è匱æ§è©äŸ¡ãšã»ãã¥ãªãã£ç£æ»ã«ã€ããŠåŠã³ãŸãããµã€ããŒè åšããçµç¹ãå®ãããã®éèŠæ§ãæ¹æ³è«ãããŒã«ãããã³ãã®åœ¹å²ãçè§£ããŸãã
è匱æ§è©äŸ¡ïŒã»ãã¥ãªãã£ç£æ»ã®ããã®å æ¬çã¬ã€ã
仿¥ã®çžäºæ¥ç¶ãããäžçã§ã¯ããµã€ããŒã»ãã¥ãªãã£ã¯æéèŠã§ããããããèŠæš¡ã®çµç¹ã¯ãæ©å¯ããŒã¿ã䟵害ããéçšãäžæãããè©å€ãæãªãå¯èœæ§ã®ãããçµ¶ããé²åããè åšã®ç¶æ³ã«çŽé¢ããŠããŸããè匱æ§è©äŸ¡ãšã»ãã¥ãªãã£ç£æ»ã¯ãå ç¢ãªãµã€ããŒã»ãã¥ãªãã£æŠç¥ã®éèŠãªæ§æèŠçŽ ã§ãããçµç¹ãæªæã®ããæ»æè ã«ãã£ãŠæªçšãããåã«åŒ±ç¹ãçºèŠãã察åŠããã®ã«åœ¹ç«ã¡ãŸãã
è匱æ§è©äŸ¡ãšã¯äœã§ããïŒ
è匱æ§è©äŸ¡ãšã¯ãã·ã¹ãã ãã¢ããªã±ãŒã·ã§ã³ããŸãã¯ãããã¯ãŒã¯å ã®è匱æ§ãç¹å®ãå®éåãåªå é äœä»ãããäœç³»çãªããã»ã¹ã§ããããã¯ãæ»æè ãäžæ£ã¢ã¯ã»ã¹ãåŸãããããŒã¿ãçãã ãããµãŒãã¹ãäžæãããããããã«æªçšã§ãã匱ç¹ãçºèŠããããšãç®çãšããŠããŸããããžã¿ã«è³ç£ã®å æ¬çãªå¥åº·èšºæãšèããŠãæå®³ãåŒãèµ·ããåã«æœåšçãªåé¡ãç©æ¥µçã«æ€çŽ¢ããŸãã
è匱æ§è©äŸ¡ã®äž»èŠãªã¹ãããïŒ
- ã¹ã³ãŒãå®çŸ©ïŒè©äŸ¡ã®å¢çãå®çŸ©ããŸããã©ã®ã·ã¹ãã ãã¢ããªã±ãŒã·ã§ã³ããŸãã¯ãããã¯ãŒã¯ãå«ãŸããŸããïŒããã¯ãè©äŸ¡ãçŠç¹ãçµãã广çã§ããããšãä¿èšŒããããã®éèŠãªæåã®ã¹ãããã§ããããšãã°ãéèæ©é¢ã¯ããªã³ã©ã€ã³ãã³ãã³ã°ååŒã«é¢ãããã¹ãŠã®ã·ã¹ãã ãå«ããããã«è匱æ§è©äŸ¡ã®ã¹ã³ãŒããå®çŸ©ããå ŽåããããŸãã
- æ å ±åéïŒã¿ãŒã²ããç°å¢ã«é¢ããæ å ±ãåéããŸããããã«ã¯ããªãã¬ãŒãã£ã³ã°ã·ã¹ãã ããœãããŠã§ã¢ããŒãžã§ã³ããããã¯ãŒã¯æ§æããŠãŒã¶ãŒã¢ã«ãŠã³ãã®ç¹å®ãå«ãŸããŸããDNSã¬ã³ãŒãããŠã§ããµã€ãã®ã³ã³ãã³ããªã©ãå ¬éãããŠããæ å ±ã䟡å€ããããŸãã
- è匱æ§ã¹ãã£ã³ïŒèªååãããããŒã«ã䜿çšããŠãã¿ãŒã²ããç°å¢ã§æ¢ç¥ã®è匱æ§ãã¹ãã£ã³ããŸãããããã®ããŒã«ã¯ãã·ã¹ãã ã®æ§æããCommon Vulnerabilities and Exposures (CVE) ããŒã¿ããŒã¹ãªã©ã®æ¢ç¥ã®è匱æ§ã®ããŒã¿ããŒã¹ãšæ¯èŒããŸããè匱æ§ã¹ãã£ããŒã®äŸãšããŠã¯ãNessusãOpenVASãQualysããããŸãã
