è åšã¢ããªã³ã°å®è£ ã®ããã®å æ¬çãªã¬ã€ããæ¹æ³è«ãå©ç¹ãããŒã«ãããã³äžçäžã®ããããèŠæš¡ã®çµç¹åãã®å®éçãªæé ãç¶²çŸ ããŠããŸãã
ãªã¹ã¯è©äŸ¡ïŒè åšã¢ããªã³ã°å®è£ ã®ããã®å æ¬çãªã¬ã€ã
仿¥ã®çžäºæ¥ç¶ãããäžçã§ã¯ããµã€ããŒè åšããŸããŸãé«åºŠåããèå»¶ããŠãããããçµç¹ã¯è²Žéãªè³ç£ãšããŒã¿ãä¿è·ããããã®å ç¢ãªæŠç¥ãå¿ èŠã§ãã广çãªãµã€ããŒã»ãã¥ãªãã£ããã°ã©ã ã®åºæ¬çãªèŠçŽ ã¯ãªã¹ã¯è©äŸ¡ã§ãããè åšã¢ããªã³ã°ã¯ãæœåšçãªè匱æ§ãç¹å®ãã軜æžããããã®ç©æ¥µçãã€æ§é åãããã¢ãããŒããšããŠéç«ã£ãŠããŸãããã®å æ¬çãªã¬ã€ãã§ã¯ãè åšã¢ããªã³ã°ã®å®è£ ã®äžçãæãäžãããã®æ¹æ³è«ãå©ç¹ãããŒã«ãããã³äžçäžã§äºæ¥ãå±éããããããèŠæš¡ã®çµç¹åãã®å®éçãªæé ãæ€èšããŸãã
è åšã¢ããªã³ã°ãšã¯äœã§ããïŒ
è åšã¢ããªã³ã°ã¯ãã·ã¹ãã ãã¢ããªã±ãŒã·ã§ã³ããŸãã¯ãããã¯ãŒã¯ã«ãããæœåšçãªè åšãšè匱æ§ãç¹å®ããã³è©äŸ¡ããããã®äœç³»çãªããã»ã¹ã§ããããã«ã¯ãã·ã¹ãã ã®ã¢ãŒããã¯ãã£ã®åæãæœåšçãªæ»æãã¯ãã«ã®ç¹å®ãããã³å¯èœæ§ãšåœ±é¿ã«åºã¥ããŠãªã¹ã¯ãåªå é äœä»ãããããšãå«ãŸããŸããæ¢åã®è匱æ§ã®çºèŠã«éç¹ã眮ãåŸæ¥ã®ã»ãã¥ãªãã£ãã¹ããšã¯ç°ãªããè åšã¢ããªã³ã°ã¯ãæªçšãããåã«æœåšçãªåŒ±ç¹ãç©æ¥µçã«ç¹å®ããããšãç®çãšããŠããŸãã
建ç¯å®¶ã建ç©ãèšèšããã®ãšåãããã«èããŠãã ããã圌ãã¯ãããŸããŸãªæœåšçãªåé¡ïŒç«çœãå°éãªã©ïŒãèæ ®ãããããã«èããããããã«å»ºç©ãèšèšããŸããè åšã¢ããªã³ã°ã¯ããœãããŠã§ã¢ãšã·ã¹ãã ã«å¯ŸããŠåãããšãè¡ããŸãã
è åšã¢ããªã³ã°ã¯ãªãéèŠã§ããïŒ
è åšã¢ããªã³ã°ã¯ããã¹ãŠã®æ¥çã®çµç¹ã«å€ãã®å©ç¹ããããããŸãã
- ç©æ¥µçãªã»ãã¥ãªãã£ïŒçµç¹ã¯ãéçºã©ã€ããµã€ã¯ã«ã®æ©ã段éã§ã»ãã¥ãªãã£ã®è匱æ§ãç¹å®ããŠå¯ŸåŠã§ãããããåŸã§ä¿®æ£ããããã«å¿ èŠãªã³ã¹ããšåŽåãåæžã§ããŸãã
- ã»ãã¥ãªãã£äœå¶ã®æ¹åïŒæœåšçãªè åšãçè§£ããããšã§ãçµç¹ã¯ãã广çãªã»ãã¥ãªãã£å¶åŸ¡ãå®è£ ããå šäœçãªã»ãã¥ãªãã£äœå¶ãæ¹åã§ããŸãã
- æ»æå¯Ÿè±¡é åã®åæžïŒè åšã¢ããªã³ã°ã¯ãäžèŠãªæ»æå¯Ÿè±¡é åãç¹å®ããŠæé€ããæ»æè ãã·ã¹ãã ã䟵害ããããšãããå°é£ã«ããŸãã
- ã³ã³ãã©ã€ã¢ã³ã¹èŠä»¶ïŒGDPRãHIPAAãPCI DSSãªã©ã®å€ãã®èŠå¶ãã¬ãŒã ã¯ãŒã¯ã§ã¯ãçµç¹ã¯è åšã¢ããªã³ã°ãå«ããªã¹ã¯è©äŸ¡ã宿œããå¿ èŠããããŸãã
