International Conference on ASEAN-JAPANCybersecurity Community（IC-AJCC）2023

Developing Cybersecurity Human Resource

2023/10/6
Professional University of Information and Management for Innovation(i-University)
Professor Toshihiro HirayamaiU情報経営イノベーション専門職大学
教授 平山 敏弘
1
All Rights Reserved. Professional University of Information and Management for Innovation

Professor Toshihiro Hirayama

Professional University of Information and Management for Innovation(i-University)
NPO Japan Network Security Association(JNSA)Director,Education Comittee【Profile】
Have been experiencing a lot of tasks of system design and build for large-scale
distributed systems with a central focus on UNIX since joining an IT company. Worked
Web systems and commercial Internet systems, and then moved to the security field.
and worked as a security principal director in a consulting company. Currently, professorof professional university.
Also, engage in activities regarding business-academia cooperation education and humanresource development through the work such as giving lectures about information
security, IT career path, etc. as a part-time lecturer in several universities and graduate
schools.

【Award】
In 2013, I received the Information Security Leadership
Achievement (ISLA) Asian Award from (ISC)² for his contributions
to the development of security in the Asia Pacific region.

2
All Rights Reserved. Professional University of Information and Management for Innovation

Substance of this speech
In the after-covid-19, further digitalization will be driven by the promotion of remote
work and the increase in online meetings without traveling to work. On the other
hand, the promotion of digitalization will also make users with low security skills
more vulnerable to targeted attacks. Therefore, we are entering an era in which
security skills will be widely demanded, not only by security experts, but also byusers with low security skills.
In this talk, I will introduce the nurturing of "Plus Security Human Resources" using
SecBoK(Security Body of Knowledge), a Body of Knowledge of Security thatoriginated in Japan.

I hope you will know the words "SecBoK" and “Plus security humanresources" in this speech.

3
All Rights Reserved. Professional University of Information and Management for Innovation

1. Is there really ashortage of Security
Human Resources?

4
All Rights Reserved. Professional University of Information and Management for Innovation

The current shortage of "Security Human
Resources" in JapanIs there really a shortage of
Security Human Resources inJapan?

5
All Rights Reserved. Professional University of Information and Management for Innovation

What kind of human resources do we really need?
Pay attention to these numbers.

Source: http://www.meti.go.jp/press/2016/06/20160610002/20160610002.html
All Rights Reserved. Professional University of Information and Management for Innovation

6

Mapping the number of security humanresources shortages

In terms of numbers, it is imperative to address the "plus security
human resources" shortage••••

Directors
Audit & Board Member
Accounting Auditor
Shareholders

The areas where the national
government has not yet taken
action and the human resource
shortage layer match perfectly.
In the future, the government isgoing to begin to consider
strengthening this area as a policy.

CEO、COO、CFO等

CISO、CIO
About
11,000peopleDepartment head
About
1,500
peopleAbout
20,000peopleAbout 160,000 people

Business divisions(sales, manufacturing, development, etc.)
All Rights Reserved. Professional University of Information and Management for Innovation

Administrative divisions(General Affairs, Human
Resources, Legal, etc.)

Skill Level 3-4
Able to lead the identification
and resolution of businessissues using specialized skills
Level

Skill Level 1-2
Level of ability to perform someof the tasks independently under
the guidance of higher-level
personnel
Possesses the necessary basic
knowledge and skills

IT providers, IT subsidiaries,
security providers

7

Japan is not alone in its lack of
security human resources

8
All Rights Reserved. Professional University of Information and Management for Innovation

2. Why is security humanresources development
so important in Japan?

9
All Rights Reserved. Professional University of Information and Management for Innovation

From "defensive IT investment" to“Proactive IT investment"
Regular system
update cycle

Quick response to markets
and customers
Use of new technologies,
products, and services

Converting un-IT businessprocesses to IT

defensive
IT investment

Business Model
Transformation
Strengthen productand service
development・businessstreamlining
・Cost Reduction

Due to expansion ofcompany sizeDue to legal
regulations

proactive
IT investment

Strengthen analysis ofcustomer behavior
and markets
To expand business andproduct line

Because sales are
increasing

Because profits
are increasing

出典：JEITA『2017 年 国内企業の「IT経営」に関する調査結果 https://www.jeita.or.jp/japanese/exhibit/2018/0116.pdf
All Rights Reserved. Professional University of Information and Management for Innovation

10

Market Capitalization Ranking (1989 vs 2018:Heisei era)
Company Name
1

NTT

2

marketcapitalization(B$)

country

Company Namemarketcapitalization(B$)

country

1,638.6

Japan

1

Apple

9,409.5USA

The Industrial Bank of Japan

715.9

Japan

2

Amazon8,800.6

USA

3

Sumitomo Bank

695.9

Japan

3

Alphabet (Google)