- è匱æ§åæïŒã¹ãã£ã³çµæãåæããŠãæœåšçãªè匱æ§ãç¹å®ããŸããããã«ã¯ãæ€åºçµæã®æ£ç¢ºæ§ãæ€èšŒããéå€§åºŠãšæœåšçãªåœ±é¿ã«åºã¥ããŠè匱æ§ã®åªå é äœãä»ããåè匱æ§ã®æ ¹æ¬åå ãç¹å®ããããšãå«ãŸããŸãã
- å ±åïŒè©äŸ¡ã®çµæãå æ¬çãªã¬ããŒãã«ææžåããŸããã¬ããŒãã«ã¯ãç¹å®ãããè匱æ§ã®æŠèŠããããã®æœåšçãªåœ±é¿ãããã³ä¿®æ£ã®ããã®æšå¥šäºé ãå«ãŸããŠããå¿ èŠããããŸããã¬ããŒãã¯ãçµç¹ã®æè¡çããã³ããžãã¹çããŒãºã«åãããŠèª¿æŽãããå¿ èŠããããŸãã
è匱æ§è©äŸ¡ã®çš®é¡ïŒ
- ãããã¯ãŒã¯è匱æ§è©äŸ¡ïŒãã¡ã€ã¢ãŠã©ãŒã«ãã«ãŒã¿ãŒãã¹ã€ãããªã©ã®ãããã¯ãŒã¯ã€ã³ãã©ã¹ãã©ã¯ãã£ã®è匱æ§ã®ç¹å®ã«çŠç¹ãåœãŠãŸãããã®ã¿ã€ãã®è©äŸ¡ã¯ãæ»æè ããããã¯ãŒã¯ãžã®ã¢ã¯ã»ã¹ãååŸããããæ©å¯ããŒã¿ãååãããããããšãå¯èœã«ããå¯èœæ§ã®ãã匱ç¹ãçºèŠããããšãç®çãšããŠããŸãã
- ã¢ããªã±ãŒã·ã§ã³è匱æ§è©äŸ¡ïŒWebã¢ããªã±ãŒã·ã§ã³ãã¢ãã€ã«ã¢ããªã±ãŒã·ã§ã³ããã®ä»ã®ãœãããŠã§ã¢ã®è匱æ§ã®ç¹å®ã«çŠç¹ãåœãŠãŸãããã®ã¿ã€ãã®è©äŸ¡ã¯ãæ»æè ãæªæã®ããã³ãŒããæ¿å ¥ããããããŒã¿ãçãã ããã¢ããªã±ãŒã·ã§ã³ã®æ©èœãäžæãããããããšãå¯èœã«ããå¯èœæ§ã®ãã匱ç¹ãçºèŠããããšãç®çãšããŠããŸãã
- ãã¹ãããŒã¹ã®è匱æ§è©äŸ¡ïŒåã ã®ãµãŒããŒãŸãã¯ã¯ãŒã¯ã¹ããŒã·ã§ã³ã®è匱æ§ã®ç¹å®ã«çŠç¹ãåœãŠãŸãããã®ã¿ã€ãã®è©äŸ¡ã¯ãæ»æè ãã·ã¹ãã ãå¶åŸ¡ããããã·ã¹ãã ã«ä¿åãããŠããããŒã¿ãçãã ãããããšãå¯èœã«ããå¯èœæ§ã®ãã匱ç¹ãçºèŠããããšãç®çãšããŠããŸãã
- ããŒã¿ããŒã¹è匱æ§è©äŸ¡ïŒMySQLãPostgreSQLãOracleãªã©ã®ããŒã¿ããŒã¹ã·ã¹ãã ã®è匱æ§ã®ç¹å®ã«çŠç¹ãåœãŠãŸãããã®ã¿ã€ãã®è©äŸ¡ã¯ãæ»æè ãããŒã¿ããŒã¹ã«ä¿åãããŠããæ©å¯ããŒã¿ã«ã¢ã¯ã»ã¹ããããããŒã¿ããŒã¹ã®æ©èœãäžæãããããããšãå¯èœã«ããå¯èœæ§ã®ãã匱ç¹ãçºèŠããããšãç®çãšããŠããŸãã
