OWT2017JP - OWASP Project Overview for Developers

#OWT2017JP
Opening Session by 上野宣, OWASP Japan

Transcript

1. 08"41ͷา͖ํ 
   085 08"41
   +BQBO
   $IBQUFS
   -FBEFS 4FO
   6&/0 08"41
   1SPKFDU
   0WFSWJFX GPS
   %FWFMPQFST
2. 08"41
   1SPKFDU
3. 'MBHTIJQ
   1SPKFDUT • 5PPMT – 08"41
   ;FE
   "UUBDL
   1SPYZ – 08"41
   8FC
   5FTUJOH
   &OWJSPONFOU
   1SPKFDU – 08"41
   085' – 08"41
   %FQFOEFODZ
   $IFDL – 08"41
   4FDVSJUZ
   4IFQIFSE
   </FX> • $PEF – 08"41
   .PE4FDVSJUZ $PSF
   3VMF
   4FU
   1SPKFDU – 08"41
   $43'(VBSE 1SPKFDU – 08"41
   "QQ4FOTPS 1SPKFDU • %PDVNFOUBUJPO – 08"41
   "QQMJDBUJPO
   4FDVSJUZ
   7FSJGJDBUJPO
   4UBOEBSE
   1SPKFDU – 08"41
   4PGUXBSF
   "TTVSBODF
   .BUVSJUZ
   .PEFM
   4".. – 08"41
   "QQ4FOTPS 1SPKFDU – 08"41
   5PQ
   5FO
   1SPKFDU – 08"41
   5FTUJOH
   (VJEF
   1SPKFDU IUUQTXXXPXBTQPSHJOEFYQIQ08"41@1SPKFDU@*OWFOUPSZ'MBHTIJQ@1SPKFDUT
4. 08"41
   5PQ
   
   
   3$ • 8FCΞϓϦέʔγϣϯ੬ऑੑτοϓ 3$
   3FKFDUFE ݄Լ०ϦϦʔε༧ఆ
5. 08"41
   5PQ
   
   GPS
   
   ೔ຊޠ൛ΞϦ㽂
6. ;"1 • ;"1
   ;FE
   "UUBDL
   1SPYZ
   
   • 8FCΞϓϦέʔγϣϯ੬ऑੑεΩϟφʔ ೔ຊޠ൛ΞϦ㽂
7. 8FC
   5FTUJOH
   &OWJSPONFOU • ओʹ08"41ͷΞϓϦέʔγϣϯηΩϡϦςΟπʔϧͱυΩϡϝ ϯτͷ٧Ί߹Θͤ -JOVY
   EJTU • 08"41ͷ֤छϓϩδΣΫτ – πʔϧ΍υΩϡϝϯτ – 08"41Ҏ֎ͷ8FCΞϓϦέʔγϣϯηΩϡϦςΟπʔϧ΋ऩ࿥ • *40΍7.XBSF
   7JSUVBM#PY
   1BSBMMFMTɺ-JOVYύοέʔδͳͲͷ ܗࣜͰఏڙ – چ08"41
   -JWF
   $%
8. 085' • 085' 0GGFOTJWF
   8FC
   5FTUJOH
   'SBNFXPSL – ࣗಈ਍அπʔϧ – 08"41
   5FTUJOH
   (VJEF
   