8,336.6

USA

4

Fuji Bank

670.8

Japan

4

Microsoft

8,158.4

USA

5

The Dai-Ichi Kangyo Bank

660.9

Japan

5

Facebook

6,092.5

USA

6

IBM

646.5

USA

6

Berkshire Hathaway

4,925.0

USA7

Mitsubishi Bank

592.7

Japan

7

Alibaba

4,795.8China

8Exxon Mobil

549.2

USA

8

Tencent

4,557.3

China

9

Tokyo Electric Power Company

544.6

Japan

9

JPMorgan Chase

3,740.0

USA

10

Royal Dutch Shell

543.6

UK

10

Exxon Mobil

3,446.5

USA

11

Toyota

541.7

Japan

11

Johnson & Johnson

12

GE

493.6

USA

12

Visa

13

Sanwa Bank

492.9

Japan

13

Bank of America

14

Nomura Securities

444.4

Japan

14

Royal Dutch Shell

2,899.7

USA

15

NIPPON Steel

414.8

Japan

15

Industrial and Commercial Bank of China

2,870.7

China

16

AT&T

381.2

USA

16

Samsung

2,842.8

Korea

17

Hitachi

358.2

Japan

17

Wells Fargo

2,735.4

USA

18

Matsushita Electric Industrial

357.0

Japan

18

Walmart

2,598.5

USA

19

Philip Morris

321.4

USA

19

China Construction Bank

2,502.8

China

20

Toshiba

309.1

Japan

20

Nestlé

2,455.2

Swiss

出典：2018年8月20日のダイヤモンドオンライン「昭和という「レガシー」を引きずった平成30年間の経済停滞を振り返る」
All Rights Reserved. Professional University of Information and Management for Innovation

3,375.5 USA
出典：3,143.8 USA
2018年8月20日のダイヤモンドオンライン「昭和という「レガシー」を引きずった平成30年
間の経済停滞を振り返る」 3,016.8 USA

1111

As a result, the difference in market capitalization
has finally reached this level
GAFA's total stock market capitalization has
exceeded that of all Japanese companies.
According to an August 26, 2021 article in the Nihon Keizai
Shimbun, the combined stock market capitalization of GAFA
reached $7.05 trillion (about ¥770 trillion), exceeding the$6.86 trillion (about ¥750 trillion) for all Japanese companies.
Among GAFAs, Apple has the highest stock market
capitalization, with a market capitalization of approximately$2.45 trillion (approximately 267 trillion yen), according toMarket Watch. Apple became the first company in history toreach $2 trillion in stock market capitalization since the U.S.
stock market opened in August 2020.
12

12
All Rights Reserved. Professional University of Information and Management for Innovation

The 2022 IMD World Competitiveness Ranking

13
All Rights Reserved. Professional University of Information and Management for Innovation

Japan's International Competitiveness in Crisis

In the 2022 edition of the Global Competitiveness
Yearbook produced by the IMD (International
Institute for Management Development), Japan isranked 34th in the competitiveness ranking,down three more places from the previous year,
and has remained in the low 30s for four
consecutive years, a critical situation.

14
All Rights Reserved. Professional University of Information and Management for Innovation

The 2022 IMD World Talent Ranking

・
・
・

15
All Rights Reserved. Professional University of Information and Management for Innovation

The causes of the lower international competitivenessare "human resources" and "digital"

In particular, in the human resources ranking, the country is in 41st
place, falling for the fourth consecutive year since 2019, dropping twoplaces from the previous year and stagnating at the bottom of the list
among the countries surveyed in recent years.
It also ranks 29th in the Digital Competitiveness Ranking, a drop of
one place from 2021
and the lowest ranking ever since the 2017 survey.
・・・
From these results,
it is clear that the development of "digital" +"human resources" is an urgent necessity in order to increaseinternational competitiveness.

16
All Rights Reserved. Professional University of Information and Management for Innovation

Security Human Resource Development Essential
for Improving International Competitiveness
The IMD report also points out that cybersecurity measures are a top priority
for strengthening digital competitiveness, as follows.

World Digital Competitiveness Ranking
https://www.imd.org/centers/wcc/world-competitiveness-center/rankings/world-digital-competitiveness-ranking/In digitally competitive economies, cybersecurity measures are top priority
for public and private sector, the 2022 IMD World Digital CompetitivenessRanking also found.
Governments and the private sector need to shield their digital infrastructurefrom cyber attacks if they want to continue in the race for digitallycompetitive economies. This was a major finding in the 2022 edition of the
IMD World Digital Competitiveness Ranking, published today by IMD’s World
Competitiveness Center (WCC).
It is clear that "human resources" + "digital" + "security" are necessary
to increase international competitiveness, and that it is impossible to achieve
this without "security human resource development”.