ã»ãã¥ãªãã£ç£æ»ãšã¯äœã§ããïŒ
ã»ãã¥ãªãã£ç£æ»ãšã¯ãçµç¹ã®å šäœçãªã»ãã¥ãªãã£äœå¶ã®ãããå æ¬çãªè©äŸ¡ã§ããããã¯ãæ¥çæšæºãèŠå¶èŠä»¶ãããã³ãã¹ããã©ã¯ãã£ã¹ã«å¯ŸããŠãã»ãã¥ãªãã£å¶åŸ¡ãããªã·ãŒãããã³æé ã®å¹æãè©äŸ¡ããŸããã»ãã¥ãªãã£ç£æ»ã¯ãçµç¹ã®ã»ãã¥ãªãã£ãªã¹ã¯ç®¡çèœåã®ç¬ç«ãã客芳çãªè©äŸ¡ãæäŸããŸãã
ã»ãã¥ãªãã£ç£æ»ã®äž»èŠãªåŽé¢ïŒ
- ããªã·ãŒã¬ãã¥ãŒïŒçµç¹ã®ã»ãã¥ãªãã£ããªã·ãŒããã³æé ããå æ¬çã§ææ°ãã€å¹æçã«å®æœãããŠããããšã確èªããããã«æ€èšããŸããããã«ã¯ãã¢ã¯ã»ã¹å¶åŸ¡ãããŒã¿ã»ãã¥ãªãã£ãã€ã³ã·ãã³ã察å¿ãããã³çœå®³åŸ©æ§ã«é¢ããããªã·ãŒãå«ãŸããŸãã
- ã³ã³ãã©ã€ã¢ã³ã¹è©äŸ¡ïŒGDPRãHIPAAãPCI DSSãISO 27001ãªã©ã®é¢é£èŠå¶ããã³æ¥çæšæºãžã®çµç¹ã®ã³ã³ãã©ã€ã¢ã³ã¹ãè©äŸ¡ããŸããããšãã°ãã¯ã¬ãžããã«ãŒã決æžãåŠçããäŒæ¥ã¯ãã«ãŒãäŒå¡ããŒã¿ãä¿è·ããããã«PCI DSSæšæºã«æºæ ããå¿ èŠããããŸãã
- å¶åŸ¡ãã¹ãïŒãã¡ã€ã¢ãŠã©ãŒã«ãäŸµå ¥æ€ç¥ã·ã¹ãã ãã¢ã³ããŠã€ã«ã¹ãœãããŠã§ã¢ãªã©ã®ã»ãã¥ãªãã£å¶åŸ¡ã®å¹æããã¹ãããŸããããã«ã¯ãå¶åŸ¡ãé©åã«æ§æãããæå³ãããšããã«æ©èœããè åšã«å¯ŸããŠé©åãªä¿è·ãæäŸããŠããããšã確èªããããšãå«ãŸããŸãã
- ãªã¹ã¯è©äŸ¡ïŒçµç¹ã®ã»ãã¥ãªãã£ãªã¹ã¯ãç¹å®ããã³è©äŸ¡ããŸããããã«ã¯ãæœåšçãªè åšã®å¯èœæ§ãšåœ±é¿ãè©äŸ¡ããçµç¹ã®å šäœçãªãªã¹ã¯ãšã¯ã¹ããŒãžã£ãŒã軜æžããããã®ç·©åæŠç¥ãéçºããããšãå«ãŸããŸãã
- å ±åïŒç£æ»ã®çµæã詳现ãªã¬ããŒãã«ææžåããŸããã¬ããŒãã«ã¯ãç£æ»çµæã®æŠèŠãç¹å®ããã匱ç¹ãããã³æ¹åã®ããã®æšå¥šäºé ãå«ãŸããŠããå¿ èŠããããŸãã
ã»ãã¥ãªãã£ç£æ»ã®çš®é¡ïŒ
- å éšç£æ»ïŒçµç¹ã®å éšç£æ»ããŒã ã«ãã£ãŠå®æœãããŸããå éšç£æ»ã¯ãçµç¹ã®ã»ãã¥ãªãã£äœå¶ã®ç¶ç¶çãªè©äŸ¡ãæäŸããæ¹åã®ããã®é åãç¹å®ããã®ã«åœ¹ç«ã¡ãŸãã
