5‑4

5 Cyber Security

Cyber Security Operations for the Tokyo
2020 Games
ONISHI Masaki HOSODA Naofumi
NAKANISHI Katsuhiko IBAYASHI Hiroaki

The Olympic and Paralympic Games Tokyo 2020 established a robust security environment through security
governance and the use of many security solutions However without the mature security operations that enabled full
utilization of the security solutions the security measures provided would be meaningless This article describes how the
security operations were designed implemented and matured for the Tokyo 2020 Olympic and Paralympic Games
Keywords：Tokyo 2020 Games Cyberattacks Security operations

preliminary operations in 2016 and full‑scale operations

1．Prefacein March 2019 in time for the transition of the network

As described in this special issue “5‑3 Solutions forfrom the Games preparation to Games production andCyber Security Challenges of the Tokyo 2020 Games”

then the number of security operators were to be

The Olympic and Paralympic Games Tokyo 2020

gradually increased for the Games(hereinafter referred to as “Tokyo 2020 Games”)

As of March 2019 there were 15 full‑time weekday

implemented many security solutions from the perspec-and day shift operators but during the Olympic Games

tive of defense in depth

to prepare for

the Security Operations Centre (SOC) was establishedunpredictable cyberattacks that evade these solutions

Howeverwithin the Technology Operations Centre (TOC) andor to prevent them from interfering with the proper

operated 24 hours a day by approximately 130 operators

operation of the system the maturity of the securityin 44 positions in three teams : the Security Solutions

operations is the key

Team the Security Incident Response Team and the

It is difficult to achieve a sufficient level of the security

Security Intelligence Team

operations in a day and it is necessary to mature them

The following sections describe how the security

over time On the other hand there are cost constraints

operations were prepared and matured for the GamesFor the Tokyo 2020 Games the master plan was to start

2．Basic Design of the Security Operations
ONISHI Masaki
Technology Services Bureau The Tokyo Organising Committee of the Olympic
and Paralympic GamesHOSODA Naofumi
Technology Services Bureau The Tokyo Organising Committee of the Olympic
and Paralympic Games
NAKANISHI KatsuhikoTechnology Services Bureau The Tokyo Organising Committee of the Olympic
and Paralympic GamesIBAYASHI Hiroaki
Technology Services Bureau The Tokyo Organising Committee of the Olympic
and Paralympic GamesThe Journal of The Institute of Electronics Information and Communication Engineers Vol 105 No 8 Supplement pp 272‑278 August 2022
© 2022 The Institute of Electronics Information and Communication Engineers

272

21

Basic Design

In designing the security operations we referred tothe security operation design documents of the past
Games and the “Textbook for Security Response
Organizations Version 2 1” (1) issued by the Information
Security Operation providers Group Japan to efficiently
design the overall security operations required for the
Tokyo 2020 Gamesthe relationship between each

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

Figure 1

operation

Overall Security Operations and the Relationship between Each Operationand the operations to be performed incooperation with the Tokyo 2020 Games stakeholders(Figure 1) The basic design was also effective as acommon language when cooperating with staff and

3．Security Operations during the Preparation
PeriodWhen security solutions are put into operation there
are many cases where the detection capability against

relevant departments

new cyberattacks is insufficient or where the solution
22

reacts more excessively than expected and interferes

Detailed Design

Due to cost constraints the required number of thewith the operation of legitimate services Therefore it issecurity operators could only be allocated approximately

important for the security operations to review theone month before the Games time On the other handsolution and the operation method itself each time andbecause many security solutions were implemented

to promote optimization and improvement

based on defense in depth

the information that

operators needed to understand covered a wide range of

31

fields Based on these premises to train new operators

For the Tokyo 2020 Games Security Information andin a short period of time we developed policies andEvent Management (SIEM) was introduced to collectprocedures (PnP) in detail for each solution andand correlate server and PC logs alerts from security

standardized operations We also developed a detailed

devices etc

PnP for security incident response including what towere difficult to detect by each security solution alone

identify how to prioritize what actions to take and how

Since the attack detection rules to be developed on theto recover from user inquiries and alerts from each

