Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
カンムにおけるプロダクトセキュリティのこれまでとこれから
Search
Moto Ishizawa
September 30, 2022
Technology
1
2.5k
カンムにおけるプロダクトセキュリティのこれまでとこれから
Moto Ishizawa
September 30, 2022
Tweet
Share
More Decks by Moto Ishizawa
See All by Moto Ishizawa
LLM エージェントを使った実験
summerwind
0
1k
Sharing test cases of internet protocols with Go and OCI Artifacts
summerwind
0
900
Using Thanos as a long-term storage for your Prometheus metrics
summerwind
1
12k
Using Kubernetes as a datastore for SPIRE
summerwind
1
1k
Whitebox Controller
summerwind
5
1.7k
Managing Kubernetes manifests with Spruce
summerwind
2
4.1k
Understanding HTTP/2 prioritization
summerwind
16
6k
HTTP/2 Deep Dive: Priority & Server Push
summerwind
17
3.4k
HTTP/2 Server Push Considered Harmful
summerwind
1
2k
Other Decks in Technology
See All in Technology
とあるOSSを継続可能にするための取り組みについて / OSS Refactoring Process
bun913
1
210
グイグイ系QAマネージャーの仕事
sadonosake
0
340
スタッフエンジニアの道: The Staff Engineer’s Path
snoozer05
PRO
44
14k
技術的負債解消の取り組みと専門チームのお話
bengo4com
0
330
Oracle Base Database Service 技術詳細
oracle4engineer
PRO
5
46k
株式会社EventHub・エンジニア採用資料
eventhub
0
2.9k
より快適なエラーログ監視を目指して
leveragestech
4
1.4k
忙しい人のためのLangGraph概要まとめ
__ymgc__
1
190
Agile in Automotive Industry, puzzles and lights.
hiranabe
3
1.4k
Functional TypeScript
naoya
11
4.8k
GC24 Recap: Interface Internals
task4233
0
140
ついに出た!OpenAIの最新モデル「o1」って何がすごいの?
minorun365
PRO
3
1.1k
Featured
See All Featured
YesSQL, Process and Tooling at Scale
rocio
167
14k
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
rmw
29
2.6k
A designer walks into a library…
pauljervisheath
201
24k
Designing the Hi-DPI Web
ddemaree
278
34k
Designing Experiences People Love
moore
138
23k
Raft: Consensus for Rubyists
vanstee
135
6.5k
Adopting Sorbet at Scale
ufuk
73
8.9k
Building Your Own Lightsaber
phodgson
101
6k
Fontdeck: Realign not Redesign
paulrobertlloyd
80
5.1k
Imperfection Machines: The Place of Print at Facebook
scottboms
263
13k
How GitHub Uses GitHub to Build GitHub
holman
472
290k
[RailsConf 2023] Rails as a piece of cake
palkan
48
4.6k
Transcript
ΧϯϜʹ͓͚Δ ϓϩμΫτηΩϡϦςΟͷ ͜Ε·Ͱͱ͜Ε͔Β -BZFS9ͱ,BONV'JO5FDIελʔτΞοϓηΩϡϦςΟࣄ
Moto Ishizawa Software Engineer, Kanmu, Inc.
