
ããŒããã©ã¹ããã¬ãŒã ã¯ãŒã¯ãæè¡ããçè§£ããããã¢ãŒããã¯ãã£ãå®è£ ãéçšâçæAIå¿çšãŸã§
ã¯ããã«
çŸä»£ã®ãµã€ããŒã»ãã¥ãªãã£ç°å¢ã«ãããŠãåŸæ¥ã®ãåãšå ãã¢ãã«ã¯æ¢ã«éçãè¿ããŠããããªã¢ãŒãã¯ãŒã¯ã®æ®åãã¯ã©ãŠããã¡ãŒã¹ãã®å éããããŠå·§åŠåãããµã€ããŒæ»æã«ããããããã¯ãŒã¯å¢çã«ããé²åŸ¡ã¯æ ¹æ¬çãªèŠçŽããè¿«ãããŠãããããããèæ¯ããæ³šç®ãããŠããã®ãããŒããã©ã¹ããã¬ãŒã ã¯ãŒã¯ãã»ãã¥ãªãã£ã¢ãŒããã¯ãã£ã ã
ãŒããã©ã¹ãïŒZero TrustïŒã¯ã決ããŠä¿¡é Œãããåžžã«æ€èšŒããååãšããã»ãã¥ãªãã£èšèšææ³ã§ããããã®äžæ žãšãªãã®ã¯ãããªã·ãŒé§åã®ã¢ã¯ã»ã¹å¶åŸ¡ãšç¶ç¶çè©äŸ¡ããããŠãã€ã¯ãã»ã°ã¡ã³ããŒã·ã§ã³ã ãæ¬èšäºã§ã¯ãNIST SP 800-207ã«ããæšæºã¢ãŒããã¯ãã£ãCISAã®æç床ã¢ãã«ã瀺ãç§»è¡ããŒãããããGoogle BeyondCorpã®å€§èŠæš¡å®è£ äºäŸãæè¡ç芳ç¹ãã詳説ããããã«çæAIæä»£ã®æ°ããªå¿çšå¯èœæ§ãŸã§æ¢ãã
1. ãŒããã©ã¹ããã¬ãŒã ã¯ãŒã¯ã®å®çŸ©ãšæè¡çèæ¯
1.1 æè¡çå®çŸ©
ãŒããã©ã¹ããã¬ãŒã ã¯ãŒã¯ã¯ããããã¯ãŒã¯äœçœ®ãçµç¹å å€ãšãã£ã屿§ã«ããæé»ã®ä¿¡é ŒãæãããªãœãŒã¹ããšã«ã¢ã€ãã³ãã£ãã£ã»ããã€ã¹ã»ã³ã³ããã¹ããè©äŸ¡ããŠã¢ã¯ã»ã¹ã決å®ããäžé£ã®ã»ãã¥ãªãã£ãã©ãã€ã ã§ããããŒããã©ã¹ãã¢ãŒããã¯ãã£ïŒZTAïŒã¯ããã®ååã«åºã¥ããŠäŒæ¥ã€ã³ãã©ãšã¯ãŒã¯ãããŒãèšèšãããã¬ãŒã ã¯ãŒã¯ãæäŸããã
åŸæ¥ã®ããªã¡ãŒã¿ã»ãã¥ãªãã£ãšã®æ ¹æ¬çãªéãã¯ãä¿¡é Œã®ä»äžæ¹æ³ã«ãããåŸæ¥ã¢ãã«ã§ã¯ã瀟å ãããã¯ãŒã¯ïŒä¿¡é Œã§ããããšããåæã®ããšãäžåºŠèªèšŒããããŠãŒã¶ãŒã«ã¯åºç¯ãªã¢ã¯ã»ã¹æš©éãä»äžãããŠããã察ããŠãŒããã©ã¹ãã§ã¯ããã¹ãŠã®ã¢ã¯ã»ã¹èŠæ±ãåå¥ã«è©äŸ¡ããæå°æš©éã®ååã«åºã¥ããŠåçã«ã¢ã¯ã»ã¹å¶åŸ¡ãè¡ãã
1.2 æŽå²ççºå±
ãŒããã©ã¹ãã®æŠå¿µã¯2010幎ã«Forrester Research瀟ã®John Kindervagæ°ã«ãã£ãŠåããŠäœç³»åãããããã®åŸãGoogleã瀟å ã·ã¹ãã ã§å®è£ ããBeyondCorpãããžã§ã¯ããå®çšæ§ã蚌æãã2020幎ã«NISTïŒç±³åœåœç«æšæºæè¡ç ç©¶æïŒãSP 800-207ãšããŠæšæºåããããšã§ç£æ¥çã»æ¿åºæ©é¢ãžã®æ¬æ Œçãªæ®åãå§ãŸã£ãã
ç¹ã«ç±³åœã§ã¯ã2021幎ã®å€§çµ±é 什14028å·ãåœå®¶ã®ãµã€ããŒã»ãã¥ãªãã£ã®æ¹åãã«ãããé£éŠæ¿åºæ©é¢ã«ããããŒããã©ã¹ãã¢ãŒããã¯ãã£ã®æ¡çšã矩ååãããæè¡æšæºãšããŠã®å°äœã確ç«ããŠããã
2. äžæ žæè¡ã³ã³ã»ãã
2.1 ã·ã°ãã«ããŒã¹ã®ç¶ç¶çè©äŸ¡
ãŒããã©ã¹ãã¢ãŒããã¯ãã£ã®æãéèŠãªæè¡çç¹åŸŽã¯ãã¢ã¯ã»ã¹å€å®ã«ãããŠè€æ°ã®ã·ã°ãã«ãåçã«çµã¿åãããŠãªã¹ã¯è©äŸ¡ãè¡ãããšã§ãããäž»èŠãªè©äŸ¡è»žã¯ä»¥äžã®éãã ã
ã¢ã€ãã³ãã£ãã£ã·ã°ãã«ã§ã¯ã人éã®ãŠãŒã¶ãŒã ãã§ãªãããµãŒãã¹ã¢ã«ãŠã³ããAPIããã€ã¯ããµãŒãã¹ééä¿¡ãªã©ããã¹ãŠã®ããžã¿ã«ã¢ã€ãã³ãã£ãã£ã察象ãšãããå€èŠçŽ èªèšŒïŒMFAïŒã®åŒ·åºŠãèªèšŒãããã³ã«ïŒSAMLãOpenID ConnectçïŒãã¢ã€ãã³ãã£ãã£ãããã€ããŒã®ä¿¡é Œã¬ãã«ãè©äŸ¡ãããã