SIEM vary depending on the security solutions andsecurity solution

environment it is necessary to develop the detection

In addition we set up a management indicator to

SIEM Operationand thereby to detect cyberattacks thatrules suitable for each organization For the Tokyo 2020

measure whether the incident was handled in accord-Games

ance with the PnP for operational refinement This

allowed the security operators to develop and modify theenabled us to continuously improve the scope anddetection rules themselves to continuously utilize thecontent of the PnPs by feeding back the knowledge

SIEM

obtained from daily operations

we established the operational system that

For the start of the SIEM operation the detection
rules were developed with reference to MITRE ATT &Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020273

Figure 2

Dashboard Utilizing CDN Logs

CK (2) When developing the detection rules we focusedup with the latest cyberattacks

on operational feasibility We conducted actual cyberat-This preparation was put to great use during thetacks to verify whether our detection rules could

Games When PetitPotam an attack method against

adequately detect the attacks and we used past logs to

Windows domain controllers was disclosed during theensure that false positives were eliminated as much asGames time the security operators themselves devel-

possible When we conducted tests we found cases

oped the detection rule to detect PetitPotam enabling

where our detection rules failed to detect cyberattacks

them to promptly detect and immediately respond to the

because the behavior of the security solutions was very

attackdifferent from our expectations and cases where thesecurity operations were difficult due to many false

32

Visualization and Dashboard

positives This initiative was extremely useful in terms

Visualization is very important to quickly grasp theof improving the quality of our detection rules as well as

situation when a cyberattack occurs and to takethe skills of the security operators

appropriate initial actions

After the start of the SIEM operation we added andAs an example of visualization we introduce one ofmodified our detection rules mainly to detect actions

the dashboards used in the security operations Figure 2

prohibited by our regulations (e ginteractive logon

shows the number of attacks detected by the Content

using a service account) Since these actions were often

Delivery Network (CDN) at the top and the attack

used in cyberattacks and were useful for attack

source and destination at the bottom This was createddetection we continuously implemented the detection

with an emphasis on information sharing between therule whenever new regulation was added The detection

security operators and website operators rather than arules developed based on our regulations sometimes

detailed analysis of attacks The dashboard visualized

resulted in more false positives than expected This waswhich websites were being attacked and which attacks

because the configuration of the system was changing

were slipping through the CDN filters Cyberattacks are

dynamically in preparation for the Games and each timeoften misunderstood as a cause of system trouble

this happened we analyzed the causes and continually

However by utilizing this dashboard it was possible toimproved the detection rule and operated the permission

show the state that there were no cyberattacks or there

list In addition continuous development of the detection

were attacks but they did not affect the system This

rules by analyzing the signs of cyberattacks observed

enabled each team to understand the effects of attacks

and the cyberattacks methods used during the Cyberand to respond promptly and appropriately

War Games (to be described later) as well as other

In Figure 2 the attack source information is hidden to

cyberattack methods disclosed to the world resulted in

avoid misunderstanding Visualization can cause a great

the advancement of both the detection rules and thedeal of misunderstanding if it is used for unexpectedskills of the security operators which enabled us to keep

purposes It is very important for dashboards to clarify

274

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERSto whom and what the information is intended to beimportant to keep on tuning in the security monitoring

shown and to appropriately limit the scope of disclosurephase
In the security monitoring phase false positives are

33

CDN Operation

found in a mixture connections of legitimate user

As described in this special issue “5‑3 Solutions foraccesses and attacks False positives are difficult to

Cyber Security Challenges of the Tokyo 2020 Games”

detect because they are hidden in low‑risk attacks

our websites were hosted in a CDN

It was a

detections They are always too many low‑risk attacks

countermeasure against Distributed Denial of Service

and often ignored To detect false positives it was(DDoS) attacks and unauthorized access but it also

important to implement monitoring rules that focus notcaused serious false positives which blocked legitimate

only on the characteristics of attacks but also on theuser connections 3 3 will focus on countermeasurescharacteristics of false positives By maturing theseagainst false positives

rules based on actual cases we established a system that

The Tokyo 2020 Games website delivered not only

detected and responded to even small false positives

static contents such as documents and images but also

without omission Although we could have wait for users

accepted information uploads from related parties or

to report false positives we decided to proactively

related systems These connections may be misidenti-

detect false positives because there was a risk that they

fied as attacks and blocked For example the format ofwould be left unreported and become a major problem

uploaded data may resemble an attack code or the hashduring a critical period of timevalue in a cookie may look like an attack command

