ৴͡Δ

ηΩϡϦςΟઐ໳ՈͱνʔϜεςʔΫϗϧμʔͷڠಇΛิॿ w ηΩϡϦςΟϖϧιφ Ξϯνϖϧιφ w ΞλοΧʔετʔϦʔ w ΞλοΫπϦʔ

ηΩϡϦςΟϖϧιφ Ξϯνϖϧιφ ηΩϡϦςΟઐ໳ՈͱνʔϜεςʔΫϗϧμʔͷڠಇΛิॿ %BWJE ϖϧιφλΠϓ "VUIPS 1FSTPOBM'BNFº&YQFSU όοΫάϥ΢ϯυ ɾ௕೥ίϯϐϡʔλʔͰ༡ΜͰ͍Δ ಘҙͳ߈ܸ
ΤΫεϓϩΠτίʔυͷ࡞੒ ɾίϯϐϡʔλʔɾαΠΤϯεम࢜ ɾΞϓϦέʔγϣϯϨΠϠʔͷ։ൃܦݧ͕௕͍ ߈ܸऀͷϖϧιφΛߟ͑ɺ։ൃऀ΍εςʔΫϗϧμʔʹ఻͑Δ

ϖϧιφλΠϓ

ηΩϡϦςΟϖϧιφʙϖϧιφλΠϓʙ ηΩϡϦςΟઐ໳ՈͱνʔϜεςʔΫϗϧμʔͷڠಇΛิॿ 5ISFBU.PEFMJOH%FTJHOJOHGPS4FDVSJUZ ѱҙ *5εΩϧ

ΞλοΧʔετʔϦʔ ηΩϡϦςΟઐ໳ՈͱνʔϜεςʔΫϗϧμʔͷڠಇΛิॿ w ಘΒΕΔޮՌ͸91ͷετʔϦʔ΍ϢʔβʔετʔϦʔͱ΄΅ಉ͡ w ߈ܸऀ͕རӹΛಘΒΕͳ͍͜ͱΛ֬ೝ͢Δ w γεςϜΛϒϥοΫϘοΫεԽͯ͠ɺϢʔβʔ΍߈ܸऀଆͷࢹ఺Ͱ۩ମతͳ߈ ܸΛߟ͑Δ ϗϫΠτϘοΫεతʹߟ͑ΔڴҖϞσϦϯάͱ͸ҟͳΔ

ΞλοΧʔετʔϦʔͷϑΥʔϚοτ

ΞλοΧʔετʔϦʔͷϑΥʔϚοτ ηΩϡϦςΟઐ໳ՈͱνʔϜεςʔΫϗϧμʔͷڠಇΛิॿ "TB\໾ׂ^ *XBOUUP\໨ඪ^ TPUIBU\໨ඪୡ੒͢Δ͜ͱͰ໾ׂ͕ಘΒΕΔརӹ^

ΞλοΧʔετʔϦʔͷϑΥʔϚοτ ηΩϡϦςΟઐ໳ՈͱνʔϜεςʔΫϗϧμʔͷڠಇΛิॿ "TB\ఢ^ *XBOUUP\߈ܸ^ TPUIBU\߈ܸ͢Δ͜ͱͰఢ͕ಘΒΕΔརӹ^

ΞλοΫπϦʔ ηΩϡϦςΟઐ໳ՈͱνʔϜεςʔΫϗϧμʔͷڠಇΛิॿ w #SVDF4DIOFJFS͕ߟҊ w υϝΠϯΤΩεύʔτɺҰ෦ͷ։ൃऀɺ10ɺηΩϡϦςΟͷઐ໳Ո͕ڠಇ͠ ͯ࡞Δ w ߈ܸऀͷࢹ఺͔ΒηΩϡϦςΟϦεΫΛચ͍ग़͢ w
ΞλοΧʔετʔϦʔΛجʹ࣮ࢪՄೳ

ΞλοΫπϦʔͷ࡞੒खॱ

ΞλοΫπϦʔͷ࡞੒खॱ ηΩϡϦςΟઐ໳ՈͱνʔϜεςʔΫϗϧμʔͷڠಇΛิॿ ηΩϡϦςΟ߈ܸͷ໨ඪΛهࡌ ໨ඪΛୡ੒͢ΔͨΊͷखஈΛهࡌ खஈͷίετΛهࡌ ॏ఺తʹରԠ͢Δ߈ܸखஈͷߜΓࠐΈ

·ͱΊ

·ͱΊ w 08"41%FW4FD0QTMJGFDZDMFT w 1MBOʜڴҖϞσϦϯά ࣮ྫϚοϐϯά w $PEFʜطଘͷΞδϟΠϧϓϥΫςΟε w #VJME
w 4"45 w ແঈπʔϧ #BOEJU #SBLFNBOʜ w ༗ঈπʔϧ 4OZL$PEF 4FNHSFQ ()"EWBODFE4FDVSJUZ w 4$"ʜ4OZLPQFO4PVSDF ()EFQFOEBCPU w %"45ʜ;"1 #VSQ4VJUF w *"45ʜ$POUSBTU$PNNVOJUZ&EJUJPO 4FFLFS w *74ʜ/FTTVT w $74ʜ1SJWZ w 3FMFBTFʜࣗಈϦϦʔε ࣗಈϩʔϧόοΫ w %FQMPZʜ()"DUJPOT(JU-BC w 0QFSBUF.POJUPS w ؂ࢹ w ηΩϡϦςΟΠϯγσϯτରԠޮ཰Խ