ããã€ã¹ã·ã°ãã«ã§ã¯ããšã³ããã€ã³ãã®ã»ãã¥ãªãã£å§¿å¢ãç¶ç¶çã«ç£èŠãããOS ãããã¬ãã«ããã«ãŠã§ã¢å¯Ÿçãœããã®ç¶æ ãããã€ã¹æå·åããžã§ã€ã«ãã¬ã€ã¯ã»ã«ãŒãåã®æ€åºãã¢ãã€ã«ããã€ã¹ç®¡çïŒMDMïŒã³ã³ãã©ã€ã¢ã³ã¹çãå«ãŸããã
ãããã¯ãŒã¯ã»ç°å¢ã·ã°ãã«ã§ã¯ãã¢ã¯ã»ã¹å ã®å°ççäœçœ®ãæé垯ãéåžžã®è¡åãã¿ãŒã³ããã®éžè±ããããã¯ãŒã¯ç°åžžæ€ç¥ãVPN䜿çšç¶æ³çãåæãããæ©æ¢°åŠç¿ã«ããè¡åè§£æïŒUEBA: User and Entity Behavior AnalyticsïŒãããã§éèŠãªåœ¹å²ãæããã
ã¢ããªã±ãŒã·ã§ã³ã»ã¯ãŒã¯ããŒãã·ã°ãã«ã§ã¯ãã³ã³ããã€ã¡ãŒãžã®ã»ãã¥ãªãã£ã¹ãã£ã³çµæããœãããŠã§ã¢éšå衚ïŒSBOMïŒãã©ã³ã¿ã€ã ã»ãã¥ãªãã£ç£èŠãAPI䜿çšãã¿ãŒã³çãè©äŸ¡å¯Ÿè±¡ãšãªãã
ããŒã¿ã·ã°ãã«ã§ã¯ãããŒã¿åé¡ã¬ãã«ãæå·åç¶æ³ãããŒã¿æåšå°ãã¢ã¯ã»ã¹å±¥æŽçã«åºã¥ããŠä¿è·èŠä»¶ã決å®ããã
CISAã®ãã¬ãŒã ã¯ãŒã¯ã§ã¯ããããã«å ããŠå¯èŠåã»åææ©èœãšèªååã»ãªãŒã±ã¹ãã¬ãŒã·ã§ã³æ©èœã暪æçãªèŠçŽ ãšããŠäœçœ®ã¥ããŠããã
2.2 ãã€ã¯ãã»ã°ã¡ã³ããŒã·ã§ã³æè¡
ãã€ã¯ãã»ã°ã¡ã³ããŒã·ã§ã³ã¯ããããã¯ãŒã¯ããã现ããåäœã«åå²ããåã»ã°ã¡ã³ãéã®ãã©ãã£ãã¯ãå¶åŸ¡ããæè¡ã§ãããåŸæ¥ã®VLANããŒã¹ã®ã»ã°ã¡ã³ããŒã·ã§ã³ãšã¯ç°ãªãããœãããŠã§ã¢å®çŸ©ãããã¯ãŒã¯ïŒSDNïŒãã³ã³ãããããã¯ãŒã¯ããµãŒãã¹ã¡ãã·ã¥çã®æè¡ã掻çšããŠã¢ããªã±ãŒã·ã§ã³ã¬ãã«ã§ã®å¶åŸ¡ãå®çŸããã
æè¡çãªå®è£ æ¹åŒãšããŠããã¹ãããŒã¹ãã¡ã€ã¢ãŠã©ãŒã«ããããã¯ãŒã¯ä»®æ³åãKubernetes NetworkPolicyãIstioãµãŒãã¹ã¡ãã·ã¥çãããããããã®æè¡ã«ãããL3ããL7ãŸã§å€å±€ã«ããã现ããªå¶åŸ¡ãå¯èœã«ãªãã
2.3 䟵害åæèšèšïŒAssume BreachïŒ
ãŒããã©ã¹ããã¬ãŒã ã¯ãŒã¯ã§ã¯äŸµå®³ã®çºçãåæãšããŠãæ€ç¥ã»å¯Ÿå¿ã»åŸ©æ§ã®ã¬ãžãªãšã³ã¹æ©èœãéèŠãããSIEMïŒSecurity Information and Event ManagementïŒãSOARïŒSecurity Orchestration, Automation and ResponseïŒãEDRïŒEndpoint Detection and ResponseïŒçã®ã»ãã¥ãªãã£éçšæè¡ãšã®çµ±åãäžå¯æ¬ ã§ããã
3. NISTæšæºã¢ãŒããã¯ãã£ã®æè¡è©³çް
3.1 å¶åŸ¡ãã¬ãŒã³ãšããŒã¿ãã¬ãŒã³ã®åé¢
NIST SP 800-207ã¯ããŒããã©ã¹ãã¢ãŒããã¯ãã£ã®æšæºã¢ãã«ãšããŠãå¶åŸ¡ãã¬ãŒã³ãšããŒã¿ãã¬ãŒã³ãæç¢ºã«åé¢ããèšèšãæå±ããŠããã
ããªã·ãŒãšã³ãžã³ïŒPolicy Engine: PEïŒã¯ããã¹ãŠã®ã¢ã¯ã»ã¹èŠæ±ã«å¯ŸããŠãªã¹ã¯è©äŸ¡ãšæææ±ºå®ãè¡ãäžå€®éæš©çãªã³ã³ããŒãã³ãã§ãããæ©æ¢°åŠç¿ã¢ã«ãŽãªãºã ãã«ãŒã«ãšã³ãžã³ããªã¹ã¯ã¹ã³ã¢ãªã³ã°æ©èœãå å ããè€æ°ã®ããŒã¿ãœãŒã¹ããã®æ å ±ãçµ±åããŠã¢ã¯ã»ã¹å€å®ãè¡ãã
ããªã·ãŒã¢ãããã¹ãã¬ãŒã¿ïŒPolicy Administrator: PAïŒã¯ãããªã·ãŒãšã³ãžã³ã®æ±ºå®ãå®éã®å¶åŸ¡èšå®ã«å€æããåããªã·ãŒå®è¡ç¹ã«é ä¿¡ãã圹å²ãæ ããRESTful APIãGraphQLãgRPCçã®éä¿¡ãããã³ã«ãçšããŠããªã¢ã«ã¿ã€ã ã§ããªã·ãŒæŽæ°ãè¡ãã
