CSIRT and Information Security
Governance

Joint Workshop on Security 2008, Tokyo
26 March 2008
Tomohiko Yamakawa
NTTDATA Corp.
Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮCSIRT for the business enterprises•Issues for business– Globalization of the threat e.g. Estonia case
– Business enterprises with Global Supply Chain depend on IT– Importance of IT Risk
– Overregulation or not？
• Information security＝protect information asset (for ourselves)• Compliance ＝ required from outside (by stake holders)• Critical Infrastructure Protection --- For Whom?
•CSIRT for business enterprises– What is the advantage?
– How to take advantage of the framework of “CSIRT”?
• In-house or outsource• In the context of “international cooperation”

1Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮModel of “information sharing” in global basis

Country B
POC•CC=Coordination Center•Contact between CC and POCs

CC

•Each organization has comprehensive program

Local Gov y
Program•Each system may differ in each country

Ministry X
Security
Program

Country A

International
Cooperation
POC
CC(Coordination
Center)Company Z
Security
ProgramCompany z
Program

POC

Local Gov. Y
Security
Program

Ministry x
Program

Country NCC

Ministry 1
Program
Local Gov 2
ProgramCompany 3
POC
ProgramPOC
2

Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮHow to build us “domestic model” in Japan?
•What is the role of Government, CIP, and business enterprises?
– How to merge with law and regulation in Japan?
– What is the role of each player, such as CEPTOAR, GSOC, JPCERT/CC, etc.?
– Who or what division should act as “POC” for each organization?

Japan

CSIRT
In bus.

POC？

ISAC

International
cooperation

SOC(Business)

CEPTOAR（A area）

JPCERT/CC
Gov. CSIRT（Min. b）

Gov. CSIRT（min. a）

CSIRT
In bus.
3

CEPTOAR（B area）

Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮ

Policy of “Security” as a background of CSIRT
Cybersecurity or Information Security?

Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮ

Information Security Policy in Japan•02 Feb. 2006; The First National Strategy on Information Security•15 June 2006; Secure Japan 2006
* ref. http://www.nisc.go.jp/eng/pdf/overview_eng.pdf•14 June 2007; Secure Japan 2007
The First National Strategy in Information Security

role

Central and Local
Governments

CriticalInfrastructures

Businesses

Individuals

Giving “Best Practice” forinformation security
measures

Ensuring stable supply of theirservices as the basis of people’s
lives and economic activities

Implementing information
security measures so as to behighly regarded by the market

Raising awareness as main
players of IT society

Critical Infrastructure
Action Plan

Measures promoted byMinistries and Agencies

Measures promoted byMinistries and Agencies【SectoralStandard for measuresplan】

CrosssectoralissuesPromoting information security technology strategy

ISAC
CSIRT
and collaboration
CEPTOAR
ForPromoting
Gov. international cooperation

Developing human resources

CSIRT
Crime
protection/remedial measures for rights
forandBus.
and interests

Secure Japan
Secure Japan 2006

Secure Japan 2007
5Secure Japan 2008

Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮ

“Information Security”＝”Cybersecurity”?
JapanUSA

Idea

Information Security Governance

CybersecurityWhat?

•Protect CIA of information assets•Prevent
cyberattacks
againstAmerica’s critical infrastructure–Confidentiality–Integrity–Availability•Reduce national vulnerability to cyberattacks•Incorporate Information Security •Minimize damage and recovery time
into a part of corporate governance from cyber attacks that do occur*
National security

NoYes

Volunteer basis
or notVoluntary measures by businesses

National Strategy to Secure Cyberspace

Incident
response andinformation
sharing

Government: standards for measures •Government: FISMA(partly compulsory?)
CIP: CEPTOAR•CIP: ISAC

Business:•Business:–Nippon CSIRT Association–Confusing obligation of reportand incident response–IT-ISAC and several activities onvolunteer basis in IT providers*= strategic object of National Strategy to Secure Cyberspace
6

Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮCSIRT regulations for Governments (Japan and USA)

MinistryUSAJapan

DHS/NCSDNISC•FISMA-Standards •NIST SP 800-61•CERT/CC “Incident Management
Capability Metrics”•StandardsforInformation
Security
Measures for the Central Government
Computer Systems (Dec. 2005)•Federal agency responsibilities…

•Standards for…

Law

Outline–Each agency shall develop, document,
and implement an agency wide
information security program (§3544(b))–(7) procedures for detecting,reporting, and responding to security
incidents–Advance Preparation for Possible
Malfunction–Reporting and Taking Emergency
Measures on Malfunctions–Cause investigation and to Prevent
the Recurrence of malfunction•Federal Information Security incident •Domestic system for reporting and incident
response
Center （§3543 (a) (7)、 §3546 ）7

Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮCIP (Japan and USA)
Ministry

USAJapan

DHS/NCSD

NISC

Measures National infrastructure protection Plan (NIPP) •Action Plan on Information Security•As a major component of the IT sector’s Measures for Critical infrastructures
responsibility•17 sector-specific plans, identified in U.S.
Homeland Security Presidential Directive 7Sectors

17 Agriculture and Food, Health, Water, DIB, 10 Telecommunications, Finance, Civil
Energy, Chemical, Communications, IT,
Transportation, Emergency Services,Dams, Postal and Shipping, Government
Facilities, Commercial Facilities, Nuclear,
Banking and Finance, Monuments andIcon(10 by DHS)IT–“Security Standards, Guidelines etc.”–Strengthening the Information Sharing
Frameworks–Analysis of interdependencies–Cross-Sectoral Exercise …

•IT Sector partnership model

aviation, Railways, Electricity, Gas,
Government/Administrative Services,
Medical Services, Water Works,
Logistics

Nothing special…

–IT Sector Coordinating Council (SCC)–IT Sector Specific Agency (SSA)•IT Sector Specific Plan (SSP), May 2007
8Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮCIP, critical infrastructure protection
JapanUSAIT Users

CIP

CIP

Compliance

Compliance

CIP

CIP

OthersOthers•IT-ISAC•IT-SCC

What security
measures?
CIP

CIP
IT Providers
Compliance
Telco andISP

Compliance

Software vendors
and hardware
vendors

Telco andISP

9Software vendors
and hardware
vendors

Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮCIP in Japan
Collaboration andself-regulation

RegulationCIP

IT Users•Action Planon
Information
Security•NISC
Measures for
CriticalInfrastructures（by NISC）

Compliance

CIP

Others•Cyber Clean
Center (CCC)•NIPPON CSIRTAssociation(NCA)

CIP
Compliance
IT Providers
Telco andISP
10Software vendors
and hardwarevendors•Information
Security EarlyWarningPartnership

Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮ

“Information sharing” in CIP of Japan•Action Plan on Information Security Measures for Critical Infrastructures (13 Dec., 2005)– “Security Standards, Guidelines etc.” concerning Assurance of Information Security ofCritical Infrastructure– Strengthening the Information Sharing Frameworks– Analysis of interdependencies•NISC → Ministries →– Cross-Sectoral Exercise

CIP business entities

Information
provision andliaisons between
public and privatesectors

Provide information to the business entities
Liaison from business entities
Information providing and reporting procedures

CEPTOAR•Function/Role•Contact section for information provided by
the government•Sharing information with related organizations

CEPTOARCouncil•Cross-sectoral information sharing environment•Formation and functions of “CEPTOAR Council”•Procedure for establishment•IT-malfunction•By cyber attack, byunintentional factors, bydisasters•Include incidents, failures,
delays of operation, etc.
obliged to be reported bystatutes and those thebusiness entities engaged
in critical infrastructuresconsider to be especiallyreported

CSPTOAR= Capability for engineering of Protection, Technical Operation, Analysis and Response
11Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮ

Let’s look into the details of CEPTOAR…
December 13, 2005 Decision by the Information Security Policy Council“Action Plan on Information Security Measures for Critical infrastructures” Attachment 3-1

To realize and enhance information sharing frameworks…
Incident response
relevant agencies

Notify information ofcrime victimization

NISC
Information for ITmalfunctions

Analysis ofinterdependencies

Ministries and Agencies of therelevant critical infrastructure

Various related information
Recovery method information etc.

