CASE
STUDYIntelligence: The Cornerstone of Toshiba’s
Aggressive Security Transformation
Recorded Future’s intelligence powers Toshiba’s advanced security strategy

Toshiba, the multinational conglomerate technology
company headquartered in Japan, drives their advanced
security strategy and transformation through their
Cyber Security Center. At the core of the Cyber Security
Center’s strategy is their “intelligence-centric” approach,for which they depend on Recorded Future Intelligence
Platform to help inform how they protect their business.
Manufacturers providing products and services in thedigital age must strengthen security in two areas: first,information security, which protects internal systems
and data to facilitate business operations; and second,product security, which enhances the security of theproducts and services they provide to protect customers
and partners to defend against cyber attacks.
Given Toshiba’s wide range of businesses operating
globally, including manufacturing, energy, infrastructurerelated systems, and electronic devices, they have seen
the need to bolster their security posture. The company
established the Cyber Security Center in 2017, which isresponsible for protecting their global operations fromboth an information and product security standpoint witha consolidated and streamlined approach to security.

1Intelligence plays a critical role in this process.
From the establishment of the Cyber Security Center
to its current day operations, how did the company
succeed in its efforts to strengthen security, including
the transformation of its structure? We talked to theleaders of the Cyber Security Center to find out.

Proactive Intelligence: Essential for
Risk-Based Countermeasures
Toshiba's Cyber Security Center focuses on andpromotes three main objectives:
Governance, establishing regulations andguidelines, developing systems, and collaboratingwith external parties.
Operations, based on the concept of security
lifetime protection, which consists of design andprotection, monitoring and detection, response
and recovery, and evaluation and verification.
Training for all Toshiba Group employees andsecurity specialists.
With the establishment of the Cyber Security Center,Toshiba has changed its approach to be proactive "riskbased security management" basing decisions to invest
in security solutions according to the level of protection
a solution can provide for Toshiba’s assets.

Recorded Future® | www.recordedfuture.com

Takashi Amano,
General Manager of Cyber Security
Technology Center, Toshiba

Kenji Kojima,
Senior Manager of Cyber Security
Technology Center, Toshiba“We realized that in order to take risk-based
countermeasures, we needed to shift our focus fromreactive to proactive protection," recalls Takashi Amano.
As a result, he came to the conclusion that "to support
our proactive approach to security, we needed to invest
in threat intelligence to prepare us for cyber attacks
before they happen. Recorded Future’s wide coverageand volume of information led to our initial evaluation of
their intelligence, and later to choosing Recorded Future
as our intelligence provider.”After evaluating a range of intelligence vendors thatprovide IoCs (Indicator of Compromise) and threat
intelligence, Toshiba chose Recorded Future. The
deciding factor was Recorded Future’s superiority inboth breadth of information coverage and volumeof information. Kenji Kojima said, "Recorded Futureaccumulates a wide range of data to provide us withthe most useful intelligence. Moreover, we can setalerts within the Recorded Future Intelligence Platformthat trigger when specific keywords are found on theweb. We most appreciated the fact that Recorded
Future's intelligence has accumulated a wide rangeof past information and delivers relevant information
based on its own engine once keywords are set.”

Recorded Future® | www.recordedfuture.com

2

"Rather than handling IoC feeds such as harmful
IP addresses or malware hash values in pieces,the Recorded Future Intelligence Platform presents
a dashboard of IoCs tied to specific threats and theattackers who use them. We found it easy to use
in that it displays a large amount of information ina structured manner, rather than in isolation,"
Kojima said.
In parallel to the introduction of Recorded Future, theCyber Security Center established a team of analysts toutilize intelligence. The analyst team helps to respond toinquiries from the Computer Security Incident Response
Team (CSIRT) and Product Security Incident Response
Team (PSIRT), which are responsible for incident
response in the field.
Intelligence also contributes to two-way collaboration,for example, when the results of dashboard investigations
are given to the CSIRT, enabling them to ask deeper
questions related to threats. “As we mature, we arebuilding strong processes around intelligence, digging
deeply into our alerts with the help of relevant threat
intelligence," Kojima said.
The Cyber Security Center also uses Recorded Future’sBrand Intelligence solution to ascertain whether any
intellectual property or confidential information related
to Toshiba has been leaked on the dark web, and gather
context around that leak. By setting keywords such as
the Toshiba brand name, alerts fire to notify the Cyber
Security Center when relevant information hasbeen detected.