ããªã·ãŒå®è¡ç¹ïŒPolicy Enforcement Point: PEPïŒã¯ãå®éã®ãã©ãã£ãã¯ãã¹ã«é 眮ãããPA ããã®æç€ºã«åŸã£ãŠã¢ã¯ã»ã¹å¶åŸ¡ã宿œããããããã·ãµãŒããŒãAPIã²ãŒããŠã§ã€ããã¡ã€ã¢ãŠã©ãŒã«ãããŒããã©ã³ãµãŒçãPEPãšããŠæ©èœããã
3.2 ãããã€ã¡ã³ããã¿ãŒã³
NIST SP 800-207ã§ã¯ãçµç¹ã®æè¡ç°å¢ãšèŠä»¶ã«å¿ããè€æ°ã®ãããã€ã¡ã³ããã¿ãŒã³ãå®çŸ©ããŠããã
ããã€ã¹ãšãŒãžã§ã³ãåã§ã¯ãåãšã³ããã€ã³ãã«ãœãããŠã§ã¢ãšãŒãžã§ã³ããé 眮ããããã€ã¹ã¬ãã«ã§ã®ããªã·ãŒæœè¡ãè¡ããäŒæ¥æ¯çµŠããã€ã¹ã«é©ããŠããããBYODç°å¢ã§ã¯å®è£ ãå°é£ã§ããã
ãšã³ã¯ã¬ãŒãåã§ã¯ãéèŠãªãœãŒã¹ãå°çšã»ã°ã¡ã³ãã«é 眮ããã²ãŒããŠã§ã€ã§ã¢ã¯ã»ã¹å¶åŸ¡ãè¡ããã¬ã¬ã·ãŒã·ã¹ãã ã®æ®µéçç§»è¡ã«é©ããŠããã
ãªãœãŒã¹ããŒã¿ã«åã§ã¯ãWebã¢ããªã±ãŒã·ã§ã³åãã®ãªããŒã¹ãããã·ãã¯ã©ãŠãã¢ã¯ã»ã¹ã»ãã¥ãªãã£ãããŒã«ãŒïŒCASBïŒã掻çšãããSaaSã¢ããªã±ãŒã·ã§ã³ãžã®ã¢ã¯ã»ã¹å¶åŸ¡ã«ç¹ã«æå¹ã§ããã
ããã€ã¹èªèšŒæ å ±åã§ã¯ãããã€ã¹èšŒææžãããŒããŠã§ã¢ã»ãã¥ãªãã£ã¢ãžã¥ãŒã«ïŒHSMïŒã掻çšãã匷åºãªããã€ã¹èªèšŒãå®è£ ããã
3.3 ã¯ã©ãŠããã€ãã£ãæ¡åŒµ
NIST SP 800-207Aã¯ããã«ãã¯ã©ãŠãç°å¢ã«ããããŒããã©ã¹ãã¢ãŒããã¯ãã£ã®å®è£ æéãæäŸããŠãããKubernetesã¯ã©ã¹ã¿ãŒããµãŒãã¹ã¡ãã·ã¥ããµãŒããŒã¬ã¹é¢æ°çã®ã¯ã©ãŠããã€ãã£ãæè¡ã«ãããä¿¡é Œå¢çã®å®çŸ©ãšãã¯ãŒã¯ããŒãééä¿¡ã®ã»ãã¥ãªãã£ç¢ºä¿ãäž»èŠããŒããšãªã£ãŠããã
4. CISAæç床ã¢ãã«ãšå®è£ æŠç¥
4.1 æç床ãã¬ãŒã ã¯ãŒã¯
CISAïŒãµã€ããŒã»ãã¥ãªãã£ã»ã€ã³ãã©ã¹ãã©ã¯ãã£ã»ãã¥ãªãã£åºïŒã®Zero Trust Maturity Model v2.0ã¯ãçµç¹ã®ãŒããã©ã¹ãå°å ¥é²æã段éçã«è©äŸ¡ãããã¬ãŒã ã¯ãŒã¯ãæäŸããŠããã
æç床ã¯4段éã§å®çŸ©ããããTraditional段éã§ã¯åŸæ¥ã®ããªã¡ãŒã¿ã»ãã¥ãªãã£ã¢ãã«ãæ¡çšãInitial段éã§ã¯ãŒããã©ã¹ãååã®éšåçå®è£ ãå§ãŸããAdvanced段éã§ã¯å æ¬çãªããªã·ãŒé§åã¢ã¯ã»ã¹å¶åŸ¡ãšèªååãå®çŸããããOptimal段éã§ã¯å®å šèªååãããç¶ç¶çè©äŸ¡ãšé©å¿çã»ãã¥ãªãã£ã確ç«ãããã
4.2 å®è£ ã®5æ¬æ±
Identityæ±ã§ã¯ããã¹ãŠã®ãŠãŒã¶ãŒãšãµãŒãã¹ã®çµ±äžçãªã¢ã€ãã³ãã£ãã£ç®¡çã匷åãªèªèšŒæ¹åŒãæš©éã®ç¶ç¶çæ€èšŒãæ±ãããããæè¡çã«ã¯ãSecurity Assertion Markup LanguageïŒSAMLïŒãOpenID ConnectãOAuth 2.0çã®æšæºãããã³ã«ã®æŽ»çšãéèŠã§ããã
Devicesæ±ã§ã¯ãäŒæ¥æ¯çµŠããã€ã¹ãšBYODã®äž¡æ¹ã察象ãšããå æ¬çãªããã€ã¹ç®¡çããšã³ããã€ã³ãæ€ç¥ã»å¯Ÿå¿ïŒEDRïŒãã¢ãã€ã«ã¢ããªã±ãŒã·ã§ã³ç®¡çïŒMAMïŒã®å®è£ ãå¿ èŠãšãªãã
Networks/Environmentæ±ã§ã¯ããã€ã¯ãã»ã°ã¡ã³ããŒã·ã§ã³ãæå·åéä¿¡ããããã¯ãŒã¯ç£èŠã»åæã®é«åºŠåãäžå¿ãšãªãããœãããŠã§ã¢å®çŸ©å¢çïŒSDPïŒãZTNAïŒZero Trust Network AccessïŒçã®æè¡ã掻çšãããã
Applications/Workloadæ±ã§ã¯ãã¢ããªã±ãŒã·ã§ã³ã¬ãã«ã§ã®ã»ãã¥ãªãã£å¶åŸ¡ãAPIä¿è·ãã³ã³ããã»ãµãŒããŒã¬ã¹ã»ãã¥ãªãã£ãéèŠãªèŠçŽ ãšãªãã