None
ϓϩμΫτηΩϡϦςΟʜ 🤔 AWS API Go Python γεςϜߏ ੬ऑੑཧ WAF Logging
PCI DSS GitHub ݖݶཧ IAM VPC PKI TLS มߋཧ Monitoring σϓϩΠ ίϯςφ Linux Django
ϓϩμΫτηΩϡϦςΟʜ 🤔 AWS API Go Python γεςϜߏ ੬ऑੑཧ WAF Logging
PCI DSS GitHub ݖݶཧ IAM VPC PKI TLS มߋཧ Monitoring σϓϩΠ ίϯςφ Linux Django
ॳͷঢ়گ • ϓϩμΫτʮόϯυϧΧʔυʯͷΈ • ܾࡁͷΈΛఏڙ͍ͯ͠ΔͨΊɺηΩϡϦςΟ࠷ॏཁͳཁૉ • όοΫΤϯυΤϯδχΞ CTO ΛؚΊͯ4ਓ •
ϓϩμΫτηΩϡϦςΟͷྖҬओʹ CTO ͕୲ • ࠷ॳͷΠϯϑϥઐΤϯδχΞͱͯ͠ೖࣾ • AWS ԿΘ͔ΒΜϚϯ
ͻͱ·ͣͷઓུ • ϓϩμΫτ։ൃʹࢀՃͯ͠γεςϜͷมߋϑϩʔΛѲ͢Δ • AWS ͳͲͷΫϥυαʔϏεͷཧऀݖݶΛΒ͍ར༻ঢ়گΛѲ͢Δ • ։ൃӡ༻ʹؔΘΔ֤छαʔϏεͷݖݶཧͷঢ়گΛѲ͢Δ • ηΩϡϦςΟ໘Ͱͷ੍ΛѲ͢Δ
ݟ͖͑ͯͨ՝ϦεΫ • Վతͳ AWS ͷཧ • ͍͋·͍ͳݖݶཧมߋཧͷϓϩηε • ։ൃ࣌ظʹΑΓҟͳΔγεςϜߏ •
PCI DSS ʹΑΔ੍ͱଐਓతͳͦͷӡ༻ • Կ͔ى͖ͯؾ͚ͳ͍ɾௐࠪͰ͖ͳ͍ྖҬ͕͋Δ • ͳͲͳͲ…
1$*%44ͱ • Payment Card Industry (PCI) ͱ͍͏ΫϨδοτΧʔυͷۀքஂମ͕ࡦఆͯ͠ ͍Δ Data Security
Standard (DSS) ͱ͍͏ඪ४ͷ͜ͱ • ΧʔυใΛదʹཧ͢ΔͨΊͷηΩϡϦςΟج४͕ఆٛ͞Ε͍ͯΔ • ΧϯϜΫϨδοτΧʔυΛൃߦ͢Δཱͱͯ͠४ڌ͕ٻΊΒΕ͍ͯΔ • υΩϡϝϯτެࣜαΠτ͔Β୭ͰμϯϩʔυͰ͖Δ • https://www.pcisecuritystandards.org/document_library/
վળํʮϕʔεϥΠϯΛ͑Δʯ • ઃఆͷ౷ҰΨόφϯεͷڧԽ • ϚωʔδυαʔϏεΛ׆༻ͨ͠γεςϜߏͷཧ • Կ͔͕ى͖ͯͦΕʹؾ͖ͮɺௐࠪͰ͖ΔΑ͏ʹ͢Δ (ࠪੑͷ্) • ࠷খݖݶͷݪଇʹै͏
• CTO ʹλεΫ͕ूத͢Δঢ়ଶ͔Βͷ٫ • ։ൃऀͷମݧҰॹʹվળ͢Δ
"84ͷվળྫ • ϕετϓϥΫςΟεʹجͮ͘ઃఆͷಋೖ • AWS Organization ͱ AWS SSO (AWS
