Information Security
Handbook
for Network Beginners
National Center of Incident Readiness and Strategy for Cybersecurity (NISC)
The Government of JAPAN

Ver

2.11e
September 29, 2017

Table of Contents
Foreword —Be your home CSIRT—. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Black Hat the Cracker. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Prologue

What Is a Cyber-Attack?

9

1. What a Cyber-Attack Looks Like. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1. Who carries out cyber-attacks? How do they do it?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Column: Attackers, Hackers, and Crackers.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Column: Malware - The weapon of an attacker. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2. Examples of cyber-attacks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3. Crimes and problems in cyber-attacks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4. Social engineering attacks that exploit your psychological security hole. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Chapter 1 Basic Security —A Step-by-Step Guide to Strengthen Your Security—17

1. 4 Points to Maintain Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
1. Keep systems always up-to-date and Install security software for protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2. Using complex passwords and multi-factor authentication to make intrusion more difficult. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3. Make attacks more difficult by ensuring intrusion takes time and effort (cost).. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4. Patch your psychological security hole (resistance to social engineering). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

2. Keep Your Systems Up-to-Date And Install Security Software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
1. Install security software to strengthen defenses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2. Keep your PC and security software up-to-date.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3. Keep smartphone and network devices up-to-date. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4. Download software and apps from trusted sources/Pay attention to permissions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Column: Consider purchasing security packs for smartphones if necessary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Column: Even up-to-date PCs and smartphones are vulnerable to attack. The attack is called a Zero-Day attacks!. . . . . . 25

3. Make Intrusion into Your System More Difficult by Using Complex Passwords andMulti-Factor Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
1. Increase password security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
2. Do not reuse passwords. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
3. Store passwords appropriately.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
4. Do not honestly answer security questions. Use multi-factor or biometric authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Column: How are passwords leaked? How are they used?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

4. Make Attacks More Difficult by Ensuring Intrusion Takes Time and Effort (Cost).. . . . . . . . . . . . . . 30
5. Patch Your Psychological Security Hole (Resistance to Social Engineering). . . . . . . . . . . . . . . . . . . . . . . . 32
Column: If you are targeted by military or industrial spies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Column: Social engineering seen in the movie “Takedown”. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Column: The origin of spam e-mail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

4

*Caution
This handbook is intended to help beginners understand the problems related to cybersecurity, and simplifies actual
cases for easier understanding. Some related information may be omitted so as to make the content easier tounderstand.
For those who want to deepen their understanding of cybersecurity by reading this handbook, we would appreciate it
if you go a step further and try reading different specialty magazines and latest articles.
The persons and organizations that appear here are fictitious and any similarity to any actual persons or organizations
is purely coincidental.

5Foreword —Be your home CSIRT—
Hi, I’m ZaN, an analyst of NISC, the National Center ofIncident Readiness and Strategy for Cybersecurity, andthis is my boss, Nick, who is a bit tired from working
so hard.

Government agencies and the private sector are
doing all they can against these cyber-attacks, but theattacks show no sign of slowing down and are steadily
increasing.

In this book, we will introduce knowledge about cybersecurity from familiar topics, and Takashi and Mayu will
join in to learn with us.

What we need to do in these circumstances is toimprove the security of computers and smartphones in
the hands of each citizen that are at risk of a cyber-attack, and make it difficult for an attack to be carried out.

Various cyber-attacks happen on the Internet every day.

ZaN
I’m an analyst of NISC Cyber Special
Team 1. My job is to work undercoverinvestigating cyber-attacks by diving into
the Internet. My hobby is diving.

Nick

Takashi
I’m interested in PCs, and I met
ZaN at a programming seminar
and asked her to help out withmy research assignment over thesummer holidays. I want to learn
more about security.

I’m the leader of NISC Cyber
Special Team 1. I wear a suit tohide my geek clothes underneath.
My specialty is investigating
cyber-attacks and penetration
tests. My hobbies are a secret.

Mayu
Well, I’m not really interested insecurity, but I’m along for the ride
because Takashi says that I’ll learnsomething. Of course it’s not that
I’m worried about him!
*NISC Special Team 1 is a fictitious group.

6As seen in recent things like bank transfer scams, wehave to prevent it as they skillfully prey on psychologicalsecurity holes and can control victims at will.

When we say, “your home CSIRT,” the CSIRT stands for
Computer Security Incident Response Team, which is a
special organization in a company that deals with cybersecurity incidents when they occur. Similarly, whether it
is in your own home, a circle or group of friends, or in asmall company which cannot set up a special CSIRT,
if you have an interest in cybersecurity, we hope thatyou will take on the role of being your home CSIRT, yourcircle’s CSIRT, or a small company CSIRT.

So, just as the safety of the city is not only supported
by professionals such as police officers and firefighters
but also various volunteers, the safety of the Internet
is supported by everyone sharing the Internet. We allneed to be involved in raising security awareness andcrime prevention activities related to the Internet as
your home CSIRT.

We need your help in order to realize an Internet societythat everyone can use securely.

We can create a safe Internet society when everyone is responsible for cybersecurity.
People with malicious intent on the Internet are targeting the smartphones in your hands and the computers in your homes.
However, there is no easy way to protect all the smartphones and PCs in the world. Help us protect the Internet together justas crime prevention activities protect where you live through increased crime awareness, and develop an attitude of helping
one another when something happens.

7

Black Hat the Cracker
There are people who maliciously use cyberspace (theInternet) for their own benefit to rob others, and carryout cyber-attacks to demonstrate their ability.

I want to talk about these things in the illustrated explanations, so please be sure to read them carefully.
The origin of his (her?) official name, Black Hat The
Cracker, will be explained in the column “Attackers,
Hackers and Crackers.”

In this book, those people appear as Black Hat The
Cracker and his minions, the Black Pumpkins, andvarious malware.
Sometimes, they also put on masks of ordinary people,
or ordinary people may wear their masks and do bad
things.

8

Information Security Handbook Ver 2.11

Prologue

What Is a Cyber-Attack?
What do you think of when you hear the word “cyber-attack?
What happens? Who does it?
But first, let’s learn about what a cyber-attack is.

Personal information

Money

Botnets
Abduction

Explicit photos

1 What a Cyber-Attack Looks Like
1 Who carries out cyber-attacks? How do they do it?
Hackers?
Spies?

Mnd inform
ey a
ati
on
on

?

something with strong security because it takes time andeffort (≈ the cost is too high) and attack things that takelittle effort (≈ cheap), attackers will tend to go after easytargets, so if we increase the security level of our devices,
we are less susceptible to attack to some extent. Thinkof it as you making an effort to reduce the probability of
being victimized, even though it is difficult to completely
prevent an attack.

Who carries out cyber-attacks and for what purpose?
Is it military or industrial spies? Or is it hackers?
Spies seek to obtain useful information for their own
countries and companies, such as military secrets andinformation on advanced research. On the other hand,the cyber-attacks we normally encounter are aimed at
something that will benefit the attacker, such as personal
information or money.

Dealing with cyber-attacks is not like in cartoons where
the hero appears to stop the bad guy, nor can they betightly defended digitally. First of all, we need to steadilybuild up the way to secure safety.

Since spies must accomplish their objective, they will
attack with any and all means, and try to intrude no matter
how strong security is. They are a problem and there is no
way to completely stop them for now.

Please keep this in mind as we continue to explain thestory about cybersecurity.

Meanwhile, cyber-attacks for profit are a businessfor attackers. For example, given that they will avoid

10

Prologue

What is a cyber-attack?

Hackers
WHITE HATBLACK HAT

Prologue

Column: Attackers, Hackers, and Crackers

Chapter 1
Chapter 2

Malicious hacker●●White hat hacker●●Black hat hacker●●Good hacker●●Bad hacker●●White hacker●●Cracker●●Attacker

And in Japan, they are also called “bad hackers”
or “malicious hackers”. Conversely, people who
use their expert knowledge and skills with goodintent are called “white hat hackers,” “white hats,”
or “white hackers,” and in Japan they are also
called “good hackers” or “ethical hackers.”
In this book we will use these terms based on their
original meaning, so please remember them andtry and use the correct name so that it will become
widely used in everyday life.

However, because there are people who use theirknowledge and skills with malice, to distinguishthem from those with good intentions, they arecalled “black hat hackers” or “black hats,” while11

EpilogueA hacker is a sort of honorific name for someone
with expert computer knowledge and skills, but it
does not mean that they are attackers who seek
to do harm. The work they do using their skills iscalled “hacking” or simply a “hack,” and likewise
this does not necessarily mean that they intend to
do bad things.