- å€éšç£æ»ïŒç¬ç«ãã第äžè ç£æ»äººã«ãã£ãŠå®æœãããŸããå€éšç£æ»ã¯ãçµç¹ã®ã»ãã¥ãªãã£äœå¶ã®å®¢èгçã§åãã®ãªãè©äŸ¡ãæäŸããèŠå¶ãŸãã¯æ¥çæšæºãžã®æºæ ã®ããã«ãã°ãã°å¿ èŠãšãããŸããããšãã°ãå ¬éãããŠããäŒæ¥ã¯ãSarbanes-OxleyïŒSOXïŒèŠå¶ã«æºæ ããããã«å€éšç£æ»ãåããå ŽåããããŸãã
- ã³ã³ãã©ã€ã¢ã³ã¹ç£æ»ïŒç¹å®ã®èŠå¶ãŸãã¯æ¥çæšæºãžã®æºæ ãè©äŸ¡ããããšã«ç¹åããŠããŸããäŸãšããŠã¯ãGDPRã³ã³ãã©ã€ã¢ã³ã¹ç£æ»ãHIPAAã³ã³ãã©ã€ã¢ã³ã¹ç£æ»ãPCI DSSã³ã³ãã©ã€ã¢ã³ã¹ç£æ»ãªã©ããããŸãã
è匱æ§è©äŸ¡ãšã»ãã¥ãªãã£ç£æ»ïŒäž»ãªéã
è匱æ§è©äŸ¡ãšã»ãã¥ãªãã£ç£æ»ã®äž¡æ¹ããµã€ããŒã»ãã¥ãªãã£ã«äžå¯æ¬ ã§ããããããã¯ç°ãªãç®çãæãããæç¢ºãªç¹æ§ãæã£ãŠããŸãã
| ç¹åŸŽ | è匱æ§è©äŸ¡ | ã»ãã¥ãªãã£ç£æ» |
|---|---|---|
| ã¹ã³ãŒã | ã·ã¹ãã ãã¢ããªã±ãŒã·ã§ã³ããããã¯ãŒã¯ã®æè¡çãªè匱æ§ã®ç¹å®ã«çŠç¹ãåœãŠãŸãã | ããªã·ãŒãæé ãå¶åŸ¡ãå«ããçµç¹ã®å šäœçãªã»ãã¥ãªãã£äœå¶ãåºç¯å²ã«è©äŸ¡ããŸãã |
| æ·±ã | æè¡çã§ãç¹å®ã®è匱æ§ã«çŠç¹ãåœãŠãŠããŸãã | å æ¬çã§ãè€æ°ã®ã»ãã¥ãªãã£ã¬ã€ã€ãŒã調ã¹ãŸãã |
| é »åºŠ | éåžžãããé »ç¹ã«å®è¡ããããã°ãã°å®æçãªã¹ã±ãžã¥ãŒã«ïŒäŸïŒææ¬¡ãååæããšïŒã§è¡ãããŸãã | éåžžãããŸãé »ç¹ã«å®è¡ãããŸããïŒäŸïŒå¹Žæ¬¡ãåæããšïŒã |
| ç®ç | ä¿®æ£ã®ããã«è匱æ§ãç¹å®ããåªå é äœãä»ããŸãã | ã»ãã¥ãªãã£å¶åŸ¡ã®å¹æãšãèŠå¶ããã³æšæºãžã®æºæ ãè©äŸ¡ããŸãã |
| åºå | è©³çŽ°ãªæ€åºçµæãšä¿®æ£æšå¥šäºé ãå«ãè匱æ§ã¬ããŒãã | å šäœçãªã»ãã¥ãªãã£äœå¶ã®è©äŸ¡ãšæ¹åã®ããã®æšå¥šäºé ãå«ãç£æ»ã¬ããŒãã |
ãããã¬ãŒã·ã§ã³ãã¹ãã®éèŠæ§
