Japan’s IT Security Evaluation

March 29th, 2001
Office of IT Security Policy
Ministry of Economy, Trade and Industry, Japan

METI’s Information Security Policy
UNAUTHORIZED COMPUTER ACCESS/USECOMPUTER VIRUSES

R&D (IPA, etc.), New Legislation / Guidelines,
Reporting (IPA & JPCERT/CC)

R&D (IPA,), Guidelines,Reporting (IPA)

CRITICAL INFRUSTRUCTURE PROTECTION
R&D (IPA, etc.), Cooperation with Cabinet related Office

CRYPTOGRAPHY
R&D (IPA,etc.), Evaluation (Cryptrec), Export Control(Export Control Div.)IT SECURITY EVALUATION (CC; ISO/IEC 15408)
R&D (IPA, JEITA etc.), Training/HR Development, Scheme Preparation (NITE etc.)

SECURITY MANAGEMANT
Voluntary accreditation scheme for IPS providers, Preparation to incorporate BS7799(ISO/IEC17799) into JIS, Human Resource Development (National Exam. for IT experts)

SYSTEM AUDIT
Guidelines, Voluntary registration scheme for system auditing firms

Japan’s Activities in Security Evaluation(Stage1)
Participation to the discussion in ISO/IEC SC 27 WG3Study of security functional requirements (JEIDA)
Development of new security evaluation methodologies (JEIDA &IPA)(Stage2)

Establishment ofCommon Criteria TaskForce (CCTF) in IPA(May 1998)

Preparation of documents for security evaluation
Development of security evaluation tools
Experimental security evaluation
ISO/IEC 15408 into JIS(Published July 2000)(Stage3)

Training Program (From April 2000)
Evaluation Start

Building Secure e-Government
Japanese Government has started to build eGovernment by FY2003 as a booster for IT revolution.
Information Security is an essential factor for thesuccess of the project.
Confidence for the IT products, as well as applicationof protection measures is necessary.

New Scheme will launch from FY2001METI will start in FY2001 the evaluation andcertification scheme, according to CCR, forgovernment use to promote secure e-Government.
Concerning the scheme, NITE (National Institute ofTechnology and Evaluation) is in charge ofcertification. Several ITSEFs will be accredited.
METI also plans to participate in CCR as one of theCertificate Authorizing Participants before FY2003, thetarget year of building e-Government.

Our New Scheme
METI
Oversight ( as a sponsor)

NITE (National Institute of Technology and Evaluation (Governmental organization))- Operation in accordance with ISO/IEC Guide 65- Certification of evaluation results- Technical oversight of ITSEFs- maintenance of evaluation and certification / validation
rules and scheme- Cooperation with IPA- Accreditation of ITSEFs- Operation in accordance with
ISO/IEC 17025 (Business PersonUnit)

Accreditation program
Application

Accreditation

ITSEFsITSEFs- -Evaluation
Evaluationaccording
accordingtotoISO/IEC15408
ISO/IEC15408

Certification/Validation program

Evaluation
TechnicalReport

TechnicalOversight

Consultation
Evaluation
Application forevaluation

Application for
Certification/
Validation

Certificate

IT
ITProduct/
Product/System
System(PP)(PP)
Manufacturers,
Manufacturers,Vendor
VendorororUsers
Users

Further Activities
Development of Evaluation Techniques / Tools-More cost-effective evaluation techniques and tools-System evaluation methods

Development of Human Resources-Training programs for software/hardware developers and evaluator-Program participants will be over 300 this FY. Continued in next FY

Promotion of the use of IT Security Evaluation by CC-Information dissemination to the private sector-Government-Wide Guidelines for the use of Evaluated Products

ContactYoshitaka TouiDirector,
Office of IT Security Policy, METI, Japan
toi-yoshitaka@meti.go.jp
Tel : ** 81-3-3501-0397
Fax: ** 81-3-3581-6639