Upgrade to Pro — share decks privately, control downloads, hide ads and more …

「サプライチェーン攻撃」に立ち向かう!SBOMを使った脆弱性管理がもたらす品質とスピード向上

 「サプライチェーン攻撃」に立ち向かう!SBOMを使った脆弱性管理がもたらす品質とスピード向上

ihcomega56

July 21, 2022
Tweet

More Decks by ihcomega56

Other Decks in Technology

Transcript

  1. ༷ʑͳϑΣʔζʹજΉڴҖ 9 ιʔε ίʔυ ґଘ Ϗϧυ ϦϦ ʔε SOURCE THREATS

    BUILD THREATS DEPENDENCY THREATS A B C D F G H E ग़యɿ ೥݄೔ (JU)VC#MPHʠ"DIJFWJOH4-4"$PNQMJBODFXJUI(JU)VC"DUJPOTBOE4JHTUPSF GPS(PNPEVMFTʡ IUUQTHJUIVCCMPHTMTBDPNQMJBODFXJUIHJUIVCBDUJPOT ೥݄೔ (PPHMF4FDVSJUZ#MPHʠ*OUSPEVDJOH4-4" BO&OEUP&OE'SBNFXPSLGPS4VQQMZ$IBJO*OUFHSJUZʡ IUUQTTFDVSJUZHPPHMFCMPHDPNJOUSPEVDJOHTMTBFOEUPFOEGSBNFXPSLIUNM ʮ4-4" αϧα ʯΑΓ ͦ͜ɺେৎ෉ʁ νΣοΫϙΠϯτ "ίʔυϨϏϡʔ #7$4Ͱͷ؅ཧ $ίʔυͷීวੑ %Ϗϧυ؀ڥ &ґଘؔ܎ '$*$% (ύοέʔδϦϙδτϦ )࢖༻ύοέʔδͷબ୒
  2. ͷιϑτ΢ΣΞɺ ͷΤϯλʔϓϥΠζ޲͚ιϑτ΢ΣΞ͕ ΦʔϓϯιʔεͷίϯϙʔωϯτΛؚΉ ͷ߈ܸ͕αϓϥΠϠʔ΁ͷ৴པΛ ѱ༻ͨ͠΋ͷͰ͋Γɺ_Ͱ ഒʹ૿͑ͨ ೥ʹ߈ܸ͸ ഒʹ૿͑Δͱ༧૝͞Ε͍ͯΔ 11 ग़యɿ

    ೥݄೔ (JU)VC#MPHʠ"DIJFWJOH4-4"$PNQMJBODFXJUI(JU)VC"DUJPOTBOE4JHTUPSF GPS(PNPEVMFTʡ IUUQTXXXFOJTBFVSPQBFVQVCMJDBUJPOTUISFBUMBOETDBQFGPSTVQQMZDIBJOBUUBDLT ʠ5ISFBU-BOETDBQFGPS4VQQMZ$IBJO"UUBDLTʡ IUUQTHJUIVCCMPHTFDVSFZPVSTPGUXBSFTVQQMZDIBJOBOEQSPUFDUBHBJOTUTVQQMZDIBJOUISFBUTHJUIVCCMPH
  3. "VUPNBUJPO4VQQPSU • ࣗಈԽ͓Αͼ૊৫ͷ֞ࠜΛӽ͑ͨӡ༻ͷͨΊɺ4#0.͸ඪ४ ϑΥʔϚοτʹଇͬͯੜ੒͢Δ • 4PGUXBSF1BDLBHF%BUB&YDIBOHF 41%9 ࠃࡍඪ४ • 4PGUXBSF*EFOUJGJDBUJPO

    48*% • $ZDMPOF%9 • Ұ؏ͯ͠ಉ͡ϑΥʔϚοτͰ؅ཧ͢Δͷ͕๬·͍͠ • UBHWBMVFܗࣜ 41%9 ɺ+40/ɺ:".-ɺ9.-ͳͲʹରԠ • ਓؒʹ΋ػցʹ΋ಡΊΔ 22
  4. πʔϧͷछྨ • ࣗಈɾखಈ͍ͣΕ΋͋Δ ࣗಈ͕Φεεϝ • ࣗಈͷ৔߹ɺϏϧυ࣌ʹੜ੒͢Δ͔ɺϏϧυࡁΈͷ ΞʔςΟϑΝΫτΛղੳ͢Δ • ਓ͕ಡΊΔܗͰදࣔ͠ҙࢥܾఆʹ໾ཱͯΔ •

    4#0.ಉ࢜Λൺֱ͢Δ • 4#0.ΛγεςϜʹಡΈࠐΈ׆༻͢Δ • ผͷϑΥʔϚοτʹม׵͢Δ • ෳ਺ͷ4#0.Λ౷߹͢Δ 23 ੜ੒ ࢖༻ ফඅ ม׵ ·ͣ͸͔͜͜Β ൃల్தͰ σϑΝΫτ ελϯμʔυͱ ݴ͑Δπʔϧ͸ ·ͩͳ͍
  5. 1SBDUJDFTBOE1SPDFTTFT • Ϗϧυ΍ϦϦʔεʹΑΓιϑτ΢ΣΞ͕ߋ৽͞ΕͨΒ 4#0.΋৽ͨʹ࡞੒͢Δ • 4#0.ʹޡΓ͕ݟ͔ͭͬͨΒमਖ਼͢Δ • ਪҠతґଘؔ܎΋ؚΊৄࡉͳϦετΛ࡞Δ • ѱҙ͋Δύοέʔδ͕ʮͳ͍ʯ͜ͱΛূ໌͢Δʹ͸ɺ