ãããã¬ãŒã·ã§ã³ãã¹ãïŒãšã·ã«ã«ãããã³ã°ãšãåŒã°ããïŒã¯ãè匱æ§ãç¹å®ããã»ãã¥ãªãã£å¶åŸ¡ã®å¹æãè©äŸ¡ããããã«ãã·ã¹ãã ãŸãã¯ãããã¯ãŒã¯ã«å¯Ÿããã·ãã¥ã¬ãŒãããããµã€ããŒæ»æã§ããããã¯ãè匱æ§ãç©æ¥µçã«æªçšããããšã§ãæ»æè ãåŒãèµ·ããå¯èœæ§ã®ããæå®³ã®çšåºŠã倿ããããšã§ãè匱æ§ã¹ãã£ã³ãè¶ ããŠããŸãããããã¬ãŒã·ã§ã³ãã¹ãã¯ãè匱æ§è©äŸ¡ãæ€èšŒããèªåã¹ãã£ã³ã§èŠéãããå¯èœæ§ã®ãã匱ç¹ãç¹å®ããããã®è²ŽéãªããŒã«ã§ãã
ãããã¬ãŒã·ã§ã³ãã¹ãã®çš®é¡ïŒ
- ãã©ãã¯ããã¯ã¹ãã¹ãïŒãã¹ã¿ãŒã¯ãã·ã¹ãã ãŸãã¯ãããã¯ãŒã¯ã«é¢ããäºåã®ç¥èããããŸãããããã¯ãæ»æè ã«å éšæ å ±ããªãå®éã®æ»æãã·ãã¥ã¬ãŒãããŸãã
- ãã¯ã€ãããã¯ã¹ãã¹ãïŒãã¹ã¿ãŒã¯ããœãŒã¹ã³ãŒããæ§æããããã¯ãŒã¯å³ãå«ããã·ã¹ãã ãŸãã¯ãããã¯ãŒã¯ã«é¢ããå®å šãªç¥èãæã£ãŠããŸããããã«ããããã培åºçã§ã¿ãŒã²ãããçµã£ãè©äŸ¡ãå¯èœã«ãªããŸãã
- ã°ã¬ã€ããã¯ã¹ãã¹ãïŒãã¹ã¿ãŒã¯ãã·ã¹ãã ãŸãã¯ãããã¯ãŒã¯ã«é¢ããéšåçãªç¥èãæã£ãŠããŸããããã¯ããã©ãã¯ããã¯ã¹ããã³ãã¯ã€ãããã¯ã¹ãã¹ãã®å©ç¹ããã©ã³ã¹ãããäžè¬çãªã¢ãããŒãã§ãã
è匱æ§è©äŸ¡ããã³ã»ãã¥ãªãã£ç£æ»ã§äœ¿çšãããããŒã«
è匱æ§è©äŸ¡ããã³ã»ãã¥ãªãã£ç£æ»ãæ¯æŽããããã«ãããŸããŸãªããŒã«ãå©çšå¯èœã§ãããããã®ããŒã«ã¯ãããã»ã¹ã«é¢ããå€ãã®ã¿ã¹ã¯ãèªååããããå¹ççãã€å¹æçã«ããããšãã§ããŸãã
è匱æ§ã¹ãã£ã³ããŒã«ïŒ
- NessusïŒå¹ åºããã©ãããã©ãŒã ãšãã¯ãããžãŒããµããŒããããåºã䜿çšãããŠããåçšè匱æ§ã¹ãã£ããŒã
- OpenVASïŒNessusãšåæ§ã®æ©èœãæäŸãããªãŒãã³ãœãŒã¹ã®è匱æ§ã¹ãã£ããŒã
- QualysïŒå æ¬çãªè匱æ§ã¹ãã£ã³ããã³ã¬ããŒãæ©èœãæäŸããã¯ã©ãŠãããŒã¹ã®è匱æ§ç®¡çãã©ãããã©ãŒã ã
- NmapïŒãããã¯ãŒã¯äžã®éããŠããããŒãããµãŒãã¹ããªãã¬ãŒãã£ã³ã°ã·ã¹ãã ãç¹å®ããããã«äœ¿çšã§ãã匷åãªãããã¯ãŒã¯ã¹ãã£ãã³ã°ããŒã«ã
ãããã¬ãŒã·ã§ã³ãã¹ãããŒã«ïŒ
- MetasploitïŒã»ãã¥ãªãã£è匱æ§ã®ãã¹ãã®ããã®ããŒã«ãšãšã¯ã¹ããã€ãã®ã³ã¬ã¯ã·ã§ã³ãæäŸãããåºã䜿çšãããŠãããããã¬ãŒã·ã§ã³ãã¹ããã¬ãŒã ã¯ãŒã¯ã
