Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
クラウド脆弱性の傾向とShisho Cloudの活用
Search
adachin0817
March 16, 2025
Technology
0
150
クラウド脆弱性の傾向とShisho Cloudの活用
https://findy-tools.connpass.com/event/347629/
クラウドを活用する開発組織の実践的セキュリティ対策 〜脆弱性診断とDBへのアクセス制御〜
adachin0817
March 16, 2025
Tweet
Share
More Decks by adachin0817
See All by adachin0817
TechBullエンジニアコミュニティの取り組みについて
rvirus0817
0
910
横断SREの立ち上げと、AWSセキュリティへの取り組みの軌跡
rvirus0817
3
7.4k
ゼロから創る横断SREチーム ~挑戦と進化~
rvirus0817
3
2k
入社1ヶ月でここまでやった!Findy Toolsインフラ支援の最適化
rvirus0817
11
9.4k
メンティー同士で輪読会を始めたら学びしかなかった
rvirus0817
1
1.1k
Lancersをコンテナへ本番移行する取り組み
rvirus0817
1
2.7k
~CircleCIでTerraformリリースのサーバーレス化~ インフラの独自リリースを継続的リリースへ
rvirus0817
0
4.7k
Terraform v0.12.29 → v1.0.5にバージョンアップする上で気をつけること
rvirus0817
0
4.2k
MENTAをAWSに移行して振り返る(ECS/Fargate + Laravel編)
rvirus0817
3
9.8k
Other Decks in Technology
See All in Technology
watsonx.data上のベクトル・データベース Milvusを見てみよう/20250418-milvus-dojo
mayumihirano
0
120
PicoRabbit: a Tiny Presentation Device Powered by Ruby
harukasan
PRO
2
260
3D生成AIのための画像生成
kosukeito
2
320
今日からはじめるプラットフォームエンジニアリング
jacopen
8
1.7k
Spring Bootで実装とインフラをこれでもかと分離するための試み
shintanimoto
7
890
PdM採用とAIの製品活用を同時に頑張ってみた話 / EM oasis 20250418
rakus_dev
0
120
“パスワードレス認証への道" ユーザー認証の変遷とパスキーの関係
ritou
1
640
読んで学ぶ Amplify Gen2 / Amplify と CDK の関係を紐解く #jawsug_tokyo
tacck
PRO
1
260
【Λ(らむだ)】最近のアプデ情報 / RPALT20250422