Chapter 5

those who seek to penetrate defenses are called“crackers,” and those who carry out attacks,“attackers.”

Newspapers, magazines, and TV, often refer
those who carry out cyber-attacks as “hackers.”
The truth is, however, this way of putting it is notquite correct.

Chapter 4

A hacker is a person who has expert
computer knowledge and skills, andthat does not necessarily mean thatthey are out to do bad things. You
need to be careful of the meaning of
hacker when you use the word yourself or when you see it in the media.

Chapter 3

Ethical hacker

Column: Malware - The weapon of an attacker●●What kinds are there?

What kinds are there?

As with the earlier examplesof hackers and crackers, theterm “computer virus” or simply“virus” is also not used properly.
When an attacker carries out acyber-attack, they often use themethod of infecting a target’s
computer with a malicious
program and gaining control of
it. The programs used for this
attack tend to be collectively
called “viruses.”
However, the programs used
for attacks should correctly becalled “malware” or “malicious
programs.” A virus is one typeof malware limited to referring
only to the type that infects files
on a computer and acts like aparasite on the infected files.

MalwareTrojan horse(non-self-replicating)

Virus (parasitic)

Worm (self-replicating)

What kind of functions do they have?

Malicious bot (bot)Ransomware

Keylogger●●What kind of functions do they have?

To give a real-life example, malware is the genericterm for a pathogen that causes a disease. It issimilar to what we call a virus, a kind of pathogen,which cannot grow unless it infects cells.

If you divide malware by function, they look something like this.
• Malicious bot (bot)Bot is short for robot. A malicious bot is one
that infects a computer and allows an attacker
to use it to attack another computer.

Besides viruses, there are bacteria, protozoa,
and parasites that can exist alone as pathogens.
Similarly, with malware, there are independent andnon-self-replicating types called “Trojan horses”
and independent and self-replicating types called“worms.”• Ransomware
When a computer is infected by ransomware,
the files on the computer are encrypted and aransom is demanded for their return.

There are also “bots,” “ransomware,” and “keyloggers” that are defined by their functions. These
are like the names of the symptom that represent
the behavior of the pathogen.

• Keylogger
A comparatively older type of malware thatrecords keystrokes and sends them to theattacker. The attacker can analyze the recorded
keystrokes to steal passwords and other things.

However, the word virus is broadly used to mean
the same as malware in general, so they areviruses in a broad sense for consistency.

For example, a Trojan horse first pretends to beharmless when intruding a computer, but once
inside, it reveals itself as malware, invoking botsand ransomware from the outside, and starts
causing harm. It gets its name from the Greek
story of the Trojan Horse.

It is important for everyone to remember this andspread the correct usage. When you see the word
“virus” being used in newspapers, magazines,
or on TV, it is important that you correctly understand from the context whether it means “a virus
in a broad sense, such as malware,” or “a virus
in a narrow sense, such as an intrusive program
infecting files.”12Prologue

TabletSmartphone

Various devices that connect to theInternet can be infected by malware.
IoT (Internet of Things)

IP camera

POS
register

Network
routerSmartrefrigerator

But the most serious
cause of infections
may be humanThe key to solving this question is that modern
electronic equipment, even if they don’t look likecomputers, actually contain built-in computers.

No matter how hard you defend against cyber-attacks, there are numerous attack techniques totrick humans that are not easily prevented. Thisis important to know.

Since these devices connect to a network andexchange data, they too can easily be infectedby malware.

Let’s first gain the knowledge to prevent thesethings, and then take action.

Epilogue

In order for malware to easily infect a device, acomputer has to have a weak point in a program
called a security hole. A security hole is likea broken window lock of a house. However,frequent security updates repair these problems
and take care of most security holes.

Chapter 5

You may be a victim and may unwittingly be partof an attack, and may even be the assailant insome instances.

However, there is a problem even more serious
than a malware infection from a malicious attack.
That is a cyber-attack on humans’ psychologicalsecurity holes.

Chapter 4

The victims can spread infections one after
another to friends and colleagues in the workplace, and various devices may join the cyber-attack as part of a botnet, all without their owners
knowing.

In particular, in the era of IoT (the Internet ofthings), the devices around us have becomecomputerized and connected to the Internet,
paving the way for even more devices to bepotentially infected.

Chapter 3

a psychological security hole cannot be easily
patched like a security hole on a computer.
Security awareness does not improve unless the
person himself recognizes that it is necessary.

Chapter 2

It is no mistake to say thatmalware is a malicious programthat infects a computer.
However, the wireless LAN
router in your home, a printerconnected to a network, asurveillance camera or IP
camera, a smart TV, a smart
refrigerator, and even a POS
register can all be infected. Ifthey don’t look like computers,
how can they be infected?

Computer

Chapter 1

When it comes to malware
infections, personal computers,
smartphones, and tablets probably come to mind.

What things are infected, can cause
infections, and what harm do they cause?

Prologue●●What things are infected,
can cause infections,and what harm do theycause?

What is a cyber-attack?

Despite this, if an attacker can trick an ownerinto installing malware himself, they are free
to do all the harm they want without having to
intrude. This is a type of attack on psychologicalsecurity holes, such as a targeted e-mail attack,which will be explained later. The problem is that13

2 Examples of cyber-attacks
Let’s look at a couple of examples
of how the cyber-attacks we introduced earlier are actually carried out.
An attacker first attaches malware toan e-mail, sends it to you, or guides
you to a website containing malware,and infects your computer with it.
After that, your IDs and passwords
are stolen, and the attacker can haveyour computer send images andimportant information in the background without you noticing. Your
IDs and passwords can be used
to make purchases without yourpermission and then later converted
into money.
E-mail can be used to conduct“phishing scams” by leading you to
fake bank websites that steal your ID
and password, and then make illegalmoney transfers.

Phishing scam with a fake website and illegaltransmission of important information
IDs and passwords extracted

Send malware andinfect device

Secr
ets
Illegal transmission ofimportant files
In order to steal money and important information from you, an attacker caries out a phishingscam with a fake e-mail that guides you to a fake bank website, infects your device with malware, and illegally transmits important files. Let’s look at how you can be fooled.

Demands for money by ransomware
Malware instructed toencrypt files without theowner’s permission

More directly, they may demandmoney from the target. Ransomware
encrypts data on your PC or smartphone without your permission anddemands that a ransom be paid todecrypt the files if you want themback.
A “DDoS attack1” forces infected
PCs and devices to participate inan illegal scheme called a botnet
without the owner’s permission, andthe botnet causes massive requests
to target a website to prevent people
from browsing the website. The
owner is an unwitting accomplice tothe attack.

Illegal money transfer

Guided to a fakewebsite and infectedwith malware

The files are
encrypted. Pay theransom if you wantyour files back!

When infected with ransomware, files on computers and other devices are encrypted, and aransom is demanded in order to decrypt the files. However, paying the ransom does not mean
the files will be decrypted. Prepare for this situation by making backups of your system anddata so you can restore your computer to its original state. Let’s learn how intrusions happen
by looking for examples in columns.

Devices that have become part of botnets
Attack!

Attacker orders malware in
the hijacked device to attack
a server

DDoS attack

An attacker may rent out this illegal
botnet mechanism on a time basis tomake money.

A web server
targeted for attack
1 DDoS attack: Distributed Denial of Service attack.
Multiple devices attack a server or other device tooverwhelm its communication capabilities and render
it unavailable.

When infected with a malicious bot, the bot is connected to a botnet, which is an attack mechanism controlled by an attacker, and uses your computer or device in a cyber-attack without
your knowledge. Without you knowing it, you may be the assailant.

14

Prologue

What is a cyber-attack?

Prologue3 Crimes and problems in cyber-attacks
Besides cyber-attacks, various crimes
and troubles happen on the Internet.

Are you Emily?
I’ve come to pick
you up.
Alexandra is
waiting at ourhouse. Let’s go.

Really?

There are people who fake their age and gender to approach you through social networking service. Theyimpersonate the same age and gender in order to become friends with you, then lure you into meeting, which
could lead to your abduction or kidnaping. Be careful when people approach you on social networking service
who you have never met as they may not be who they appear to be in their picture and personal information.

Sexting

We’re friends, right?
I’ll send a nudephoto, then you
send me one too!
It’s a sign of ourfriendship!

Really?
...Well, we’rethe sameage...whynot?

I can makemoney byselling thesephotos...