- Burp SuiteïŒSQLã€ã³ãžã§ã¯ã·ã§ã³ãã¯ãã¹ãµã€ãã¹ã¯ãªããã£ã³ã°ãªã©ã®è匱æ§ãç¹å®ããããã«äœ¿çšã§ããWebã¢ããªã±ãŒã·ã§ã³ã»ãã¥ãªãã£ãã¹ãããŒã«ã
- WiresharkïŒãããã¯ãŒã¯ãã©ãã£ãã¯ããã£ããã£ããã³åæããããã«äœ¿çšã§ãããããã¯ãŒã¯ãããã³ã«ã¢ãã©ã€ã¶ãŒã
- OWASP ZAPïŒãªãŒãã³ãœãŒã¹ã®Webã¢ããªã±ãŒã·ã§ã³ã»ãã¥ãªãã£ã¹ãã£ããŒã
ã»ãã¥ãªãã£ç£æ»ããŒã«ïŒ
- NISTãµã€ããŒã»ãã¥ãªãã£ãã¬ãŒã ã¯ãŒã¯ïŒçµç¹ã®ãµã€ããŒã»ãã¥ãªãã£äœå¶ãè©äŸ¡ããã³æ¹åããããã®æ§é åãããã¢ãããŒããæäŸããŸãã
- ISO 27001ïŒæ å ±ã»ãã¥ãªãã£ç®¡çã·ã¹ãã ã®åœéæšæºã
- COBITïŒITã¬ããã³ã¹ããã³ç®¡çã®ãã¬ãŒã ã¯ãŒã¯ã
- æ§æç®¡çããŒã¿ããŒã¹ïŒCMDBïŒïŒITè³ç£ãšæ§æã远跡ããã³ç®¡çããããã«äœ¿çšãããã»ãã¥ãªãã£ç£æ»ã«è²Žéãªæ å ±ãæäŸããŸãã
è匱æ§è©äŸ¡ããã³ã»ãã¥ãªãã£ç£æ»ã®ãã¹ããã©ã¯ãã£ã¹
è匱æ§è©äŸ¡ããã³ã»ãã¥ãªãã£ç£æ»ã®å¹æãæå€§åããã«ã¯ããã¹ããã©ã¯ãã£ã¹ã«åŸãããšãéèŠã§ãã
- æç¢ºãªã¹ã³ãŒããå®çŸ©ããïŒè©äŸ¡ãŸãã¯ç£æ»ã®ã¹ã³ãŒããæç¢ºã«å®çŸ©ããŠããããçŠç¹ãçµãã广çã§ããããšã確èªããŸãã
- è³æ Œã®ããå°éå®¶ã䜿çšããïŒè³æ Œãããçµéšè±å¯ãªå°éå®¶ãè©äŸ¡ãŸãã¯ç£æ»ã®å®æœã«èµ·çšããŸããCertified Information Systems Security ProfessionalïŒCISSPïŒãCertified Ethical HackerïŒCEHïŒãCertified Information Systems AuditorïŒCISAïŒãªã©ã®èªå®ãæ¢ããŠãã ããã
- ãªã¹ã¯ããŒã¹ã®ã¢ãããŒãã䜿çšããïŒè匱æ§ãšã»ãã¥ãªãã£å¶åŸ¡ããæœåšçãªåœ±é¿ãšæªçšã®å¯èœæ§ã«åºã¥ããŠåªå é äœãä»ããŸãã
- å¯èœãªå Žåã¯èªååããïŒèªååãããããŒã«ã䜿çšããŠãè©äŸ¡ãŸãã¯ç£æ»ããã»ã¹ãåçåããå¹çãåäžãããŸãã
- ãã¹ãŠãææžåããïŒãã¹ãŠã®æ€åºçµæãæšå¥šäºé ãããã³ä¿®æ£äœæ¥ãæç¢ºãã€ç°¡æœãªã¬ããŒãã«ææžåããŸãã