lambda
0
120
PostgreSQL Log File Mastery: Optimizing Database Performance Through Advanced Log Analysis
shiviyer007
PRO
1
140
LiteXとオレオレCPUで作る自作SoC奮闘記
msyksphinz
0
800
勝手に!深堀り!Cloud Run worker pools / Deep dive Cloud Run worker pools
iselegant
4
520
Featured
See All Featured
What's in a price? How to price your products and services
michaelherold
245
12k
How STYLIGHT went responsive
nonsquared
100
5.5k
Agile that works and the tools we love
rasmusluckow
328
21k
How to Ace a Technical Interview
jacobian
276
23k
Chrome DevTools: State of the Union 2024 - Debugging React & Beyond
addyosmani
5
570
KATA
mclloyd
29
14k
Speed Design
sergeychernyshev
29
900
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
507
140k
The Straight Up "How To Draw Better" Workshop
denniskardys
232
140k
Being A Developer After 40
akosma
91
590k
JavaScript: Past, Present, and Future - NDC Porto 2020
reverentgeek
47
5.3k
Typedesign – Prime Four
hannesfritz
41
2.6k
Transcript
Ϋϥυ੬ऑੑͷͱShisho Cloudͷ׆༻ ʮ2025/03/17 ΫϥυΛ׆༻͢Δ։ൃ৫ͷ࣮ફతηΩϡϦςΟରࡦ ʙ੬ऑੑஅͱDBͷΞΫηε੍ޚʙʯ ϑΝΠϯσΟגࣜձࣾ ϓϩμΫτ։ൃ෦/SRE ҆ୡ ྋ(@adachin0817)
ࣗݾհ
3 ࣗݾհ ҆ୡ ྋ(@adachin0817) ɾϑΝΠϯσΟ(ג) / ϓϩμΫτ։ൃ෦/Senior SRE ɾBlog: blog.adachin.me/wiki.adachin.me
ɾTechBull(ΤϯδχΞίϛϡχςΟ) techbull.cloud ɹɾSRE/ΤϯδχΞͷϝϯλϦϯά ྦྷܭ300໊↑ ɹɾίϛϡχςΟϚωʔδϟʔ ɾ͔ͭͯOSS൛VulsͷίϯτϦϏϡʔλʔΠϕϯτओ࠵ͳͲ ɾ89ੜ·Εɺ౦ژཱ۠ग़Ͱ࡛ۄݝय़෦ࢢ͕ݩ ɾϑϨϯνϒϧυοάͷࣂ͍ओͰ͋Δ
4
ԣஅSREνʔϜͷҐஔ͚ͮͱϛογϣϯ