Socialnetworking
service

Sexting is the casual sending of nude photos and explicit images which is popular among young
people. But what if the photos online are sold or used to threaten you? Once a photo is releasedon the Internet, there is no way to completely erase it. Do not do this under any circumstances.

Cyberbullying

Really?

Wow...

She’s doing something really dumb
(this is actually a lie)

School’sanonymousbulletin board

Just as bullying in real life is unacceptable, do not use the Internet to bully someone. The Internet
should be a place where everyone can create their future, and it should not be used to cause suffering.

15

EpilogueIs that so...

Chapter 5

There is also cyberbullying in whichsocial networking service and underground websites spread bad things
about someone, but even if it is donein jest, it can sometimes cross theline and result in tragedy, so just likebullying in the real world, cyberbullying is something you should neverdo.

When they meet days later...

Chapter 4This is not limited to minors, and isa problem for adults as the crime of“revenge porn” in which nude photos
are posted on the Internet to get backat partners who have broken up.

Socialnetworking
service

Chapter 3

Children are casual about exchanging
nude photos, called “sexting,” butonce the photos are stored on theirsmartphone or other device, they
are at risk of being leaked even if
they do not intentionally give themto someone. Once you give a photo
to someone, you have to think about
the possibility that it will end up
spreading on the Internet and cause
you a lot of anguish for a long time.

♪

OK

Chapter 2

Likewise, there are cases where aperson can impersonate a minor on
the Internet, gain their trust, request
nude photos be sent saying that theperson will reciprocate, and thenuse the nude photos to threaten theminor.

?

Hi, my name is Alexandra
and I’m a 13-year-old juniorhigh school student. Emily, I
want to be your friend!

Chapter 1

Impersonation
andabduction/
kidnapping are an example. There
are instances where a person uses
social networking service to impersonate the same age and genderof a minor to become friends withthem, lures them into meeting, andthen abducts or kidnaps them. There
are also cases where an assailant
finds the posts of a minor on social
networking service who has run
away from home and takes the minor
to his or her own home.

Impersonation and abduction/kidnapping4 Social engineering attacks that exploit your psychological security holePutting cyber-attacks aside, what isa typical crime that you often hearof? Perhaps it’s the grandparents
scam that is a type of bank transfer
fraud.

Social engineering exploits psychologicalsecurity holes in real life and on the Internet

Grandma,It’s me! It’s me!

Although banks and other organizations are constantly calling attention
to them, many people still fall victim.

Takashi?!
Is that you,
Takashi?!

To use a computer as an example,
it would be as if you are desperately trying to fill security holes but
you can’t patch all of them, and thecyber-attacks keep happening one
after the other right before your eyes.
The reason is because these attacks
target psychological security holes,
and these attacks on psychological security holes are not easily
prevented. There are many cyber-attacks targeting psychological security holes.

❷❶

Huh? Meeting?
Was there one?
Might as wellcheck...
Click!

On the Internet

TO: Mr. A
SUB: I need you to urgently lookat this.
These are the minutes from themeeting the other day.
Minutes-doc.exe

❸

n
ctio
infe
Malware

❹

k
Attac

❺

ac
hij
er

s

th
em

k

Attacks targeting psychologicalsecurity holes are broadly called“social engineering.” Be sure to
remember this.

The nature of these two examples is that they prey on
psychological security holes

h
ll t
sa

In order to reduce the damage
caused by these attacks, it isimportant that everyone becomesfamiliar with cybersecurity and thatawareness of the dangers becomes
common sense.

Real worldl
Stea

Take the “targeted e-mail” attack thatwas the beginning of the information
breach at the Japan Pension Service
in 2015 for example. An attacker isanalyzing the target individual, andan e-mail is sent that is addressed
personally to him, with an attachment
appearing to be related to work, butwhich in fact contains malware, withthe aim of infecting their computerwith the malware when the attachment is inadvertently opened.

Grandma,I’m in trouble. I
need some money,
immediately.

e

da

ta
h

ac
hin

e

e wa
nts

With bank transfer scams, for example, the victim is led to believe that there
was an accident or some kind of trouble with their relatives which deprives themof their ability to think clearly, such as confirming who is calling. Psychologicalmanipulation, such as hurrying, impersonating a lawyer or police officer, andgiving terms of negotiation like suggesting that paying money will solve theproblem, are classic social engineering techniques along the lines of “hurry up,”“name dropping,” and “give and take.”
Meanwhile, social engineering on the Internet uses the “friendship” method tosend targeted e-mail as an acquaintance.
Whether in the real world or on the Internet, any security can be breached by
exploiting psychological security holes. This technique of deception is calledsocial engineering. Remember that this technique is out there.

16

Information Security Handbook Ver 2.11

Chapter 1

Basic Security—A Step-by-Step Guide to Strengthen Your Security—
In this chapter, we will explain step-by-step how to strengthen your devices’ security against cyber-attacks.
We will also show you how to manage passwords and what you need to do so that an attacker will no longer
want to attack you. We will also explain social engineering attacks that use psychological security holes.

Patch your psychologicalsecurity hole(resistance to social
engineering)
Make attacks more difficult by
security measures forcing attackers
time and effort (cost)
Using complex passwords andmulti-factor authentication to
make intrusion more difficult
Keep your systems up-to-date andinstall security software

1 4 Points to Maintain Security
1 Keep systems always up-to-date and install security
software for protection
The first step in protecting yourproperty from cyber-attacks is tokeep your system up-to-date.
The first thing to do is to update
the firmware of your device. Next,
is to update the operating system(OS) which is the interface that lets
you control your device. After that,
update your apps and software,
which often contain security holes.
In the case of a computer, installand update your security softwarethat detects malware, etc. In thecase of a smartphone, please see
p. 26, and install a security pack
if necessary. You can patch thesecurity holes by regularly updatingthese things.

Maintain security at various levels❹ software

Security
software❸ and apps

Softwareand apps❷ Update OS

OS (operating
system)❶ firmware

DeviceUpdate security

Update software

Update device

Smartphone and tablet

Computer

While there is free security software available, some detection functions are not as goodas commercial software, and some are even act like a malware masquerading as security
software. If you are unsure about which software to buy, consider software offered byyour Internet service provider or from a trusted software company. The software costs
money, but is an investment in improving your security.

2 Using complex passwords and multi-factor
authentication to make intrusion more difficult
Another item vulnerable to cyber-attacks are passwords. Attackers
will try to find or steal passwords.
So first make sure to change yourpassword when you purchase a
device to make it more difficult to be
find, and use a complex password
for each web service or device. It is
important to store your passwords
securely not to be stolen.

Maintain security with complex passwords andmulti-factor authentication
A password should be
at least 10 characterslong and use acombination of upperand lowercase letters,
numbers, and symbols.

Online bankFirstfactorSecondfactorExample)$0.5inTheB@ank

Internet shopping

Enter yourbank transfer
PIN code□□□□

Hardware token

Example)B@tman-AndRO--B1---NNN!

Next, let’s add an additional authentication measures with multi-factor
authentication so that your device
or service cannot be hijacked even
if your password is stolen.

Enter yoursecure login
code
□□□□

Software token,
single-use (one-time)
password

ID and password

USB key

Online auction

Example)NoBet!?>$2000

Using complex passwords that contain upperand lowercase letters, numbers, and symbols
that are not shared between different web
services and devices.

18

Introducing multi-factor authentication
and using physical device keys thatcannot be leaked on the Internet.

Chapter 1

Basic Security

Prologue

3 Make attacks more difficult by ensuring intrusion
takes time and effort (cost)

The story also happens on theInternet. If there are multiple
defenses for your devices, theattacker need to take time andeffort (cost) and even cannot penetrate in the first place.

I can’t getin...

kH1oQ!tV6

Cyber-attack

Complex Unauthorized Security
password that accesssoftwareis tough to notification
break

FirewallSecurity
patch

This is going
to be tough...

Chapter 2

Imagine that a thief does not breakinto a place where there is a security
guard and a locked door, but they will
break into an unlocked house where
nobody is home because of the lowrisk (cost) and ease to break in.

Make intrusion even more difficult with multiple
layers of defense

Chapter 1

With the exception of professional
spies, efficiency is important for
attackers to conduct cyber-attacks,
so they tend to choose targets
where intrusion is easier.

Thief enters
empty house

DimpleSecurity
lock that device withis tough to
intruder
pick
alarm

Security
guard

Strong doors
and windows,
spikesQuickly
repairdamageddoors

4 Patch your psychological security hole(resistance to social engineering)

Panic

Oh no!!