- ããè¯ããªãœãŒã¹é åïŒæœåšçãªåœ±é¿ã«åºã¥ããŠãªã¹ã¯ãåªå é äœä»ãããããšã§ãçµç¹ã¯æãéèŠãªè匱æ§ã«å¯ŸåŠããããã«ãªãœãŒã¹ããã广çã«é åã§ããŸãã
- ã³ãã¥ãã±ãŒã·ã§ã³ã®åŒ·åïŒè åšã¢ããªã³ã°ã¯ãã»ãã¥ãªãã£ãéçºãããã³éçšããŒã éã®ã³ãã¥ãã±ãŒã·ã§ã³ãšã³ã©ãã¬ãŒã·ã§ã³ãä¿é²ããã»ãã¥ãªãã£æèã®æåãè²ã¿ãŸãã
- ã³ã¹ãåæžïŒéçºã©ã€ããµã€ã¯ã«ã®æ©ã段éã§è匱æ§ãç¹å®ããããšã¯ãå±éåŸã«ãããã«å¯ŸåŠãããããå€§å¹ ã«å®äŸ¡ã§ãããéçºã³ã¹ããåæžããã»ãã¥ãªãã£äŸµå®³ã«ããæœåšçãªçµæžçæå€±ãæå°éã«æããŸãã
äžè¬çãªè åšã¢ããªã³ã°æ¹æ³è«
ããã€ãã®ç¢ºç«ãããè åšã¢ããªã³ã°æ¹æ³è«ããçµç¹ãããã»ã¹å šäœã§å°ãããšãã§ããŸããæãäžè¬çãªãã®ãããã€ã瀺ããŸãã
STRIDE
Microsoftã«ãã£ãŠéçºãããSTRIDEã¯ãè åšã6ã€ã®äž»èŠãªã«ããŽãªã«åé¡ããåºã䜿çšãããŠããæ¹æ³è«ã§ãã
- ã¹ããŒãã£ã³ã°ïŒå¥ã®ãŠãŒã¶ãŒãŸãã¯ã·ã¹ãã ã«ãªãããŸãã
- æ¹ããïŒèš±å¯ãªãã«ããŒã¿ãŸãã¯ã³ãŒãã倿ŽããŸãã
- åŠèªïŒã¢ã¯ã·ã§ã³ã«å¯Ÿãã責任ãåŠå®ããŸãã
- æ å ±ã®æŒæŽ©ïŒæ©å¯æ å ±ãå ¬éããŸãã
- ãµãŒãã¹æåŠïŒæ£åœãªãŠãŒã¶ãŒãã·ã¹ãã ã䜿çšã§ããªãããã«ããŸãã
- ç¹æš©ã®ææ ŒïŒäžäœã¬ãã«ã®ç¹æš©ãžã®äžæ£ã¢ã¯ã»ã¹ãååŸããŸãã
äŸïŒeã³ããŒã¹Webãµã€ããèããŠã¿ãŸããããã¹ããŒãã£ã³ã°ã®è åšã«ã¯ãæ»æè ã顧客ã«ãªãããŸããŠã¢ã«ãŠã³ãã«ã¢ã¯ã»ã¹ããããšãå«ãŸããå¯èœæ§ããããŸããæ¹ããã®è åšã«ã¯ãè³Œå ¥åã«ã¢ã€ãã ã®äŸ¡æ Œã倿Žããããšãå«ãŸããå¯èœæ§ããããŸããåŠèªã®è åšã«ã¯ã顧客ãååãåãåã£ãåŸã§æ³šæããããšãåŠå®ããããšãå«ãŸããå¯èœæ§ããããŸããæ å ±ã®æŒæŽ©ã®è åšã«ã¯ã顧客ã®ã¯ã¬ãžããã«ãŒãæ å ±ãå ¬éããããšãå«ãŸããå¯èœæ§ããããŸãããµãŒãã¹æåŠã®è åšã«ã¯ããã©ãã£ãã¯ã§Webãµã€ããå§åããŠäœ¿çšã§ããªãããããšãå«ãŸããå¯èœæ§ããããŸããç¹æš©ã®ææ Œã®è åšã«ã¯ãæ»æè ãWebãµã€ããžã®ç®¡çè ã¢ã¯ã»ã¹ãååŸããããšãå«ãŸããå¯èœæ§ããããŸãã
LINDDUN
LINDDUNã¯ããã©ã€ãã·ãŒã«çŠç¹ãåœãŠãè åšã¢ããªã³ã°æ¹æ³è«ã§ãããæ¬¡ã®é¢é£ãããã©ã€ãã·ãŒãªã¹ã¯ãèæ ®ããŸãã
- ãªã³ã¯å¯èœæ§ïŒããŒã¿ãã€ã³ããæ¥ç¶ããŠå人ãèå¥ããŸãã
- èå¥å¯èœæ§ïŒããŒã¿ããå人ã®èº«å ãç¹å®ããŸãã