    ׬શͳ໢ཏੑ͕ඞཁͱͳΔ • ґଘؔ܎ͷ໢ཏੑ͕෼͔Γ͖͍ͬͯΔՕॴͱෆ໌֬ͳ Օॴ͸۠ผ͠ɺͦͷࢫΛ໌ه͢Δ 24 ස౓ ਂ͞ ط஌ͷະ஌ ,OPXO6OLOPXO
  6. 37 ࣗݾ঺հ • ࢁܗݝ௽Ԭࢢੜ·Ε ࢁܗݝ௽Ԭࢢࡏॅ • େֶ࣌୅͸ؠखˠٶ৓Ͱա͝͠ɺब৬Λػʹ্ژ • ೥ʹ஍ݩʹ6λʔϯ͠ɺϦϞʔτϫʔΫͰ࢓ࣄ ࠤ౻

    ༝ٱ 4"50:PTIJIJTB @umekichi1984 • 4*FSͰΞϓϦέʔγϣϯͷ։ൃΤϯδχΞ΍ΞʔΩςΫτɺ *5ίϯαϧΛܦݧ • ఏҊʙཁ݅ఆٛʙઃܭɾ։ൃʙಋೖɺͦͷޙͷӡ༻อक·Ͱ • ೥݄ΑΓ +'SPH +BQBOͷσϕϩούʔΞυϘέΠτ • ͍Ζ͍ΖͳΤϯδχΞͱؔΘͬͯɺΤϯδχΞ໨ઢͰ৘ใ ൃ৴͍͖͍ͯͨ͠ʂ ग़਎ ܦྺ • υϥΠϒɺ໺ࡊ࡞Γɺ৯΂ΔɾҿΉɾ࿩͢ झຯ
  7. ࢀߟจݙ • ;%/FU೥݄೔ܝࡌʮถ੓෎ͳͲ΁ͷେن໛αΠόʔ߈ܸɺ4PMBS8JOETͷιϑτ΢ΣΞߋ৽Λѱ༻ʯ IUUQTKBQBO[EOFUDPNBSUJDMF • +'SPH೥݄೔ܝࡌʮ-PH4IFMMθϩσΠ஌͓ͬͯ͘΂͖͜ͱʯIUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPVOFFEUPLOPX • 4ZOPQTZTXIJUFQBQFSʮ0QFO4PVSDF3JTLJO."CZUIF/VNCFSTʯIUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJHBTTFUTXIJUFQBQFSTXQSJTL NBOVNCFSTQEG •

    ʮʰηΩϡϦςΟɾεΩϟϯʱ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$" ͱ͸ʁʯIUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM • ʮ&YQMPSFZPVS044EFQFOEFODJFT7JTVBMMZʯIUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS • ʮ4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSETʯIUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@ @WFSTJPO@QEG • ೔ܦ95&$)೥݄೔ܝࡌ τϤλ͕ਪ͢αΠόʔରࡦͷ৽ৗࣝʮ4#0.ʯɺྲྀग़͢ΔϦεΫ͸ʁ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM • *5NFEJB /&84೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ͍ʯ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM • ܦࡁ࢈ۀল঎຿৘ใ੓ࡦہαΠόʔηΩϡϦςΟ՝ʮ044ͷར׆༻ٴͼͦͷηΩϡϦςΟ֬อʹ޲͚ͨ؅ཧख๏ʹؔ͢Δࣄྫूʯ IUUQTXXXNFUJHPKQQSFTTQEG • ʮ#FTUQSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QT QSPDFTTʯIUUQTNFEJBKGSPHDPNXQDPOUFOUVQMPBET#FTU QSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QTQSPDFTTQEG • ೥݄೔ (JU)VC#MPHʮ"DIJFWJOH4-4"$PNQMJBODFXJUI(JU)VC"DUJPOTBOE4JHTUPSF GPS(PNPEVMFTʯ IUUQTXXXFOJTBFVSPQBFVQVCMJDBUJPOTUISFBUMBOETDBQFGPSTVQQMZDIBJOBUUBDLT • ʮ5ISFBU-BOETDBQFGPS4VQQMZ$IBJO"UUBDLTʯIUUQTHJUIVCCMPHTFDVSFZPVSTPGUXBSFTVQQMZDIBJOBOEQSPUFDUBHBJOTUTVQQMZDIBJO UISFBUTHJUIVCCMPH • ೥݄೔ (JU)VC#MPHʮ"DIJFWJOH4-4"$PNQMJBODFXJUI(JU)VC"DUJPOTBOE4JHTUPSF GPS(PNPEVMFTʯIUUQTHJUIVCCMPHTMTB DPNQMJBODFXJUIHJUIVCBDUJPOT • 5IF6OJUFE4UBUFT%FQBSUNFOUPG$PNNFSDFʮ 5IF.JOJNVN&MFNFOUT'PSB4PGUXBSF#JMMPG.BUFSJBMT 4#0. ʯ IUUQTXXXOUJBEPDHPWGJMFTOUJBQVCMJDBUJPOTTCPN@NJOJNVN@FMFNFOUT@SFQPSUQEG • ೥݄೔ (PPHMF4FDVSJUZ#MPHʮ*OUSPEVDJOH4-4" BO&OEUP&OE'SBNFXPSLGPS4VQQMZ$IBJO*OUFHSJUZʯ IUUQTTFDVSJUZHPPHMFCMPHDPNJOUSPEVDJOHTMTBFOEUPFOEGSBNFXPSLIUNM 42 42