Security human resource development is a measure
directly related to improving international competitiveness
All Rights Reserved. Professional University of Information and Management for Innovation17

Is it clear now foryou why “the plus
security humanresource is lack" issaid in Japan?
Data shown by METI* includes prediction and expectation as “it should be”,
although it’s true that there’s a lack of security human resources.
↓
In other words, when "security human resoueces development" is further
strengthened to increase the competitiveness of "human resources" +"digital" + "security," there will be a significant shortage of "plus security
personnel" in the business sector.
↓
The lack of security human resources in US is just at this stage.
*METI: Ministry of Economy, Trade and Industry, JapanAll Rights Reserved. Professional University of Information and Management for Innovation18

3. What is the new term
“plus security humanresources”?

19
All Rights Reserved. Professional University of Information and Management for Innovation

Security Human Resource Development
Policy and Plus Security in Japan
What does the government
think about security humanresource development?
What does "plus security
human resources" have to dowith today's theme?

20
All Rights Reserved. Professional University of Information and Management for Innovation

Cyber Security Strategy 2021
"Plus security" is one of the issues to be considered in JapanThe NISC (National center of Incident readiness and Strategy for Cybersecurity) will
launch a new "Next Cyber Security Strategy" in FY2021. One of the cross-sectional
measures in the strategy is "securing, developing and promoting human resources",
which is taken up as an environment for supplementing "plus security knowledge".

https://www.nisc.go.jp/conference/cs/jinzai/dai13/pdf/13shiryou0103.pdf

1. Establish a new development, monitoring and response system to ensure cybersecurity.
Consideration of measures to establish and disseminate a new development system andmonitoring and response system for rapid and flexible businesses, products, and services
that incorporate security.
２．Promote an environment and human resource development that can
supplement the "plus security" knowledge required for DX*.
Consideration of measures to promote an environment and human resource developmentin which those responsible for management and business related to DX can supplement
their "plus security" knowledge.
３．Promote liquidity and matching opportunities for cyber security personnel topromote their activities
Consideration of ways to broaden opportunities for security human resources, make career
paths more attractive, and promote liquidity and matching opportunities.

*DX: Digital Transformation

All Rights Reserved. Professional University of Information and Management for Innovation

21

4. Overview ofSecurity Body of Knowledge(SecBoK)22
All Rights Reserved. Professional University of Information and Management for Innovation

Development of Information Security Engineers
1) Requested from IPA(Information-technology Promotion
Agency, Japan), the Information Security Skill Map
was created in 2004 and 2005 (revision).
http://www.ipa.go.jp/security/fy15/reports/skillmap/documents/skillmap_2003.pdf
http://www.ipa.go.jp/security/fy16/reports/skillmap/documents/skillmap_2004.pdf

2) Renamed from JNSA(NPO Japan Network Security
Association), SecBoK opened to public as an
entrusted business from Ministry of Economy, Tradeand Industry.
The knowledge described in the Guidebook for Instructors ofInformation Security Education (2007 Edition) is SecBoK (p. 40 p. 67).
http://www.jnsa.org/result/2007/edu/materials/071111/tebiki2007.pdf
23
All Rights Reserved. Professional University of Information and Management for Innovation

What is SecBoK ?

NIST SP800-181 Coordination

Over 1,000 skills in NIST SP800-181 were coordinated with 16 roles in SecBoK .
(Category changes, itemization of the basics, general descriptions, etc.,
and other work was done independently to facilitate use in Japan.)
SecBoK2021(English version):https://www.jnsa.org/en/reports/secbok.html＜Level of knowledge and skills＞
M Medium (more than 3 years of experience or related exercises / training
participants can cope)00 Basis78

00 Basis

5K0061

Almost same Term as
Old NICE

92

00 Basis

6

K0108

Similar Term exists in
Old NICE

261

00 Basis

7

K0109

Similar Term exists in
Old NICE

264

00 Basis8

K0113

Almost same Term as
Old NICE

278

00 Basis

Skills9K0114

Almost same Term as
Old NICE

281

00 Basis

10

K0138

Similar Term exists in
Old NICE

903

00 BasisK0395

Almost same Term as
Old NICE

1122

00 Basis2
Computer/Communication Engineering
2Computer/Communication Engineering
2Computer/Communication Engineering
2Computer/Communication Engineering

2Computer/Communication Engineering
2Computer/Communication Engineering
2Computer/Communication Engineering

12

K0491

New Term－

00 Basis

13

K0516

New Term－

00 Basis

14

K0555

New Term－

00 Basis

15

K0556

New Term－

00 Basis16

K0015 Same term as Old NICE

21

00 Basis2
Computer/Communication Engineering
2Computer/Communication Engineering
2Computer/Communication Engineering
3 Software

17

K0016

Similar Term exists in
Old NICE

23

00 Basis

3 Software

All Rights Reserved. Professional University of Information and Management for Innovation

IT system division

52

K0055 Same term as Old NICE

IT planning divisionK0036 Same term as Old NICE

4

Legal advisor

3

Investigator

00 Basis

KSA (knowledge, Skill, Ability) Description

Knowledge of mathematics (e.g. logarithms, trigonometry, linear algebra,
Lcalculus, statistics, and operational analysis).