- åŠèªé²æ¢ïŒå®è¡ãããã¢ã¯ã·ã§ã³ã蚌æã§ããªãã
- æ€åºå¯èœæ§ïŒæ¬äººã®ç¥èãªãã«å人ãç£èŠãŸãã¯è¿œè·¡ããŸãã
- æ å ±ã®éç€ºïŒæ©å¯ããŒã¿ã®äžæ£ãªãªãªãŒã¹ã
- ç¡æèïŒããŒã¿åŠçã®æ £è¡ã«é¢ããç¥èã®æ¬ åŠã
- äžéµå®ïŒãã©ã€ãã·ãŒèŠå¶ã®éåã
äŸïŒããŸããŸãªã»ã³ãµãŒããããŒã¿ãåéããã¹ããŒãã·ãã£ã®åãçµã¿ãæ³åããŠã¿ãŠãã ãããäžèŠå¿ååãããããŒã¿ãã€ã³ãïŒäº€éãã¿ãŒã³ããšãã«ã®ãŒæ¶è²»ãªã©ïŒãçžäºã«ãªã³ã¯ããŠç¹å®ã®äžåž¯ãèå¥ã§ããå Žåããªã³ã¯å¯èœæ§ãæžå¿µãããŸããé¡èªèæè¡ã䜿çšããŠå ¬å ±ã¹ããŒã¹ã§å人ãèå¥ããå Žåãèå¥å¯èœæ§ãçºçããŸããåžæ°ãèªåã®æºåž¯é»è©±ãä»ããŠèªåã®åãã远跡ãããŠããããšã«æ°ä»ããªãå Žåãæ€åºå¯èœæ§ã¯ãªã¹ã¯ã§ããåéãããããŒã¿ãæŒæŽ©ããããåæãªãã«ç¬¬äžè ã«è²©å£²ããããããå Žåãæ å ±ã®é瀺ãçºçããå¯èœæ§ããããŸãã
PASTAïŒæ»æã·ãã¥ã¬ãŒã·ã§ã³ãšè åšåæã®ããã»ã¹ïŒ
PASTAã¯ãæ»æè ã®èŠç¹ãšåæ©ãçè§£ããããšã«çŠç¹ãåœãŠãããªã¹ã¯äžå¿ã®è åšã¢ããªã³ã°æ¹æ³è«ã§ããããã«ã¯ã7ã€ã®æ®µéãå«ãŸããŸãã
- ç®çã®å®çŸ©ïŒã·ã¹ãã ã®ããžãã¹ããã³ã»ãã¥ãªãã£ã®ç®çãå®çŸ©ããŸãã
- æè¡çç¯å²ã®å®çŸ©ïŒã·ã¹ãã ã®æè¡çã³ã³ããŒãã³ããç¹å®ããŸãã
- ã¢ããªã±ãŒã·ã§ã³ã®åè§£ïŒã·ã¹ãã ãåã ã®ã³ã³ããŒãã³ãã«åå²ããŸãã
- è åšåæïŒæœåšçãªè åšãšè匱æ§ãç¹å®ããŸãã
- è匱æ§åæïŒåè匱æ§ã®å¯èœæ§ãšåœ±é¿ãè©äŸ¡ããŸãã
- æ»æã¢ããªã³ã°ïŒç¹å®ãããè匱æ§ã«åºã¥ããŠæœåšçãªæ»æãã·ãã¥ã¬ãŒãããŸãã
- ãªã¹ã¯ãšåœ±é¿ã®åæïŒæœåšçãªæ»æã®å šäœçãªãªã¹ã¯ãšåœ±é¿ãè©äŸ¡ããŸãã
äŸïŒéè¡ã®ã¢ããªã±ãŒã·ã§ã³ãèããŠã¿ãŸããããç®çã®å®çŸ©ã«ã¯ã顧客ã®è³éã®ä¿è·ãšäžæ£è¡çºã®é²æ¢ãå«ãŸããå ŽåããããŸããæè¡çç¯å²ã®å®çŸ©ã«ã¯ããã¹ãŠã®ã³ã³ããŒãã³ãïŒã¢ãã€ã«ã¢ããªãWebãµãŒããŒãããŒã¿ããŒã¹ãµãŒããŒãªã©ïŒã®æŠèŠãå«ãŸããŸããã¢ããªã±ãŒã·ã§ã³ã®åè§£ã«ã¯ããã°ã€ã³ããã»ã¹ãééæ©èœãªã©ãåã³ã³ããŒãã³ããããã«åå²ããããšãå«ãŸããŸããè åšåæã¯ããã°ã€ã³è³æ Œæ å ±ãæšçãšãããã£ãã·ã³ã°æ»æãªã©ã®æœåšçãªè åšãç¹å®ããŸããè匱æ§åæã¯ããã£ãã·ã³ã°æ»æãæåããå¯èœæ§ãšæœåšçãªçµæžçæå€±ãè©äŸ¡ããŸããæ»æã¢ããªã³ã°ã¯ãæ»æè ãçãŸããè³æ Œæ å ±ã䜿çšããŠè³éã転éããæ¹æ³ãã·ãã¥ã¬ãŒãããŸãããªã¹ã¯ãšåœ±é¿ã®åæã¯ãçµæžçæå€±ãšè©å€ã®äœäžã®å šäœçãªãªã¹ã¯ãè©äŸ¡ããŸãã
