CaseStudyWebsite Attack Early Warning System

GRED WebCheck JCB Co., Ltd.

Introduction of website anti-tampering measures to bolster safety of customers
accessing own website
The industry s major credit card company, JCB Co., Ltd.
(hereinafter referred to as JCB ) introduced SecureBrain s GRED
WebCheck, which is a security service to quickly identify andrespond to website tampering damage, in January 2010 so as toCase Study Company

JCB Co., Ltd.
FoundedJanuary 1961

Capital10,616.1 million yen

従業員数
Oﬃce

Aoyama Rise Square, 5-1-22
Minami Aoyama, Minato-ku,Tokyo

Business
Portfolio

Credit card operations,providing credit card
operation services, ﬁnancing,credit guarantee, collections,issuing of prepaid payment
instruments, and sales andits substitution business

Mr. Yusuke Takada,
Vice Chief of the Operation System
Supervisory Group in the Operation
System Development Department
of System Headquarters

enhance security for any customers visiting their corporatewebsite by quickly ﬁnding and handling such attacks ‒ as they are
considered diﬃcult to completely prevent ‒ against a backdrop ofincreased reports of damage from website tampering.
JCB always seeks out cuttingedge security

JCB s security response canbasically be split into twocategories.

JCB has been a leader in theThe ﬁrst iscredit card industry for half aaccordance with the latest

century as the pioneer intrends in security threats,

adopting credit card payments

more speciﬁcally, security

for Japanese consumers since

patches for OSes andits establishment in 1961.

applications, and in recent

JCB has long been an earlycases, responding to threats

adopter of various web-based

from which damage can expand

services (e.g. online The second

rapidly, such as Gumblar.The

issecurity diagnosis.

responding inorA

authentication service, J/Securecomprehensive diagnosis is™, and SecureBrain s phishingmade by an outsourced

counteracting tool, PhishWall,specialist company, primarily towere adopted in this regard.

assess the response to high-risk

We determine the risks based on

threats.

information received fromThe diagnosis details comply

security vendors who arewith PCIDSS, and are periodicallybusiness partners, and thenimplemented. As regards theresponded to as needed.

websites eﬀorts to ensure theJCB has always been a step

ultimate safety and convenience,

ahead in this industry in terms ofthey constantly strive tobeing highly security conscious,

enhance their security andandreliability so that their customers

characteristically swift

always enjoy safe and worry-freeimplementation.

access. subscriptions for credit
cards, enquiries about usage
amounts and points, andpayment requests for utility fees)in a bid to oﬀer its customers themost convenience, and has also
long focused on security
measures so that customers canuse their credit cards safely.

isknownfor

its

Recognition of need for newsolutions triggered byGumblar
JCB had to consider future
measures in response towebsite tampering.
Mr. Yusuke Takada, Vice Chief ofthe Operation System

CaseStudy

Website Attack Early Warning System

GRED WebCheck JCB Co., Ltd.

Supervisory Group in the

conducted to check the load on

Ordinarily, it takes several

Operation System Development

the Website and the inﬂuence ofmonths to implement systemic

Department of System

any resultant response, but itchanges.

Headquarters, looked back andwas conﬁrmed that GRED

actually started, we were relieved

commented,

When the service

We heard about

WebCheck had no problem at all,that there was no tampering as aGumblar within the last year

and service was started

result of the checks performed

while hearing about tampering

immediately.

based on SecureBrain s originalcases that aﬄicted other

Having just recently started

analysis algorithm, and there

companies

websites, and weusing a SaaS-type service for thewere no diﬃculty on thebecame more concerned. Of

ﬁrst time, JCB commented,

management screen on thecourse, we already have

Being a SaaS model was theoperational side.

measures in place to protect ourprimary point for GRED

they contacted the support teamsystem from attack, but cracking

WebCheck.

There were nofor enquiries as the detection

technologies keep advancing

particular concerns with using amethod and mechanism wererelentlessly, so we recognized

SaaS-type product, because theunfamiliar for the ﬁrst month, butthat detection is just as

mechanism of GRED WebCheckever since then, they have nevernecessary as prevention.

is detection based on the sameneeded to contact the support

GRED WebCheck, a productprocessing as general website

team for enquiries, nor had anyoﬀered by SecureBrain who alsobrowsing rather than handing

problems.

provide PhishWall which wasover information to SecureBrain

The service was quickly

installed in 2006, was proposed

to process.

introduced thanks to being a

as a solution around that time.

Mr. Takada also mentioned some

SaaS model, and to date,other points regarding its

operation has been utterly

adoption:

hassle-free.

SaaS-type solution and engine
that warrant expectations ofhigh quality prove decisive
The number of news reports
detailing damage inﬂicted by theGumblar malware had been
increasing day by day at thestart of 2010, and JCB quickly
held discussions about speciﬁcmeasures and the introduction ofsolutions. JCB also received
proposals for other vendor sproducts, but deemed them
impractical when considering theimpact on the system andWe already had asense of reliability regarding

This system can be described as

SecureBrain following thevery comfortable to use.

introduction of PhishWall, and

JCB focuses on the latest threat

heard about their stance oftrends so as to further improveaccumulating knowhow by

their security to ensure thatproviding free security services,

customers can visit theirso had high hopes concerning

corporate website safely andthe engine, since it wasreliably at any time.

developed based on such

At the end of the interview, heknowledge.

added some comments about
SecureBrain, the developer of

Swift introduction ‒Hassle-free system proves
attractive

cost-related issues.

It only took about two weeks

The SaaS-type GRED WebCheckfrom ﬁrst considerations towas se lect e d a s t h e p ri ma ry

starting the service.

candidate since it did not impose

Two weeks is much shorter than

any additional load on theother security products we vesystem.

used ‒ possibly because this is a

Subsequently, tests were

SaaS product,

GRED WebCheck, as follows:
We consider SecureBrain to beleaders in the security ﬁeld, andthey have accumulated
information unique toSecureBrain. We are happy tofurther bolster JCB s security byholding periodic discussions with
SecureBrain.

he stated.

About SecureBrain
https://www.securebrain.co.jp/eng

He added that

Based in Tokyo, Japan, SecureBrainCorporation develop and provide IT
security specializing in cyber security
for web service providers and enterprises.