セキュリティ系アップデート全体像と AWS Organizations 新ポリシー「宣言型ポリシー」を紹介 / reGrowth 2024 Security

Transcript

1. ηΩϡϦςΟܥΞοϓσʔτͷશମ૾ 
   0SHBOJ[BUJPOT
   ͷ৽ϙϦγʔΛ঺հ 
2. SFHSPXUI@PTBLB ࣗݾ঺հ ઒ݪ੐େ LBXBIBSBNBTBIJSP ˔ $MBTTNFUIPE
   "84ࣄۀຊ෦ ίϯαϧςΟϯά෦ ˔ 
   d
   
   "84
   5PQ
   &OHJOFFST ˔ SF*OWFOU
   
   ݱ஍ࢀՃ ˓ ,
   3BDF
   ͕૘շͰͨ͠
3. SFHSPXUI@PTBLB ࠓ೔࿩͢͜ͱ ˔ ηΩϡϦςΟܥΞοϓσʔτΛ͓͞Β͍ ˔ "84
   0SHBOJ[BUJPOT
   ͷΞϓσΛ঺հ ˔ ↳ એݴܕϙϦγʔΛਂງΓ ˔ ↳ ͜Ε͔Βͷ༧๷తΨʔυϨʔϧ
4. ηΩϡϦςΟܥΞοϓσʔτ ͬ͘͟Γͱ͓͞Β͍
5. SFHSPXUI@PTBLB ߋ৽ͷ͋ͬͨ"84αʔϏε ˞༧બམؚͪΉ
6. SFHSPXUI@PTBLB ߋ৽ͷ͋ͬͨ"84αʔϏε ˞༧બམؚͪΉ <"84
   3FTPVSDF
   &YQMPSFS> ɾػೳ֦ॆɻηΩϡϦςΟ΍ίετͷ৘ใΛҰݩతʹݕࡧɾ؅ཧՄೳʹ <"84
   4ZTUFNT
   .BOBHFS> ɾϚϧνΞΧ΢ϯτϚϧνϦʔδϣϯͷϊʔυ೺Ѳɺ؅ཧ͕ҰݩԽ <"84
   4FDVSJUZ
   -BLF> ɾ৽͍͠ύʔτφʔೝఆ "NB[PO
   4FDVSJUZ
   -BLF
   3FBEZ
   4QFDJBMJ[BUJPO
   ͕ൃද ɾ0QFO4FBSDI
   4FSWJDF
   ͱͷ [FSP&5-
   ౷߹Λαϙʔτ <"84
   $MPVE5SBJM> ɾػೳڧԽɻแׅతͳμογϡϘʔυ௥ՃͱΫϩεΞΧ΢ϯτͰͷσʔλετΞڞ༗ ɾ"*ػೳΛ௥ՃɻࣗવݴޠͰͷΫΤϦੜ੒ͱΫΤϦ݁Ռͷཁ໿ػೳ <*".
   "DDFTT
   "OBMZ[FS> ɾະ࢖༻ΞΫηε෼ੳʹͯɺΞΧ΢ϯτ*%΍ϩʔϧλάʹΑΔείʔϓબ୒͕Մೳʹ
7. SFHSPXUI@PTBLB ߋ৽ͷ͋ͬͨ"84αʔϏε ˞༧બམؚͪΉ <"84
   *".> ɾ0SHBOJ[BUJPOTͷϝϯόʔΞΧ΢ϯτͷϧʔτΞΫηε ΛҰݩ؅ཧՄೳʹ <"84
   0SHBOJ[BUJPOT> ɾએݴܕϙϦγʔ %FDMBSBUJWF
   QPMJDZ ͕௥Ճ ɾ3$1 3FTPVSDF
   DPOUSPM
   QPMJDZ ͕௥Ճ <"84
   $POUSPM
   5PXFS> ɾએݴܕϙϦγʔΛ࢖༻ͨ͠༧๷ίϯτϩʔϧ͕௥Ճ ɾ3$1Λ࢖༻ͨ͠༧๷ίϯτϩʔϧ͕௥Ճ ɾ"84
   #BDLVQͱ౷߹ɻਪ঑όοΫΞοϓઃఆΛҰׅద ༻Մೳʹ
8. SFHSPXUI@PTBLB ߋ৽ͷ͋ͬͨ"84αʔϏε ˞༧બམؚͪΉ <"NB[PO
   71$> ɾ71$ͷϒϩοΫύϒϦοΫΞΫηε #1"
   Λൃද ɾ$MPVE'SPOU͕71$ΦϦδϯʹରԠ <"84
   /FUXPSL
   'JSFXBMM> ɾ)551ɺ26*$ɺ1PTUHSF42-ͳͲͷ৽ϓϩτίϧݕ ग़ʹରԠ <"84
   7FSJGJFE
   "DDFTT> ɾ5$1΍44)ɺ3%1ͳͲͷඇ)551 4 Ϧιʔε΁ͷθϩ τϥετΞΫηε͕Մೳʹ
9. SFHSPXUI@PTBLB ߋ৽ͷ͋ͬͨ"84αʔϏε ˞༧બམؚͪΉ <"NB[PO
   (VBSE%VUZ> ɾߴ౓ͳڴҖݕग़ػೳ͕௥Ճɻෳ਺εςʔδͷ߈ܸΛࣗಈݕग़ <"84
   4FDVSJUZ
   *ODJEFOU
   3FTQPOTF> ɾ༗ਓͰηΩϡϦςΟΠϯγσϯτʹରԠͯ͘͠ΔαʔϏε͕(" ˞࠷௿ֹ݄ྉۚ 
   υϧ͔Β ɾ"84
   4FDVSJUZ
   *ODJEFOU
   3FTQPOTF
   ͷ৽͍͠ύʔτφʔϓϩάϥϜ
10. "84
    0SHBOJ[BUJPOT
    ͷ ΞοϓσʔτΛ঺հ
11. "84
    0SHBOJ[BUJPOT
    Λ ͞Βͬͱ͓͞Β͍
12. SFHSPXUI@PTBLB 0SHBOJ[BUJPOT
    ͸ϚϧνΞΧ΢ϯτ؅ཧͰ໾ཱͭαʔϏε <ओͳಛ௃> ˔ શ"84ΞΧ΢ϯτͷ੥ٻΛू໿ ˔ "84ΞΧ΢ϯτΛ֊૚Խͯ͠؅ཧɺ੍ޚ ˔ ͞·͟·ͳ"84αʔϏεͱ࿈ܞ ը૾Ҿ༻
    "84
    0SHBOJ[BUJPOT
    ͷ֓೦ͱ༻ޠ  "84
    0SHBOJ[BUJPOT
13. SFHSPXUI@PTBLB ֤छ ϙϦγʔ
    Λ࢖ͬͯෳ਺ΞΧ΢ϯτΛ੍ޚͰ͖Δ ˔ 4$1 4FSWJDF
    DPOUSPM
    QPMJDZ ˔ λάϙϦγʔ ˔ όοΫΞοϓϙϦγʔ ˔  ࢖͑ΔϙϦγʔͷৄࡉ͸ҎԼΛࢀর ˠ
    5FSNJOPMPHZ
    BOE
    DPODFQUT
    GPS
    "84
    0SHBOJ[BUJPOT
     "84
    0SHBOJ[BUJPOT
14. "84
    0SHBOJ[BUJPOT
    ͷ SF*OWFOU
    