OCTAVEïŒéçšäžéèŠãªè åšãè³ç£ãããã³è匱æ§ã®è©äŸ¡ïŒ
OCTAVEã¯ãã»ãã¥ãªãã£ã«é¢ãããªã¹ã¯ããŒã¹ã®æŠç¥çè©äŸ¡ããã³èšç»ææ³ã§ããããã¯äž»ã«ãã»ãã¥ãªãã£æŠç¥ãå®çŸ©ããããšããŠããçµç¹ã§äœ¿çšãããŸããOCTAVE Allegroã¯ãå°èŠæš¡ãªçµç¹ã«çŠç¹ãåœãŠãåçåãããããŒãžã§ã³ã§ãã
OCTAVEã¯çµç¹ã®ãªã¹ã¯ã«çŠç¹ãåœãŠãŠããŸããããã®åçåãããããŒãžã§ã³ã§ããOCTAVE Allegroã¯ãæ å ±è³ç£ã«çŠç¹ãåœãŠãŠããŸããä»ã®ãã®ãããæ¹æ³è«ã«åºã¥ããŠãããããããæ§é åãããã¢ãããŒããå¯èœã§ãã
è åšã¢ããªã³ã°ãå®è£ ããæé
è åšã¢ããªã³ã°ã®å®è£ ã«ã¯ãäžé£ã®æç¢ºã«å®çŸ©ãããæé ãå«ãŸããŸãã
- ç¯å²ã®å®çŸ©ïŒè åšã¢ããªã³ã°æŒç¿ã®ç¯å²ãæç¢ºã«å®çŸ©ããŸããããã«ã¯ãåæããã·ã¹ãã ãã¢ããªã±ãŒã·ã§ã³ããŸãã¯ãããã¯ãŒã¯ãããã³è©äŸ¡ã®ç¹å®ã®ç®çãšç®æšãç¹å®ããããšãå«ãŸããŸãã
- æ å ±ã®åéïŒã¢ãŒããã¯ãã£å³ãããŒã¿ãããŒå³ããŠãŒã¶ãŒã¹ããŒãªãŒãã»ãã¥ãªãã£èŠä»¶ãªã©ãã·ã¹ãã ã«é¢ããé¢é£æ å ±ãåéããŸãããã®æ å ±ã¯ãæœåšçãªè åšãšè匱æ§ãç¹å®ããããã®åºç€ãæäŸããŸãã
- ã·ã¹ãã ã®åè§£ïŒã·ã¹ãã ãåã ã®ã³ã³ããŒãã³ãã«åå²ããã³ã³ããŒãã³ãéã®çžäºäœçšãç¹å®ããŸããããã¯ãæœåšçãªæ»æå¯Ÿè±¡é åãšãšã³ããªãã€ã³ããç¹å®ããã®ã«åœ¹ç«ã¡ãŸãã
- è åšã®ç¹å®ïŒSTRIDEãLINDDUNããŸãã¯PASTAãªã©ã®æ§é åãããæ¹æ³è«ã䜿çšããŠãæœåšçãªè åšãšè匱æ§ããã¬ã€ã³ã¹ããŒãã³ã°ããŸããå éšããã³å€éšã®è åšããªãã³ã«æå³çãªè åšãšæå³ããªãè åšã®äž¡æ¹ãèæ ®ããŠãã ããã
- è åšã®ææžåïŒç¹å®ãããåè åšã«ã€ããŠãæ¬¡ã®æ å ±ãææžåããŸãã
- è åšã®èª¬æ
- è åšã®æœåšçãªåœ±é¿
- è åšãçºçããå¯èœæ§
- 圱é¿ãåããã³ã³ããŒãã³ã
- æœåšçãªè»œæžæŠç¥
- è åšã®åªå é äœä»ãïŒæœåšçãªåœ±é¿ãšå¯èœæ§ã«åºã¥ããŠè åšã®åªå é äœãä»ããŸããããã¯ãæãéèŠãªè匱æ§ãžã®å¯ŸåŠã«ãªãœãŒã¹ãéäžããã®ã«åœ¹ç«ã¡ãŸããDREADïŒæå®³ãåçŸæ§ãæªçšå¯èœæ§ã圱é¿ãåãããŠãŒã¶ãŒãçºèŠå¯èœæ§ïŒã®ãããªãªã¹ã¯ã¹ã³ã¢ãªã³ã°æ¹æ³è«ã¯ãããã§åœ¹ç«ã¡ãŸãã