Early-warninginformation etc

CEPTOAR-Council

Information sharing/
analysis function（CEPTOAR）

Information sharing/
Analysis Function（CEPTOAR）

Information sharing/
analysis function（CEPTOAR）•How about inside of the businessenterprises?

・・・
Company ACompany B
12CompanyN

Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮ

Issue for business enterprises•How to build up departments inside– Chief Information Security Officer, CISO
– Information Security Department– Divide role and responsibility between each business unit and corporate staffs•How to react to stakeholders outside– Disclosure by publishing “Information Security Report” to stakeholders– Report to ministries as follows;
Kind of the•Receive early warning•Information for IT-malfunctions
response information to transfer for sharing•Various related information
in-house•Recovery method information etc•Notify information of crime
victimization

Report toNISC

Relevant Ministry

Law enforcement

POC•Information Security Department•Information Security Department•General Affairs Department•General Affairs Department•Legal Department•Report to relevant ministry•Decide independently

Points andissues•Via CEPTOAR or NISC•Information Sharing withCEPTOAR
13Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮCSIRT awareness raising for business
How to build up “CSIRT” in business enterprises

Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮ

Business voices
Misunderstanding at security division

Fact of CSIRT•Organization and details of all CSIRTs
are not same.
•JPCERT/CC、HIRT、NTT-CERT、NIRT・・・•Law and regulation define thedetails of CSIRT.
•Lack of flexibility forresponding to the uniquenessof each business enterprises•Usual security measures ororganizations may easily shit to CSIRT•Persons are same
•Just do same things as before•CSIRT needs too much money•“My company is not so big as
XXX to pay for start up
CSIRT!”•By declaring itself as CSIRT, you caneasily cooperate with CSIRT
colleagues•Need too much humanresources, sometimes reform ofcorporate structure is required•Please do not worry by yourself ! It’s
a CSIRT !!
15Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮPoints of CSIRT（RFC2350）
Application to each business enterprises may differ depending on variousconditions
3.3 Charter•Mission statement•Constituency•Sponsorship/ affiliation•Authority

Team（CSIRT）

3.4 Policies

3.5 Services•Type of Incidents andlevel of Support•Co-operation,
Interaction anddisclosure of information•Communication andAuthentication

Disclosurepolicies etc.
Incident
reporting•Incident Response•Incident Triage•Incident Coordination•Incident Resolution•Proactive Activities•Proactive services

Constituency
3.6 Incident
Reporting Forms

16

Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮThe organization of CSIRT•Technology research•Announcement of•Developing security tool security information•Security Audit

Proactiveservices•Incident handling•Incident analysis•Artifact•Proposing counter•Vulnerability handling measures

Reactive•Risk analysis•Business Continuity Plan
•Security Consulting

Security Quality
Management•Education•AwarenessraisingPlanning andManagement

17

Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮ

Suggestion for Information Security Governance•Compliance and/or information sharing– Not an alternative but “Both Sides of the Coin”– Without effective communication either of them cannot
work for business enterprises•Merits of CSIRT for corporate governance– Sharing information of threat by cooperation– Technology and tools brought by information sharing•Basic framework of CSIRT, shown in slide No.16, would
be quite effective when applied as a part of corporate
governance– “A Culture of Security” by OECD Guidelines
18

Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮ

Thank you very much!

Mail to: yamakawat@nttdata.co.jp

Ｃｏｐｙｒｉｇｈｔ (C) ２００８ ＮＴＴ ＤＡＴＡ ＣＯＲＰＯＲＡＴＩＯＮ