It’s me! Mom?
I was in an
accident and I
need money!

reunion. Pleasecheck for details.

Employee A

Huh? Is thattrue? Anyway,
I’ll take a look.

You say “it’sme,” but what’s
your name?

It’s me! Mom?
I was in an
accident...

Chapter 5

Here are themeeting minutes.

Was there ameeting? Let’scheck with him.

Employee A

Epilogue

Against bank transfer scam, you
can protect yourself with a sharedsecret word over the phone. Against
targeted e-mail and other cyber-attacks, you can protect yourself toconfirm it with other communicationmeans. These ways of protection,same as multi-factor authentication
discussed earlier in the section
above, are simple and effective.

Patch your psychological security hole.
Do not allow attacks.
Notice of class

What’sthe secret
word?

Hello? Did you
send me ane-mail?

What are thenames ofthe Power
Rangers?

No? I haven’t
sent anything?

Bank transfer scam

19

Chapter 4

Even though taking security
measures shown earlier, anotherform of attack such as social engineering which exploits psychological security holes to open the door
from the inside may happen. If you
don’t defend against this, all effortof the system security itself will bemeaningless. Increased systemsecurity and being conscious about
psychological security holes go
hand in hand.

Chapter 3

security software, as well as use complex passwords
and multi-factor authentication.

This is why it is necessary to keep
your system up-to-date, patch security holes, use

Targeted e-mailEmployee B

Keep Your Systems Up-to-Date
2 And Install Security Software
1 Install security software to strengthen defenses
Basic virus detection and anti-virus
software use a “wanted list” todetect malware.
The wanted list contains the characteristics of known malware andis sent from the distributor to eachdevice so that it can remove any
malware that matches the list. The
list contains information that identifies malware by file size, content,
and other traits.
However, attackers are able to subtly
change the malware made to each
recipient and can even create tailormade malware for their targets, so it
is becoming difficult to use wanted
lists to detect all malware.
In addition to the wanted list
method, recent comprehensive
security software monitoring insidea PC continuously for detecting
suspicious activity caused byunknown malware and removes
it if detected. It is called “behavior
detection.” There is also softwarethat uses heuristic analysis todetect functions that are acting
suspiciously. These methods can,to a certain extent, even detect
unknown malware and counter it.

Basic virus detection software
Virus detection
software

Computer

Gotcha!
I can get past thewanted list if I have
only a little difference!

Passthrough
No Match!

Advanced security software (comprehensive security
software). Behavior detection and heuristic analysis
Comprehensive security
software

Computer
1. Even if itgets past
the security
software

No Match!

3. If itbehavessuspiciously

2. Keeps
monitoring

4. Quarantine

Zero-Day attacks that wanted lists can’t keep up
with
Virus detection
ComputersoftwareNEW

However, some types of malware
cannot be detected. That is theHere is the latest
malware that carries out so-called
wanted list!
“Zero-Day attacks” which uses
security holes and exploits them
before its patch is released. Wanted
lists cannot keep up with these
attacks, and there is currently no
definitive or effective way to defend
against them. However, taking this into consideration,
there are many merits to using comprehensive security
software. Think about purchasing it to strengthen the
defenses of your computer.
20

No Match!

New functions canbe installed overthe Internet

Chapter 1

Basic Security

Prologue2 Keep your PC and security software up-to-date
Installing various updates is a must
to keep the security of your PC
up-to-date.

Windows
Windows Update
screenFirmware
Mac OSMac OS Update
screenUpdate important software
Microsoft Office

X

P

N

Virus
definition file

Adobe
Acrobat
Reader DC

OracleJava

Google Chrome,
Mozilla Firefox,
and other
additional web
browsers

Botnets that appeared in an earlier section will not be established unless there isa machine that can be attacked and hijacked. Each person’s behavior that does
not leave a security hole creates a secure Internet.

21

Epilogue

The important software mentioned here is working like important public infrastructure such as railways, electricity, and gas services, and these softwares areused in most personal computers. Terrorists tend to target public infrastructure
because of its high reward at a low cost, and the same reasoning applies totargeting important software. This is why you should update important software
you use as soon as possible so as to prevent an attacker from making an attack.
It is also a good idea to delete any important software that you are not using.

Chapter 5

Security software normally automatically updates itself once
installed, but try to make a habit ofopening the security software andchecking its security screen once aday. This is a way of checking thesecurity condition of your device.

Chapter 4

W

Adobe
Flash
PlayerUpdate security
software

Chapter 3

Also make sure to update thefirmware of the device itself. Some
devices do this update notification
automatically while others do not,so be sure you know how to findout when your device has a firmware update and pay attention to
the update releases.

Update the OS and basic software

Chapter 2

Furthermore, let’s pay particularattention to updating software thatis easily targeted by cyber-attacks.
Adobe Flash Player, Adobe Acrobat
Reader DC, Oracle Java, andvarious web browsers are generally
used and are therefore easy targets
for attack.

Update thedevice’s firmware

Chapter 1

On recent devices, nearly all of the
OS updates are installed automatically or an update alert is displayed
prompting the user to install them.
However, some OS updates only
occur once a day, it is a goodidea to regularly monitor security
news websites and install updates
by yourself. OS developers also
update other important software
they make, such as Office and othersoftware suites, at the same time.

Update the device itself, the OS, security
software, and any important software

3 Keep smartphone and network devices up-to-date
Similar to PCs, smartphones also
require various updates.
The update notifications on smartphones are relatively easy to understand, and the automatic update
functions are also working well.
Let’s update devices, OS and appsfor daily use anytime when update
notifications appear on the screen.

Updates for app and security software should be
set to automatic and frequently checked
Google Play store
update screen
Google Play store
update screen

To ensure this, let’s check the
update procedures of your device
including the settings menu to
update the device’s firmware (software update and system update)and OS update. Also check thatapp updates are set to automatic.
Depending on the configuration,
automatic updates for smartphone
apps may run only on a wireless
LAN connection, and even if youchange the setting, the updates
still may not be automatic due
to permissions required to be
confirmed on the update, thus, you
may find a long list of apps needing
to be updated. Be aware of this andfrequently open the update screen
and update all apps.
Although, smart home appliancesand IoT devices connected to a
network do not have these kinds ofnotifications, so even if the update
file is published, you may not realize
it and the security hole may remain
open. Let’s check once a week oreven once a month for any new
releases of update files. In particular,
IP cameras and the similar devices
may be controlled by attackers if it
is not managed properly.

Security app
update screen
Security app
update screen

App Store
update screen
App Store
update screen

AndroidiOS

AndroidiOS

Don’t forget to update
your smartphone software and OS
Don’t forget to update
Androidyour
firmwareAndroid software
OS
iOSOS
OS
smartphoneandupdate screen
Android firmware
update screen

update screen

Android OS
update screen

update screen

iOS OS
update screen

Let’s also update the firmware of home appliances
connected to the Internet
Let’s change the setting page ID and password from theinitial setting

Wi-Fi router

Network connected printerIP camera

Updating the firmware of smart home appliances is normally done through a web
browser. Be sure to change the ID and password from the default settings. Not
doing so can result in unauthorized access or spying over IP cameras.

22Chapter 1

Basic Security

Do not install apps from unknown sources.
Pay attention to permissions
Pay attention topermissions when
installing and starting apps

Be aware the setting of
unknown sources

For security software to detectmalware, past collected data isquite important. The more of thisdata there are, the more chance ofdetecting malware. It is the same as
being able to find a reliable cure if
there are many sick specimens.

ItoDenWa

Chapter 2

Here

Also pay attention to permissions for accessing smartphone’s functions when installing apps for the first timeon Android and iOS. These permissions determine whatkind of functions of smartphone you allow apps to use.

Additionally, there are apps that indirectly steal permissions by using link functions between apps or web
services, so pay close attention to the word “link.”

For example, simple camera apps which request
permission to use your contacts, or other apps which
request tens of permissions may be suspicious. Deny23

Epilogueeach permission which is not needed, and if you cannot
deny each permission, then do not install that app. Also,
be aware of additional request of permissions when
updating the apps. There are some apps that initiallyappeared to be harmless when first installed and later
attempt to get more control.

Chapter 5

In the case of iOS devices, apps
can be installed only from the official app store, but in the case ofAndroid devices, it is possible toinstall apps not only from the official store but also from unverified
sources, so make sure to uncheckthe “Unknown sources” item in the“Security” settings which allows installation of apps
from unknown sources. This way, you can protect
against downloading apps from unverified sources.