Dataæ±ã§ã¯ãããŒã¿åé¡ãæå·åãããŒã¿æå€±é²æ¢ïŒDLPïŒãæš©å©ç®¡çïŒIRM/DRMïŒçã«ããããŒã¿äžå¿ã®ã»ãã¥ãªãã£ã¢ãããŒããæ±ããããã
4.3 æšªææ©èœ
Visibility & Analyticsã§ã¯ãã»ãã¥ãªãã£æ å ±ã»ã€ãã³ã管çïŒSIEMïŒããŠãŒã¶ãŒã»ãšã³ãã£ãã£è¡ååæïŒUEBAïŒãã»ãã¥ãªãã£ãªãŒã±ã¹ãã¬ãŒã·ã§ã³ã»èªååã»å¯Ÿå¿ïŒSOARïŒçã®æè¡ã«ãããå æ¬çãªå¯èŠæ§ãšåæèœåã確ä¿ããã
Automation & Orchestrationã§ã¯ãããªã·ãŒã®èªåé åžãã€ã³ã·ãã³ã察å¿ã®èªååãç¶ç¶çã³ã³ãã©ã€ã¢ã³ã¹ç£èŠçãå®çŸãããInfrastructure as CodeïŒIaCïŒãPolicy as CodeïŒPaCïŒã®å®è·µãéèŠã§ããã
5. Google BeyondCorpïŒå€§èŠæš¡å®è£ ã®ãªãã¡ã¬ã³ã¹
5.1 ã¢ãŒããã¯ãã£ã®ç¹åŸŽ
Google BeyondCorpã¯ãäŒæ¥å ç¹æš©ãããã¯ãŒã¯äžèŠããšããç念ã®ããšããã¹ãŠã®ã¢ã¯ã»ã¹ãã€ã³ã¿ãŒãããçµç±ã§è¡ã驿°çãªã¢ãããŒããæ¡çšããŠãããæè¡çãªæ žå¿ã¯ãã¢ã¯ã»ã¹ãããã·ã«ããäžå çãªããªã·ãŒæœè¡ãšãããã€ã¹ãã©ã¹ãæšè«ãšã³ãžã³ã«ããåçãªã¹ã¯è©äŸ¡ã«ããã
ã¢ã¯ã»ã¹ãããã·ã¯ããã¹ãŠã®äŒæ¥ãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹èŠæ±ã仲ä»ãããŠãŒã¶ãŒã¢ã€ãã³ãã£ãã£ãããã€ã¹ç¶æ ãã¢ã¯ã»ã¹ãã¿ãŒã³çãç·åçã«è©äŸ¡ããããããã·ã¯Google Front EndïŒGFEïŒã€ã³ãã©ã¹ãã©ã¯ãã£äžã§åäœããã°ããŒãã«ãªè² è·åæ£ãšDDoSæ»æå¯ŸçãæäŸããã
5.2 ããã€ã¹ãã©ã¹ãæšè«
BeyondCorpã®æè¡ç驿°ã®äžã€ã¯ãããã€ã¹ãã©ã¹ãæšè«ã·ã¹ãã ã§ãããäŒæ¥æ¯çµŠããã€ã¹ã«ã¯èšŒææžããŒã¹ã®åŒ·åºãªèªèšŒãé©çšããå人ããã€ã¹ã«ã¯è¡ååæãšãªã¹ã¯ããŒã¹èªèšŒãçµã¿åããããæ©æ¢°åŠç¿ã¢ã«ãŽãªãºã ã«ãããããã€ã¹ã®äœ¿çšãã¿ãŒã³ãã»ãã¥ãªãã£å§¿å¢ãå°ççäœçœ®çãåæããä¿¡é Œã¹ã³ã¢ãåçã«ç®åºããã
5.3 ç§»è¡æŠç¥ãšéçšç¥èŠ
Googleã®å€§èŠæš¡ç§»è¡ããåŸãããéèŠãªç¥èŠãšããŠã段éçç§»è¡ã®éèŠæ§ãæãããããäžåºŠã«ãã¹ãŠã®ã·ã¹ãã ãç§»è¡ããã®ã§ã¯ãªããã¯ãŒã¯ãããŒåäœã§ã®æ®µéçç§»è¡ãæ¡çšãããŠãŒã¶ãŒãšã¯ã¹ããªãšã³ã¹ã®æªåãæå°éã«æå¶ããã
ã¬ã¬ã·ãŒã·ã¹ãã ãšã®å ±åæéãé·æåããããšãæ³å®ããåŸæ¥ã®VPNã¢ã¯ã»ã¹ãšãŒããã©ã¹ãã¢ã¯ã»ã¹ã®ãã€ããªããéçšãèšèšãããããã«ãããæè¡çè² åµã段éçã«è§£æ¶ããªããç§»è¡ãé²ããããšãå¯èœãšãªã£ãã
6. èšèšã»éçšã®å®åãã€ã³ã
6.1 ããŒã¿äžå¿èšèš
ãŒããã©ã¹ãã¢ãŒããã¯ãã£ã®èšèšã«ãããŠãããŒã¿ä¿è·èŠä»¶ã®æç¢ºåãæåªå äºé ãšãªããããŒã¿åé¡ã¹ããŒã ãæå·åèŠä»¶ïŒä¿åæã»è»¢éæã»äœ¿çšæïŒãä¿ææéãå°åèŠä»¶çãå è¡ããŠå®çŸ©ãããããã®èŠä»¶ã«åºã¥ããŠã¢ã¯ã»ã¹å¶åŸ¡ããªã·ãŒãèšèšããã
æè¡çã«ã¯ãããŒã¿åé¡ã®èªååãæå·éµç®¡çã·ã¹ãã ïŒKMSïŒã®çµ±åãããŒã¿ããŒã¹æå·åãã¢ããªã±ãŒã·ã§ã³ã¬ãã«æå·åçã®å®è£ ãå¿ èŠãšãªãã
6.2 ã¢ã€ãã³ãã£ãã£ã©ã€ããµã€ã¯ã«ç®¡ç
人éãŠãŒã¶ãŒããµãŒãã¹ã¢ã«ãŠã³ãããã·ã³ã¢ã€ãã³ãã£ãã£ã®ã©ã€ããµã€ã¯ã«ãçµ±äžçã«ç®¡çããã·ã¹ãã ã®æ§ç¯ãéèŠã§ãããããããžã§ãã³ã°ã»ãããããžã§ãã³ã°ã®èªååã宿çãªã¢ã¯ã»ã¹æš©ã¬ãã¥ãŒãäŒç ã¢ã«ãŠã³ãã®èªåç¡å¹åçãå®è£ ããã