Forensic engineer

4200 Basis

Subcategory

Researcher

K0030

75

Category
1 Mathematical andPhysical Informatics
2
Computer/Communication Engineering
2Computer/Communication
Engineering
2Computer/Communication Engineering
2Computer/Communication Engineering

Curator2

Similar Term exists in
Old NICE

Field

Commander,Triage

K0052

1

Old NICE ID

leveling this time)

Le
ve
l

POC

Old / New
Similar Term exists in
Old NICE

advanced training or "prominent personnel" can cope)

P Pending (related to information gathering and intelligence. It is not a subject to

CISO

KSA
-ID

H High (10 or more years of experience or experienced professional who assumed

Notification

3
Reference skills (Not required for job performance but desirable knowledge / skills)※Relationship between"Prerequisite skills" and "Required skills"
If you secure human resources with prerequisite skills and provide education and training on required skills to the person, he/shewill be able to take the job..

Information security auditor

Required skills (Knowledge / skills required to carry out job performance)

Vulnerability diagnostic
consultant

L Low（less than 3 years experience）

2

Self assessment,Solution
analystPrerequisite skills (Knowledge / skills to be possessed as a premise for job performance)

Incident manager,Incident
handler1

Education / Awareness raising

Required knowledge and skills for each role

Roles

3

Knowledge of electrical engineering as applied to computer architectureL(e.g., circuit boards, processors, chips, and computer hardware).

L Knowledge of human-computer interaction principles.

1

1

L Knowledge of microprocessors.
Knowledge of how traffic flows across the network (e.g., Transmission
Control Protocol [TCP] and Internet Protocol [IP], Open System
Interconnection Model [OSI], Information Technology Infrastructure
Library, current version [ITIL]).
Knowledge of concepts, terminology, and operations of a wide range of
L communications media (computer and telephone networks, satellite, fiber,
wireless).
Knowledge of physical computer components and architectures, including
L the functions of various components and peripherals (e.g., CPUs,
Network Interface Cards, data storage).

L

L

Knowledge of different types of network communication (e.g., LAN, WAN,
MAN, WLAN, WWAN).

2

1

1

1

1

1

1

3

2

1

1

1

1

1

1

1

1

1
1

Knowledge of electronic devices (e.g., computer systems/components,
access control devices, digital cameras, digital scanners, electronic
L organizers, hard drives, memory cards, modems, network components,
networked appliances, networked home control devices, printers,
removable storage devices, telephones, copiers, facsimile machines, etc.).

L Knowledge of Wi-Fi.

1

3

1

1

L Knowledge of computer networking fundamentals (i.e., basic computercomponents of a network, types of networks, etc.).

1
1

1

1

1

1

1

1

L Knowledge of TCP/IP networking protocols.

1

L Knowledge of telecommunications fundamentals.

1

1
1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

L Knowledge of computer algorithms.

1

1

1

1

1

L Knowledge of computer programming principles

1

1

1

1

1

Knowledge of networking and Internet communications fundamentals (i.e.
L devices, device configuration, hardware, software, applications,ports/protocols, addressing, network architecture and infrastructure,routing, operating systems, etc.).
Knowledge of physical and logical network devices and infrastructure toinclude hubs, switches, routers, firewalls, etc.

L

1

24

Linkage of each role in CSIRT with SecBoK

Task Chart of Information Security Engineers by Nippon CSIRT Association (NCA)

In incident response

Management,
external organization
Investigator

POC
Responding
vendorIn-house system,
related system

General status
explanation

Statusexplanation

Investigation request Incident informationacquisition

Investigation into
in-house crime

Commander

Forensics

Notification
Incident information conveyance,
request for a measure

Solution analyst
Statusexplanation

Status explanation

Status explanation

Prioritization

Incident management
TriageStatus explanation

Self assessment

Status explanation
Investigation request

Incident handler
Request fora measure

GAP
explanation

Researcher, curator
Cooperation

Responding vendor(concreate response)
All Rights Reserved. Professional University of Information and Management for Innovation

Responding
vendor(MSS, intelligence)25

Features of SecBoK 2021
Work role

CISO
1 (Chief Information
Security Officer)

Work Role Description（Main roles in user
company）

NIST SP800-181 Coordination 2
Work Role Name of NICE Definition

1
Manages internal information security. From a security perspective,
confront the CIO (Chief Information Security Officer) and the CFO(Chief Financial Officer) as needed.