IAM Identity Center) ͷಋೖ • CloudTrail ͱ AWS Con fi g ͷ༗ޮԽͱϩάઐ༻ΞΧϯτͰͷҰݩཧ • GuardDuty ͱ Security Hub ͷಋೖ • վળޮՌ • ଟ͘ଘࡏ͍ͯͨ͠ IAM User Λશʹഇࢭ • SSO ʹΑΓෳͷ AWS ΞΧϯτͷϩάΠϯ͕༰қʹ • Կ͔ҟৗ͕͋ͬͯͦΕʹؾ͍ͮͯௐ͕ࠪͰ͖Δঢ়ଶʹ
(JU)VCͷվળྫ • ϕετϓϥΫςΟεʹجͮ͘ઃఆͷಋೖ • ݖݶͷ୨Է͠ͱ Team Permission ͷඋ •
CODEOWNERS Branch Protection ͷઃఆ • ࣗಈΞαΠϯ Slack ௨ͷ༗ޮԽ • վળޮՌ • ѱҙͷ͋Δมߋվ͟ΜΛ࠷ݶࢭ • มߋݖݶΛ࣋ͭਓͷ໌֬Խ • Slack ͰΓͱΓ͍ͯͨ͠ϨϏϡʔґཔͷࣗಈԽ
γεςϜߏͷվળྫ • ϚωʔδυαʔϏεͷஔ͖͑ΞΫηε੍ޚͷݟ͠Λ࣮ࢪ • Session Manager Λಋೖ͠ɺ2िؒʹ1ճ͙Β͍յΕΔ LDAP Λൃഁղମ •
Cloud One Λಋೖ͠ɺಠࣗӡ༻͍ͯͨ͠ OSSEC Λൃഁղମ • վળޮՌ • ӡ༻ෛՙͷܰݮ • ϞχλϦϯά͓Αͼࠪੑͷ্ • SSO ʹΑΓ EC2 ΠϯελϯεͷΞΫηε͕༰қʹ
1$*%44ؔ࿈ͷվળྫ • ཁ݅ͷཧղͱӡ༻໘ͷඋ • ࠪʹରԠ͢ΔϝϯόʔͰશ12ཁ݅ͷಡΈ߹ΘͤձΛ࣮ࢪ • ఆظతʹඞཁͳӡ༻λεΫΛચ͍ग़͠ͱͦͷλεΫͷ࣮ࢪ • ཁ݅ͱ࣮ࡍͷγεςϜʹ͋ΘͤͨࣾϙϦγʔͷݟ͠ •
վળޮՌ • CTO ͕ରԠ͍ͯͨ͠ӡ༻ΛνʔϜͰͰ͖ΔΑ͏ʹͳͬͨ • 3.5ਓఔͰ2ͭͷϓϩμΫτͷ PCI DSS ४ڌΛୡ
৽ϓϩμΫτ1PPMͷϦϦʔε • ϦϦʔεલʹϕʔεϥΠϯ͓͖͍͑ͯͨ • AWS γεςϜશମͷઃఆͷϨϏϡʔ • PCI DSS ཁ݅ͷ४ڌʹؔΘΔઃఆͳͲͷϨϏϡʔ
• όϯυϧΧʔυͰݟ͔ͭͬͨطͷ੬ऑੑͷରԠ • վળޮՌ • طͷ੬ऑੑʹ͍ͭͯϦϦʔεલʹରࡦͰ͖ͨ • ϦϦʔε࣌ͷߏͰ PCI DSS ͷ४ڌΛୡ
͜͜·Ͱͷঢ়گ • ϓϩμΫτηΩϡϦςΟͷϕʔεϥΠϯ͖ͬͯͨ • େ͖ͳ੍ͱͳΔ PCI DSS ͷӡ༻ࠪνʔϜͰରԠͰ͖͍ͯΔ • ࠓޙࣗಈԽͷਪਐ৽ٕज़ͷಋೖɺ͞ΒͳΔϦεΫܰݮࡦͷ࣮ΛਐΊΔ
• ηΩϡϦςΟΛιϑτΣΞͰ࣮͍ͯ͘͠ɺ৭ʑͱָ͘͠ͳΔϑΣʔζ
ࠓޙ͍͖͍ͬͯͨ͜ͱ • EC2 ΛՄೳͳݶΓഇࢭͯ͠ίϯςφҠߦ (ਐߦத) • ηΩϡΞͰͳ͍ Go ͳͲͷίʔυͷࣗಈݕ •
੬ऑੑ͓ΑͼαϓϥΠνΣʔϯؔ࿈ͷϞχλϦϯάͱͦͷରԠͷڧԽ • AWS GitHub ͳͲͷઃఆͷܧଓతͳݕূͱͦͷରԠͷࣗಈԽ • PCI DSS ͓ΑͼίϯϓϥΠΞϯεؔ࿈ӡ༻ͷࣗಈԽ • PCI DSS v4 ͷ४ڌ
ҰॹʹΓ·ͤΜ͔ʂ https://team.kanmu.co.jp/
Thanks!