CaseStudy

Website Attack Early Warning System

GRED WebCheck CyberAgent, Inc.

Introduction of WAF alongside website anti-tamperingcountermeasures Tamper checking + attack blocking to reduce risks
In July 2014, the well-established Internet advertising agency,
CyberAgent, Inc. (hereinafter, CyberAgent ) introduced a
SaaS-type website-tampering checking service, GRED
WebCheck, to their corporate website to prevent damage caused
by website tampering in advance, as it is often reported that majorcompany website suﬀers tampering, and take on a victimizer
status with any aﬀected users. We asked why CyberAgentchanged to GRED from the previously used tampering detection
service.
Case Study Company

CyberAgent, Inc.

Establishment of IT Security
Strategy Oﬃce to reinforce
security throughout the company

FoundedMarch 18, 1998

CyberAgent was established inCapital

7,203 million yen（As of end of Sep, 2015）

1998, and has long been a

Shibuya markcity West1-12-1 Dogenzaka
Shibuya-Ku, Tokyochanges in the Internet

Ameba Business
Internet Ad BusinessGame BusinessMedia and Other Business
Investment De ve lo p m e n t
Business

technology, as a pioneering

従業員数Oﬃce

Business
Portfolio

leader amidst the signiﬁcant
advertising industry, e.g. mailmagazines, blogs, and ad
Internet advertising agency.
Information security-relatedrisks are clearly stated amongst
the risk information on theircorporate site, and concrete Web
security measures areconsciously implemented.
On the recruitment side, thiscompany has been proactively
recruiting security engineers, andendeavoring to reinforce security
not only on their Website, but

CyberAgent Inc.
System Department
Mr. Masatsugu Nishimuraalso in their apps and internalsystems.

staﬀ involved in security
measures in each department
and the person in charge of IT in
the sales department.
The members were selected fromthose responsible or others in asimilar position in eachdepartment,

clearlydemonstrating the high priority ofsecurity measures inCyberAgent.
In the past, standards forsecurity measures wereestablished by each department,
but there was a lack ofcompany-wide standards.
Establishment of standards toensure a certain security level orhigher is also one of theobjectives of the IT Security
Strategy Oﬃce.
Inherent vulnerabilities of CMS
Using GRED to prevent being
victimized by tampering

Under such circumstances, theCyberAgent prioritizes

IT Security Strategy Oﬃce wasanti-tampering measures as wellestablished this year. It sets up

as focusing on eﬀorts to prevent

company-wide security

leakage of personal information

guidelines, boosts security skills

held by various services,

and awareness, as well as taking

information about recruitment

on the role of consultation

applicants, and information

contact point regarding

concerning employees.

corporate security.

As part of this, they took theThis oﬃce is comprised of ten

opportunity aﬀorded to introduce

members, all of whom are

GRED WebCheck ‒ a service that

security experts selected fromchecks for signs of tampering,

various departments, such as

when renewing their corporate

CaseStudy

Website Attack Early Warning System

GRED WebCheck CyberAgent, Inc.

website.

behind the selection of GRED?

Considering the purpose of

Cloud-type WAF Scutum is also

Mr. Nishimura stated: Their alert

tampering, which is often virus

introduced, and WAF-based

speciﬁcations for tampering

distribution, pages that areattack blocking and tampering

detection matched our image.

frequently accessed make betterchecks are implemented.

The mechanism employed bytargets. Thus, it would be best

The main reason for introducing

other services we compared was

to apply tampering detection toGRED WebCheck on their staticthat an alert mail was sent whenthose URLs that are most often

corporate site is thetriggered by any update action.

accessed.

vulnerabilities held by CMS.

Such a mechanism delivers anMr. Masatsugu Nishimura of theiralert even for minor updates

Company-wide System Oﬃce

whenever an update occurs oncommented on the backgroundCMS but splits them up between

to the introduction of GRED: We

a number of users. If an alert isuse

content

output every time a normal

management of the corporate

update is implemented, thewebsite. As long as that is theperson who checks them maycase, its inherent vulnerabilities

become inured to so many alerts,

are unavoidable, although theyand so the main concern is thatare not as serious as those inthey may be ignored. Under

WordPress, which has many

GRED s speciﬁcations, an alert

users. Our company is covered

mail is only sent when aon TV and sometimes accessmalicious update or tampering issurges, so we adopted GRED

detected, so an emergency

WebCheck from the viewpoint ofresponse can be implemented

minimizing the possibility ofwhenever an alert is received.

damage to tampering to theIn addition to countermeasures

users and prevent it in advance.

against human error caused by

CMS

for

operational complacency, theImprove literacy through internal
education as well as systemic
defenseTampering detection had beencost and small number ofbottlenecks to its introduction,
which is unique to SaaS-typemodels, were also selling points.

New security issues areunavoidable as Web technology
advances.

CyberAgent tackles
education

Internal

as one of theircountermeasures.
Mr. Nishimura mentioned themechanism of defense anddetection including GRED, andsteady measures by CyberAgentto reduce security risks by
improving employee literacy.
Although certain protective
measures are in place to counter
external cyber attacks by using
WAF and checking for tampering,versions of such measures need
to be upgraded bearing in mind
the risk of more advanced andmalicious hacking. In particular,
leaks of management information
via humans, any resultant
account hacking, and internal

implemented even before theCyberAgent s corporate website

countermeasures against

adoption of GRED, but there

has between 15,000 andattacks on the internal network,

were often false detections or

20,000 pages, so it can be

are issues.

malicious script wentconsidered a very expansive

promoting the preparation of an

undetected, and was passed andcorporate website.

internal education environment

let through. Following demands

Many of these pages are

via e-learning to raise the ITfor more reliable tamperingarchived press releases.

literacy level of our employees.

detection, GRED was introduced

thousand pages are targeted forby Secure Sky Technology, whichchecking under the standard

operates Scutum.

GRED service, so Mr.

Were there any other factors

Nishimura s opinion was as

besides reliability of detection

follows.

AThus, we are

About SecureBrain
https://www.securebrain.co.jp/eng

Based in Tokyo, Japan, SecureBrain
Corporation develop and provide IT
security specializing in cyber security
for web service providers and enterprises.