CaseStudy

Website Attack Early Warning System

GRED WebCheck Wacoal Holdings Corp.

Lessons to be learned about security measures based on Wacoal’ s real experience– Too late for regrets after “something” happens

Mr. Koichi Yabushita, Assistant Manager, Promotion of Information
Security, Corporate Planning Department, Wacoal Holdings Corp.,(right) and Ms. Yuri Kamo, Retail Information System Section,
Information System Department, Wacoal Holdings Corp. (left)

If asked, “Are your EC site’ s security measures fully prepared?” canyou immediately say, “No problem at all” ? If you hesitate to answer
even for a moment, you may need to review your security
measures.Wacoal, the long-established underwear maker, adopted theWeb-tampering detection solution, GRED WebCheck (hereinafter,GRED) as one of their security measures.GRED enables automatic
patrolling of the site, sending out email alerts if any tampering isdetected, and identifying the source code, etc.This service SecureBrain
provided has been adopted by over 5,000 companies, including
CyberAgent and JCB.Needless to say, the optimum situation is never tohave a cyberattack or unauthorized access that would be detected byGRED.However, unless one responds quickly in the event of acyberattack on an EC site, or acts appropriately when a Website istampered with, any delay in such response can be severely detrimental
to any EC vendor that depends on that EC site. “Security” is thequintessential “safety measure” that is not directly related to conversions
or sales. We interviewed Mr. Yabushita and Ms. Kamo about security
measures that EC vendors really should consider.

Consider Wacoal as a textbook example ofprotective “security measures”- First, could you please tell us about your own business
responsibilities?
Yabushita: I promote security across the entire group,
which is comprised of about 20 companies, including
Wacoal, Peach John, and Ai that runs San-ai Resort, as the
person responsible for promoting information security in theCorporate Planning Department of Wacoal Holdings Corp.
Kamo: I work for the Retail Information System Section
under the Information Systems Department at Wacoal
Holdings Corp. I mainly handle system operations for theB-to-C channel. My department monitors systems related
to customer purchases, such as via stores, websites andcatalog mail orders.
-Please could you describe Wacoal’s EC site?
Kamo: Wacoal established the predecessor of this EC site
as the Wacoal Web Store in 2000. The EC site is defined asa core channel in the corporate mid-term management plan,
and we aim to proactively reinforce its functionality toenhance our customers’ convenience. Furthermore, wealso promote the realization of an Omni-channel service tomake the most of our synergy with physical stores. The
benefits offered by Wacoal include the option for a trial
fitting before purchase in a department store, and receiving
advice from professional sales clerks in the store. On theother hand, many of those who are more familiar with EC

prefer the hassle-free nature of making their purchases

online. We have further improved the convenience of such
online sites and reinforced our services to meet thosecustomers’ needs.

All websites were taken offline for a month due toWeb tampering. “A quicker response would havebeen possible if GRED had been adopted.”-I understand that the Web tampering detection solution“GRED” has now been adopted for Wacoal’s EC site.
Please can you explain how and why it was adopted.
Yabushita: Wacoal had a data leakage incident due tounauthorized access about ten years ago. We were proudthat we took that opportunity to implement all possible
security measures as a company. However, we discoveredthat part of our site was tampered with due to unauthorizedaccess by a third party in 2014. We had to take ourcorporate EC site, Wacoal’s group company sites, andbrand sites, etc. offline for a month. We became keenly
aware that our past efforts had been insufficient, and had toreview our security measures from scratch. We began byinitiating discussions on solutions, as a mechanism todetect Web tampering had to be found quickly, and thendiscovered GRED.

WebCheckKamo: Because of this experience, we became more focused

Yabushita: I think that very few people will have a strong

later, our focus on security is undiminished.

experienced is not so common. However, if asked, “Are theon security measures as a company. Even now, four years- So, of all the solutions available, why did you select GRED?

Yabushita: Immediately after the incident, we wanted to scrub
the source code to confirm that nothing unnecessary wasincluded in the source code of the revised site. Then, before
adopting GRED, we requested, “First, please recheck that all
the source code for all Wacoal Holdings sites is clean,” andafter one or two months, all the sources were confirmed via

GRED. The way this was handled at the time was impressive,
and the realization that the service could be used quickly bysimply registering site URLs, which is attractive, led to ourdecision to adopt GRED. At first, we selected the cloud-based
version out of the two types of GRED products, the other being

sense of ownership, like we do, because the incident wesite, server, and vulnerabilities and the version of the EC

package being used, perfectly managed?” – if you cannot
claim to be well prepared for any one of them, it would bebetter to take appropriate measures, such as adopting

solutions as far as possible. On the one hand, although someissues can be improved, without taking perfect measures, yoursites may still be stopped, but by adopting sufficient solutions at
an earlier stage, you can minimize the problem by reacting

quickly if something happens. I think the difference between
these two approaches can be massive.

- How would you both like to tackle security measures fromnow?

an on-site version. If we had had to prepare a server, thenoperation and maintenance requirements would arise, so thecloud-based version that could easily be started was very
advantageous for us.

Kamo: The cost was lower than that we expected, which wasanother factor in the decision.

- What is it like now that it is actually adopted?
Kamo: GRED automatically patrols the sites every day, andalso automatically conducts a number of scanning checks if set
in advance. In addition, reports are periodically created, so it ishassle-free, and very helpful. Perhaps the only thing we dohave to do manually is checking the detection results, which
confirms whether the detected details are problematic or not.
- Has anything changed since GRED was adopted?
Kamo: As expected, the site is more secure. Looking back, I

think that the incident in 2014 could have been handled much

more quickly if GRED had been adopted. If there were any

suspicious activity on the site, we would receive an email alert
from GRED by the following day, which would have enabled us
to respond sooner. We really appreciate the sense of security

that comes with knowing that “there shouldn’t be any problem
because GRED can reliably detect anything that happens”
because GRED is adopted.

“Security measures that are often considered a lowpriority” should be taken immediately if not alreadywell prepared.
- Security measures are not directly linked to EC sales andresults, so may end up as an after-thought. Please tell us whyYabushita: In 2018, Wacoal established Wacoal-SIRT(Wacoal Security Incident Response Team) and joined theNippon CSIRT Association to better respond to security threats
in unison by effectively and quickly reacting to each security

incident. We would like closer connections with other member
companies, and to consider what type of products or services

are needed to construct more reliable security systems. Also, Ipersonally would like to increase the number of personnel

involved in security within the company. We would like tobolster security knowledge together with the Retail Information
System Section that Kamo works for, and strive to establish astronger organization in terms of security.

Kamo: Isn’t operation of sites without having to worry abouttime spent improving security one of the ideal styles for EC

vendors? I would like to take advantage of GRED so that we
can use security measures as much as possible and focus oncommunication with customers.

EC vendors should implement security measures, such as web
tampering detection solutions, and advise companies who areconsidering adopting such services.

About SecureBrain
https://www.securebrain.co.jp/eng

Based in Tokyo, Japan, SecureBrain
Corporation develop and provide IT
security specializing in cyber security
for web service providers and enterprises.