æè¡æšæºãšããŠã¯ãSystem for Cross-domain Identity ManagementïŒSCIMïŒãLightweight Directory Access ProtocolïŒLDAPïŒãActive Directoryãšã®çµ±åãäžè¬çã§ããã
6.3 æå°æš©éãšJust-In-Time Access
åŸæ¥ã®ãåžžææš©éä»äžãã¢ãã«ãããå¿ èŠæã®ã¿æš©éä»äžãã¢ãã«ãžã®è»¢æãå¿ èŠã§ãããPrivileged Access ManagementïŒPAMïŒãœãªã¥ãŒã·ã§ã³ãJust-In-TimeïŒJITïŒã¢ã¯ã»ã¹ãJust-Enough-AccessïŒJEAïŒçã®æè¡ã«ããã管çè æš©éã®ä¹±çšãªã¹ã¯ãæå°åããã
6.4 ç¶ç¶çè©äŸ¡ãšã¢ãããã£ãã»ãã¥ãªãã£
éçãªã»ãã¥ãªãã£ããªã·ãŒããåçã»é©å¿çãªããªã·ãŒãžã®ç§»è¡ãéèŠã§ãããæ©æ¢°åŠç¿ã«ããç°åžžæ€ç¥ããªã¹ã¯ã¹ã³ã¢ã«é£åããã¢ã¯ã»ã¹å¶åŸ¡ã®èª¿æŽãèªåçãªè¿œå èªèšŒèŠæ±çãå®è£ ããã
6.5 å¯èŠåãšãã¬ã¡ããª
ãŒããã©ã¹ãã¢ãŒããã¯ãã£ã®å¹æçãªéçšã«ã¯ãå æ¬çãªå¯èŠæ§ãäžå¯æ¬ ã§ãããã»ãã¥ãªãã£ãã°ã®äžå€®éçŽããªã¢ã«ã¿ã€ã ç£èŠãè¡ååæãè åšã€ã³ããªãžã§ã³ã¹ã®çµ±åçã«ãããã»ãã¥ãªãã£ç¶æ³ã®å šäœåãææ¡ããã
6.6 ã¬ã¬ã·ãŒã·ã¹ãã ãšOTç°å¢ãžã®å¯Ÿå¿
æ¢åã·ã¹ãã ãå¶åŸ¡ã·ã¹ãã ïŒOTïŒç°å¢ã§ã¯ãçŽæ¥çãªãŒããã©ã¹ãå®è£ ãå°é£ãªå Žåãããããããã·ããŒã¹ã®ã¢ã¯ã»ã¹å¶åŸ¡ãä»®æ³ã»ã°ã¡ã³ããŒã·ã§ã³ãã»ãã¥ã¢ãªãžã£ã³ããã¹ãçã«ãããæ®µéçã«ãŒããã©ã¹ãååãé©çšããã
6.7 éçšèªåå
Infrastructure as CodeïŒIaCïŒãPolicy as CodeïŒPaCïŒãConfiguration as CodeïŒCaCïŒçã®ææ³ã«ãããããªã·ãŒå€æŽã®å³åº§ãªåæ ãšèšå®ã®äžè²«æ§ã確ä¿ãããCI/CD ãã€ãã©ã€ã³ãžã®ã»ãã¥ãªãã£æ€æ»ã®çµ±åãèªååãããã³ã³ãã©ã€ã¢ã³ã¹ç£æ»çãéèŠãªèŠçŽ ã§ããã
7. ãŒããã©ã¹ãã»ããã³ããã¡ãœããïŒZTPMïŒâçæAIæä»£ãžã®å¿çš
7.1 çºæ³ã®è»¢æ
çæAIãæ®åããçŸä»£ã«ãããŠããŒããã©ã¹ãã®ååãããã³ãããšã³ãžãã¢ãªã³ã°ãšçæç©å質管çã«å¿çšããæ°ããªã¢ãããŒããæ³šç®ãããŠãããåŸæ¥ã®ã»ãã¥ãªãã£å¯Ÿè±¡ããããã¯ãŒã¯è³ç£ããããã³ãããšçæç©ã«æ¡åŒµãããã¢ãã«åºåãéµåã¿ã«ããªãããšããå§¿å¢ã§ç¶ç¶çãªå質æ€èšŒãè¡ãææ³ã§ããã
7.2 ZTPM ã¢ãŒããã¯ãã£ã¢ãã«
NIST ã®ãŒããã©ã¹ãã¢ãŒããã¯ãã£ãçæAIç°å¢ã«é©çšãããšã以äžã®ã³ã³ããŒãã³ãæ§æãšãªãã
Prompt Policy EngineïŒP-PEïŒã¯ãçæã¿ã¹ã¯ã«å¯Ÿããå質ã»å®å šæ§ã»ã³ã³ãã©ã€ã¢ã³ã¹èŠä»¶ãå®çŸ©ããäžå€®ç®¡çã·ã¹ãã ã§ãããæ ¹æ æç€ºã®å¿ é åãåºå žæ°ã®æå°èŠä»¶ãçŠæ¢çšèªã»è¡šçŸã®å®çŸ©ãåºå圢åŒã®æšæºåçã®ããªã·ãŒã管çããã
Prompt Policy AdministratorïŒP-PAïŒã¯ãP-PE ã§å®çŸ©ãããããªã·ãŒãåå¥ã®ã¿ã¹ã¯ããããžã§ã¯ãã«é åžããããã³ãããã³ãã¬ãŒãã«åæ ããã圹å²ãæ ãã
Prompt Enforcement PointïŒP-PEPïŒã¯ãå®éã®çæããã»ã¹ã«ãããŠããªã·ãŒã匷å¶é©çšããããåºå žã3ä»¶ä»¥äžæèšããããæ°å€ã«ã¯å¿ ãåäœãä»äžããããæ¥ä»ãæèšãããçã®å¶çŽãå®è¡æã«èª²ãã
7.3 ZTPM ã·ã°ãã«ãã¬ãŒã ã¯ãŒã¯
