Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
クラウド脆弱性の傾向とShisho Cloudの活用
Search
adachin0817
March 16, 2025
Technology
0
56
クラウド脆弱性の傾向とShisho Cloudの活用
https://findy-tools.connpass.com/event/347629/
クラウドを活用する開発組織の実践的セキュリティ対策 〜脆弱性診断とDBへのアクセス制御〜
adachin0817
March 16, 2025
Tweet
Share
More Decks by adachin0817
See All by adachin0817
TechBullエンジニアコミュニティの取り組みについて
rvirus0817
0
430
横断SREの立ち上げと、AWSセキュリティへの取り組みの軌跡
rvirus0817
3
6.3k
ゼロから創る横断SREチーム ~挑戦と進化~
rvirus0817
3
1.4k
入社1ヶ月でここまでやった!Findy Toolsインフラ支援の最適化
rvirus0817
11
8.7k
メンティー同士で輪読会を始めたら学びしかなかった
rvirus0817
1
1.1k
Lancersをコンテナへ本番移行する取り組み
rvirus0817
1
2.2k
~CircleCIでTerraformリリースのサーバーレス化~ インフラの独自リリースを継続的リリースへ
rvirus0817
0
4.2k
Terraform v0.12.29 → v1.0.5にバージョンアップする上で気をつけること
rvirus0817
0
4.2k
MENTAをAWSに移行して振り返る(ECS/Fargate + Laravel編)
rvirus0817
3
9.2k
Other Decks in Technology
See All in Technology
「頑張る」を「楽しむ」に変換する技術
tomoyakitaura
14
6.4k
失敗しないAIエージェント開発:階層的タスク分解の実践
kworkdev
PRO
0
720
User Story Mapping + Inclusive Team
kawaguti
PRO
3
670
AI_Agent_の作り方_近藤憲児
kenjikondobai
19
4.9k
一歩ずつ成長しながら進める ZOZOの基幹システムリプレイス/Growing Stap by Stap ZOZO BackOffice System Replacement
cocet33000
2
460
なぜ「Event Sourcing」を選択したのか〜事実に基づくことの重要性〜/Why did we choose "Event Sourcing"?
bitkey
0
210
【Snowflake九州ユーザー会#2】BigQueryとSnowflakeを比較してそれぞれの良し悪しを掴む / BigQuery vs Snowflake: Pros & Cons
civitaspo
5
1.7k
Scala meets WebAssembly