- è匱æ§ãè¿ éã«ä¿®æ£ããïŒçµç¹ã®ãªã¹ã¯ãšã¯ã¹ããŒãžã£ãŒã軜æžããããã«ãç¹å®ãããè匱æ§ãã¿ã€ã ãªãŒã«å¯ŸåŠããŸãã
- ããªã·ãŒãšæé ã宿çã«ã¬ãã¥ãŒããã³æŽæ°ããïŒã»ãã¥ãªãã£ããªã·ãŒãšæé ã广çã§é¢é£æ§ãããããšã確èªããããã«ã宿çã«ã¬ãã¥ãŒããã³æŽæ°ããŸãã
- åŸæ¥å¡ãæè²ããã³ãã¬ãŒãã³ã°ããïŒåŸæ¥å¡ã«ç¶ç¶çãªã»ãã¥ãªãã£æèãã¬ãŒãã³ã°ãæäŸããŠãè åšãç¹å®ããåé¿ããã®ãæ¯æŽããŸãããã£ãã·ã³ã°ã·ãã¥ã¬ãŒã·ã§ã³ã¯è¯ãäŸã§ãã
- ãµãã©ã€ãã§ãŒã³ãèæ ®ããïŒãµãŒãããŒãã£ã®ãã³ããŒããã³ãµãã©ã€ã€ãŒã®ã»ãã¥ãªãã£äœå¶ãè©äŸ¡ããŠããµãã©ã€ãã§ãŒã³ãªã¹ã¯ãæå°éã«æããŸãã
ã³ã³ãã©ã€ã¢ã³ã¹ããã³èŠå¶äžã®èæ ®äºé
å€ãã®çµç¹ã¯ãè匱æ§è©äŸ¡ããã³ã»ãã¥ãªãã£ç£æ»ã矩åä»ããç¹å®ã®èŠå¶ããã³æ¥çæšæºã«æºæ ããå¿ èŠããããŸããäŸãšããŠã¯ã次ã®ãã®ãæããããŸãã
- GDPRïŒäžè¬ããŒã¿ä¿è·èŠåïŒïŒEUåžæ°ã®å人ããŒã¿ãåŠçããçµç¹ã«ããã®ããŒã¿ãä¿è·ããããã®é©åãªã»ãã¥ãªãã£å¯Ÿçãå®è£ ããããšãèŠæ±ããŠããŸãã
- HIPAAïŒå»çä¿éºã®æºè¡æ§ãšèª¬æè²¬ä»»æ³ïŒïŒå»ççµç¹ã«ãæ£è ã®å¥åº·æ å ±ã®ãã©ã€ãã·ãŒãšã»ãã¥ãªãã£ãä¿è·ããããšãèŠæ±ããŠããŸãã
- PCI DSSïŒPayment Card Industry Data Security StandardïŒïŒã¯ã¬ãžããã«ãŒã決æžãåŠçããçµç¹ã«ãã«ãŒãäŒå¡ããŒã¿ãä¿è·ããããšãèŠæ±ããŠããŸãã
- SOXïŒSarbanes-Oxley ActïŒïŒå ¬éãããŠããäŒæ¥ã«ã財åå ±åã«é¢ãã广çãªå éšçµ±å¶ãç¶æããããšãèŠæ±ããŠããŸãã
- ISO 27001ïŒæ å ±ã»ãã¥ãªãã£ç®¡çã·ã¹ãã ã®åœéæšæºã§ãããçµç¹ãã»ãã¥ãªãã£äœå¶ã確ç«ãå®è£ ãç¶æãããã³ç¶ç¶çã«æ¹åããããã®ãã¬ãŒã ã¯ãŒã¯ãæäŸããŸãã
ãããã®èŠå¶ã«æºæ ããªããšãé倧ãªçœ°éãããã«ãã£ãããã³è©å€ãžã®æå®³ã«ã€ãªããå¯èœæ§ããããŸãã
è匱æ§è©äŸ¡ããã³ã»ãã¥ãªãã£ç£æ»ã®æªæ¥