·ͱΊ w ςεςΟϯά w 45%%ʜ%"45ͷϑΟʔυόοΫ͕஗͍͜ͱ΁ͷରԠ w #%%ʜ(BVOUMU#%%4FDVSJUZ w ςετϐϥϛουʜ4"45Λલఏʹ6OJUUFTU#%%%"45Λ૊ΈࠐΉ w
୳ࡧతςετʜ੬ऑੑͷԣల։ʹ༗ޮͳҰํͰ࣮ߦίετ໘ͳͲ͔Β՝୊΋ࢦ ఠ

·ͱΊ w ରԠͷ༏ઌॱҐ͚ͮ w ॏେ౓ͷଌఆʜ$744είΞ w ѱ༻Մೳੑͷଌఆʜ&144είΞ w मਖ਼ίετͷଌఆʜΤϯδχΞͷݟੵ΋Γ

·ͱΊ w ηΩϡϦςΟઐ໳ՈͱνʔϜεςʔΫϗϧμʔͷڠಇΛิॿ w ηΩϡϦςΟϖϧιφ Ξϯνϖϧιφ w ΞλοΧʔετʔϦʔ w
ΞλοΫπϦʔ

"QQFOEJY

ࢀߟॻ੶ࢀߟهࣄ "QQFOEJY w "HJMFº4FDVSJUZʹؔ͢Δશମ૾Λ௫Έ͍ͨ w 08"41%FW4FD0QT(VJEFMJOFW w IUUQTPXBTQPSHXXXQSPKFDUEFWTFDPQTHVJEFMJOFMBUFTU w "HJMF"QQMJDBUJPO4FDVSJUZ
w IUUQTXXXBNB[PODPKQ"HJMF"QQMJDBUJPO4FDVSJUZ&OBCMJOH $POUJOVPVTEQ

ࢀߟॻ੶ࢀߟهࣄ "QQFOEJY w %FW4FD0QTMJGFDZDMFTʹؔͯ͠ൃදͰ঺հ͞ΕͨϓϥΫςΟεҎ֎ͷϓϥΫςΟ εΛ஌Γ͍ͨ۩ମతͳ࣮૷΍ಈ͔͠ํ͕஌Γ͍ͨ w 5IF%FW4FD0QT1MBZCPPL w IUUQTXXXBNB[PODPKQ%FW4FD0QT1MBZCPPL%FMJWFS$POUJOVPVT 4FDVSJUZEQ
w *NQMFNFOUJOH%FW4FD0QT1SBDUJDFT w IUUQTXXXBNB[PODPKQ*NQMFNFOUJOH%FW4FD0QT1SBDUJDFT 4VQFSDIBSHFFYDFMMFODFEQ

ࢀߟॻ੶ࢀߟهࣄ "QQFOEJY w ςεςΟϯάपΓͷ࣮૷ྫΛ஌Γ͍ͨ w 1SBDUJDBM4FDVSJUZ"VUPNBUJPOBOE5FTUJOH5PPMTBOEUFDIOJRVFTGPS BVUPNBUFETFDVSJUZTDBOOJOHBOEUFTUJOHJO%FW4FD0QT w IUUQTXXXBNB[PODPN1SBDUJDBM4FDVSJUZ"VUPNBUJPO5FTUJOH UFDIOJRVFTEQ

ࢀߟॻ੶ࢀߟهࣄ "QQFOEJY w 45%%ͷσϞ͕ݟ͍ͨ w IUUQTXXXZPVUVCFDPNXBUDI WL'5O(C

ࢀߟॻ੶ࢀߟهࣄ "QQFOEJY w ڴҖϞσϦϯάηΩϡϦςΟϖϧιφΛ΋ͬͱৄ͘͠஌Γ͍ͨ w 5ISFBU.PEFMJOH%FTJHOJOHGPS4FDVSJUZ w IUUQTXXXBNB[PODPKQ5ISFBU.PEFMJOH%FTJHOJOH"EBN 4IPTUBDLEQ

ࢀߟॻ੶ࢀߟهࣄ "QQFOEJY w ΧΦεΤϯδχΞϦϯάΛ΋ͬͱৄ͘͠஌Γ͍ͨ w ΧΦεΤϯδχΞϦϯά w IUUQTXXXPSFJMMZDPKQCPPLT

アジャイル開発で役立つセキュリティプラクティス / Agile Security Practice

アジャイル開発で役立つセキュリティプラクティス / Agile Security Practice

More Decks by aki.m

Other Decks in Technology

Featured

Transcript