After finding false positives it is necessary to optimize

which will be blocked by a rule‑based filter In otherthe detection settings Understanding the specifications

cases

related system connections suddenly becomeand behavior of the website is essential for this andfrequent and they would be misidentified as DoS attacks

cooperation with the system developer is also important

and were blocked by the rate‑based filter

False

By establishing a cooperative system with the develop-

positives are not rare cases They occur frequently anders and deepening the CDN operation teamʼs under-

require daily response If legitimate connections werestanding of the site we were able to determine theblocked they could interfere with the operation of the

optimal settings prevent attacks and maintain legiti-

website andmate connections without interfering with the Gamein the worst casemight affect theoperation of the Games Responding to false positives is
as important as responding to attacks For the Tokyo

34

2020 Games we worked to minimize the number of false

The Security Intelligence Team began its activities inpositives by combining pre‑tuning before the site was

October 2019 The team detected signs of cyberattacks

released with tuning after the service was launched

information leaks fake websites fake mobile applica-

Security Intelligence Activities

In pre‑tuning a dedicated period of time is defined totions spoofing of official SNS fake news and so on

generate traffics that simulate legitimate connections

using the information provided by multiple security

and evaluate filters This is done in a staging environ-intelligence services and the government agencies asment with limited access When deploying CDN towell as information collected from Internet forums SNS

existing services

and the dark web

the filters are often activated as

detection‑only mode to eliminate the risk of false

As an example we detected the leakage of credential

blocking and tuning is performed while using actual

information such as authentication IDs and passwords

user communications However for the Tokyo 2020

used for the Tokyo 2020 Games ticket site and official

Games almost all sites had access peaks immediately

online store Upon detection we promptly reset theafter the release therefore filtering protection needed bepassword for the account before any unauthorized

put in place from the beginning Based on this we ruled

intrusion occurred In this case it was assumed that thethat sites needed to start their services with block mode

service provided by the Tokyo 2020 Games was notfilters after reducing the risk of false positives as muchcompromised by the attacker but rather the userʼs

as possible by pre‑tuning and then start using the filter

private device was infected with information‑stealingin blocking mode Nevertheless false positives were

malwareremained in many cases because it was difficult to

In addition we built the security intelligence platform

prepare enough test patterns For this reason it wasthat automatically collected the Indicators of Compro-

Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020275

conducted various tests to sufficiently enhance theability to respond to these security incidents
41

Cyber War GamesThe Cyber War Games (CWGs) are practicalcyberattack exercises to evaluate staff the implementation of the IT system and network and operation
processes from a cyber security perspective by conducting cyberattacks that may occur on the IT systems used
for the Tokyo 2020 Games during the GamesThe CWGs consisted of three teams : the Green Team
Figure 3

which coordinated and evaluated the exercise ; the Red

Security Intelligence Platform

Team which launched the cyberattacks ; and the Blue
Team which defended against the Red Teamʼs attack
For the Tokyo 2020 Games the CWGs were conducted
mise from the International Olympic Committee (IOC)four times : two exercises at the Back Office Network

security intelligence services

the network used by the Tokyo Organising Committee

Japan cyber security

Information Sharing Platform (JISP)

Open SourceIntelligence (OSINT) and automatically distributed thestaffs in their work (BON)

one exercise at theCompetition Network the network for competitions

collected Indicators of Compromise to network security

connecting venues (CPN) and one exercise at the Core

devices SIEM and Endpoint Detection and Response

Hosting Network the network for Olympic and Paraly-(EDR) (Figure 3)

mpic Games related system (CHN) The following major

Security intelligence was also used as a countermeas-

issues were identified and resolved :ure against reputation risk and ambush marketing
Using the PyeongChang 2018 Games and the 2018 FIFA(

World Cup as case studies we worked with the relevant･

departments to improve the maturity of monitoring･

methods and responses to detection
35)

Rule Violation
Credentials were recorded in plain text in the log
Accounts were assigned more privileges thannecessary etc

Threat Hunting

(

)

･

The configurations for servers network devices

While promoting the maturity of the security opera-

Improper System and Network Configurations

differed from the design documents

tions it is also important to prepare for cyberattacks(

that cannot be detected by current security measures･)

Response to Unexpected Cyberattacks
Failed to detect cyberattacks using standard

For this purpose we conducted Threat Hunting which

Windows tools (Living Off The Land Binaries andwas a research activity to proactively detect signs of