3Strengthening global governance and raising the levelof security across Toshiba’s entire group of companies
is also a major challenge that the Cyber Security Centeris addressing with intelligence. The Chief Information
Security Officers (CISOs) of Toshiba Group companies
meet regularly to share company-wide threat trends
obtained through intelligence and to communicate with
the CSIRTs of individual companies regarding alerts
related to their own operations. Kojima says, "We havebeen able to achieve a good balance between top-level
information sharing and field-level information sharing.”"Intelligence-centric" Securityin Combination with SOAR
The Cyber Security Center aims to be an "intelligencecentric" operation that detects and responds to threatsby collecting a variety of internally available logs
and event information in addition to external threat
information from the Recorded Future Intelligence
Platform (see Figure 1).
Automation of incident response through a Security
Orchestration, Automation and Response (SOAR) has
been critical to the Cyber Security Center’s operations.
Toshiba has integrated intelligence into their SOAR andutilizes it in the Security Operation Center (SOC) andCSIRT, which monitor Toshiba Group's security.

Recorded Future® | www.recordedfuture.com

Figure 1. Diagram showing how Toshiba’s Cyber Security Center’s security operations function with intelligence at its core
(Source: Toshiba Corporation)

By automating the process of obtaining
and enriching threat information andincorporating threat intelligence into theprocess, Toshiba is attempting to turn
tacit knowledge of personnel into formal
knowledge and achieve intelligencecentric operations.

Incident handling tends to rely on personal knowledge
and abilities. When a device alerts, it is necessary
to examine the reputation and risk of the IP addresscommunicating with that device, and to check fordevices or suspicious processes communicating withthe same IP address.

Recorded Future® | www.recordedfuture.com

To support this response, Toshiba augments their SOAR
through an API (application programming interface)with their Recorded Future integration. By automating theprocess of obtaining and enriching threat information andincorporating threat intelligence into the process, Toshiba
is attempting to turn tacit knowledge of personnel into
formal knowledge and achieve intelligence-centric
operations. For example, when handling an incident,
experienced personnel used to have to search for thenecessary information themselves, but after switching
to a system that automatically retrieves relevant threat
information, the need for such work, which requires
reliance on human skills, was reduced.
Amano has noticed that "Recorded Future's intelligencehas reduced the time required to respond to incidents.
In the future, we plan to visualize the effects and quantify
the effectiveness of using intelligence to prevent damage
before it occurs, and present this information
to management.”4Becoming a "Trusted Partner"
Through Enhanced Product Security
Toshiba's Cyber Security Center’s leaders are also
enthusiastic about various future applications ofRecorded Future’s intelligence in their security
infrastructure. The company plans to integrate
Recorded Future with their Endpoint Detection andResponse (EDR) solution, which has been introduced
globally, to visualize the status of devices through
EDR and compare it with threat intelligence, thereby
enabling a comprehensive understanding of potential
threats and the presence of malware.
Further, Toshiba expects that intelligence will beused in a wider range of situations in zero-trust
security, which is being implemented in phases.
As the transition from perimeter defense to zerotrust security progresses, the number of targets tobe monitored by their SOC, including authentication,
will increase. “In the transformation from perimetersecurity to zero-trust security, we will consider
how to best make use of intelligence," said Amano.

5A key initiative unique to the manufacturing industry,the company intends to use intelligence not only toprotect its internal infrastructure, but also to protect
the products and services it provides to its corporate
customers. “There is a possibility that we ourselves
will have to become intelligence providers for Toshiba’s
products and services," said Amano.
Toshiba is developing an internal vulnerability
management platform to manage which products andservices are affected by vulnerabilities discovered ona daily basis. By utilizing the Vulnerability Intelligence
provided by Recorded Future, Toshiba intends tobuild a system that not only confirms the existenceof vulnerabilities, but also prioritizes them based onrisk scores.

Recorded Future® | www.recordedfuture.com

From left to right: Mr. Kojima, Mr. Amano

The manufacturing industry is facing a major turning
point. Toshiba is also working to promote digitaltransformation (DX) and increase corporate value by
combining its manufacturing technology and experience
with the latest technologies. To do so, the foundationof trust is essential.

Amano expresses trust using the formula "value divided
by risk.” This means that trust can be enhanced not only
by increasing value, but also by reducing risk. “We wantto strengthen trust by increasing value and reducing risk
at the same time," said Amano. “In an age when we areconnected to our customers and partners in the digitalworld, what is most important is trust. We will continue
to strive to enhance Toshiba's value as a connected
partner through continued investment in security
measures," said Amano.

ABOUT RECORDED FUTURE
Recorded Future is the world’s largest intelligence company. The Recorded Future Intelligence Platform provides the most complete coverage across adversaries, infrastructure, and targets.
By combining persistent and pervasive automated data collection and analytics with human analysis, Recorded Future provides real-time visibility into the vast digital landscape and empowers
clients to take proactive action to disrupt adversaries and keep their people, systems, and infrastructure safe. Headquartered in Boston with offices and employees around the world,
Recorded Future works with more than 1,300 businesses and government organizations across 60 countries. Learn more at recordedfuture.com.

www.recordedfuture.com

Recorded Future® | www.recordedfuture.com@RecordedFuture© Recorded Future®, Inc. All rights reserved. All trademarks remain property of their respective owners.

6