tanishiking
0
140
OPENLOGI Company Profile for engineer
hr01
1
21k
実践的なバグバウンティ入門 (2025年版)
scgajge12
1
510
完璧を捨てろ! “攻め”のQAがもたらすスピードと革新/20250306 Hiroki Hachisuka
shift_evolve
0
200
How to benefit from the latest Keycloak features
ahus1
0
120
Featured
See All Featured
Code Reviewing Like a Champion
maltzj
521
39k
Testing 201, or: Great Expectations
jmmastey
42
7.3k
Scaling GitHub
holman
459
140k
XXLCSS - How to scale CSS and keep your sanity
sugarenia
248
1.3M
How to Think Like a Performance Engineer
csswizardry
22
1.4k
The Web Performance Landscape in 2024 [PerfNow 2024]
tammyeverts
4
460
Large-scale JavaScript Application Architecture
addyosmani
511
110k
Fantastic passwords and where to find them - at NoRuKo
philnash
51
3.1k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
marktimemedia
30
2.3k
Optimising Largest Contentful Paint
csswizardry
34
3.1k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
40
2k
The Power of CSS Pseudo Elements
geoffreycrofte
75
5.5k
Transcript
Ϋϥυ੬ऑੑͷͱShisho Cloudͷ׆༻ ʮ2025/03/17 ΫϥυΛ׆༻͢Δ։ൃ৫ͷ࣮ફతηΩϡϦςΟରࡦ ʙ੬ऑੑஅͱDBͷΞΫηε੍ޚʙʯ ϑΝΠϯσΟגࣜձࣾ ϓϩμΫτ։ൃ෦/SRE ҆ୡ ྋ(@adachin0817)
ࣗݾհ
3 ࣗݾհ ҆ୡ ྋ(@adachin0817) ɾϑΝΠϯσΟ(ג) / ϓϩμΫτ։ൃ෦/Senior SRE ɾBlog: blog.adachin.me/wiki.adachin.me
ɾTechBull(ΤϯδχΞίϛϡχςΟ) techbull.cloud ɹɾSRE/ΤϯδχΞͷϝϯλϦϯά ྦྷܭ300໊↑ ɹɾίϛϡχςΟϚωʔδϟʔ ɾ͔ͭͯOSS൛VulsͷίϯτϦϏϡʔλʔΠϕϯτओ࠵ͳͲ ɾ89ੜ·Εɺ౦ژཱ۠ग़Ͱ࡛ۄݝय़෦ࢢ͕ݩ ɾϑϨϯνϒϧυοάͷࣂ͍ओͰ͋Δ