Scripts) and undisclosed vulnerability attacks etc

attacks and attacks that were missed by current
security measures Details are described in this special

Some of these issues were known before the CWGs

issue “5‑6 Find Evil‑Know Normal : Tokyo 2020 GamesFor example we were aware that some of the accounts

Threat Hunting from Internal and External Perspec-that had existed since the inception of the Tokyo

tives”

Organising Committee had higher privileges thannecessary but we could not correct them because we
did not know the impact of changing the privileges etc

4．Security Operation Test

The successful attacks on these accounts by the CWGs

The capabilities of the security operations can beraised awareness of cyberattacks among the people

improved by responding to cyberattacks that occur on a

involved and resulted in the remediation of the situation

daily basis On the other hand for a one‑time major

The CWGs were useful in that they allowed theevent such as the Olympic and Paralympic Games the

security operators to experience security incidents thatability to respond quickly and accurately to infrequent or

did not occur in daily security operations and to makeunexpected security incidents is also required

use of them for improvement and to objectively evaluate

276

We

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

the current security level by being subjected to actual
cyberattacks

A total of 29 cyber security scenarios were conducted
including suspicious behavior in the network infection
with unknown malware

42

file server encryption by

ransomware social engineering website defacement

Disaster Recovery Rehearsals

At every Olympic and Paralympic Games Disasterand government collaboration As a result a total of 22

Recovery Rehearsals (DRRs) are held for switchingissues were identified including inadequacies in opera-

from a primary to a secondary data centre in an overseas

tion procedures and shift handover methods

data centre and from a primary to a secondary data

improvements to the dashboard for security monitoring

centre in the host countryʼs data centre

which were promptly resolved before the GamesandFor the Tokyo 2020 Games based on the security
incident that occurred during the PyeongChang 2018
Games we enhanced the DRR scenarios from a cybersecurity perspective in addition to the scenarios

5．Examples of Security Incident Response
during the Game Preparation Period

conducted for each Games Specifically the scenario

51

assumed that Active Directory (AD)which had

We describe an example of a zero‑day vulnerability

authentication and other functions was stopped due tothat we responded to just before the Game times when

unauthorized access The purpose of the scenario was toour concerns became a reality

confirm the effectiveness of the provisional operation

Zero‑day Vulnerability Response“PrinterNightmare” is a vulnerability

that wasprocedures and the roles of each team to ensure that thedisclosed at the end of June 2021 and assigned CVE‑

systems (single sign‑on system proxy etc ) linked with

2021‑34527 Because it was approximately one month

AD resume service within the target recovery time

before the opening ceremony of the Olympic Games we

The scenario allowed us to confirm the feasibility of

had to be very careful in changing the systems andrecovery by alternative means in the event of an AD

difficult decisions were required First we promptly

outage in an actual environment In addition it wascollected detailed information on the vulnerability andpossible to check the actual operation based on theproceeded to verify the Proof of Concept (PoC) code In

dependencies between systems and parameter settings

addition to confirm the extent of the impact we quickly

such as the fact that logging in to the PC and using a file

checked all servers whether the print spooler service

server were possible if the PCʼs authentication cache wasaffected by the vulnerability was running on each server

enabled while network and VPN connections wereby using the vulnerability tracking tool

disabled if the PC was logged off This was also useful for

As a result of the check we confirmed that many

improving the business continuity plan with an aware-

servers and PCs had the print spooler service enabled

ness of resilience in the event of cyberattacks

and were affected by the vulnerability We explained the

Although we conducted a rehearsal for AD and

impact of the vulnerability

workarounds

and thesystems that were linked to AD we also established

impact of implementing the workarounds to the server

appropriate procedures for the systems that might haveadministrators Then we sequentially disabled the print

a significant impact on the operation of the Tokyo 2020spooler service on the server approved by the serverGames such as network authentication systems soft-administrator using group policy On the other handware distribution systems and operation management

since PCs were unable to print if the print spooler

systems etc

service was disabled which had a significant impact on
business operations

43

we disabled Inbound Remote

Printing according to the guidance issued by Microsoft

Technology Rehearsals

Technology Rehearsals simulate technology opera-

on July 1 2021 Subsequently an emergent security

tions through various normal and abnormal scenarios

update was released and we applied it to PCs and all

during the Games time They were conducted twice

critical servers including AD to complete the response(each time for three days) to evaluate systems staff