27

Authorizing Official / Designating
Representative
Executive Cyber Leadership

31 IT Investment / Portfolio Manager

2

POC(Point of Contact)

3 Notification

4 Commander

4 Triage
5 Incident manager
5 Incident handler
6 Curator

7 Researcher

8 Self assessment

8 Solution analyst

9

Vulnerability diagnostic
consultant

Be a contact point for external organizations such as JPCERT /CC(*1), NISC(*2), police, line ministry, NCA(*3), other CSIRTs, etc.
Be a contact point as an IT department coordinator for internal
sections such as legal section, external affairs, IT department,
public relations and other business divisions, and share information
among them.
Coordinate the organization and disseminate information to relevant
departments in the company. Coordinate with the IT department
when it affects internal systems.
Perform overall control of security incidents that occur in yourorganization. Share information with CISO and managements whencritical incidents. happended In addition, support CISO andmanagements for their decision making.
Determine priorities in response to events.
Give instructions to the incident handler to monitor the response
status of the incident. Manage the response history and report thesituation to the commander.
Handle the incident. If the process is outsourced to a security
vendor, issue an instruction to cooperate and manage. Report thestatus to the incident manager.
Analyze the information collected by the researcher and selectwhether the information should be applied to the organization. Often
used as a security operation center (SOC) in conjunction withresearchers.
Collects security events, threat information, vulnerability
information, profile information on attackers, information oninternational affairs/trends, media information, etc. and provides thecollected inforarmation to the Curator. It is collected only and notanalyzed.
Formulate a security strategy in line with the business plan of yourorganization. Perform risk assessment based on Fit & Gap of thecurrent situation and Tobe image, develop a solution map andpromote adoption. Confirm the effectiveness of the introduced
solution and reflect it in the improvement plan.
Perform risk assessment in normal times. When responding toincidents, respond to vulnerability analysis, impact investigation, etc.
Check whether the network, OS, middleware, and applications arecoded in a secure programming manner, and evaluate the diagnostic
results.

No respondending role

No respondending role

27 Executive Cyber Leadership

Executes decision-making authorities and establishes vision anddirection for an organization's cyber and cyber-related resources
and/or operations.

27 Executive Cyber Leadership

Executes decision-making authorities and establishes vision anddirection for an organization's cyber and cyber-related resources
and/or operations.

35 Cyber Defense Incident Responder

Investigates, analyzes, and responds to cyber incidents in yournetwork environment or enclave.

35 Cyber Defense Incident Responder

Investigates, analyzes, and responds to cyber incidents in yournetwork environment or enclave.

37 Threat/Warning Analyst

Develops cyber indicators to maintain awareness of the status of thehighly dynamic operating environment. Collects, processes, analyzes,
and disseminates cyber threat/warning assessments.

33 Cyber Defense Analyst

Uses data collected from a variety of cyber defense tools (e.g., IDS
alerts, firewalls, network traffic logs) to analyze events that occur
within their environments for the purposes of mitigating threats.

18 Systems Security Analyst

Responsible for the analysis and development of the integration,
testing, operations, and maintenance of systems security

18 Systems Security Analyst

Responsible for the analysis and development of the integration,
testing, operations, and maintenance of systems security

36 Vulnerability Assessment Analyst
21 Cyber Instructional Curriculum Developer

10

Education / Awarenessraising

Conduct education and enlightenment activities to improve and toraise bottom of IT literacy in your organization.

22 Cyber Instructor
25 Cyber Workforce Developer and Manager

11 Forensic engineer

12 Investigator
13 Legal advisor
14 IT planning division

Perform systematic investigation, precision inspection, analysis andreporting. Since a malicious person may try to eradicate evidence, it
is also required to restore the eradicated data and track thefootprint, along with the preservation of evidence.
Investigate external crimes and internal crimes. Security incidents
differ from system failures in that malicious persons exist. As withordinary criminal investigations, it is required to logically narrow
down the investigation target while clarifying the motives, securing
the evidence, and presuming the next event to occur.
Advise on the system regarding what should be observed fromcompliance and legal point of view
Make plans for internal IT use. Conduct research and analysis of IT
usage as needed.

51

Law Enforcement/Counterintelligence
Forensics Analyst

52 Cyber Defense Forensics Analyst

15 IT system division

Information security
16
auditor

In order to effectively carry out information security risk
management, verify or evaluate the status of preparation andoperation of appropriate control measures based on risk assessment
according to the standards, and then provide assurance or advice.

Performs assessments of systems and networks within the network
environment or enclave and identifies where those systems/networks
deviate from acceptable configurations, enclave policy, or local policy.
Measures effectiveness of defense-in-depth architecture against
known vulnerabilities
Develops, plans, coordinates, and evaluates cyber training/education
courses, methods, and techniques based on instructional needs.
Develops and conducts training or education of personnel within cyberdomain.
Develops cyberspace workforce plans, strategies, and guidance tosupport cyberspace workforce manpower, personnel, training andeducation requirements and to address changes to cyberspace policy,
doctrine, materiel, force structure, and education and training
requirements.
Conducts detailed investigations on computer-based crimes
establishing documentary or physical evidence, to include digital media
and logs associated with cyber intrusion incidents.
Analyzes digital evidence and investigates computer security incidents
to derive useful information in support of system/network
vulnerability mitigation.

50 Cyber Crime Investigator

Identifies, collects, examines, and preserves evidence using controlled
and documented analytical and investigative techniques.

19 Cyber Legal Advisor

Provides legal advice and recommendations on relevant topics related
to cyber law.
Develops and maintains cybersecurity plans, strategy, and policy tosupport and align with organizational cybersecurity initiatives andregulatory compliance.

26 Cyber Policy and Strategy Planner
29 IT Project Manager

Directly manages information technology projects.

16 Network Operation Specialist

24

Communications Security (COMSEC)Manager

Plans, implements, and operates network services/systems, to include
hardware and virtual environments.
Responsible for setting up and maintaining a system or specificcomponents of a system (e.g. for example, installing, configuring, andupdating hardware and software; establishing and managing user
accounts; overseeing or conducting backup and recovery tasks;
implementing operational and technical security controls; and adhering
to organizational security policies and procedures).
Responsible for the cybersecurity of a program, organization, system,or enclave.
Individual who manages the Communications Security (COMSEC)
resources of an organization (CNSSI 4009) or key custodian for a
Crypto Key Management System (CKMS).

34

Cyber Defense Infrastructure Support
Specialist

Tests, implements, deploys, maintains, and administers theinfrastructure hardware and software.

17 System Administrator
Promote internal IT projects, as well as design, development,
operation and maintenance of application systems.

Work roles definition in NICE
Senior official or executive with the authority to formally assume
responsibility for operating an information system at an acceptablelevel of risk to organizational operations (including mission, functions,image, or reputation), organizational assets, individuals, otherorganizations, and the Nation.
Executes decision-making authorities and establishes vision anddirection for an organization's cyber and cyber-related resources
and/or operations.
Manages a portfolio of IT investments that align with the overall needsof mission and enterprise priorities.

23 Information Systems Security Manager

32 IT Program Auditor

All Rights Reserved. Professional University of Information and Management for Innovation

Conducts evaluations of an IT program or its individual components todetermine compliance with published standards.

Among the 52
roles in NIST
SP800-181,
associated roles
were picked out
and coordinatedwith the 16 roles
in SecBoK 2021.

26

5. Skills required for plus
security human resources-Utilizing SecBoK-

27
All Rights Reserved. Professional University of Information and Management for Innovation

Examples of SecBoK's use in developing plus security
human resources.
A unique feature of SecBoK is that it incorporates security literacy and security basics
skill items.
These skill items are necessary for "Plus security human resources".

Basic Skill Items
All Rights Reserved. Professional University of Information and Management for Innovation

28

Case Example of Educational Application (Information Technology University)
Computer Science Curriculum Standard (J17)The Computing Curriculum Standard J07 is a compilation of the computer science (CS), information system (IS),computer engineering (CE), software engineering (SE), information technology (IT) and general information
processing education (GE) domains. The curriculum standard follows a review of the status of specialized
information technology education in Japan. After it was reviewed in 2017, J17 was published.

The Security Body ofKnowledge (SecBoK) Human
Resource Skill Map serves as areference for the skills requiredof human resources. To
organize the knowledge items
required for the curriculum
model, each specialization levelin a range covering a
specialized information
education item in the SecBoK
Human Resource Skill Map
was organized as a reference
for creating a cybersecurity
curriculum.
29
All Rights Reserved. Professional University of Information and Management for Innovation

Case Example of Coordination With Qualifications
CompTIA Security-related Qualifications and SecBoK Skills
CompTIA is a vendor-neutral IT certification organization mapping the skills necessary for each qualification to
SecBoK skills. This makes it possible to visualize, for example, which security roles a qualification holder would
be highly suitable for. The mapping is useful not only for personal development plans but also for creating
departmental and organizational structures, developing departments as a whole, and more.
Individual qualifications
セキュリティ知識分野（SecBoK）人材スキルマップ2019年版 全体整理表※特定非営利 活動法 人日本ネッ ト ワークセキュリティ協 会 教育部会 情報セキュ リティ知識項目（ Se c B o K） 改訂 委員会作成 Se c B o K2 0 1 9 参考2114 SSL