• Android, iOS (Android screen
shown)
Many people have carelessly
pushedthe“approved”
or“agreed” button in the grant permissions screen because they arecasually displayed during installation or launch of the app, but thisbutton is asking you for permission
to let the app have free access tofunctions.
In some cases, permissions cannot be denied for each function
separately, in which case do notinstall the app. Watch out forapps that ask for unnecessary
permissions.

Chapter 4

It is why it is recommended thatsoftware and apps be downloaded
from trusted sources to avoid being
infected.

• Android
The relevant items and detailed
wordings may differ dependingon the version and smartphone
manufacturer, but it is importantto always uncheck the “Unknown
sources” item in the Security
settings.
If you need to change this setting
to install an app from a trusted
market for some reason, you may
check the item, but don’t forgetuncheck it once you have installed
the app.

Chapter 3

But on the other hand, malware
that the security software company
does not yet know, or malware forwhich not enough specimens havebeen collected, is difficult to detectwith security software.
When attackers try to distributemalware, they avoid official markets
where management is strict; rather
they use e-mail to guide targets tocertain websites to keep malware
hidden and undetected.

Chapter 1

Even if the device itself and thesystem are kept up-to-date, some
attacks are difficult to prevent.
These are intrusions of malicious
software that have yet to be identified as malware.

Prologue

4 Download software and apps from trusted sources
Pay attention to permissions

Column: Consider purchasing security packs for
smartphones if necessaryAnd, as smart home appliances
become more sophisticated,even they may need somekind of security measures in
the future. Please keep this in
mind.

Prevent
Scan forBlockleaks ofmalicious
dangerous personal
applications
websites information

Block
spam
e-mailMonthly subscription
Internet service
providerTotal security
package

Services as above are packaged for a monthly
subscription and cover multiple devices.

Mobile phone carriers and Internet service providers offer security-related services
and products as packages. Check that the package has the functions you wantand sign up it if you think it is necessary.

Do not tamper with your smartphone
Manufacturer’s security design
SECURITY WALL

iOS

ak

Official app store andverified markets

Jail

B

tin

o

In addition, remember that you
never “root” an Android device
or “jailbreak” an iOS device,as it makes the smartphones
vulnerable to attack, because
it is not prescribed usage
defined by the manufacturer’s
security design.

Mobile phone carrierChecke-mail forvirusesRo

However, you may want
additional security apps that
support checking the overall
security, such as overlooking
the points you must be careful
about, detecting the installation of malicious applications,detecting suspicious e-mails,
blocking dangerous sites,
and checking for outflow of
personal
information.
Formeeting such needs, mobile
phone carriers and Internet
service providers offer total
security packages that provide
necessary security functions,
including security apps. It may
be good idea to sign up forsuch service after thoroughly
reviewing their content.

If you feel it necessary, consider installinga security pack on your smartphone.

re

Since
smartphones
weredeveloped relatively recently
compared to PCs, the security functions are built into thebasic design of their OS, so
there is not much of a role toplay for security apps in smartphones while PCs need security software.

gAndroid

It is assumed that users will use their smartphone in a way that adheres to the
manufacturer’s security design concept. Tampering with a smartphone by rooting or jailbreaking it can be a breach of contract, and makes the security of yoursmartphone vulnerable. Do not modify your smartphone.

Do smart home appliances have computersor smartphones in them?

RouterSmart refrigerator

Smart rice cooker

Linux?

Android?

Windows?

Smart home appliances may look like just a machine, but some have the Linux
operating system built into them, and some use Android or Windows. As theseappliances become more sophisticated in the future, they will likely require some
sort of security measures.

24

Chapter 1

Basic Security

I’ll attack
before a patch
is released
A web server ishacked and malware
embedded“Drive-by-download
attack”“Watering holeattack”

I need to
make a patch
quick!

Manufacturer

Webserver

Security patch

Sends targetede-mailThe attacker
immediately
starts theattack!

Security software does notcatch itSecurity softwareand apps
Infection

Manufacturer’s
response takes days
and does not make itin time!

How do I deal with a Zero-Day attack?
Be diligent in reading security
websites and gathering information

Use other ways to avoid
security holes
If a security
hole is foundin app,Tech news
websiteSecuritynews
websiteUninstall the app
and use the webservice instead

Some services that are offered with apps areavailable in web browsers without having to

25

Epilogue

In order to keep the damage
at a minimum, make a habit ofThis is why users need to be prepared and take action. Doing so willreading security websites daily,
allow you to protect yourself.
and, for example, turning off
automatic playback for videos
use the apps, so it is a good idea to become
when video-based malware
appears on the Internet, and uninstalling smart- familiar with the web browsers versions even on
phone social networking service apps until a smartphones.
security hole is fixed.

Chapter 5

In the battle over Zero-Day attacks between the attacker and manufacturer, the attacker usually prevails. Attackers can acquire informationthat manufacturers are unaware of, and if attacks succeed with any oneof the target devices, the attacker can initiate an attack, but a manufacturer has to acquire and review the information then take necessary
and full countermeasures for all products affected by the vulnerability.

Chapter 4

In recent years in particular,
the scale of attacks has grownbecause attackers are paying
money to deliver the malware
through major commercial web
video advertising networks
so that it appears on major
websites. That means that theattacker can gain greater benefits than the advertising cost.

A security
hole isexposed!

Chapter 3

Malware delivered by e-mailcan be prevented to someextent if one is wary of it, but
malware delivered by media
such as video streaming, web
pages, or web advertisements
can infect a device just byaccessing a certain website.
So you cannot effectively
protect against this type of
Zero-Day attack without information about the malware.

Zero-Day attack

Chapter 2

The attacker normally wins
this competition. Attacks that
exploit a security hole before itis patched by a manufacturer
are called “Zero-Day attacks.”

What is a Zero-Day attack? How to deal with it.

Chapter 1

In general, if a security hole ina system or software is widely
exposed, attackers will quickly
develop malware to attack
it. When the manufacturer ordeveloper finds out about the
security hole, they develop
and release an update security
patch.

Prologue

Column: Even up-to-date PCs and smartphones are vulnerable
to attack. The attack is called a Zero-Day attack!

3

Make Intrusion into Your System More
Difficult by Using Complex Passwords
and Multi-Factor Authentication

1 Increase password security
In addition to infecting targeted
devices with malware, cyber-attacks can also involve hijacking
the target by stealing IDs andpasswords in some way.
For example, an attacker can
explore your passwords in thefollowing way.

Login passwords should be at least 10 characters and use acombination of upper and lowercase letters, numbers, and symbols.
Why a password should be at least 10 characters and use a combination of upper and lowercase
letters, numbers, and symbols.

Using numbers only → 10 billion possible variations
Using upper and lowercase letters, numbers, and symbols →Approximately 27,850,097,601 billion possible variations
The difference between using a 10-character password with numbers only and a 10-character password with upper and lowercase letters, numbers, and symbols is night and day.
It is virtually impossible to search through such a large number of combinations.

Using a device’s initial password and attackers know it.
Number of combinations with upper and lowercase letters, numbers, and symbols.
The password is leaked in
Example using uppercase letters + lowercase letters + numbers + symbols
26
+
26
+
10
+ 26 = 88
some way and attackers get
Numbers Uppercase Lowercase Symbols Total
5
6
7
8
9
10
it. The password stored byletters
letters
10
10
Number100,000
1,000,000
10,000,000
100,000,000
1,000,000,000
10,000,000,000
the web service has leaked,
1026
36
Numbers &60,466,176 2,176,782,336 78,364,164,096 2,821,109,907,456 101,559,956,668,416 3,656,158,440,062,976
and attackers use it for a “listletters
1026
26
62
Numbers &916,132,832 56,800,235,584 3,521,614,606,208 218,340,105,584,896 13,537,086,546,263,552 839,299,365,868,340,224
based attack.” Using popular
uppercase& lowercase
letters
terms as passwords and
10
26
26
26
88
Numbers &5,277,319,168 464,404,086,784 40,867,559,636,992 3,596,345,248,055,296 316,478,381,828,866,048 27,850,097,600,940,212,224
uppercaseattackers attempt a “dictionary& lowercase
letters &attack” to find out. Attackers
symbols
try all combinations of lettersand numbers as a “brute force
Increasing the length of a password increases theattack” to find out. The best
number of combinations exponentially.
defense against brute force attacks is to make the attack
take a long time by increasing the types of characters orBrute force attacks eventually succeed, but we canthe number of characters in a password.
make them time consuming to be virtually impossibleusing complex passwords. A login password should be
more than 10 characters and contain a mix of upper andlowercase letters, numbers, and symbols to be considered in the safe zone. The longer the password, thebetter the level of security.

