セキュリティログ分析基盤の構築 on AWS

2018.5.16 Security JAWS での発表資料です

Transcript

1. ηΩϡϦςΟϩά෼ੳج൫ͷߏங
   PO
   "84 ΫοΫύουגࣜձࣾ
   ΠϯϑϥετϥΫνϟʔ෦
   ਫ୩
   ਖ਼ܚ 
   8FE
2. ࣗݾ঺հˍൃද֓ཁ wਫ୩
   ਖ਼ܚ
   !N@NJ[VUBOJ
   w 
   ೔ຊ*#.
   ೖࣾ
   w ౦ژجૅݚڀॴ
   w ηΩϡϦςΟࣄۀ෦
   5PLZP
   40$
   w 
   ΫοΫύουגࣜձࣾ
   ೖࣾ
   w ΠϯϑϥετϥΫνϟʔ෦
   ηΩϡϦςΟνʔϜ
   wࠓ೔ͷൃද
    ݄ʹฐࣾ5FDI$POGͷ-5Ͱ࿩ͨ͠಺༰ͷ࠷৽൛Ͱ͢
3. ηΩϡϦςΟϩά෼ੳͱ͍͑͹4*&.ɺ͔͠͠Ϋϥ΢υ্ͩͱʜ wϩάͷૹ৴ݩΛಈతʹ੍ޚͰ͖ͳ͍
   w ૹ৴ݩʴϩάͷܗࣜͷΤϯτϦΛ؅ཧ͢Δ"1*͕ͳ͍
   w Χλϩά্͸ࣗಈొ࿥͢Δͱݴ͍ͬͯΔ͕͏·͘௥Ճ͞Εͳ͍
   w
   ΠϯελϯεɾαʔϏεͷ௥Ճɾ࡟আʹରԠ͢Δͷ͕େม
   wશମߏ੒Λؾܰʹ͍͡Εͳ͍
   w ߏ଄্εέʔϧΞ΢τ͢Δ͕खಈˍࣦഊ͢Δͱഁ໓
   w εέʔϧΞ΢τͨ͠΋ͷͷதʹϩά͕࢒ΔͷͰεέʔϧΠϯෆՄ
   w
   ϩά͕όʔετͨ͠ͱ͖ͷରԠ͕େม
   wϧʔϧͷςετ͕೉͍͠
   w ςετͷͨΊʹෳ਺ߏ੒༻ҙ͢Δ
   PS
   ࣮؀ڥͰ΍Δ
   w "1*ͳͲͳ͍ͷͰɺ౰વਓखͰؤுΔ
   w
   ΫΠοΫʹϧʔϧͷௐ੔͕Ͱ͖ͳ͍
   
   มߋʹΑΔαΠυΤϑΣΫτͰۤ࿑͢Δ
    ˞ҰൠԽ͞Εͨ࿩Ͱ͸ͳ͘ɺͱ͋Δ੡඼ͷܦݧʹج͍ͮͨ૝ఆͰ͢
4. ઃܭཁ݅ wো֐΁ͷ଱ੑ
   wੑೳɿ਺ඦ(#೔ͷྲྀྔˍ༰қͳεέʔϧΞ΢τ͕Մೳ
   wมߋཤྺ؅ཧ
   w؇͍ϦΞϧλΠϜੑɿ਺෼ఔ౓ͷ஗Ԇ͸ڐ༰
   wঢ়گʹԠͨ͡ηΩϡϦςΟ෼ੳ
   w ύλʔϯ
   ೔ৗతʹൃੜ͢ΔΞϥʔτͷ෼ੳ
   w ύλʔϯ
   Πϯγσϯτൃੜ࣌ͷ௕ظ෼ੳ
   w ύλʔϯ
   ௕ظؒͷ౷ܭ৘ใऔಘ
   w෼ੳɾରԠͷࣗಈԽ
   
5. ΞʔΩςΫνϟ֓ཁ ϩάϑΝΠϧઃஔͷ
   ΠϕϯτΛݕग़ Lambda Lambda Lambda Kinesis Stream S3 S3 Athena ϧʔϧΛ༻͍ͨ
   Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ
   ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ
   ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Ξϥʔτͷௐࠪ CloudWatch Logs/Event, GuardDuty, CloudTrail EC2 instances ͦͷଞϓϩμΫτ Kinesis Stream Kinesis Stream ˞ࡉ͔͍ͱ͜Ζ͸ͪΐͬͱ୺ંͬͯ·͢
6. ΞʔΩςΫνϟ֓ཁ
   ύʔτ෼͚ ϩάϑΝΠϧઃஔͷ
   ΠϕϯτΛݕग़ Lambda Lambda Lambda Kinesis Stream S3 S3 Athena ϧʔϧΛ༻͍ͨ
   Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ
   ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ
   ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Ξϥʔτͷௐࠪ EC2 instances ͦͷଞϓϩμΫτ Kinesis Stream Kinesis Stream ϩάऩूύʔτ ϩάॲཧύʔτ Ξϥʔτॲཧύʔτ CloudWatch Logs/Event, GuardDuty, CloudTrail
7. ϩάॲཧύʔτ
    wϑΝΠϧੜ੒Πϕϯτͷॲཧ