è åšã®ç¶æ³ã¯åžžã«é²åããŠãããè匱æ§è©äŸ¡ããã³ã»ãã¥ãªãã£ç£æ»ã¯ãããŒã¹ãç¶æããããã«é©å¿ããå¿ èŠããããŸãããããã®ãã©ã¯ãã£ã¹ã圢æããããã€ãã®äž»èŠãªãã¬ã³ãã¯æ¬¡ã®ãšããã§ãã
- èªååã®å¢å ïŒè匱æ§ã¹ãã£ã³ãåæãããã³ä¿®æ£ãèªååããããã®äººå·¥ç¥èœïŒAIïŒããã³æ©æ¢°åŠç¿ïŒMLïŒã®äœ¿çšã
- ã¯ã©ãŠãã»ãã¥ãªãã£ïŒã¯ã©ãŠãã³ã³ãã¥ãŒãã£ã³ã°ã®æ¡çšã®å¢å ã¯ãã¯ã©ãŠãç°å¢åãã®ç¹æ®ãªè匱æ§è©äŸ¡ããã³ã»ãã¥ãªãã£ç£æ»ã®å¿ èŠæ§ãæšé²ããŠããŸãã
- DevSecOpsïŒãœãããŠã§ã¢éçºã©ã€ããµã€ã¯ã«ã«ã»ãã¥ãªãã£ãçµ±åããŠãããã»ã¹ã®æ©ã段éã§è匱æ§ãç¹å®ãã察åŠããŸãã
- è åšã€ã³ããªãžã§ã³ã¹ïŒè åšã€ã³ããªãžã§ã³ã¹ã掻çšããŠãæ°ããªè åšãç¹å®ããè匱æ§ä¿®æ£ã®åãçµã¿ãåªå é äœä»ãããŸãã
- ãŒããã©ã¹ãã¢ãŒããã¯ãã£ïŒ no user or device is inherently trustworthy and requires continuous authentication and authorization ãåæãšãããŒããã©ã¹ãã»ãã¥ãªãã£ã¢ãã«ã®å®è£ ã
çµè«
è匱æ§è©äŸ¡ããã³ã»ãã¥ãªãã£ç£æ»ã¯ãå ç¢ãªãµã€ããŒã»ãã¥ãªãã£æŠç¥ã®äžå¯æ¬ ãªã³ã³ããŒãã³ãã§ããè匱æ§ãç©æ¥µçã«ç¹å®ããŠå¯ŸåŠããããšã«ãããçµç¹ã¯ãªã¹ã¯ãšã¯ã¹ããŒãžã£ãŒãå€§å¹ ã«åæžãã貎éãªè³ç£ãä¿è·ã§ããŸãããã¹ããã©ã¯ãã£ã¹ã«åŸããæ°ããªãã¬ã³ãã«é ããã«ã€ããŠããããšã§ãçµç¹ã¯ãé²åããè åšã«çŽé¢ããŠããè匱æ§è©äŸ¡ããã³ã»ãã¥ãªãã£ç£æ»ããã°ã©ã ã广çã§ããç¶ããããšãä¿èšŒã§ããŸãã宿çã«ã¹ã±ãžã¥ãŒã«ãããè©äŸ¡ãšç£æ»ã¯ãç¹å®ãããåé¡ã®è¿ éãªä¿®æ£ãšãšãã«äžå¯æ¬ ã§ããçµç¹ã®æªæ¥ãä¿è·ããããã«ãç©æ¥µçãªã»ãã¥ãªãã£äœå¶ãæ¡çšããŠãã ããã
è匱æ§è©äŸ¡ããã³ã»ãã¥ãªãã£ç£æ»ããã°ã©ã ãç¹å®ã®ããŒãºããã³èŠä»¶ã«åãããŠèª¿æŽããããã«ãè³æ Œã®ãããµã€ããŒã»ãã¥ãªãã£å°éå®¶ã«çžè«ããããšãå¿ããªãã§ãã ããããã®æè³ã¯ãé·æçã«ã¯ããŒã¿ãè©å€ãããã³åçïŒããã ã©ã€ã³ïŒãä¿è·ããŸãã