    Ξοϓσʔτ
15. SFHSPXUI@PTBLB SF*OWFOU
    
    ʹͯɺͭͷ৽ϙϦγʔ͕ొ৔ʂ ˔ <OFX>
    3$1 3FTPVSDF
    DPOUSPM
    QPMJDZ ˔ <OFX>
    એݴܕϙϦγʔ %FDMBSBUJWF
    QPMJDZ
16. એݴܕϙϦγʔ %FDMBSBUJWF
    1PMJDZ
17. SFHSPXUI@PTBLB αʔϏεϨϕϧͰ l๬·͍͠ઃఆz Λఆٛద༻Ͱ͖Δ ˔ એݴܕϙϦγʔ͸৽͍͠ʮαʔϏεϨϕϧ ͷϙϦγʔʯ ˔ ૊৫಺ͷ"84ΞΧ΢ϯτʹ͓͍ͯɺಛఆ αʔϏεଐੑΛඪ४ԽͰ͖Δ ˔ ΤϥʔϝοηʔδΛΧελϚΠζՄೳ <ݱࡏαϙʔτ͍ͯ͠Δଐੑ> ˔ 71$ ˓ 71$ϒϩοΫύϒϦοΫΞΫηε ˔ &$ ˓ γϦΞϧίϯιʔϧΞΫηε ˓ ".*ϒϩοΫύϒϦοΫΞΫηε ˓ ڐՄ͞Εͨ".*ͷར༻ ˓ *.%4ͷσϑΥϧτઃఆ ˔ &#4 ˓ εφοϓγϣοτͷϒϩοΫύϒϦοΫΞΫηε
18. SFHSPXUI@PTBLB ਺ΫϦοΫͰ؆୯ʹઃఆͰ͖Δ ը૾Ҿ༻
    ʲΞοϓσʔτʳ৽ͨʹൃද͞ΕͨEFDMBSBUJWF
    QPMJDJFTʢએݴܕϙϦγʔʣΛͨΊͯ͠Έͨ "84SF*OWFOU
    c
    %FWFMPQFST*0
19. ͦ΋ͦ΋એݴతͬͯͳΜͩΖ͏ʁ
20. SFHSPXUI@PTBLB ʮ݁ہԿ͕͍ͨ͠ͷ͔ʯͱ͍͏໨త͚ͩΛઆ໌͢Δ͜ͱ Ҿ༻
    એݴతʁ %FDMBSBUJWF Ͳ͏͍͏͜ͱʁ !)JSPZVLJ@04",*
    
     2JJUB
21. SFHSPXUI@PTBLB l&#4εφοϓγϣοτͷϒϩοΫύϒϦοΫΞΫηεz Λྫʹߟ͑ͯΈΔ &#4εφοϓγϣοτΛύϒϦοΫʹͨ͘͠ͳ͍Μ΍ʂ ໨త
22. SFHSPXUI@PTBLB ʙએݴܕϙϦγʔ͕ͳ͍ͱ͖ʙ &#4εφοϓγϣοτΛύϒϦοΫʹͨ͘͠ͳ͍Μ΍ʂ ໨త ˞ͳ͍Ͱ͢ ໨తͷୡ੒ํ๏
23. SFHSPXUI@PTBLB ʙએݴܕϙϦγʔ͕͋Δͱ͖ʙ &#4εφοϓγϣοτΛύϒϦοΫʹͨ͘͠ͳ͍Μ΍ʂ ໨త ໨తͷୡ੒ํ๏
24. ͜Ε͔Βͷ༧๷తΨʔυϨʔϧ
25. SFHSPXUI@PTBLB ࠓ೥ɺओཁͳ༧๷తΨʔυϨʔϧ͕Ұؾʹ૿͑ͨʂ ͜Ε·Ͱͷ<"84ͷ༧๷తΨʔυϨʔϧͱ͍͑͹> ˔ 4$1 4FSWJDF
    DPOUSPM
    QPMJDZ ͜Ε͔Βͷ<"84ͷ༧๷తΨʔυϨʔϧͱ͍͑͹> ˔ 4$1 4FSWJDF