4
ԣஅSREνʔϜͷҐஔ͚ͮͱϛογϣϯ
ԣஅSREνʔϜͷҐஔ͚ͮͱϛογϣϯ • ԣஅSREνʔϜ ◦ ڈ͔ΒνʔϜͱ্ཱ͓ͯͪ͛ͯ͠Γɺݱࡏ4໊Ͱ׆ಈ͍ͯ͠Δ • SREͷଘࡏҙٛ ◦ SREಓΛ࡞ΔͨΊʹଘࡏ͢Δ(։ൃͷεϐʔυͱ҆શੑΛཱ྆) ◦
ϦεΫΛड͚ೖΕɺཧ͢Δ(োͷϦεΫΛ࠷খݶʹ͑ͭͭɺޮతͳӡ༻Λࢦ͢) ◦ SLOΛܭଌ͢Δ(৴པੑͷόϥϯεΛऔΔͨΊͷج४Λࡦఆ) ◦ τΠϧͷݮͱࣗಈԽ(Ձͷߴ͍ۀʹूதͰ͖ΔڥΛఏڙ) ◦ ϓϩμΫτͷࢧԉ(։ൃεϐʔυͱ৴པੑͷόϥϯεΛอͭͨΊʹٕज़ࢧԉ) ◦ ηΩϡϦςΟͷՄࢹԽͱڧԽ (જࡏతͳϦεΫΛൃݟ͠ɺγεςϜΛΑΓ҆શͳঢ়ଶʹอͭ) • ظϛογϣϯ ◦ ʮϑΝΠϯσΟͷࣄۀΛࢧ͑ΔͨΊʹɺSRE৫ͷ͋Γํͷཱ֬ʯ • தظϛογϣϯ ◦ ʮࣾһશһ͕ࣄۀʹूதͰ͖ΔΑ͏ͳΈΛߏங͠ɺ҆શʹఏڙʯ 6
ৄ͍͠औΓΈʹ͍ͭͯFindy Tech BlogΛࢀߟʹʂ 7
ۙͷ੬ऑੑʹ͍ͭͯ
ۙͷ੬ऑੑʑ૿Ճ͍ͯ͠Δ 9 ࢀߟ: https://www.first.org/epss/data_stats https://blog.adachin.me/archives/53851 https://vuls.biz/blog/articles/20240822a/
߈ܸܦ࿏ͱ৫ͷηΩϡϦςΟରԠྗ 10 ࢀߟ: https://vuls.biz/blog/articles/20240822a/
Top Threats to Cloud Computing 2024 ΫϥυॏେڴҖϨϙʔτ
Top Threats to Cloud Computing 2024 • 2024 ΫϥυॏେڴҖϨϙʔτ ◦
CSA(ΫϥυηΩϡϦςΟΞϥΠΞϯε)ຊ෦ ◦ 2ʹҰڴҖϨϙʔτΛެ։ ◦ 500ਓҎ্ͷۀքઐՈΛରʹಛఆ • ՝ ◦ ॱҐ͕Լ͕͓ͬͯΓݒ೦͞ΕΔͷͰͳ͍ ◦ ઃఆϛεͱෆेͳมߋཧ ◦ IAMʹΑΔΞΫηεཧ ◦ ηΩϡΞͰͳ͍ΠϯλʔϑΣʔεAPI ◦ ΫϥυηΩϡϦςΟͷΞʔΩςΫνϟ ͱઓུͷܽ 12 ࢀߟ: https://www.cloudsecurityalliance.jp/site/?p=35829
Top Threats to Cloud Computing 2024 • ࠓޙͷݟ௨͠ ◦ AIΛؚΉΑΓߴԽͳ߈ܸ
◦ αϓϥΠνΣʔϯͷϦεΫ ◦ ਐԽ͢Δن੍ͷঢ়گ ◦ Ransomware-as-a-Service(RaaS) • ରࡦ ◦ SDLC(ιϑτΣΞ։ൃϥΠϑαΠΫϧ)Λ௨ͨ͡ AIͷ౷߹ ◦ AIΛ׆༻ͨ͠ηΩϡϦςΟπʔϧ ◦ θϩτϥετηΩϡϦςΟϞσϧ ◦ ࣗಈԽͱΦʔέετϨʔγϣϯ ◦ ηΩϡϦςΟεΩϧͷ֨ࠩ 13 ࢀߟ: https://www.cloudsecurityalliance.jp/site/?p=35829
ΫϥυηΩϡϦςΟʹऔΓΉୈҰา
ΫϥυηΩϡϦςΟʹऔΓΉࡍͷୈҰา • ηΩϡϦςΟஅͱݱঢ়Ѳ / CSPM(Cloud Security Posture Management) ◦ ઃఆϛε੬ऑͳϦιʔεΛՄࢹԽ͠ɺ༏ઌ͖͢ϦεΫΛಛఆ