çæAIã«ããããä¿¡é Œã·ã°ãã«ããšããŠã以äžã®è©äŸ¡è»žãå®çŸ©ããã
Source Quality ã·ã°ãã«ã§ã¯ãåç §æ å ±ã®å質ãè©äŸ¡ãããäžæ¬¡è³æã®æ¯çãå ¬åŒãã¡ã€ã³ããã®æ å ±æ¯çãæ»èªæžã¿è«æã®å²åãçºè¡æ©é¢ã®æš©åšæ§çãæ°å€åããã
Temporal Freshness ã·ã°ãã«ã§ã¯ãæ å ±ã®æéçåŠ¥åœæ§ãè©äŸ¡ãããçºè¡æ¥ã®æç€ºãææ°çãžã®èšåãæç³»åã®æŽåæ§ãæŽæ°é »åºŠçã確èªããã
Consistency ã·ã°ãã«ã§ã¯ãçæå 容ã®å éšæŽåæ§ãæ€èšŒãããæ°å€ã®äžèŽãè«ççæŽåæ§ãçšèªã®çµ±äžæ§ã䞻匵ã®ççŸçãèªåæ€æ»ããã
Bias/Compliance ã·ã°ãã«ã§ã¯ãåèŠã»å·®å¥ã»æ©å¯æŒæŽ©ã»ã©ã€ã»ã³ã¹éåçã®ãªã¹ã¯ãæ€åºãããå ¬å¹³æ§ãã£ã«ã¿ãŒãæ©å¯æ å ±ã¹ãã£ããŒãèäœæš©ãã§ãã¯çãå®è£ ããã
Novelty vs. Safety ã·ã°ãã«ã§ã¯ãç¬åµæ§ãšäºå®æ£ç¢ºæ§ã®ãã©ã³ã¹ãè©äŸ¡ãããæ¢åæ å ±ã®åçŽãªèŠçŽã§ã¯ãªãæ°èŠæ§ãšãäºå®ã«åºã¥ããä¿¡é Œæ§ã®äž¡ç«ãå³ãã
7.4 ãã€ã¯ãã»ã°ã¡ã³ããŒã·ã§ã³åã¯ãŒã¯ãããŒ
ZTPMã§ã¯ãè€éãªçæã¿ã¹ã¯ãå°ããªå¢çã«åå²ããŠå質管çãè¡ãã
ãªãµãŒãå¢çã§ã¯æ
å ±åéãšåºå
žæœåºã«ç¹åããå€éšæ
å ±ãžã®äŸå床ãæå°åããã
èšèšå¢çã§ã¯èŠåºãæ§æãšè«ç¹èšèšã®ã¿ã«éäžããæ¬æçæãžã®åœ±é¿ãæé€ããã
çæå¢çã§ã¯æ¿èªãããèšèšã«åºã¥ãæ¬æçæã®ã¿ãå®è¡ããã
æ€èšŒå¢çã§ã¯äºå®ç¢ºèªã»åºå
žç
§åã»æ°åŒæ€ç®ã«å°å¿µããã
ã³ã³ãã©ã€ã¢ã³ã¹å¢çã§ã¯èäœæš©ã»ç§å¿æ§ã»å人æ
å ±ä¿è·ã®èгç¹ããæçµãã§ãã¯ãè¡ãã
çµ±åå¢çã§ã¯äœè£èª¿æŽã»èŠçŽäœæã»ã¡ã¿ããŒã¿ä»äžã宿œããã
7.5 æå°æš©éã¢ã¯ã»ã¹å¶åŸ¡
åå¢çã«ãããŠãçæã¢ãã«ã«æž¡ãã³ã³ããã¹ãæ å ±ãæå°éã«å¶éãããæ©å¯æ å ±ãç¡é¢ä¿ãªããŒã¿ãããã³ããã«å«ãããã¿ã¹ã¯å®äºåŸã¯ã³ã³ããã¹ãã®ç Žæ£ãååãšãããããã«ãããæå³ããªãæ å ±æŒæŽ©ãçæå質ã®å£åãé²ãã
7.6 ç¶ç¶çæ€èšŒããã»ã¹
ãAssume HallucinationïŒå¹»èŠåæïŒãã®ååã®ããšãéèŠãªäž»åŒµã«ã€ããŠã¯è€æ°ã¢ãã«ã«ããã¯ãã¹ãã§ãã¯ãå¥ããã³ããã§ã®åçæãšçªåãå°éå®¶ã¬ãã¥ãŒã宿œãããæ°å€æ
å ±ã«ã€ããŠã¯æ¡ã»åäœã¬ãã«ã§ã®æ©æ¢°çãã§ãã¯ãåºå
žã«ã€ããŠã¯æ£åŒåç§°ã»çºè¡å¹Žã»URL/DOI ã®å®å
šæ§ç¢ºèªãå¿
é ãšããã
8. ZTPMå®è£ ãã³ãã¬ãŒã
8.1 æ å ±åéçšãã³ãã¬ãŒã
{ããŒã}ã«é¢ããææ°äžæ¬¡è³æã5ä»¶ä»¥äžæœåºããã
åè³æã«ã€ããŠä»¥äžãå¿
é èšèŒïŒ
- æ£åŒã¿ã€ãã«
- çºè¡å¹Žæ
- çºè¡äž»äœ
- èŠæšïŒ1è¡ïŒ
- ä¿¡é Œæ§ã®æ ¹æ
çºè¡æ¥ã®æ°ããé ã«é
åããäžæäºé
ã¯æšæž¬ããã«æèšããã8.2 èšèšãã§ãŒãºçšãã³ãã¬ãŒã
æ³å®èªè
ãå·çç®çãå¿
é ã»ã¯ã·ã§ã³ãæç¢ºåããèŠåºãã¬ãã«ïŒH2/H3ïŒã®æ§ææ¡ã®ã¿ãè¿ãã
æ¬æå·çã¯çŠæ¢ã
æ§æã®éè€ã»æ¬ èœããªããèªå·±ãã§ãã¯ãªã¹ããæ·»ä»ããã8.3 çæãã§ãŒãºçšãã³ãã¬ãŒã
æ¿èªæžã¿æ§ææ¡ã«åºã¥ããåH2ã»ã¯ã·ã§ã³ã300-500èªã§å·çããã
å¶çŽäºé
- åºå
žçªå·ãç¯æ«ã«[1][2]圢åŒã§ä»®ä»ã
- æ°å€ã«ã¯å¿
ãåäœãæèš
- æ¯å©ã»ææ
衚çŸã¯æå°é