For example, if only numbers are used for a character,there are only 10 possible variations; but if you add aletter, there are now 36 possible variations; and if you
use lowercase and uppercase letters, 62 possible variations; if you add the 26 symbols, 88 possible variations.

2 Do not reuse passwords
Even if you use a complex password, using the same password
with multiple web services isreckless. If you reuse a password
that means that once the password is leaked, it can be used for
attacks upon all other services.
Also, using a complex password
and then adding a number or
regular pattern to the end of it fordifferent web services. It is easy toguess if leaked. It is important to
set complex passwords for eachservice and never reuse them.

Do not reuse the same password. Do not use similar
passwords or guessable passwords.
White Rabbit
Network

Monkey BankWhite Rabbit
Network

Monkey Bank

Calico Cat
Electric

Octopus Credit× ReusePASSWORDPASSWORDPASSWORDPASSWORD

All the same× Add number
to endPASSWORD1PASSWORD2PASSWORD3PASSWORD4

Easy to guess× Guessable regularpattern

PASS-RABBITS PASSMONKEYS

PASS-CATSPASSOCTOPUSES

If the regularpattern isguessed,passwords arecompromised

26

Calico Cat
Electric

OctopusCreditChapter 1

Basic Security

Ms. B’s PC
Mr. C’s PC
ISP
E-mailPassword

Writing them down on
paper, putting them on
the like a poster
Do not think that people from outside the office cannot see your passwords. Contractors thatcome and go during the day could see them, and someone from the outside can even see yourpasswords using binoculars.

Manage passwords by writing them down ina notebook or use a password management app
Forshopping:
xyzsh0p...

What was the
password forthat...?

At thebank:
a6c9...

Password management
notebook (physical)
White Rabbit
Network

Calico Cat
Electric

Monkey Bank

Octopus Credit

Can’t
remember
all mypasswords?

Store separately from PC andsmartphone

Password
management app
Cloud
Mon

Whit
eR
Netw abbit
ork
key

Ban

k

Store with a standalone app

Storing on the cloud is not always a bad thing but it should be balanced by its convenience.
It is safer to manage the key yourself instead of depositing it with someone you do not know.

Do not allow your web browser to remember your password❶ Shall I save your ID
and password?

It’s troublesome❷ to enter it every
time, so “Yes.”

If you are not supposed to store
passwords where you use them,
It is convenient for your password to be automatically entered, but if you leave your desk
this may seem to apply to using
without locking your PC, anyone can login to and use all of your web services.
a password management app ona smartphone. But smartphones
But remember to always back up passwords you
and apps can be protected by PIN
manage. A lost smartphone will be not always returned
codes, biometric authentication, and encryption, whichto you.
will be explained later. Even if your smartphone is stolen
or lost, it cannot be easily used by others.
27

EpilogueStored in yourbrowser and automat❸
ically filled in the nexttime you need it.

Chapter 5

One option is to manage your passwords in a notebook and store themin a separate location, or anotheroption is to manage them with asmartphone password management app. With the latter, you
should carefully consider whether
to use a function of cloud-based
data storage. And also it is recommended that you do not use suchan app for which a security hole
has been discovered. Because, thismeans to have someone manage
your IDs and passwords, and also
increases your risk of a breach.

Mr. A’s PC

Password
written ona stickynote

Chapter 4

As a rule, you should never store
passwords in the place where you
use them. However, numerous
complex passwords with different
services can be difficult to remember.
What should you do then?

List of passwords

Chapter 3

Also, be careful with the autocomplete functions of PC web
browsers. While you are away fromyour desk, someone can use yourbrowser and access your services
or even steal your PC and all of theremembered passwords altogether.

What wasthe login
password?

Passwords
written on a file

Chapter 2

For example, if you stick a password on a PC or wall, someone
seeing it will remember. And if you
store it in PC as a plain text file it canbe leaked when the PC is infectedby malware, with the result thatmultiple accounts may be hijacked
at once.

Do not store passwords in the same place you use them.
Never store them on a PC too

Chapter 1

Passwords
withsufficientcomplexity and length that are notreused can withstand brute-force
attacks, but if they have not been
stored appropriately and stolenthese measures do nothing to stop
the attackers.

Prologue3 Store passwords appropriately

4 Do not honestly answer security questions.
Use multi-factor or biometric authentication
When web services need to verify theidentity of a user who has forgotten
their password or if there is a suspicious login, they use a “security
question.” Users register in advancequestions and answers that only theyknow and answer them like a sharedsecret word.
In some cases, you can make yourown questions and answers, butothers only offer limited options thatare related to your life, such as “thecity you were born in” or “the nameof your pet dog.” Social networking
service is now being used widely, so,such personal information can easily
be found on the Internet and cannot
be considered a reliable element for
security.
So, it makes sense not to honestly
answer security questions, but create
a completely unrelated answer insteadso that it cannot be guessed fromsocial networking service.
Also, in order to log in securely to the
web service, use two-step verification or multi-factor authentication, if
available. With these methods, there
are things that generate a disposablepassword with a hardware token or
smartphone application, and somesent by e-mail. The user can log in
by entering this second password
together with the normal password.
Furthermore, there are also methods
for verifying users by using a USB
key, or methods for detecting suspicious logins by sending a notificatione-mail to a user when the service islogged in to.

Do not honestly answer secret questions.
Do not reuse answers
Q. What is the nameof your elementary
school?

Social networking service

SecurityquestionQ.	 What is thename of yourelementary
school?

A.	Strawberry Bavarian
cream matcha flavor

Abc Elementary School
Graduated from Xyz
Middle School

Q. Where were you born?
It is possiblethat the answer
to your security
question can befound on social
networking
service or theweb, so truthfully
answering it canbe a security hole.

A.	 123 Nowhere St.
Q. What is your brother’s
name?

Ah, the answer is
Abc Elementary
SchoolA. Batman

Use multi-factor authentication and login notifications
to improve security
Multi-factor authenticationFirstfactor

ID:○○○○
PASS:△△△△

ID:○○○○
PASS:△△△△

Login notification
ID:○○○○
PASS:＊＊＊＊

You
have
loggedinSecondfactor
Hardware token(one-time
password)

Software token(one-time password)

MonkeyBankEnter banktransfer PIN

USB key

Login e-mailnotification

White
RabbitNetwork

Webmail
serviceEnter login
password

Use biometric authentication
Face recognition authentication
Ch

Fingerprint authentication

im

e
Chime

I can’t steal her
PIN code...

HelloTakashi

Additionally, recent devices havebiometric authentication functions,such as 3D face recognition, irisrecognition, and fingerprint authentication, as ways to
unlock devices.

train, but someone could use your fingers to unlock thesmartphone while you are sleeping.
Note that biometric authentication usually skips thenormal PIN code input, so if you fail authentication
several times consecutively, you will return to the normal
PIN code input. Let’s not use personal information for
PIN codes, such as birthdays, so as not to be unlocked
by searching for the PIN code when the smartphone isstolen.

Biometric authentication is a convenient function thatallows only the owner to use the smartphone, but there
are good and bad aspects.
For example, fingerprint authentication can prevent
shoulder hacking which is stealing a secret code (PINcode) over the shoulder like when you are riding on a28

Chapter 1

Basic Security

There are many ways to steal IDs and passwords
malware infecting
a computer❹ Mass stealingof IDs andpasswords byattacking web
service❸

Stealingwith a fakeserver❷ Stealing fromunencrypted
communications

Stolen IDs and passwords are used to try and hijack other web services
I wonder whether I
can use this password with anotherweb service. Let’s try.

Chapter 2

An ID and a password can be stolen
through being infected by malware,
being stolen from your own communications, or being leaked from a web
service you use. Let’s change it assoon as you find out your password
has been leaked.

Chapter 1❶ Stealing by

Prologue

Column: How are passwords leaked?
How are they used?

Your computer

Web service, online
storage, webmail
White Rabbit
Network

Online bankSocial networking
service

Credit cardcompany

Internet shopping

OctopusCreditCalico Cat
Electric

An attacker who steals IDs and passwords cantry them on various sites (list based attack) to
see if the service can be hijacked.
If you reuse or use a similar ID and password
between multiple accounts, all of them can behijacked in an instant. If that happens, your ID
can be used to purchase things online without
your permission, or money can be stolen byremitting it with some of remittance systemeven if actual cash cannot be sent. If you findyour password has been leaked, change it
immediately.