In this way we were able to quickly make decisions andand operational procedures and were attended by staff

respond to zero‑day vulnerabilities that occurredfrom the Technology Services Department of the Tokyo

immediately before and during the Games time in

Organising Committee

accordance with the vulnerability response process that

the IOC

technology partners and others

vendors including

had been prepared in advanceSpecial Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020

277

52

Phishing E‑mail Disguised as the Chief of thedaily security operations so as not to miss any earlyTokyo Organising Committee

signs of cyber attacks

In daily security operations we analyzed reports fromThe security operations during the Games time which

staff and alerts notified by each solution and identified

were the result of these efforts are described in thisthe extent of the impact and causes which were thenspecial issue “5‑5 Responding to Cyber Attacks during

addressed In addition we took action in cooperation

the Tokyo 2020 Games”

with related organizations as necessary

security operations matured during the Games prepara-

As an example

we describe how to respond tophishing e‑mails disguised as the chief of the Tokyo

but it can be said that thetion period protected the Games from cyberattacks andcontributed to the success of the Tokyo 2020 Games

Organising Committee In the example attackers sent
phishing e‑mails to an unspecified number of people
spoofing the e‑mail address of the chief of the Tokyo

References
(

)

(

)

Organising Committee The phishing e‑mails were sentintermittently seven times in two weeks from January
24 to February 6 2020 For our analysis we used
undeliverable e‑mails received in the e‑mail account of
the chief of the Tokyo Organising Committee
The phishing e‑mails were also sent to three staff
members of the Tokyo Organising Committee but wewere not affected because the spam filter handled themproperly The phishing site which illegally used the
Olympic symbol

was designed to induce e‑mailrecipients to log in to view documents We identified a
total of six phishing sites none of which were accessedby the Tokyo Organising Committee staff members
We analyzed the undeliverable e‑mails that were sentin the early stages of the phishing e‑mails and found ahigh probability that they were phishing campaigns
targeting the Tokyo 2020 Games stakeholders Therefore we regarded it as preparing activities for cyberattacks by attackers and alerted the Tokyo 2020 Games

Information Security Operation providers Group Japan, Textbook for
Security Response Organizations, Version 2.1.
https://isog-j.org/output/2017/Textbook_soc-csirt_v2.html
MITRE ATT & CK
https://attack.mitre.org/(Received February 28 2022 ; Revised March 16 2022)

ONISHI Masaki
ONISHI Masaki was engaged in security
management at NTT Communications Corporation He has been seconded to the Tokyo 2020
Organising Committee as the Director of
Security Operation Cyber Security Department Technology Services Bureau since 2018
During the Games he was responsible for the
security incident response at the SOC
HOSODA Naofumi
HOSODA Naofumi has been working for ISP
backbone operation and analysis of cyberthreats at NTT Communications Corporation
He was seconded to the Tokyo 2020 Organising
Committee as Security Operations Manager of
the Cyber Security Department Technology
Services Bureau since 2014 During the Gameshe was in charge of web security operations at
the SOC

stakeholders In addition we cooperated with externalorganizations such as security vendors to register thesites with the anti‑phishing function of the browsers andto take down the sites

6．Conclusion
This article has described the security operations The

NAKANISHI Katsuhiko
NAKANISHI Katsuhiko was engaged insecurity incident response and cyber exercise
at NEC Nexsolutions Ltd and has been
seconded to the Tokyo 2020 Organising Committee as the Director of Cyber Attack
Response Department Security Bureau andCyber Security Department Technology Services Bureau since 2015 During the Games he
was responsible for the overall security operations at the SOC

security operations and their improvement activities
accumulated since the early stage of the Gamespreparation period as well as various training andexercises such as the CWGs steadily improved thecapability of the security operations In addition we
responded promptly to security incidents such as thewebsite defacements and the compromised e‑mailaccounts that targeted the Tokyo 2020 Games stake-

IBAYASHI Hiroaki
IBAYASHI Hiroaki has been working in theservice development of cloud and security
businesses at NTT Communications Corporation since 2014 and has been seconded to theTokyo 2020 Organising Committee as the
Director of Cyber Security Department Technology Services Bureau During the Games he
was responsible for the overall security operations in the SOC

holders in cooperation with related organizations during

278

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS