2020 and Beyond– JCIC年次会合 –横浜信一

NTTグループCISO
2020年1月27日
Copyright©2020 NTT corp. All Rights Reserved.

本日お伝えしたいこと• 海外では、サイバーセキュリティが地政学や地経学と密に関連するようになり、結果として企業間、業種間、国・地域間の協力や協調が停滞しているように見受けられます。
• こうした中、日本に対しては、サイバーセキュリティでの協力、さらには広くデジタル経済発展での牽引役などが期待されるようになっており、追い風が吹いていると思われます。
• しかし、日本の実情、とりわけ産業界の実態は海外に十分伝わっていません。間違った認識が協力・協調の妨げとならないよう、等身大の姿を自信を持って正しく発信していくことが大切です。
• 提案：“Myths & Reality – Five Things You Need to Know about
Cybersecurity of Japanese Industry”を作るなどにより、より多くの人が最新情報を高頻度で発信していってはどうでしょうか。
– 現場の責任者クラスが国際的な場で発信、議論– 社長クラスが国際舞台でグローバルリーダーと渡り合う機会への助言
Copyright©2020 NTT corp. All Rights Reserved.

1

目 次• グローバルなダイナミズムと日本への期待• “Myths & Reality” (draft)

Copyright©2020 NTT corp. All Rights Reserved.

2

サイバーセキュリティは、地政学や地経学の重要要素となりつつあります
ポリティクスエコノミクス

米 国• 政権方針に不確実性が高く、実務リーダーが「待ち」の姿勢• 個別省庁が進められる範囲でバラバラに施策

プラットフォーマー主導への懐疑心• データオーナーシップ• セキュリティ方針へのインテグリティ不信

ドイツ• 政権交代が近い中、国家安全保障の象徴化• 結果として政争の材料に国家主導型モデルへの嫌悪感・警戒心• 監視社会• 自由でオープンでないインターネット

EU• ブラッセル主導型と各国主権重視の狭間に国 連• GGE再開、OEWG開始も、実りある形で進むか不透明Copyright©2020 NTT corp. All Rights Reserved.

3日本への期待はグローバルに高まりつつあります
ポリティクスエコノミクス• リベラルデモクラシーが• イノベーション、テクノロ基盤的思想
ジーの国
日本の• 比較的安定した政権
アイデンティティ • Trustworthyな国

日本への期待• 日本との協力、知見共有を期待• 広くデジタル経済分野での牽引役も期待• オルタナティブの確保への期待
Copyright©2020 NTT corp. All Rights Reserved.

4

その一方、時代遅れな認識や誇張による誤解が広がる恐れも<Over-statement>• 国家戦略や政策体系は分かった• 産業界の現場の実態は?

• セプターが2005年から活動• ISMS取得数は世界二位• 日本語のカベがあるので大丈夫
・・
・<Under-statement>• 恥の文化なので情報共有しない• コーポレートガバナンス自体が機能してない• 経営陣のITリテラシーが低い
・・・
Copyright©2020 NTT corp. All Rights Reserved.

5

等身大の実像を自信を持って発信することが大切

正しい相互理解Copyright©2020 NTT corp. All Rights Reserved.

6

目 次• グローバルなダイナミズムと日本への期待• “Myths & Reality” (draft)

Copyright©2020 NTT corp. All Rights Reserved.

7

ドラフト・叩かれ台
Cybersecurity of Japanese Industry“Myths & Realities”– Five Things You Need to Know –Copyright©2020 NTT corp. All Rights Reserved.

Myth #1

Japan is lagging.

Reality #1

Japan is making progress.

Copyright©2020 NTT corp. All Rights Reserved.

9

Myth #2

Japan is different.

Reality #2

Japan continues to inter-linked to globalcommunities.
Copyright©2020 NTT corp. All Rights Reserved.

10

Myth #3

Japan is quiet in the global community.

Reality #3

Japan shares its insights from innovative
approaches with global community.
Copyright©2020 NTT corp. All Rights Reserved.

11

You Need to Know . . .

1. Progress at corporations are clear by the increase ofCSIRT Association membership, ISAC’s, and also
initiatives by KeiDanRen (Japan Business Federation).

Copyright©2020 NTT corp. All Rights Reserved.

12

FACT 1-1: Membership increase of NCA
What is NCA?

NCA membership• NCA: Nippon CSIRT Association

Membership (as of Aug.)
400350• Founded in 2007

300

• A not-for-profit organization to
support CSIRT launch andcollaboration among CSIRT’s

250
200
150
1005002013

14

Copyright©2020 NTT corp. All Rights Reserved.

151617181913

FACT 1-2: ISAC’s in Japan
Established inISAC’s

2002• Telecom ISAC2014

• Financials ISAC Japan

2016• ICT ISAC (expansion of Telecom ISAC)• JFTC ISAC (Trading companies)

2017• Auto ISAC
• JE ISAC (Electric utilities)

2018• Transport ISAC (in preparation stage)

2019• H ISAC (Healthcare)
Copyright©2020 NTT corp. All Rights Reserved.

14

FACT 1-3: KeiDanRen*’s Management
Declaration (Mar 2018)

http://www.keidanren.or.jp/policy/2017/103_gaiyo.pdf* Keidanren: Japan Business Federation

Copyright©2020 NTT corp. All Rights Reserved.

15

You Need to Know . . .

2. Efforts to enhance cyber resiliency at the SME level andlocal business community levels are also being made.

Copyright©2020 NTT corp. All Rights Reserved.

16

FACT 2: Efforts at local businesscommunities• Chubu Cyber Security Community (CCSC)– 15 critical infrastructure and manufacturing companies– Law enforcement, academia, and expert communities such as ISACA andCISSP participate• Nagoya Chamber of Commerce & Industry– holds periodical seminars for local SMEs inviting expert companies as lecturers.

• Kansai SEC-net– A community among industry, academia, and government– Seminars for both experts and business management, best practice sharing,and cyber exercises.
https://www.soumu.go.jp/main_content/000618360.pdf
https://www.kansai.meti.go.jp/2-7it/k-cybersecurity-network/20181017k-cybersecurity-network-top.html
https://www.ntt.co.jp/sc/media/NTTannual2019_j_web_lock.pdf

Copyright©2020 NTT corp. All Rights Reserved.

17

You Need to Know . . .

3. Industries are adopting international frameworks andguidelines, including reaching out to the globalcommunities.

Copyright©2020 NTT corp. All Rights Reserved.

18

FACT 3-1: Adopting Frameworks by NIST
Cybersecurity Frameworks

NICE• 33% of companies say they use
NIST CSF*• The Cross-sector Forum uses
NICE framework in developing
Japan’s cybersecurity talentdefinition• METI refers to NIST CSF in
its “Management Principles”• Multiple workshops by NIST
staff since 2014

• JNSA** refers to NICE frameworkin its SecBok 2019 to define skill,tasks, roles for capacity building* IPA “Survey on CISO and CSIRT of Corporations - 2017” (April, 2017)** JNSA: Japan Network Security Association
Copyright©2020 NTT corp. All Rights Reserved.

19

FACT 3-2: NACD’s Cyber Risk
Management Handbook• NACD (National Association ofCorporate Directors) issued thehandbook in 2014 with support from
ISA (Internet Security Alliance).
• KeiDanRen and ISA agreed that essenceof the Handbook in applicable in Japan,
despite difference of corporate
governance.
• “Japan Edition” was issued in October
2019.
Copyright©2020 NTT corp. All Rights Reserved.

20

FACT 3-3: International Joint Statements/Recommendations by KeiDanRen*• BDI (Germany) and Keidanren “Promotion of Data Utilization”(October, 2018)• B2B Tokyo Summit Joint Recommendations “Society 5.0 for SDGS”(March, 2019)• B7 Aix-en-Provence Summit Joint Statement “Inclusive, Sustainable
Economic Growth and Governance for the 21st Century (July, 2019)• US-Japan Internet Economy Private Working Group Joint Statement
2019 (October, 2019)* Keidanren: Japan Business FederationCopyright©2020 NTT corp. All Rights Reserved.

21

You Need to Know . . .

4. Global cybersecurity governance is becoming one of
the most pressing topics among major Japanesecompanies

Copyright©2020 NTT corp. All Rights Reserved.

22

FACT 4: Global Governance Becoming
Pressing Topic• Cross-border M&A’s by Japanesecompanies increased, butcybersecurity of acquiredcompanies has not beenadequately managed• As threat environment becomes
global, attention to global
cybersecurity governance isbecoming a high priority

Cross-border M&A’s(Number of transactions)
777

499

557

560

1415635672• Some companies appoint nonJapanese as the global CISO
2013

Copyright©2020 NTT corp. All Rights Reserved.

16

17

18

23

You Need to Know . . .

5. Industry-driven innovative collaboration approaches
are generating interesting insights.

Copyright©2020 NTT corp. All Rights Reserved.

24

FACT 5-1: JCIC

Japan Cybersecurity
Innovation Committee
A Hub for every initiative to achievea secure and safe digitalized society

Copyright©2020 NTT corp. All Rights Reserved.

25

FACT 5-2: Cross Sector Forum
Finance
RailwayGas

Circle ofTrust
48 Companies

AirlineTransport

CreditCardPower

ChemicalCommunication
Oil

Copyright©2020 NTT corp. All Rights Reserved.

26

Thank you very much!

Copyright©2020 NTT corp. All Rights Reserved.

27