04ネットセキュ
0総論
リティ

M ネットワーク通信のセキュア化に関するスキル

●

2600

●

2101 ファイアウォール 〇985

04ネットセキュ
0総論
リティ

M

ネットワーク保護コンポーネントの設定と利用（例：
ファイアウォール、VPN、ネットワークIDS）に関するスキル

87

04ネットセキュ1トラフィック解析
リティ

L ネットワークトラフィック解析手法に関する知識

旧NICEと同
一

93

04ネットセキュ1トラフィック解析
リティ

L パケットレベル解析に関する知識

163 K0143

旧NICEに類似項あり

915

04ネットセキュ1トラフィック解析
リティ

L

トラフィックの収集、フィルタリング及び選択を含むフロントエンドの収集シス●
テムに関する知識

164 K0301

新規－

04ネットセキュ1トラフィック解析
リティ

M

適切なツール（例：Wireshark、tcpdump）を使用したパケットレベル分析に関する知識

●

2202

214

04ネットセキュ1トラフィック解析
リティ

適切なツールを用いたパケットレベル解析の実施（例： Wireshark,M
tcpdump）に関するスキル

04ネットセキュ1トラフィック解析
リティ
04ネットセキュ2侵入検知
リティ

M 無線LANメタデータの調査、収集、分析に関するスキル

158 A0164

新規－

159 A0165

新規－

160 A0166

新規－

161 K0058

旧NICEと同
一

162 K0062

165★

ネットワーク脆
弱性

★

3200

■

■

1103 ツール

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

2

2

2

1

1

1

2

2

2

1

2

1

プロトコルアウェ
ア技術

2★

2308 VPN

2
複雑なネットワ2104 ークセキュリティ
ソリューション
極端な設定/
1305 最悪ケースの設定
上級ネットワー
2103
ク設計

0.5

0.5

トンネリング/V
PN

通信セキュリティ（COMSEC）の環境と階層における独自の側面を認識する能力
通信セキュリティ（COMSEC）の用語、ガイドライン及び手順を解釈する能力任命された通信セキュリティ（COMSEC）要員の役割と責任を特定する能M
力通信セキュリティ（COMSEC）に関する機器のアカウント、管理策及び使M用手順を管理する能力
通信セキュリティ（COMSEC）インシデントの種類とそれらがどのように報告Mされるかを識別する能力M－

セキュアプロトコ
〇
ル実装

2102

1

ウェブ用アプリケ
2406 ーション・ファイ
アウォール

検証と品質管理サービスとプロト
3502
■
コル設定

2102 VPN

04ネットセキュ
0総論
リティ
04ネットセキュ
0総論
リティ
04ネットセキュ
0総論
リティ
04ネットセキュ
0総論
リティ
04ネットセキュ
0総論
リティ

－

■

★

4303 多層防御
インシデントの3102 重大度と優先 ★
順位付
4106

893

3203

旧NICEと同
S0046
一〇2115 SSL復号装置

205

新規

■

手順/一般的
1101
なタスク

Information security auditor

アプリケーションファイアウォールの概念と機能に関する知識（例：単一認 ●証ポイント/監査/ポリシー実施、悪意のあるコンテンツのメッセージスキャン、PCIおよびPII準拠のデータ匿名化、データ損失保護スキャン、暗号化処理の高速化、SSLセキュリティ、REST / JSON処理）

セキュアプロトコ
2600
〇
ル実装

新規

★

IT system department

トポロジー、プロトコル、構成要素及び原理を含むネットワークセキュリティ ●アーキテクチャのコンセプト（例：深層防御のアプリケーション）に関する知識確立されたネットワークセキュリティプラクティスの実践、保守及び改良に関
M
●
するスキル

157 A0163

1302 ハニーポット

2106 暗号手法
レイヤードセキュ
3103
〇
リティ

04ネットセキュ
0総論
リティ

156 A0177■

IT planning department

旧NICEとほぼ同一ネットワーク脆
弱性

2107
1105

Investigator

155 S0084

3200

★
★

Legal adviser

旧NICEと同
一M

2101 ファイアウォール 〇4501 予防的観点
1302 ハニーポット

Forensic engineer

154 S0077

153

04ネットセキュ
0総論
リティ

M

●

セキュリティゾー
ン
脱境界化の影響
脱境界化の影1105
響ネットワーク・ア
2108 クセスコントロール
複雑なネットワ2104 ークセキュリティ
ソリューション