- è»œæžæŠç¥ã®éçºïŒåªå é äœä»ããããåè åšã«ã€ããŠããªã¹ã¯ã軜æžããããã®è»œæžæŠç¥ãéçºããŸããããã«ã¯ãæ°ããã»ãã¥ãªãã£å¶åŸ¡ã®å®è£ ãæ¢åã®å¶åŸ¡ã®å€æŽããŸãã¯ãªã¹ã¯ã®åãå ¥ããå«ãŸããå ŽåããããŸãã
- è»œæžæŠç¥ã®ææžåïŒåªå é äœä»ããããåè åšã®è»œæžæŠç¥ãææžåããŸããããã¯ãå¿ èŠãªã»ãã¥ãªãã£å¶åŸ¡ãå®è£ ããããã®ããŒãããããæäŸããŸãã
- è»œæžæŠç¥ã®æ€èšŒïŒãã¹ããšæ€èšŒãéããŠè»œæžæŠç¥ã®æå¹æ§ãæ€èšŒããŸããããã«ãããå®è£ ãããå¶åŸ¡ããªã¹ã¯ã®è»œæžã«å¹æçã§ããããšãä¿èšŒãããŸãã
- ä¿å®ãšæŽæ°ïŒè åšã¢ããªã³ã°ã¯ç¶ç¶çãªããã»ã¹ã§ããã·ã¹ãã ãè åšã®ç¶æ³ãããã³çµç¹ã®ãªã¹ã¯èš±å®¹åºŠã®å€åãåæ ããããã«ãè åšã¢ãã«ã宿çã«èŠçŽããæŽæ°ããŸãã
è åšã¢ããªã³ã°ã®ããŒã«
ããã€ãã®ããŒã«ãè åšã¢ããªã³ã°ããã»ã¹ãæ¯æŽã§ããŸãã
- Microsoft Threat Modeling ToolïŒSTRIDEæ¹æ³è«ããµããŒãããMicrosoftã®ç¡æããŒã«ã
- OWASP Threat DragonïŒè€æ°ã®æ¹æ³è«ããµããŒããããªãŒãã³ãœãŒã¹ã®è åšã¢ããªã³ã°ããŒã«ã
- IriusRiskïŒéçºããŒã«ãšçµ±åãããåçšè åšã¢ããªã³ã°ãã©ãããã©ãŒã ã
- SD ElementsïŒè åšã¢ããªã³ã°æ©èœãå«ãåçšãœãããŠã§ã¢ã»ãã¥ãªãã£èŠä»¶ç®¡çãã©ãããã©ãŒã ã
- ThreatModelerïŒèªååãããè åšåæãšãªã¹ã¯ã¹ã³ã¢ãªã³ã°ãæäŸããåçšè åšã¢ããªã³ã°ãã©ãããã©ãŒã ã
ããŒã«ã®éžæã¯ãçµç¹ã®ç¹å®ã®ããŒãºãšèŠä»¶ã«ãã£ãŠç°ãªããŸããçµç¹ã®èŠæš¡ãã¢ãã«åããã·ã¹ãã ã®è€éããå©çšå¯èœãªäºç®ãªã©ã®èŠçŽ ãèæ ®ããŠãã ããã
SDLCïŒãœãããŠã§ã¢éçºã©ã€ããµã€ã¯ã«ïŒãžã®è åšã¢ããªã³ã°ã®çµ±å
è åšã¢ããªã³ã°ã®å©ç¹ãæå€§éã«æŽ»çšããã«ã¯ãè åšã¢ããªã³ã°ããœãããŠã§ã¢éçºã©ã€ããµã€ã¯ã«ïŒSDLCïŒã«çµ±åããããšãéèŠã§ããããã«ãããèšèšããå±éãŸã§ãéçºããã»ã¹å šäœã§ã»ãã¥ãªãã£ã«é¢ããèæ ®äºé ã察åŠãããããšãä¿èšŒãããŸãã
- åææ®µéïŒèšèšãšèšç»ïŒïŒèšè𿮵éã§æœåšçãªã»ãã¥ãªãã£ã®è匱æ§ãç¹å®ããããã«ãSDLCã®æ©ã段éã§è åšã¢ããªã³ã°ã宿œããŸããããã¯ãã³ãŒããèšè¿°ãããåã«å€æŽãå ããããšãã§ãããããè匱æ§ã«å¯ŸåŠããæãè²»çšå¯Ÿå¹æã®é«ãææã§ãã
- éçºæ®µéïŒè åšã¢ãã«ã䜿çšããŠãå®å šãªã³ãŒãã£ã³ã°ã®å®è·µãã¬ã€ãããéçºè ãæœåšçãªã»ãã¥ãªãã£ãªã¹ã¯ãèªèããŠããããšã確èªããŸãã