ԣஅSREνʔϜͷҐஔ͚ͮͱϛογϣϯ • ԣஅSREνʔϜ ◦ ڈ͔ΒνʔϜͱ্ཱ͓ͯͪ͛ͯ͠Γɺݱࡏ4໊Ͱ׆ಈ͍ͯ͠Δ • SREͷଘࡏҙٛ ◦ SREಓΛ࡞ΔͨΊʹଘࡏ͢Δ(։ൃͷεϐʔυͱ҆શੑΛཱ྆) ◦
ϦεΫΛड͚ೖΕɺཧ͢Δ(োͷϦεΫΛ࠷খݶʹ͑ͭͭɺޮతͳӡ༻Λࢦ͢) ◦ SLOΛܭଌ͢Δ(৴པੑͷόϥϯεΛऔΔͨΊͷج४Λࡦఆ) ◦ τΠϧͷݮͱࣗಈԽ(Ձͷߴ͍ۀʹूதͰ͖ΔڥΛఏڙ) ◦ ϓϩμΫτͷࢧԉ(։ൃεϐʔυͱ৴པੑͷόϥϯεΛอͭͨΊʹٕज़ࢧԉ) ◦ ηΩϡϦςΟͷՄࢹԽͱڧԽ (જࡏతͳϦεΫΛൃݟ͠ɺγεςϜΛΑΓ҆શͳঢ়ଶʹอͭ) • ظϛογϣϯ ◦ ʮϑΝΠϯσΟͷࣄۀΛࢧ͑ΔͨΊʹɺSRE৫ͷ͋Γํͷཱ֬ʯ • தظϛογϣϯ ◦ ʮࣾһશһ͕ࣄۀʹूதͰ͖ΔΑ͏ͳΈΛߏங͠ɺ҆શʹఏڙʯ 6
ৄ͍͠औΓΈʹ͍ͭͯFindy Tech BlogΛࢀߟʹʂ 7
ۙͷ੬ऑੑʹ͍ͭͯ
ۙͷ੬ऑੑʑ૿Ճ͍ͯ͠Δ 9 ࢀߟ: https://www.first.org/epss/data_stats https://blog.adachin.me/archives/53851 https://vuls.biz/blog/articles/20240822a/
߈ܸܦ࿏ͱ৫ͷηΩϡϦςΟରԠྗ 10 ࢀߟ: https://vuls.biz/blog/articles/20240822a/
Top Threats to Cloud Computing 2024 ΫϥυॏେڴҖϨϙʔτ
Top Threats to Cloud Computing 2024 • 2024 ΫϥυॏେڴҖϨϙʔτ ◦
CSA(ΫϥυηΩϡϦςΟΞϥΠΞϯε)ຊ෦ ◦ 2ʹҰڴҖϨϙʔτΛެ։ ◦ 500ਓҎ্ͷۀքઐՈΛରʹಛఆ • ՝ ◦ ॱҐ͕Լ͕͓ͬͯΓݒ೦͞ΕΔͷͰͳ͍ ◦ ઃఆϛεͱෆेͳมߋཧ ◦ IAMʹΑΔΞΫηεཧ ◦ ηΩϡΞͰͳ͍ΠϯλʔϑΣʔεAPI ◦ ΫϥυηΩϡϦςΟͷΞʔΩςΫνϟ ͱઓུͷܽ 12 ࢀߟ: https://www.cloudsecurityalliance.jp/site/?p=35829
Top Threats to Cloud Computing 2024 • ࠓޙͷݟ௨͠ ◦ AIΛؚΉΑΓߴԽͳ߈ܸ
◦ αϓϥΠνΣʔϯͷϦεΫ ◦ ਐԽ͢Δن੍ͷঢ়گ ◦ Ransomware-as-a-Service(RaaS) • ରࡦ ◦ SDLC(ιϑτΣΞ։ൃϥΠϑαΠΫϧ)Λ௨ͨ͡ AIͷ౷߹ ◦ AIΛ׆༻ͨ͠ηΩϡϦςΟπʔϧ ◦ θϩτϥετηΩϡϦςΟϞσϧ ◦ ࣗಈԽͱΦʔέετϨʔγϣϯ ◦ ηΩϡϦςΟεΩϧͷ֨ࠩ 13 ࢀߟ: https://www.cloudsecurityalliance.jp/site/?p=35829
ΫϥυηΩϡϦςΟʹऔΓΉୈҰา
ΫϥυηΩϡϦςΟʹऔΓΉࡍͷୈҰา • ηΩϡϦςΟஅͱݱঢ়Ѳ / CSPM(Cloud Security Posture Management) ◦ ઃఆϛε੬ऑͳϦιʔεΛՄࢹԽ͠ɺ༏ઌ͖͢ϦεΫΛಛఆ