■■Education/Enlightenment

旧NICEと同
S0040
一－04ネットセキュ0総論
リティ

2106 暗号手法

Vulnerability examiner

新規

1072

ゾーン/トポロジ〇ーResearcher

152 K0202

旧NICEに類
似項あり

－

3201

2101 ファイアウォール 〇Self assessment/
Solution analyst

151 K0179

新規

ネットワークセキュリティの基礎に関する知識（例：暗号化、ファイアウォール
L、認証、ハニーポット、境界防御など）●

ネットワークセキュリティに関する知識（例：暗号化、ファイアウォール、認証●、ハニーポット、境界防衛）

Curator150 K0561

04ネットセキュ
0総論
リティ

L

Incident manager/
Incident handler－

L 非武装地帯（DMZ）に関する知識

Notification

新規

Minor Item

04ネットセキュ
0総論
リティ
04ネットセキュ
0総論
リティ

Commander/Triage

149 K0487

の対象外）

POC

－

Middle Item

CISO

新規

Major ItemCASP

148 K0326

Field

CySA+

New/Old Old ID

高（経験10年以上または高度な研修受講を前提とする専門実務経験者
または「突出した人材」なら対応可能）

P ペンディング（情報収集・インテリジェンスに関するもの。今回はレベル付け

Level

KSA
-ID

H

Pentest+※「前提スキル」と「必須スキル」の関係
前提スキルを有する人材を確保し、必須スキルに関する教育・トレーニング
を行うと、当該職務を担うことができる人材となる＜知識・スキルのレベル＞
L 低（概ね経験３年未満でも対応可能）
M 中（経験３年以上または関連する演習・トレーニング受講者なら対応可能）

Security+＜ロール毎の必須知識・スキル＞
1
前提スキル（職務遂行の前提として有しておくべき知識・スキル）
2
必須スキル（職務遂行の実施に際して必要となる知識・スキル）0.5 参考スキル（職務遂行に際して必須ではないが、あると望ましい知識・スキル）

M

●

●

ネットワークスキ〇ャナワイヤレススキャ
2203
ナー
プロトコルアナラ
2201
〇
イザー
2202

■

2103 パケットの作成 ■2104 パケットの検査

166 S0276

新規－

167 K0046

旧NICEに類似項あり

66

168 K0324

旧NICEに類似項あり

59

04ネットセキュ
2侵入検知
リティ

L IDS/IPSツールとアプリケーションに関する知識

169 K0191 旧NICEに類 1119
似項あり

04ネットセキュ
2侵入検知
リティ

M

L

〇

■

ネットワークスキ〇
ャナ

2104 パケットの検査 ■4502 収集的観点★

●

ネットワークスキ
2202
〇
ャナ

■

4502 収集的観点

★

●

2203

■

1102 環境の変化★

ワイヤレススキャ〇ナー

2107 盗聴〇

2302 判断

侵入検知手法とホスト及びネットワークベースの侵入を検出するための技術に関する知識ウイルス、マルウェア及び攻撃に対するシグネチャ実装の影響に関する知識

ネットワーク現★
状調査
ネットワークに3401
関連する兆候ポイントインタイ
1202★
ムデータ分析
ネットワークに3401
関連する兆候

1200●

2103 HIPS/HIDS〇●

3401 サンドボックス

〇

3505

3201

3201

ネットワークツー
ルの種類

ネットワークツー
ルの種類

2

2

2

2

1

1

2

2

2

2

1

1

2

0.5

0.5

2

2

0.5

0.5

0.5

0.5

0.5

0.5

★

★
セキュアプログラ★
ミング
1103 ツール■

4400

サンドボックスエ
■
スケープ

3100

4501 予防的観点
インシデントの影響★

インシデント対
3305 応サポートツー
ル
インシデント対
3305 応サポートツー
ル
ネットワークツー3201
ルの種類
2203 ホストの強化
2106

ソフトウェア定義ネットワーク

2403

アプリケーションのサンドボックス

2

0.5

2

2

2

2

0.5

2

2

2

2

0.5

2

2

0.5

1

1

1

1

1

1

1

2

2

1

1

1

1

1

1

0.5

0.5

0.5

2

0.5

0.5

0.5

0.5

0.5

0.5

2

0.5

0.5

2

2

0.5

2

2

2

2

Range of questions for each qualification, and prerequisite skills
All Rights Reserved. Professional University of Information and Management for Innovation

0.5

30

Next stage of required security humanresource
1. Would a lack of security human resources change?
Required human resources are changing

2. Is security not a matter of the non-security department?
Security is essential for the companies survive in the tide of DX
3. What kind of security human resources are required for businessdepartments as system users?
Not for defense, “proactive security” to make benefits has
emerged. Make user/business departments be aware of security too.
4. Critical “proactive plus security human resources” for the future ofcompanies in Japan
There is no way to go without “DX” for Japanese companies tosurvive in the future. For the success of DX, develop “proactive plus
security human resources” that is severely deficient.
SecBoK is unique in that it can be used not only for traditional"security professional" development, but also for "plus security
human resources" development, and can be used by many people!
All Rights Reserved. Professional University of Information and Management for Innovation

31Professional University ofInformation and Management for Innovation(i-University)
32
All Rights Reserved. Professional University of Information and Management for Innovation