- 䞻芳ç衚çŸãé¿ã客芳çèšè¿°ã培åºã8.4 æ€èšŒãã§ãŒãºçšãã³ãã¬ãŒã
å·çæžã¿æ¬æã®äž»èŠäž»åŒµäžäœ10é
ç®ãæœåºãã
åã
ã«ã€ããŠïŒ
- åºå
žãšã®æŽåæ§ç¢ºèª
- ççŸã»æ ¹æ äžè¶³ç®æã®ç¹å®
- ä¿®æ£æ¡ã®å
·äœçæç€º
æ€èšŒçµæãæ§é åããŠå ±åããã8.5 ã³ã³ãã©ã€ã¢ã³ã¹ç¢ºèªçšãã³ãã¬ãŒã
宿åçš¿ã以äžã®èгç¹ã§æçµç¢ºèªïŒ
- èäœæš©äŸµå®³ãªã¹ã¯ïŒé·æåŒçšãç»å䜿çšçïŒ
- å人æ
å ±æŒæŽ©ãªã¹ã¯ïŒå®åãé£çµ¡å
çïŒ
- æ©å¯æ
å ±æŒæŽ©ãªã¹ã¯ïŒå
éšæ
å ±ãæ©å¯ããŒã¿çïŒ
åãªã¹ã¯é
ç®ã«ã€ããŠå
·äœç察å¿çïŒç·šé/åé€/èšãæãïŒãææ¡ããã9. ZTPM éçšææšãšç£æ»
广çãªZTPMéçšã®ããã«ã¯ãå®éçãªåè³ªææšã®èšå®ãšç¶ç¶çãªç£æ»ãäžå¯æ¬ ã§ããã
æ ¹æ ä»äžçã§ã¯ãéèŠãªäºå®ç䞻匵ã®ãã¡é©åãªåºå žãæã€å²åãæž¬å®ãããç®æšå€ã¯90%以äžãšããåéãå 容ã®éèŠåºŠã«å¿ããŠèª¿æŽããã
ã¯ãã¹ãã§ãã¯ééçã§ã¯ãè€æ°ã¢ãã«ã§ã®åçæã»åæ€èšŒã«ãããäžäžèŽçã®æ¹åã远跡ãããç¶ç¶çãªå質åäžã®ææšãšããŠæŽ»çšããã
ä¿®æ£ã«ãŒãåæ°ã§ã¯ãåå¢çã«ããããªã¯ãŒã¯çºçåæ°ãèšé²ããããã»ã¹æ¹åã®ææšãšããã
å ¬éåŸèšæ£çã§ã¯ãææç©å ¬éåŸã®äºå®èª€èªã«ããèšæ£ä»¶æ°ã远跡ããäºåå質管çã®æå¹æ§ãè©äŸ¡ããã
æ©å¯äºæ ä»¶æ°ã§ã¯ãå¢çèšèšã®æ©èœäžå šã«ããæ å ±æŒæŽ©äºæ ããŒãç®æšã§ç®¡çããã
10. é¿ããã¹ãã¢ã³ããã¿ãŒã³
ZTPMã®å¹æçãªå®è£ ã®ããã以äžã®ã¢ã³ããã¿ãŒã³ãåé¿ããå¿ èŠãããã
äžçºã§ã®é·æçæåŸã«äºåŸçãªæŽåäœæ¥ãè¡ãã¢ãããŒãã¯ãå¢çãªã巚倧暩éã«çžåœããå質ãªã¹ã¯ãé«ããåºå žãè£ é£Ÿçã«ä»å ããã ãã§äžæ¬¡è³æã®å®è³ªçæ€èšŒãçç¥ããããšã¯ã圢åŒçã³ã³ãã©ã€ã¢ã³ã¹ã«éããªãã
è€æ°ã¢ãã«ã§ã®æ€èšŒãåçæãé¢åãã£ãŠåäžåçãç²ä¿¡ããããšã¯ãç¶ç¶çæ€èšŒã®ååã«åãããããã³ããã«äžèŠãªæ©å¯æ å ±ãç¡é¢ä¿ããŒã¿ãè©°ã蟌ãããšã¯ãæå°æš©éã®ååã«éåããã»ãã¥ãªãã£ãªã¹ã¯ãå¢å€§ãããã
ãŸãšã
ãŒããã©ã¹ããã¬ãŒã ã¯ãŒã¯ã¯ãåŸæ¥ã®å¢çé²åŸ¡ããè±åŽãããã¹ãŠã®ã¢ã¯ã»ã¹ãç¶ç¶çã«æ€èšŒãã驿°çãªã»ãã¥ãªãã£ãã©ãã€ã ã§ãããNISTã®æšæºã¢ãŒããã¯ãã£ãçè«çåºç€ãæäŸããCISAã®æç床ã¢ãã«ãå®è£ ããŒããããã瀺ããGoogle BeyondCorpãå€§èŠæš¡é©çšã®å®èšŒäŸãæäŸããŠããã
æè¡çãªæ žå¿ã¯ãããªã·ãŒé§åã®ã¢ã¯ã»ã¹å¶åŸ¡ãå€å±€çãªã·ã°ãã«è©äŸ¡ããã€ã¯ãã»ã°ã¡ã³ããŒã·ã§ã³ãç¶ç¶çæ€èšŒã«ããããããã®ååã¯ãã»ãã¥ãªãã£åéãè¶ ããŠçæAIå質管çã«ãå¿çšå¯èœã§ããããŒããã©ã¹ãã»ããã³ããã¡ãœããïŒZTPMïŒãšããŠæ°ããªå質ä¿èšŒææ³ã確ç«ã§ããã
åŸæ¥ã®ã»ãã¥ãªãã£ããä¿¡é ŒããŠæ€èšŒãã§ãã£ããšããã°ããŒããã©ã¹ãã¯ãæ€èšŒããŠä¿¡é Œããžã®è»¢æã§ããããããŠçæAIæä»£ã«ãããŠã¯ãçæããŠæ€èšŒããããæ€èšŒããŠçæããžã®é²åãæ±ããããã
æ¬èšäºã§ç޹ä»ãããã³ãã¬ãŒããšãã¹ããã©ã¯ãã£ã¹ã掻çšããããšã§ãçµç¹ã¯å³åº§ã«ZTPMã®å®è£ ãéå§ããçæAIã®å質ãšå®å šæ§ãå€§å¹ ã«åäžãããããšãã§ããã ãŒããã©ã¹ããšZTPMã®å ±éç¹ã¯ãåå²çµ±æ²»ã«ããå¶åŸ¡å¯èœæ§ã®åäžãç¶ç¶çè©äŸ¡ã«ããé©å¿æ§ã®ç¢ºä¿ããããŠæå°æš©éã«ãã圱é¿ç¯å²ã®éå®ã«ããããããã®ååãäžè²«ããŠé©çšããããšã§ãåŸæ¥ã®ãäºåŸå¯Ÿå¿åããããäºé²çµ±å¶åããžã®æ ¹æ¬çãªãã©ãã€ã ã·ãããå®çŸãããã