- ãã¹ã段éïŒè åšã¢ãã«ã䜿çšããŠãç¹å®ãããè匱æ§ãæšçãšããã»ãã¥ãªãã£ãã¹ããèšèšããŸãã
- å±é段éïŒã·ã¹ãã ãé 眮ããåã«ãå¿ èŠãªãã¹ãŠã®ã»ãã¥ãªãã£å¶åŸ¡ãæŽã£ãŠããããšã確èªããããã«ãè åšã¢ãã«ã確èªããŸãã
- ã¡ã³ããã³ã¹æ®µéïŒã·ã¹ãã ãšè åšã®ç¶æ³ã®å€åãåæ ããããã«ãè åšã¢ãã«ã宿çã«ç¢ºèªããã³æŽæ°ããŸãã
è åšã¢ããªã³ã°ã®ãã¹ããã©ã¯ãã£ã¹
è åšã¢ããªã³ã°ã®åãçµã¿ãæåãããã«ã¯ã次ã®ãã¹ããã©ã¯ãã£ã¹ãæ€èšããŠãã ããã
- é¢ä¿è ã®é¢äžïŒã·ã¹ãã ãšãã®æœåšçãªè åšãå æ¬çã«çè§£ããããã«ãã»ãã¥ãªãã£ãéçºãéçšãããžãã¹ãªã©ãããŸããŸãªããŒã ã®é¢ä¿è ãé¢äžãããŸãã
- æ§é åãããæ¹æ³è«ã®äœ¿çšïŒäžè²«æ§ã®ããåçŸå¯èœãªããã»ã¹ãä¿èšŒããããã«ãSTRIDEãLINDDUNããŸãã¯PASTAãªã©ã®æ§é åãããè åšã¢ããªã³ã°æ¹æ³è«ã䜿çšããŸãã
- ãã¹ãŠã®ææžåïŒç¯å²ãç¹å®ãããè åšãéçºãããè»œæžæŠç¥ãããã³æ€èšŒçµæãªã©ãè åšã¢ããªã³ã°ããã»ã¹ã®ãã¹ãŠã®åŽé¢ãææžåããŸãã
- ãªã¹ã¯ã®åªå é äœä»ãïŒæãéèŠãªè匱æ§ãžã®å¯ŸåŠã«ãªãœãŒã¹ãéäžããããã«ãæœåšçãªåœ±é¿ãšå¯èœæ§ã«åºã¥ããŠãªã¹ã¯ã®åªå é äœãä»ããŸãã
- å¯èœãªå Žåã¯èªååïŒå¹çãæ¹åãããšã©ãŒãåæžããããã«ãè åšã¢ããªã³ã°ããã»ã¹ã®å¯èœãªéãå€ããèªååããŸãã
- ããŒã ã®ãã¬ãŒãã³ã°ïŒå¹æçãªè åšã¢ããªã³ã°æŒç¿ã宿œããããã«å¿ èŠãªã¹ãã«ãšç¥èãããŒã ãæã€ããã«ãè åšã¢ããªã³ã°ã®æ¹æ³è«ãšããŒã«ã«é¢ãããã¬ãŒãã³ã°ãããŒã ã«æäŸããŸãã
- 宿çãªç¢ºèªãšæŽæ°ïŒã·ã¹ãã ãè åšã®ç¶æ³ãããã³çµç¹ã®ãªã¹ã¯èš±å®¹åºŠã®å€åãåæ ããããã«ãè åšã¢ãã«ã宿çã«ç¢ºèªããã³æŽæ°ããŸãã
- ããžãã¹ç®æšã«çŠç¹ãåœãŠãïŒè åšã¢ããªã³ã°ã宿œããéã¯ãåžžã«ã·ã¹ãã ã®ããžãã¹ç®æšã念é ã«çœ®ããŠãã ãããç®æšã¯ãçµç¹ã®æåã«æãéèŠãªè³ç£ãä¿è·ããããšã§ãã
è åšã¢ããªã³ã°ã®å®è£ ã«ããã課é¡
å€ãã®å©ç¹ãããã«ãããããããè åšã¢ããªã³ã°ã®å®è£ ã«ã¯ããã€ãã®èª²é¡ããããŸãã
- å°éç¥èã®æ¬ åŠïŒçµç¹ã¯ã广çãªè åšã¢ããªã³ã°æŒç¿ã宿œããããã«å¿ èŠãªå°éç¥èãæ¬ ããŠããå¯èœæ§ããããŸãã
- æéã®å¶çŽïŒè åšã¢ããªã³ã°ã¯ãç¹ã«è€éãªã·ã¹ãã ã®å Žåãæéããããå¯èœæ§ããããŸãã
- ããŒã«ã®éžæïŒé©åãªè åšã¢ããªã³ã°ããŒã«ã®éžæã¯é£ããå ŽåããããŸãã