    DPOUSPM
    QPMJDZ ˔ 3$1 3FTPVSDF
    DPOUSPM
    QPMJDZ ˔ એݴܕϙϦγʔ %FDMBSBUJWF
    QPMJDZ
26. SFHSPXUI@PTBLB <Πϝʔδ>
    ͜Ε·Ͱͷ༧๷తΨʔυϨʔϧ
27. SFHSPXUI@PTBLB <Πϝʔδ>
    ༧๷తΨʔυϨʔϧͷ͜Ε͔Β
28. SFHSPXUI@PTBLB <Πϝʔδ>
    ༧๷తΨʔυϨʔϧͷ͜Ε͔Β ˞
    3$1͕αϙʔτ͍ͯ͠ΔαʔϏε ɾ4 ɾ454 ɾ,.4 ɾ424 ɾ4FDSFUT
    .BOBHFS ˞
    એݴܕϙϦγʔͷαϙʔτൣғ ɾ71$
    ϒϩοΫύϒϦοΫΞΫηε ɾ&$
    γϦΞϧίϯιʔϧΞΫηε ɾ&$
    ".*ϒϩοΫύϒϦοΫΞΫηε ɾ&$
    ڐՄ͞Εͨ".*ͷར༻ ɾ&$
    *.%4ͷσϑΥϧτઃఆ ɾ&#4
    εφοϓγϣοτͷϒϩοΫύϒϦοΫΞΫηε
29. ͓ΘΓʹ
30. SFHSPXUI@PTBLB ࿩ͨ͜͠ͱ ˔ ηΩϡϦςΟܥΞοϓσʔτΛ͓͞Β͍ ˔ "84
    0SHBOJ[BUJPOT
    ͷΞϓσΛ঺հ ˔ ↳ એݴܕϙϦγʔΛਂງΓ ˓ αʔϏεϨϕϧͰʮ๬·͍͠ઃఆʯΛఆٛద༻ ˓ ਺ΫϦοΫͰ؆୯ʹઃఆͰ͖Δ ˔ ↳ ͜Ε͔Βͷ༧๷తΨʔυϨʔϧ ˓ ·ͣ͸ એݴܕϙϦγʔ<OFX>
    Λద༻Ͱ͖ͳ͍͔ ˓ ࣍ʹैདྷ௨Γ 4$1
    Λ࢖͏ ˓ ิ׬తʹ 3$1<OFX>
    Λ࢖͏
31. SFHSPXUI@PTBLB ࢀߟ ˔ 4JNQMJGZ
    HPWFSOBODF
    XJUI
    EFDMBSBUJWF
    QPMJDJFT
    c
    "84
    /FXT
    #MPH ˔ <Ξοϓσʔτ>
    "84
    0SHBOJ[BUJPOT
    ͰએݴܕϙϦγʔ EFDMBSBUJWF
    QPMJDJFT
    ͕ར༻Մೳʹͳ Γ·ͨ͠ "84SF*OWFOU
    c
    %FWFMPQFST*0 ˔ ʲΞοϓσʔτʳ৽ͨʹൃද͞ΕͨEFDMBSBUJWF
    QPMJDJFTʢએݴܕϙϦγʔʣΛͨΊͯ͠Έͨ "84SF*OWFOU
    c
    %FWFMPQFST*0 ˔ એݴతʁ %FDMBSBUJWF Ͳ͏͍͏͜ͱʁ !)JSPZVLJ@04",*
    