◦ ૣظରԠͰηΩϡϦςΟΠϯγσϯτΛະવʹ͙ • ηΩϡϦςΟࢹͱΞϥʔτͷઃఆ ◦ ҟৗͳϩάΠϯڴҖΛϦΞϧλΠϜʹݕग़ ◦ ඞཁͳΞϥʔτΛదʹઃఆ͠ɺਝͳରԠΛՄೳʹ • TrivyΛ׆༻ͨ͠ηΩϡϦςΟεΩϟϯ ◦ طͷڥʹର͢Δஅͱɺ৽نߏங࣌ͷࣗಈεΩϟϯΛCIԽ • ηΩϡϦςΟϩάͷՄࢹԽ ◦ AWS WAFɺCloudTrailɺGuardDutyͷঢ়ଶΛઃఆ͢Δ͚ͩͰͳ͘ՄࢹԽɾੳ ◦ ҟৗݕͷਫ਼Λ্ͤ͞ɺରԠεϐʔυΛਐΊΔ • ηΩϡϦςΟڭҭͱҙ্ࣝ ◦ νʔϜશମͷηΩϡϦςΟҙࣝΛߴΊΔ͜ͱ͕େ ◦ ࠷৽ͷڴҖରࡦํ๏Λڞ༗͢ΔΛઃ͚Δ 15
ΫϥυηΩϡϦςΟڧԽʹ͓͚ΔπʔϧબఆͷΞϓϩʔν • ॳͷܭը: AWS Security Hub Λ׆༻ͨ͠ηΩϡϦςΟཧΛݕ౼ ◦ AWS OrganizationsͰཧ͍ͯ͠ΔͨΊɺेݸҎ্ͷΫϩεΞΧϯτ͕ଘࡏ
◦ σʔλੳͰGCPར༻͍ͯ͠ΔͨΊɺҰݩཧ͕Ͱ͖ͣɺҰ؏ੑ͕อͯͳ͍ ◦ ༷ʑͳαʔϏε͕ಈ࡞͢ΔͨΊɺෳࡶʹͳΓ͘͢ɺίετ͕ߴ͘ͳΓ͍͢ ◦ ૢ࡞ੑɺධՁ݁Ռͷࢹೝੑ͕ѱ͘ɺτϦΞʔδͷूܭʹ͕͔͔Δ ◦ ରԠํ๏ͷυΩϡϝϯτ͕ӳޠͩΒ͚ͰΤϯδχΞ͕ૉૣ͘ରԠͰ͖ͳ͍ • ༷ʑͳΫϥυηΩϡϦςΟπʔϧΛࢼݧಋೖ ◦ ػೳૢ࡞ੑɺίετύϑΥʔϚϯεͷ؍͔Βൺֱݕ౼ ◦ Shisho Cloud͕࠷ཁ݅ʹద߹͠ɺಋೖͷܾఆʹ🎉 16
Shisho Cloudͷಋೖ
Shisho Cloudͷ͍͢͞ • Simple is the best ◦ ϚϧνΫϥυͷҰݩཧ ◦
ηΩϡϦςΟઐ͕ࣝͳͯ͘ରԠՄೳ ◦ ϦεΫͷଈ࣌ՄࢹԽ ◦ ຊޠରԠͷஸೡͳϨϙʔτ ◦ ಋೖͷ༰қ͞ͱݕग़݁Ռͷ͞ ◦ ेʹ४උ͞ΕͯΔϚωʔδυϙϦγʔ ◦ ϫʔΫϑϩʔʹΑΔΧελϚΠζੑͷߴ͞ ◦ Ձ͕͍֨҆ 18
Shisho Cloudͷӡ༻ϙΠϯτ • ηΩϡϦςΟΨΠυϥΠϯϙϦγʔͷ࡞ ◦ ࢛ظ͝ͱʹ༏ઌͷߴ͍IssueΛͯ͢ରԠ͢Δ͜ͱΛඪʹઃఆ • ηΩϡϦςΟࢹͱΞϥʔτͷઃఆ ◦ ֤ϓϩδΣΫτʹઐ༻ͷSlackνϟϯωϧΛ࡞
◦ ؔऀΛר͖ࠐΉΈΛߏங ◦ Embedded SRE͚ʹใڞ༗ͷΛઃ͚Δ ◦ τϦΞʔδ͞ΕͨΞϥʔτͯ͢ରԠ͢Δඞཁͳ͘ɺ༏ઌ͔ΒߜΔ • ηΩϡϦςΟରԠͷܗ֚ԽΛ͗ɺνʔϜͷཱࣗΛଅਐ ◦ ηΩϡϦςΟରԠͷܗ֚ԽΛ͗ɺνʔϜͷཱࣗΛଅਐ 19
Shisho Cloudͷӡ༻՝ • ৽نΠϯϑϥߏங࣌ʹຖճΞϥʔτͷޡݕ͕ൃੜ ◦ Terraform ͰશΠϯϑϥΛཧ͍ͯ͠Δ͕ɺڥ͝ͱͷ౷Ұϧʔϧ͕ͳ͍ ◦ ෛՙςετڥ৽نΠϯϑϥڥͷςϯϓϨʔτԽ͕ະඋ ◦
ηΩϡϦςΟϙϦγʔ͕ڥ͝ͱʹ౷Ұ͞Ε͓ͯΒͣɺෆཁͳΞϥʔτ͕ൃੜ ◦ Slack ௨͕ଟൃ͠ɺϊΠζͰຒ·ͬͯ͠·͏ • ॏཁͳ௨ݕ ◦ Critical / High ͷΞϥʔτ Slack Ͱϝϯγϣϯ͖௨ ◦ ϊΠζΛݮΒ͠ɺରԠ͖͢ΞϥʔτʹूதͰ͖ΔڥΛߏங 20
Findy ToolsͰϨϏϡʔ͍ͯ͠·͢ʂ 21
ηΩϡϦςΟϩάج൫