- SDLCãšã®çµ±åïŒè åšã¢ããªã³ã°ãSDLCã«çµ±åããããšã¯ãç¹ã«ç¢ºç«ãããéçºããã»ã¹ãæã€çµç¹ã«ãšã£ãŠã¯é£ããå ŽåããããŸãã
- å¢ãã®ç¶æïŒå¢ããç¶æããè åšã¢ããªã³ã°ãåªå äºé ã§ããç¶ããããã«ããããšã¯é£ããå ŽåããããŸãã
ãããã®èª²é¡ãå æããããã«ãçµç¹ã¯ãã¬ãŒãã³ã°ã«æè³ããé©åãªããŒã«ãéžæããè åšã¢ããªã³ã°ãSDLCã«çµ±åããã»ãã¥ãªãã£æèã®æåãè²æããå¿ èŠããããŸãã
çŸå®äžçã®äŸãšã±ãŒã¹ã¹ã¿ãã£
è åšã¢ããªã³ã°ãããŸããŸãªæ¥çã§ã©ã®ããã«é©çšã§ãããã®äŸãããã€ã瀺ããŸãã
- ãã«ã¹ã±ã¢ïŒè åšã¢ããªã³ã°ã䜿çšããŠãæ£è ããŒã¿ãä¿è·ããå»çæ©åšã®æ¹ãããé²ãããšãã§ããŸããããšãã°ãç é¢ã¯è åšã¢ããªã³ã°ã䜿çšããŠãé»åå»çèšé²ïŒEHRïŒã·ã¹ãã ã®è匱æ§ãç¹å®ããæ£è ããŒã¿ãžã®äžæ£ã¢ã¯ã»ã¹ãé²ãããã®è»œæžæŠç¥ãéçºã§ããŸãããŸããæ£è ã«å±å®³ãå ããå¯èœæ§ã®ããæ¹ããããã茞液ãã³ããªã©ã®ãããã¯ãŒã¯æ¥ç¶ãããå»çæ©åšãä¿è·ããããã«ã䜿çšã§ããŸãã
- éèïŒè åšã¢ããªã³ã°ã䜿çšããŠãäžæ£è¡çºã鲿¢ããéèããŒã¿ãä¿è·ã§ããŸããããšãã°ãéè¡ã¯è åšã¢ããªã³ã°ã䜿çšããŠããªã³ã©ã€ã³ãã³ãã³ã°ã·ã¹ãã ã®è匱æ§ãç¹å®ãããã£ãã·ã³ã°æ»æãã¢ã«ãŠã³ãã®ä¹ã£åããé²ãããã®è»œæžæŠç¥ãéçºã§ããŸãã
- 補é ïŒè åšã¢ããªã³ã°ã䜿çšããŠãç£æ¥çšå¶åŸ¡ã·ã¹ãã ïŒICSïŒããµã€ããŒæ»æããä¿è·ã§ããŸããããšãã°ã補é ãã©ã³ãã¯è åšã¢ããªã³ã°ã䜿çšããŠãICSãããã¯ãŒã¯ã®è匱æ§ãç¹å®ããçç£ã®äžæãé²ãããã®è»œæžæŠç¥ãéçºã§ããŸãã
- å°å£²ïŒè åšã¢ããªã³ã°ã䜿çšããŠã顧客ããŒã¿ãä¿è·ããã¯ã¬ãžããã«ãŒãã®äžæ£äœ¿çšãé²ãããšãã§ããŸããã°ããŒãã«eã³ããŒã¹ãã©ãããã©ãŒã ã¯ãè åšã¢ããªã³ã°ã掻çšããŠæ¯æãã²ãŒããŠã§ã€ãä¿è·ãã倿§ãªå°åããã³æ¯æãæ¹æ³å šäœã§ãã©ã³ã¶ã¯ã·ã§ã³ããŒã¿ã®æ©å¯æ§ãšæŽåæ§ã確ä¿ã§ããŸãã
- æ¿åºïŒæ¿åºæ©é¢ã¯ãè åšã¢ããªã³ã°ã䜿çšããŠãæ©å¯ããŒã¿ãšéèŠãªã€ã³ãã©ã¹ãã©ã¯ãã£ãä¿è·ããŸãã圌ãã¯ãåœé²ãŸãã¯åžæ°ãµãŒãã¹ã«äœ¿çšãããã·ã¹ãã ãè åšã¢ãã«åããå¯èœæ§ããããŸãã
ãããã¯ãè åšã¢ããªã³ã°ã䜿çšããŠããŸããŸãªæ¥çã§ã»ãã¥ãªãã£ãåäžãããããšãã§ããæ¹æ³ã®ã»ãã®äžäŸã§ããæœåšçãªè åšãç©æ¥µçã«ç¹å®ããŠè»œæžããããšã«ãããçµç¹ã¯ãµã€ããŒæ»æã®ãªã¹ã¯ãå€§å¹ ã«è»œæžãã貎éãªè³ç£ãä¿è·ã§ããŸãã