What you need to know is that they can beleaked without your PC being infected by29

Epilogue

One way is for malware to infect your computeror device where the malware steals your password and sends it to the attacker. Another isby having your password intercepted along thepath from the device you are using to the webservice you are logging into. Also, an attacker
can steal IDs and passwords that a web service
has stored for the authentication of the login.

Chapter 5

malware. Even if you normally do not use yourID and password, it does not mean that you are
safe.

The IDs and passwords used on personal
computers, smartphones, social networking
service, or web services can cause a lot of harm
if stolen in a cyber-attack. But how does it actually leak out?

Chapter 4

MonkeyBank

An attacker who obtains IDs andpasswords by some way tests themon various sites to see if they can beused at another service (list based
attack). To prevent these attacks fromsucceeding, do not reuse passwords,
use similar passwords, or use guessable passwords.

Chapter 3

Cyber-attack

Make Attacks More Difficult by
4 Ensuring Intrusion Takes Time andEffort (Cost)
Most cyber attackers carry out
cyber-attacks with a profit motive,
except for a military or industrial
spy, or a malicious hacker who isout to make a name for himself.
It is a business for them, andbusiness should be cost effective,
namely, that it is important to makea large profit with little effort.
From the point of view of these
attackers, it is clear that you needto create a difficult environment to
attack.
In the real world, for example, athief is more likely to break into ahouse that has open windows andno one home rather than a houseprotected by heavy security. Thatis because such a house is safe forthem and requires no effort (cost).
The same applies to the Internet.
If there are many barriers to intrusion, such as break-in activities
are recorded (in a log) and notifications may be sent to appropriate
administrators, passwords arecomplicated and difficult to crack,
the latest systems are used, wheresecurity holes cannot be found to
attack, security software is also
used, and even if files are stolen,
they use complex encryption thatwould take hundreds of years to
crack, rendering them unreadable.
An ordinary attacker would avoid
this.

Make attacks more difficult by ensuring intrusion
takes time and effort
Dimple lock thatis tough to pick
Guard dog

Broken window
Sturdy window
with glass noteasily broken

Spikedfence

Lock that iseasy to pick

SurveillancecameraHigh wall

Security
company logo

Broken wallis quickly
fixed

Security
guard

Sturdygate

Window left
open

The security looks
tough. I don't think
I can get in...

High

The window isopen. It’ll be easy
to get in...

Difficulty of attack(cost ≈ risk)

Real world

Low
On the Internet

New OS
Complexpassword thatis not reusedand biometricauthentication

Securitypack

Old OS

Simple or no
password
Logs, unauthorized accessnotification

Securitypatch

FirewallNo security
packThis looks likeit will take a lotof time (cost) to
get in...

But elsewhere, however, security
holes are left unpatched, simple orno passwords are used, files are
unencrypted, and the same passwords are used for
multiple web services.

Securityhole

Big hole here!
Getting in will
be easy!

to penetrate and protect from being attacked. But for
attackers who are not motivated by profit, the countermeasures are a little different.

From a business perspective, these targets are clearlycost effective.
It is a good idea to look from the attacker’s point of viewand build an environment that makes it very troublesome
30

Chapter 1

Socialnetworking
service

Or I’ll limit it toactual friends
only

Do not upload personal information to the Internet
I wonder if there is alittle girl I can trick?
Who shall it be...

Handle nameSnowflake

Let’s be friends!

Elementary school:
None
Junior high school:
None
Current address:
None
Socialnetworking
serviceI don't know thisperson, so I’ll ignore
him or block him!

Do not become friends with anyone who is not someone you actually know
Minors who use social networking service should never make their photos andpersonal information public. Also, do not make your posts public; keep yoursocial networking service post settings to friend only mode so just your friends
can see them.
Never approve friend requests on social networking service from someone you
do not know. Either ignore or reject them.
Without this, it is as dangerous as walking down the street with your personal
information written on a name tag or going off with someone you just met anddo not know their name.

Be alert so that an attacker cannot manipulate
you to open the door to them from the inside

The techniques to deceive people
are not limited to the above examples but happen in a variety of situations in daily life.

This app is great!
Everyoneshould try it!

This is like taking someone
for a drive without tellingthe destination. I don’t fall
into this trap!

You have to readthis! Take a look!
URL
Socialnetworking
serviceBe alert for suspicious e-mail and get in the habit of checking anything suspicious with the sender before opening it. If you watch security tech news every
day, you will get skills to find out suspicious e-mail or social networking service
posts. So let’s train for it.

31

Epilogue

Bank transfer scams and targetede-mail are two examples. No matter
how tough your security measures,
it is all meaningless if you are
deceived and victimized by anattacker. Let’s all be on the lookout.

That’s weird. I’ll
open it after callingthe sender.

Chapter 5

Please check theattached ASAP

Chapter 4

While you may not have heard
about this kind of psychological
technique to trick people (social
engineering), they are systematized
and kind of a manual is organized in
the underworld.

Elementary school: None
Junior high school: None
High school: None
University: Abc
University Humor
department
Current address: Dreamcountry

Chapter 3

And if you feel something weird
while talking, or the story is different
from the conversation you previously had, it may be a psychological technique to trick you. Be alertand make the decision to leave andreturn home.

I don’t upload mypersonal information
to the Internet

Chapter 2

When a person you do notknow approaches you on social
networking service or a bulletinboard system, be careful and nevergive them your personal information. If you are invited to meetsomeone you do not know, do notmeet them. If you need to do so, gowith an adult or guardian.

Handle name
Mr. Robertson

I wonder if there
is any personal
information here.

Chapter 1

On the street, most people would
refuse and run away if asked toprovide an explicit photo of themselves, but they would provide it on
the Internet because an attacker
pretends to be someone else who
appears friendly to deceive thetarget.

Prepare for attacks that are not about money

Prologue

For attacks that are not motivatedby monetary gain, some aim forthe targets themselves, that is,
abducting minors or trying to obtain
explicit photos.

Basic Security

Patch Your Psychological Security
5 Hole (Resistance to Social
Engineering)Social engineering attacks targeting
psychological security holes include“trashing” (going through garbagecans), a technique that does not
require direct contact with a target;“name dropping” (eliciting information by appearing to have authority),and “hurry up” (to get information
by rushing a target) to control thesituation where the target cannot
think normally, elicit the necessary
information or have the target
perform a requested action.
For scams in general, includingbank transfer scams, calling it “acommonly-used social engineering
technique that targets psychological security holes” gives you anidea of its nature.
Social engineering in the digitalized
generation also uses manipulationin the same way.
For example, as a way to obtain
valuable information without directcontact with the target, the PIN
code or pattern lock of someone
using their smartphone on the
train can be stolen using “shoulder
hacking” while standing behindthem. Or the pattern lock of a smartphone left on a table can be discovered by picking it up and looking at
the finger traces on the screen. By
identifying how to unlock the smartphone in advance, you can obtain
all of their other personal data bystealing their smartphone later.

Patch your psychological security hole(resistance to social engineering)
Classic social engineering
Hello, this is
Abcd !!.

Trashing
I wonder if there are any
data DVDs or important
documents here.
○○ Inc., Entrance

Commercial
wasteThis is director Xyz!!
I want to get into thebuilding but the lockcode is changed!
Nobody told me! Tellme the code, rightnow!

Name dropping,hurry up, etc.

Social engineering in the digitalized generation
Shoulder hacking
Lock code is 1126...

Looking at finger traces on the screen
The pattern lockis S-shaped

When unlocking your smartphone Never leave your smartphone unatin public place, be careful of people tended at your desk and never leavebehind watching.
it on the table to reserve your space.

“Targeted e-mail” can also be usedin attacks on psychological security
holes. Just as a swindler investigates his target well, with targeted e-mail, attackers
investigate the target’s name, affiliation, identity, andthe pattern of e-mails exchanged at a similar company.
By doing so, attackers can send scam targeted e-mails
which cannot be distinguished from e-mail for everyday
work.

If this elaborate targeted e-mail is like a rifle that shoots
only the target, then spam e-mail is a method for broad
attacks.

32

Chapter 1

Examples of targeted e-mail and spam e-mailExample of Targeted e-mailFor example, the screen at thebottom left in the frame on the rightis an example of spam texted to asmartphone that impersonates abank.