   4
   ˠ
   -BNCEB
   ˠ
   ,JOFTJT
   4USFBN
   w 4ͷ$SFBUF0CKFDUΠϕϯτΛ-BNCEBͰड͚ͯ,JOFTJT
   4USFBNʹྲྀ͢
   w -BNCEBʹ͸௚઀ϩά͸ྲྀͣ͞ʹ4্ͷϑΝΠϧͷΩʔͳͲ࠷௿ݶͷ ৘ใ͚ͩΛྲྀ͢
   w ,JOFTJT
   4USFBNͰΠϕϯτ৘ใΛड͚औͬͨޙଓͷ-BNCEB͕4಺ͷ ϑΝΠϧΛಡΈࠐΈϩάσʔλΛऔಘ͢Δ
    ϩάϑΝΠϧઃஔͷ
   ΠϕϯτΛݕग़ Lambda Lambda Kinesis Stream ϧʔϧΛ༻͍ͨ
   Ξϥʔτͷݕ஌ ϩάͷม׵ Kinesis Stream
8. ϩάॲཧύʔτ
    wϩάͷม׵
   
   UP
   (SBZMPH
   w ,JOFTJT
   4USFBN͔ΒϩάϑΝΠϧઃஔͷΠϕϯτΛड͚औͬͨޙɺ ϑΝΠϧΛ4͔ΒಡΈऔΔ
   ˠ
   ϩάͷύʔε
   ˠ
   (SBZMPH΁సૹ
   w ύʔα͸ࣗલͰ༻ҙ
   
   4ͷόέοτʴύεͰϑΥʔϚοτΛ൑ผ
   w (SBZMPHͷ(&-'ܗࣜʹม׵ͨ͠ޙ5$1Ͱసૹ
   wϩάͷม׵
   
   UP
   "UIFOB
   w -BNCEBͰ"UIFOBʹରԠͨ͠+40/ܗࣜʹม׵
   w (MVFΛ࢖ͬͨม׵ʹͰ͖ͳ͍͔ݕ౼த
    ϩάϑΝΠϧઃஔͷ
   ΠϕϯτΛݕग़ Lambda Lambda Kinesis Stream ϧʔϧΛ༻͍ͨ
   Ξϥʔτͷݕ஌ ϩάͷม׵ Kinesis Stream
9. Ξϥʔτॲཧύʔτ w(JU)VC
   &OUFSQSJTF
   ()&
   Λ৘ใू໿ͷج఺ʹ
   w Ξϥʔτ͕ݕ஌͞ΕͨΒ()&ʹ*TTVFΛͨͯͯɺͦ͜ʹؔ࿈৘ใΛί ϝϯτͱͯ͠௥ه͠ूதͤ͞Δ
   wؔ࿈৘ใͷࣗಈऩू
   w 7JSVT5PUBMͰͷݕࡧɺ(SBZMPHͰͷؔ࿈ϩάͷݕࡧͳͲ͸ఆܗ࡞ۀͳ ͷͰࣗಈͰ()&ʹίϝϯτͤ͞Δ
   w௨஌͸ϝʔϧ
   
   4MBDL
   w ηΩϡϦςΟάϧʔϓ಺Ͱϩʔςʔγϣϯ
    Ξϥʔτͷൃใ GHE PagerDuty Slack Ξϥʔτͷௐࠪ Kinesis Stream
10. ӡ༻ͷ༷ࢠ
    
11. 1BHFS%VUZ͕ൃใ
    ʢϝʔϧ
    
    4MBDLʣ
    
12. 
     Ξϥʔτ͸()&ͷ
    *TTVF
    ͱͯ͠ىථ
13. 
     7JSVT5PUBMͷ
    ৘ใ΋ࣗಈͰ௥ه
14. 
     (SBZMPH͔ΒϩάΛநग़
    ˍ
    ৽ͨͳϩά΋ࢀরͰ͖ΔΑ ͏ʹΫΤϦ63-Λίϝϯτ
15. 
     ඞཁʹԠͯ͡(SBZMPH ͰΞϥʔτͷৄࡉௐࠪ
    ·ͨ͸
    *OEJDBUPS
    ͕ྲྀΕ͖ͯͨ ͱ͖ʹΫΠοΫʹௐࠪ
16. 
     ௐࠪɾ෼ੳ݁ՌΛ ίϝϯτͱͯ͠
    ॻ͖࢒͢͜ͱͰ
    ஌ݟΛڞ༗
17. Thank you