◦ ૣظରԠͰηΩϡϦςΟΠϯγσϯτΛະવʹ͙ • ηΩϡϦςΟࢹͱΞϥʔτͷઃఆ ◦ ҟৗͳϩάΠϯڴҖΛϦΞϧλΠϜʹݕग़ ◦ ඞཁͳΞϥʔτΛదʹઃఆ͠ɺਝͳରԠΛՄೳʹ • TrivyΛ׆༻ͨ͠ηΩϡϦςΟεΩϟϯ ◦ طͷڥʹର͢Δஅͱɺ৽نߏங࣌ͷࣗಈεΩϟϯΛCIԽ • ηΩϡϦςΟϩάͷՄࢹԽ ◦ AWS WAFɺCloudTrailɺGuardDutyͷঢ়ଶΛઃఆ͢Δ͚ͩͰͳ͘ՄࢹԽɾੳ ◦ ҟৗݕͷਫ਼Λ্ͤ͞ɺରԠεϐʔυΛਐΊΔ • ηΩϡϦςΟڭҭͱҙ্ࣝ ◦ νʔϜશମͷηΩϡϦςΟҙࣝΛߴΊΔ͜ͱ͕େ ◦ ࠷৽ͷڴҖରࡦํ๏Λڞ༗͢ΔΛઃ͚Δ 15
ΫϥυηΩϡϦςΟڧԽʹ͓͚ΔπʔϧબఆͷΞϓϩʔν • ॳͷܭը: AWS Security Hub Λ׆༻ͨ͠ηΩϡϦςΟཧΛݕ౼ ◦ AWS OrganizationsͰཧ͍ͯ͠ΔͨΊɺेݸҎ্ͷΫϩεΞΧϯτ͕ଘࡏ
◦ σʔλੳͰGCPར༻͍ͯ͠ΔͨΊɺҰݩཧ͕Ͱ͖ͣɺҰ؏ੑ͕อͯͳ͍ ◦ ༷ʑͳαʔϏε͕ಈ࡞͢ΔͨΊɺෳࡶʹͳΓ͘͢ɺίετ͕ߴ͘ͳΓ͍͢ ◦ ૢ࡞ੑɺධՁ݁Ռͷࢹೝੑ͕ѱ͘ɺτϦΞʔδͷूܭʹ͕͔͔Δ ◦ ରԠํ๏ͷυΩϡϝϯτ͕ӳޠͩΒ͚ͰΤϯδχΞ͕ૉૣ͘ରԠͰ͖ͳ͍ • ༷ʑͳΫϥυηΩϡϦςΟπʔϧΛࢼݧಋೖ ◦ ػೳૢ࡞ੑɺίετύϑΥʔϚϯεͷ؍͔Βൺֱݕ౼ ◦ Shisho Cloud͕࠷ཁ݅ʹద߹͠ɺಋೖͷܾఆʹ🎉 16
Shisho Cloudͷಋೖ
Shisho Cloudͷ͍͢͞ • Simple is the best ◦ ϚϧνΫϥυͷҰݩཧ ◦
ηΩϡϦςΟઐ͕ࣝͳͯ͘ରԠՄೳ ◦ ϦεΫͷଈ࣌ՄࢹԽ ◦ ຊޠରԠͷஸೡͳϨϙʔτ ◦ ಋೖͷ༰қ͞ͱݕग़݁Ռͷ͞ ◦ ेʹ४උ͞ΕͯΔϚωʔδυϙϦγʔ ◦ ϫʔΫϑϩʔʹΑΔΧελϚΠζੑͷߴ͞ ◦ Ձ͕͍֨҆ 18
Shisho Cloudͷӡ༻ϙΠϯτ • ηΩϡϦςΟΨΠυϥΠϯϙϦγʔͷ࡞ ◦ ࢛ظ͝ͱʹ༏ઌͷߴ͍IssueΛͯ͢ରԠ͢Δ͜ͱΛඪʹઃఆ • ηΩϡϦςΟࢹͱΞϥʔτͷઃఆ ◦ ֤ϓϩδΣΫτʹઐ༻ͷSlackνϟϯωϧΛ࡞
◦ ؔऀΛר͖ࠐΉΈΛߏங ◦ Embedded SRE͚ʹใڞ༗ͷΛઃ͚Δ ◦ τϦΞʔδ͞ΕͨΞϥʔτͯ͢ରԠ͢Δඞཁͳ͘ɺ༏ઌ͔ΒߜΔ • ηΩϡϦςΟରԠͷܗ֚ԽΛ͗ɺνʔϜͷཱࣗΛଅਐ ◦ ηΩϡϦςΟରԠͷܗ֚ԽΛ͗ɺνʔϜͷཱࣗΛଅਐ 19
Shisho Cloudͷӡ༻՝ • ৽نΠϯϑϥߏங࣌ʹຖճΞϥʔτͷޡݕ͕ൃੜ ◦ Terraform ͰશΠϯϑϥΛཧ͍ͯ͠Δ͕ɺڥ͝ͱͷ౷Ұϧʔϧ͕ͳ͍ ◦ ෛՙςετڥ৽نΠϯϑϥڥͷςϯϓϨʔτԽ͕ະඋ ◦
ηΩϡϦςΟϙϦγʔ͕ڥ͝ͱʹ౷Ұ͞Ε͓ͯΒͣɺෆཁͳΞϥʔτ͕ൃੜ ◦ Slack ௨͕ଟൃ͠ɺϊΠζͰຒ·ͬͯ͠·͏ • ॏཁͳ௨ݕ ◦ Critical / High ͷΞϥʔτ Slack Ͱϝϯγϣϯ͖௨ ◦ ϊΠζΛݮΒ͠ɺରԠ͖͢ΞϥʔτʹूதͰ͖ΔڥΛߏங 20
Findy ToolsͰϨϏϡʔ͍ͯ͠·͢ʂ 21