From: Nick
To: ZaN

There are many clues that tell youthat this is a phishing e-mail. If
the person receiving the e-maildoes not have an account at thebank, they will not open the link.
If you look closely at the link, the
URL ends in gq instead of jp forJapanese websites. Despite thesesigns, a certain number of people
will fall for this attack. If the link
goes to a website embedded with
Zero-Day attack malware insteadof a fraudulent website, then thetarget will be infected.

To all members of NISC Special Team 1

HideThis week’s schedule
TodayI’ve attached this month’s schedule. Please review
it and if you wish to take time off, please fill it in andkeep it with you until further instructions.

Example of Phishing e-mail(example using SMS Short Messages)
Message

Details

Example of proliferation
without malicious intent
Tweet thisInstall this app and you will have good luck
I did and things have changed for the better!
Sea Expert: Free Compass...
Sea Expert: Free Compass...

However, even if he doesn’t know,
the app may contain malware, andeven if it causes no harm while
being spread, it may later increase
permissions and steal personal
information.

Chapter 4

December 16, 2015 2:56 pm

Chapter 3

Taitei-chan
Caution: Your Net Direct password
will expire tomorrow. Please update itat the EX Bank maintenance website
at www.exbank.co.jp.gq.

Chapter 2

Nick, Leader, Special Team 1
Nick@nisc.govt.jp

Chapter 1

What is more troublesome arepeople who are not attackers but
spread malware in good faith. If thesocial networking service accounton the screen on the right at thebottom right of the page is a friend’s
account, you probably would not be
suspicious and think that the app isinteresting and recommend it.

Prologue

While the success rate of spam
attacks is low, its profitability
is increased by targeting large
numbers.

Basic Security

XXXT Replying to @KanmusuKonpuriIito!

Epilogue

As a countermeasure to these kinds of recommendations, it is important to draw a line. You should becautious of things that go beyond the information you
see in the body of an e-mail. In addition to the interesting
videos and schemes to make money, also be careful toavoid clicking links or installing unknown apps.

Chapter 5

the link, keep in mind that the attacker has thought ofthis and likely prepared a website containing malware
to catch people doing searches.

If it was from a stranger, you would
be alarmed, but if it was from a close friend or family,
would you be equally alarmed?

On the street, these would be the equivalent of “Comewith me” or “Just get in the car.”
Furthermore, even if you think that you can look it up
with a search engine on the Internet instead of clicking
33Column: If you are targeted by military or industrial spies
Attackers who are not spies
tend to choose targets in termsof cost effectiveness, but how
do professional spies behave?
For military and industrial
spies, their number one priority
is to obtain the information, so
even though something might
be difficult to penetrate, they
will not give up.
Second, these attackers do
not cover the costs of theiractivitiesbythemselves.
Military spies are funded by
the government and the military. Industrial spies that are
not freelance but funded by asponsor corporation carry out
their attacks with little regard
to cost effectiveness.
If you are interested, you canunderstand how unrelenting
they can be in their purposeby reading a general book on
spies. And once you understand this, you can substitutespies for cyberattacks on theInternet.
Before the Internet was developed, spies did their work
using OSINT (Open SourceIntelligence) by reading publicized information such as
the newspapers and magazines of the target country,
HUMINT (Human Intelligence)by investigating or following
or questioning people, and
SIGINT (Signal Intelligence)by intercepting or wiretapping
communications.

If you are targeted by military or industrial spies
Protection by spending is not effective against
professional spies
Image of server with strict security
Importantdata(palace)Country X is paying
for your efforts!

If the information isin there, I will get it

Our company will
provide funding!

Money

Spying then and now
Spying in the past
OSINT (Open Source Intelligence)

HUMINT(Human Intelligence)

SIGINT(Signal Intelligence)with
SPORTS GYM Meets
Friend A every
Wednesday at
the gym.

TargetVirtually all efforts involved
clipping articles fromnewspaper and magazines.

Spies today

Stealing

Important
information

ial
Socediam

ial
Socediamg
Blo

Does preliminary investigationfor HUMINT. Follows to learn
hobbies and relationshipselkDrin hol
o
alc

v
Tra

ve
Lo p
po ls
ido

Intercepts
transmissions,decoding

I’ll infect his PC
with malware andsteal all of his
e-mail and data

Targetede-mailA-ha! He goes
there every
week and likes
this place.
These are his
close friends.
These are his
hobbies.

Digital OSINT and HUMINT

Digital SIGINT

If the target is someone who likes social
networking service, even an ordinary person
can easily use HUMINT and OSINT in this age ofcyber intelligence.

In modern society in the age of the Internet,
all kinds of HUMINT can be obtained about aperson’s relationships just by looking at social
networking service. Moreover, SIGINT can becollected by malware that steals e-mails andfiles, and can also eavesdrop on smartphone
calls.

People in important positions should notdisclose information carelessly on social
networking service. Everything you do online isbeing monitored.

34

Chapter 1

Basic Security

Tsutomu
Shimomura(right)His opponent, Kevin Mitnick, authored “The Art
of Deception: Controlling the Human Element ofSecurity,” and other books.

Most people who have seen the movie comeaway thinking that there would be no escape ifthey did the things in the movie.

The story depicts Shimomura as a white hat
hacker pitted against Mitnick the cracker, with
an emphasis on the conflict between the prideof the two hackers and their techniques insteadof the morality of their actions.
One thing to pay attention to in the movie are
the hacking techniques and, in particular, thesurprising point that elite hackers don’t restrict
themselves to just the digital world for theirgoals. It is a movie that will change your viewof hackers.

Mitnick is currently a White hat hacker serving
society. It is cool that he turned to justice toatone for his crimes.

Mitnick uses social engineering in the movie
to trick people to acquire information and then35

Epilogue

If you can find a DVD or stream it online, it isworth watching. It is also recommended as
security teaching materials with a focus on
people.

Chapter 5

When we see on the news that the cause of thetheft of a notable person’s e-mails and personal
information was a phone, we think that that was
because the information was poorly managed,
but if you watch this movie, you will see howoften people are easily deceived and how muchinformation is leaked without much effort.

One of the characters in the movie, Tsutomu
Shimomura,
wrote
the
original
book,“Takedown.”

Chapter 4

casually enters a computer center to perform
cryptanalysis.

“Takedown” was released in 1999 and is a film
about the battle between two hackers that isbased on a true story.

Chapter 3

Shimomuraisaphysicist who, after
initially falling behind,then catches up, andtracks down Mitnick.

Chapter 2

While driving around in
his car, Kevin Mitnick
deceives people byphone and obtains
information.

Chapter 1

Kevin Mitnick(left)

Prologue

Column: Social engineering seen in the movie “Takedown”

Column: The origin of spam e-mail

SPAM tofu

SPAM and sausages in eggs

Boiled SPAMSPAM mixed with rice

Miso soup with SPAM

So, this is what
a SPAM lunch
modeled after
spam e-maillooks like...
I get it. I’ve
had enough of
SPAM.

SPAM and
SPAM withmore SPAM.
It’s nothingbut SPAM...

So, there’s SPAM rice balls, SPAM miso soup, sautéed SPAM, SPAM and pork omelets, but no suchthing as whole boiled SPAM?! Well, there you are! (whole boiled SPAM is the dream of the writer)In the past, there was a time when reading e-mailwas depressing (sorry to be rude) as it was full of
spam e-mails such as advertisements, solicitations, and phishing.

word spam by naming the product with uppercase letters while spam with lowercase lettersrefers to the unsolicited e-mail called spam.
Although it is difficult to explain this irritating
feeling, I tried to do it with an illustration in thestyle of a certain manga. Think of it as entering a
restaurant called “E-mail Diner” and ordering thechef’s special and this is what you get. Totally
depressing, right?

What is the origin of calling this disgusting masse-mail “spam”? There are various opinions,but the most compelling is a sketch about thesausage-in-a-can SPAM by the British comedy
troupe Monty Python.

By the way, SPAM is absolutely delicious! Apartfrom the boiled SPAM, you can find all of theother dishes in Okinawa prefecture. However,I have never encountered this complete SPAM
set meal in Okinawa though.

Since the content of the actual sketch is
nonsense that cannot be expressed in words,
try searching for the video and experiencing it
rather than imagining it.
The annoying use of SPAM in the sketch eventually became linked to the irritating spam e-mailof today.
Note that Hormel Foods Corporation, the manufacturer of SPAM, has accepted the usage of the36