     2JJUB
32. SFHSPXUI@PTBLB ࢀߟ • 識別 ◦ Introducing the Amazon Security Lake Ready Specialization - AWS ◦ Amazon OpenSearch Service zero-ETL integration with Amazon Security Lake - AWS ◦ Find security, compliance, and operating metrics in AWS Resource Explorer - AWS ◦ AWS CloudTrail Lake launches enhanced analytics and cross-account data access - AWS ◦ AWS CloudTrail Lake enhances log analysis with AI-powered features - AWS ◦ The new AWS Systems Manager experience: Simplifying node management - AWS ◦ Customize scope of IAM Access Analyzer unused access analysis - AWS • 防御 ◦ Centrally manage root access in AWS Identity and Access Management (IAM) - AWS ◦ Amazon Web Services announces declarative policies - AWS ◦ Introducing resource control policies (RCPs) to centrally restrict access to AWS resources - AWS ◦ AWS Control Tower launches managed controls using declarative policies - AWS ◦ AWS Control Tower launches configurable managed controls implemented using resource control policies - AWS ◦ AWS Control Tower adds prescriptive backup plans to landing zone capabilities - AWS ◦ AWS announces Block Public Access for Amazon Virtual Private Cloud - AWS ◦ Amazon CloudFront announces VPC origins - AWS ◦ AWS Network Firewall expands the list of supported protocols and keywords in firewall rules - AWS ◦ AWS Verified Access now supports secure access to resources over non-HTTP(S) protocols (Preview) - AWS • 検知/対応 ◦ AWS announces AWS Security Incident Response for general availability - AWS ◦ Respond and recovery more quickly with AWS Security Incident Response Partners - AWS ◦ Amazon GuardDuty introduces GuardDuty Extended Threat Detection - AWS