ããžã¿ã«å€é©ãå éããçŸä»£ã«ãããŠããŒããã©ã¹ããšZTPMã¯åãªãæè¡çéžæè¢ã§ã¯ãªããçµç¹ã®ç«¶äºåãšä¿¡é Œæ§ãæ¯ããæŠç¥çå¿ é èŠä»¶ãšãªã£ãŠããã仿¥ããã§ã段éçãªå®è£ ãéå§ããç¶ç¶çæ¹åãéããŠæç床ãé«ããŠããããšãéèŠã§ããã
åèè³æ
äž»èŠæè¡æšæºÂ
NIST SP 800-207 "Zero Trust Architecture" (2020):Â https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf
NIST SP 800-207A "A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments" (2023):Â https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207A.pdf:Â https://csrc.nist.gov/pubs/sp/800/207/a/final
CISA Zero Trust Maturity Model v2.0 (2023):https://www.cisa.gov/sites/default/files/2023-04/CISA_Zero_Trust_Maturity_Model_Version_2_508c.pdf
å®è£ ãªãã¡ã¬ã³ã¹
Google BeyondCorp: A New Approach to Enterprise Security (2014-2019):https://research.google/pubs/beyondcorp-a-new-approach-to-enterprise-security/Â :https://research.google.com/pubs/archive/44860.pdf
DoD Zero Trust Reference Architecture v2.0 (2023) :https://dodcio.defense.gov/Portals/0/Documents/Library/(U)ZT_RA_v2.0(U)_Sep22.pdf
Forrester Zero Trust eXtended (ZTX) Framework (2021):https://www.cisco.com/c/dam/m/en_sg/solutions/security/pdfs/forrester-ztx.pdf
é¢é£æè¡ä»æ§
OAuth 2.0 / OpenID Connect (IETF RFC 6749, OpenID Foundation):https://datatracker.ietf.org/doc/html/rfc6749Â /Â https://openid.net/specs/openid-connect-core-1_0.html
SAML 2.0 (OASIS Standard) - SCIM 2.0 (IETF RFC 7642-7644):https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf:Â https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.pdf
XACML 3.0 (OASIS Standard):Â https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html
- #çæAI
- #ãªã¹ã¯ç®¡ç
- #ãµã€ããŒã»ãã¥ãªãã£
- #ããã³ãããšã³ãžãã¢ãªã³ã°
- #æ å ±ã»ãã¥ãªãã£
- #ã³ã³ãã©ã€ã¢ã³ã¹
- #AIã»ãã¥ãªãã£
- #ã¯ã©ãŠãã»ãã¥ãªãã£
- #ãã«ã·ããŒã·ã§ã³å¯Ÿç
- #CISA
- #NIST
- #ãããã¯ãŒã¯ã»ãã¥ãªãã£
- #ã¢ã¯ã»ã¹å¶åŸ¡
- #DevSecOps
- #ZeroTrust
- #ã»ãã¥ãªãã£éçš
- #äŒæ¥ã»ãã¥ãªãã£
- #ãã€ã¯ãã»ã°ã¡ã³ããŒã·ã§ã³
- #AIå質管ç
- #ã¢ã€ãã³ãã£ãã£ç®¡ç
- #ã»ãã¥ãªãã£ã¢ãŒããã¯ãã£
- #BeyondCorp
- #ç¶ç¶çè©äŸ¡
- #ããªã·ãŒé§å
- #ZTPM