ηΩϡϦςΟϩάج൫ • Amazon Security Lakeͷ׆༻ ◦ AWSͰϦΞϧλΠϜʹԿ͕ى͖͍ͯΔ͔அͰ͖ͳ͍ ◦ ηΩϡϦςΟपΓͷϞχλϦϯάڧԽ ◦
CloudTrailɺWAFɺVPC Flow LogɺRoute53 (DNS Query)ΛରʹՄࢹԽ͠ੳ ◦ Security LakeͰ؆୯ʹҰݩཧ͕Մೳ ◦ ݄ສԁఔͰ࣮ՄೳͰίεύ͕ྑ͍ ◦ Amazon Managed GrafanaͰμογϡϘʔυԽ 23
WAF Log • WAF(Web ACL) ◦ Request by Country(ࠃผͷϦΫΤετ) ◦
Heat map ◦ Bar graph ◦ Total Request(શϦΫΤετͷूܭ) ◦ WAF Rule Request(WAFϧʔϧ͝ͱͷϦΫΤετ) ◦ Access Ranking(IPΞυϨεURL͝ͱͷϦΫΤετ) ◦ WAF Analytics Logs(ੳ༻ͷϩά/ϒϩοΫใͳͲ) 24
CloudTrail Log • CloudTrail ◦ Total Event Count(શΠϕϯτ) ◦ Total
Errors(શΤϥʔ) ◦ Event History(Πϕϯτཤྺ) ◦ Top Event Names(Πϕϯτ໊) ◦ Total Event Source(Πϕϯτൃੜݩ) ◦ Top Users(ϢʔβʔϥϯΩϯά) ◦ Total Source IP(ૢ࡞ݩͷIPΞυϨε) ◦ S3 Access Denied(S3ͰΞΫηεڋ൱͞Εͨճ) ◦ EC2 Change Event Count(EC2ͷઃఆมߋճ) ◦ VPC Change Event Count(VPCͷઃఆมߋճ) ◦ Security Group Change Event Count(SGͷઃఆมߋճ) ◦ Error Event(ੳ༻ΤϥʔΠϕϯτ) 25
खಈ ੬ऑੑஅ
खಈ ੬ऑੑஅ࣮ࢪ • GMO Flatt Security x WebΞϓϦέʔγϣϯஅ ◦ 2023ʙ
࣮ࢪࡁΈ ◦ SQLΠϯδΣΫγϣϯ ◦ XSSɺೝূɾೝՄͷͳͲ ◦ ༷ʑͳ੬ऑੑஅʹରԠ͍ͯ͠Δ ◦ ใࠂॻ/Ϩϙʔτඇৗʹݟ͍͢ ◦ ΞϑλʔαʔϏεॆ࣮͍ͯ͠Δ 27
Findy Team+ SOC2 Type1
Findy Team+ SOC2 Type1Λऔಘ 29
·ͱΊ
·ͱΊ • ΫϥυηΩϡϦςΟपΓՄࢹԽͯ͠ܧଓతʹੳͱରࡦΛ͢Δ͜ͱ • Shisho Cloud/ϫʔΫϑϩʔͷΧελϚΠζΛ׆͔͖͠Εͯͳ͍ ◦ ඞཁʹԠͯ͡৫ݻ༗ͷϙϦγʔΛઃఆ͠ɺӡ༻ʹద༻͢Δ ◦ AWSΞΧϯτͷఆج४Λ໌֬Խ͠ɺCritical,HighϨϕϧͷݕ࿙ΕΛࢭ
◦ طଘΞϥʔτͷվमͱ୨Է͠ • ηΩϡϦςΟϩάج൫ͷੳ ◦ Security LakeΛ༻͍ͨج൫Ͱ͖ͨͷͰɺੳΛਐΊ͍ͯ͘ ◦ μογϡϘʔυͷΧελϚΠζఆظతͳৼΓฦΓΛ࣮ࢪ͠ɺӡ༻վળΛਤΔ ◦ SQLͷ݁Ռ͔ΒBedrockͰੳ༧ఆ 31
͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