   15&4 UIF
   1FOFUSBUJPO
   5FTUJOH
   &YFDVUJPO
   4UBOEBSE
   
   /*45
9. 08"41
   %FQFOEFODZ$IFDL • 8FCΞϓϦέʔγϣϯͷத͔Β੬ऑੑͷ͋ΔίϯϙʔωϯτΛ ൃݟ͢ΔεΩϟφʔ – +BWB
   /&5
   ʹରԠ • 3VCZ
   /PEFKT
   1ZUIPO
   $$ ͸ࢼݧతͳରԠ
10. 08"41
    4FDVSJUZ
    4IFQIFSE • 8FCͱϞόΠϧͷΞϓϦέʔγϣϯηΩϡϦςΟͷͨΊͷτ Ϩʔχϯάπʔϧ – ηΩϡϦςΟΛֶͿͨΊͷϋϯζΦϯ؀ڥ – $5'ϞʔυɺΦʔϓϯϑϩΞϞʔυɺτʔφϝϯτϞʔυͳͲΛඋ͑Δ • 5FBDIJOH
    5PPM
    GPS
    "MM
    "QQMJDBUJPO
    4FDVSJUZ • 8FC
    "QQMJDBUJPO
    1FO
    5FTUJOH
    5SBJOJOH • .PCJMF
    "QQMJDBUJPO
    1FO
    5FTUJOH
    5SBJOJOH • 4BGF
    1MBZHSPVOE
    UP
    1SBDUJTF "QQ4FD 5FDIOJRVFT • 3FBM
    4FDVSJUZ
    3JTL
    &YBNQMFT
11. .PE4FDVSJUZ $PSF
    3VMF
    4FU
    1SPKFDU • .PE4FDVSJUZ – 0QFO
    4PVSDF
    8FC
    "QQMJDBUJPO
    'JSFXBMM • .PE4FDVSJUZ Ͱ࢖͑Δϧʔϧηοτ – 1SPUPDPM
    7BMJEBUJPO – .BMJDJPVT
    $MJFOU
    *EFOUJGJDBUJPO – (FOFSJD
    "UUBDL
    4JHOBUVSFT – ,OPXO
    7VMOFSBCJMJUJFT
    4JHOBUVSFT – 5SPKBO#BDLEPPS
    "DDFTT – 0VUCPVOE
    %BUB
    -FBLBHF – "OUJ7JSVT
    BOE
    %P4 VUJMJUZ
    TDSJQUT
12. $43'(VBSE 1SPKFDU • ΫϩεαΠτɾϦΫΤετϑΥʔδΣϦ $43'
    ରࡦϥΠϒϥϦ
13. "QQ4FOTPS 1SPKFDU • ΞϓϦέʔγϣϯϨΠϠʔʹର͢Δ৵ೖݕ஌ͱࣗಈԠ౴ͷͨΊͷ ϑϨʔϜϫʔΫ – ΞϓϦέʔγϣϯʹ๷ޚ૚Λ࣮૷͢Δ • ݕग़ – Ҏ্ͷݕग़ϙΠϯτͰ߈ܸΛݕ஌ • Ԡ౴ – ߈ܸΛݕग़ͨ͠ޙͷΞΫγϣϯ – ϢʔβʔͷϩάΞ΢τɺΞΧ΢ϯτϩοΫɺ؅ཧऀ΁ͷ௨஌ͳͲ • ΞϓϦέʔγϣϯͷ๷ޚ
14. "QQMJDBUJPO
    4FDVSJUZ
    7FSJGJDBUJPO
    4UBOEBSE 1SPKFDU • "474
    "QQMJDBUJPO
    4FDVSJUZ
    7FSJGJDBUJPO
    4UBOEBSE
    • ΞϓϦέʔγϣϯͷηΩϡϦςΟධՁͷͨΊͷݕࠪඪ४ – ࣗಈ·ͨ͸खಈͷηΩϡϦςΟςετٴͼίʔυϨϏϡʔํࣜͷཁ݅ • -W
    0QQPSUVOJTUJD • -W
    4UBOEBSE • -W
    "EWBODFE ೔ຊޠ൛ΞϦ㽂
15. 4PGUXBSF
    "TTVSBODF
    .BUVSJUZ
    .PEFM • 4"..
    4PGUXBSF
    "TTVSBODF
    .BUVSJUZ
    .PEFM ɿιϑτ΢ΣΞ ηΩϡϦςΟอো੒ख़౓Ϟσϧ • ϦεΫʹ߹Θͤͨιϑτ΢ΣΞηΩϡϦςΟઓུΛ࣮૷͢ΔͨΊ ͷϑϨʔϜϫʔΫ ೔ຊޠ൛ΞϦ㽂
16. 5FTUJOH
    (VJEF • 8FCαΠτʗΞϓϦέʔγϣϯͷςετΨΠυɺશϖʔδ ʢ7FSʣ • ֤੬ऑੑɺػೳผͷςετํ๏ – *OGPSNBUJPO
    (BUIFSJOH
    $POGJHVSBUJPO
    .BOBHFNFOU
    5FTUJOH
    "VUIFOUJDBUJPO
    5FTUJOH
    4FTTJPO
    .BOBHFNFOU
    "VUIPSJ[BUJPO
    5FTUJOH
    #VTJOFTT
    MPHJD
    UFTUJOH
    %BUB
    7BMJEBUJPO
    5FTUJOH
    %P4 5FTUJOH
    8FC
    4FSWJDFT
    5FTUJOH
    "+"9
    5FTUJOH
17. 8FCγεςϜʗ8FCΞϓϦέʔγϣϯ ηΩϡϦςΟཁ݅ॻ • 8FCγεςϜʗ8FCΞϓϦέʔγϣϯ։ൃͷͨΊͷཁ݅ఆٛॻ – Ұൠతʹ੝ΓࠐΉ΂͖ηΩϡϦςΟཁ݅ఆٛॻ – ։ൃݴޠ΍ϑϨʔϜϫʔΫʹґଘ͠ͳ͍ • 08"41
    +BQBO
    ηΩϡϦςΟཁ݅ఆٛॻ8(
18. ੬ऑੑ਍அ࢜εΩϧϚοϓϓϩδΣΫτ • ੬ऑੑ਍அΛߦ͏ݸਓͷٕज़తͳೳྗΛ۩ମతʹ͢Δ • ੬ऑੑ਍அΛߦ͏ٕज़ऀʢҎԼɺ੬ऑੑ਍அ࢜ʣͷεΩϧϚοϓ ͱֶशͷࢦ਑ͱͳΔγϥόεɺ੬ऑੑ਍அΛߦ͏ͨΊͷΨΠυϥ ΠϯͳͲΛ੔උ • *40(+ͱ08"41 +BQBOͷڞಉ8(
19. 8FCΞϓϦέʔγϣϯ੬ऑੑ਍அΨΠυϥΠϯ • खಈ਍அิॿπʔϧΛ࢖ͬͨ8FCΞϓϦέʔγϣϯ੬ऑੑ਍அ ʹ࢖༻͢ΔΨΠυϥΠϯ – 42-J
    944ͳͲͷ۩ମతͳ਍அύλʔϯ
20. ੬ऑੑ਍அ ॳ৺ऀϋϯζΦϯτϨʔχϯά • ೥݄೔ ౔ ։࠵ • ืूਓ਺໊ <͢Ͱʹຬ੮> IUUQTQFOUFTUXFCDPOOQBTTDPNFWFOU
21. օ͞ΜͷڠྗͰ੒Γཱ͍ͬͯ·͢ • ೔ຊޠ൛͕ͳ͍ϓϩδΣΫτ΋͍͔ͭ͘ • ఀ଺͍ͯ͠ΔϓϩδΣΫτ΋͍͔ͭ͘ • ϘϥϯςΟΞͷྗΛඞཁͱ͍ͯ͠·͢
22. +PJO
    VT