ηΩϡϦςΟϩάج൫
ηΩϡϦςΟϩάج൫ • Amazon Security Lakeͷ׆༻ ◦ AWSͰϦΞϧλΠϜʹԿ͕ى͖͍ͯΔ͔அͰ͖ͳ͍ ◦ ηΩϡϦςΟपΓͷϞχλϦϯάڧԽ ◦
CloudTrailɺWAFɺVPC Flow LogɺRoute53 (DNS Query)ΛରʹՄࢹԽ͠ੳ ◦ Security LakeͰ؆୯ʹҰݩཧ͕Մೳ ◦ ݄ສԁఔͰ࣮ՄೳͰίεύ͕ྑ͍ ◦ Amazon Managed GrafanaͰμογϡϘʔυԽ 23
WAF Log • WAF(Web ACL) ◦ Request by Country(ࠃผͷϦΫΤετ) ◦
Heat map ◦ Bar graph ◦ Total Request(શϦΫΤετͷूܭ) ◦ WAF Rule Request(WAFϧʔϧ͝ͱͷϦΫΤετ) ◦ Access Ranking(IPΞυϨεURL͝ͱͷϦΫΤετ) ◦ WAF Analytics Logs(ੳ༻ͷϩά/ϒϩοΫใͳͲ) 24
CloudTrail Log • CloudTrail ◦ Total Event Count(શΠϕϯτ) ◦ Total
Errors(શΤϥʔ) ◦ Event History(Πϕϯτཤྺ) ◦ Top Event Names(Πϕϯτ໊) ◦ Total Event Source(Πϕϯτൃੜݩ) ◦ Top Users(ϢʔβʔϥϯΩϯά) ◦ Total Source IP(ૢ࡞ݩͷIPΞυϨε) ◦ S3 Access Denied(S3ͰΞΫηεڋ൱͞Εͨճ) ◦ EC2 Change Event Count(EC2ͷઃఆมߋճ) ◦ VPC Change Event Count(VPCͷઃఆมߋճ) ◦ Security Group Change Event Count(SGͷઃఆมߋճ) ◦ Error Event(ੳ༻ΤϥʔΠϕϯτ) 25
खಈ ੬ऑੑஅ
खಈ ੬ऑੑஅ࣮ࢪ • GMO Flatt Security x WebΞϓϦέʔγϣϯஅ ◦ 2023ʙ
࣮ࢪࡁΈ ◦ SQLΠϯδΣΫγϣϯ ◦ XSSɺೝূɾೝՄͷͳͲ ◦ ༷ʑͳ੬ऑੑஅʹରԠ͍ͯ͠Δ ◦ ใࠂॻ/Ϩϙʔτඇৗʹݟ͍͢ ◦ ΞϑλʔαʔϏεॆ࣮͍ͯ͠Δ 27
Findy Team+ SOC2 Type1
Findy Team+ SOC2 Type1Λऔಘ 29
·ͱΊ
·ͱΊ • ΫϥυηΩϡϦςΟपΓՄࢹԽͯ͠ܧଓతʹੳͱରࡦΛ͢Δ͜ͱ • Shisho Cloud/ϫʔΫϑϩʔͷΧελϚΠζΛ׆͔͖͠Εͯͳ͍ ◦ ඞཁʹԠͯ͡৫ݻ༗ͷϙϦγʔΛઃఆ͠ɺӡ༻ʹద༻͢Δ ◦ AWSΞΧϯτͷఆج४Λ໌֬Խ͠ɺCritical,HighϨϕϧͷݕ࿙ΕΛࢭ
◦ طଘΞϥʔτͷվमͱ୨Է͠ • ηΩϡϦςΟϩάج൫ͷੳ ◦ Security LakeΛ༻͍ͨج൫Ͱ͖ͨͷͰɺੳΛਐΊ͍ͯ͘ ◦ μογϡϘʔυͷΧελϚΠζఆظతͳৼΓฦΓΛ࣮ࢪ͠ɺӡ༻վળΛਤΔ ◦ SQLͷ݁Ռ͔ΒBedrockͰੳ༧ఆ 31
͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