è åšã¢ããªã³ã°ã®å°æ¥
è åšã¢ããªã³ã°ã®å°æ¥ã¯ãããã€ãã®åŸåã«ãã£ãŠåœ¢äœãããå¯èœæ§ããããŸãã
- èªååïŒè åšã¢ããªã³ã°ããã»ã¹ã®èªååãé²ããšãè åšã¢ããªã³ã°æŒç¿ã®å®æœãããç°¡åãã€å¹ççã«ãªããŸããæœåšçãªè åšãšè匱æ§ãèªåçã«èå¥ã§ããAIæèŒã®è åšã¢ããªã³ã°ããŒã«ãç»å ŽããŠããŸãã
- DevSecOpsãšã®çµ±åïŒè åšã¢ããªã³ã°ãšDevSecOpsãã©ã¯ãã£ã¹ã®ããç·å¯ãªçµ±åã«ãããã»ãã¥ãªãã£ãéçºããã»ã¹ã®éèŠãªéšåã§ããããšãä¿èšŒãããŸããããã«ã¯ãè åšã¢ããªã³ã°ã¿ã¹ã¯ã®èªååãšCI/CDãã€ãã©ã€ã³ãžã®çµ±åãå«ãŸããŸãã
- ã¯ã©ãŠããã€ãã£ãã»ãã¥ãªãã£ïŒã¯ã©ãŠããã€ãã£ããã¯ãããžãŒã®æ¡çšãå¢ããã«ã€ããŠãè åšã¢ããªã³ã°ã¯ã¯ã©ãŠãç°å¢ã®åºæã®èª²é¡ã«é©å¿ããå¿ èŠããããŸããããã«ã¯ãæ§æã誀ã£ãã¯ã©ãŠããµãŒãã¹ãå®å šã§ãªãAPIãªã©ãã¯ã©ãŠãåºæã®è åšãšè匱æ§ã®ã¢ããªã³ã°ãå«ãŸããŸãã
- è åšã€ã³ããªãžã§ã³ã¹ã®çµ±åïŒè åšã€ã³ããªãžã§ã³ã¹ãã£ãŒããè åšã¢ããªã³ã°ããŒã«ã«çµ±åãããšãæ°ããªè åšãšè匱æ§ã«é¢ãããªã¢ã«ã¿ã€ã ã®æ å ±ãæäŸãããŸããããã«ãããçµç¹ã¯æ°ããªè åšã«ç©æ¥µçã«å¯ŸåŠããã»ãã¥ãªãã£äœå¶ãæ¹åã§ããŸãã
- ãã©ã€ãã·ãŒã®éèŠïŒããŒã¿ãã©ã€ãã·ãŒã«å¯Ÿããæžå¿µãé«ãŸã£ãŠãããããè åšã¢ããªã³ã°ã§ã¯ãã©ã€ãã·ãŒãªã¹ã¯ãããéèŠããå¿ èŠããããŸããLINDDUNã®ãããªæ¹æ³è«ã¯ããã©ã€ãã·ãŒã®è匱æ§ãç¹å®ããŠè»œæžããããã«ãŸããŸãéèŠã«ãªããŸãã
çµè«
è åšã¢ããªã³ã°ã¯ã广çãªãµã€ããŒã»ãã¥ãªãã£ããã°ã©ã ã«äžå¯æ¬ ãªèŠçŽ ã§ããæœåšçãªè åšãç©æ¥µçã«ç¹å®ããŠè»œæžããããšã«ãããçµç¹ã¯ãµã€ããŒæ»æã®ãªã¹ã¯ãå€§å¹ ã«è»œæžãã貎éãªè³ç£ãä¿è·ã§ããŸããè åšã¢ããªã³ã°ã®å®è£ ã¯é£ããå ŽåããããŸãããã¡ãªããã¯ã³ã¹ããã¯ããã«äžåããŸãããã®ã¬ã€ãã«æŠèª¬ãããŠããæé ã«åŸãããã¹ããã©ã¯ãã£ã¹ãæ¡çšããããšã§ãããããèŠæš¡ã®çµç¹ãè åšã¢ããªã³ã°ãæ£åžžã«å®è£ ããå šäœçãªã»ãã¥ãªãã£äœå¶ãæ¹åã§ããŸãã
ãµã€ããŒè åšãé²åãç¶ããããé«åºŠåããã«ã€ããŠãè åšã¢ããªã³ã°ã¯ãçµç¹ãæä»£ã®å ãè¡ãããã«ããã«éèŠã«ãªããŸããè åšã¢ããªã³ã°ãã³ã¢ã»ãã¥ãªãã£ãã©ã¯ãã£ã¹ãšããŠæ¡çšããããšã«ãããçµç¹ã¯ããå®å šãªã·ã¹ãã ãæ§ç¯ããããŒã¿ãä¿è·ãã顧客ãšå©å®³é¢ä¿è ã®ä¿¡é Œãç¶æã§ããŸãã