Japanese Government’s Efforts to Address
Information Security Issues- Focusing on the Cabinet Secretariat’s Efforts -November, 2007
http://www.nisc.go.jp/eng/

1. Structuring Governmental Core Function

Information Security Policy Council (ISPC)& National Information Security Center (NISC)- Based on “Review of the Role and Functions of the Government in terms of Measures to Address Information Security
Issues (decided by the IT Strategic Headquarters on December 7, 2004),” the government is developing essentialfunctions and frameworks toward strengthening its core functions to address information security issues.
¾ National Information Security Center (NISC) has been established since April 25, 2005
¾ Information Security Policy Council (ISPC) has been established under the IT Strategic Headquarters since May 30, 2005

CabinetSecretariat

Information Security Policy Council (ISPC) National Information Security Center (NISC)

IT Strategic
Headquarters

Gather experts
from the public
and private sectors* NISC is in
Cabinet Secretariat
Decision on fundamental
matters such as basic strategy
for information security(1) Formulate basic strategies for information security measures(4) Information security measures for criticalinfrastructures(2) Promote comprehensive measurestaken by central governments
governments

Ministry of
DefenseMinistry of
Economy, Tradeand Industry

Businesses

Ministry ofInternal Affairs
andCommunications

National
Police Agency

Critical Infrastructures

Ministry of
Economy, Tradeand Industry

Ministry of Land,
Infrastructure
and Transport

Ministry of
Health, Labourand Welfare

Ministry ofInternal Affairs
andCommunications

Governmental Agencies

Financial
Services
Agency(3) Help central each government agency
deal with individual incidents

Central government agencies
concerning information security
Agencies overseeing critical infrastructure- Centralize of information exchange andcooperate with foreign countries- Make International confidence-building

Individuals

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

2

Structure and Functions of NISC
Development
Developmentofof
Fundamental
FundamentalStrategy
Strategy- Planning comprehensive strategy on information
security

DeputyDeputy Director
Director ofof NISCNISC（Councilor,（Councilor,Cabinet
CabinetSecretariat）
Secretariat）

Director of NISC

(Assistant Chief Cabinet Secretary)

AdvisorAdvisor onon
Information
Information Security
Security- Planning R&D, technological strategy

Businesses

Individuals

etc.

Comprehensive
Comprehensivemeasures
measuresforgovernmental
for governmentalagencies
agencies- Establishing the government-wide framework for
information security- Implementing the comprehensive evaluation

Governmental Agencies

etc.

Development ofDevelopment of
Response Capability
Response Capability- Enhancing functions of collecting & analyzing information- Strengthening the cooperation with related organizations etc.

DeputyDeputy Director
Director ofof NISCNISC（Councilor,（Councilor,Cabinet
CabinetSecretariat）
Secretariat）

Critical Infrastructures

CriticalCriticalInformation
Information
Infrastructure
InfrastructureProtection
Protection- Analyzing interdependency- Raising the information security level- Implementing cross-sectoral exercise etc.
Foreign Organizations

International
InternationalStrategy
Strategy- Planning international strategy- Promoting international relationshipetc.

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

3

2. National Strategy and Secure Japan

2-1 First National Strategy on Information Security

Consideration for “The First National Strategy
on Information Security”¾ The Information Security Policy Council formulated “The First National Strategy on Information Security” as the mid and long-term
strategy with an overview of information security issues.
¾ The following three expert panels were established to contribute to the deliberations on “The First National Strategy on Information
Security.”• Considering measures for the cultivation of Culture of Security
Expert Panel on Culture of Security• Considering the strategies for R&D and technology development in information security and use of the results achieved thereby• Considering specific policies on information security measures for critical infrastructures

Expert Panel on Technological Strategy
Expert Panel on Critical Infrastructures“The First National Strategy on Information Security”

Expert Panel on Culture of
Security(November 17, 2005)
Considering measures for thecultivation of Culture of Security

Mid and long-term strategy with an overview of information security issues

Government agencies

Critical Infrastructures

 Implementing high-level information security
measures and ensuring robust business continuity
 Highly reliable handling of information depositedby people
 Cultivating international confidence Implementing balanced technologicalinvestments
 Ensuring transparency

 Functioning as reliable infrastructures
 Designing verifiable functions and securingbusiness continuity
 Achieving coordination and cooperation
between critical infrastructures

Businesses

Individuals

 Making active efforts as members of the
Culture of Security
 Building a consensus on personal
information protection issues and privacy
issues Strategic promotion of R&D and technology development in information security
The First Initiative of the Committee for
Essential Issues on Information Security(November 16, 2004)

The Second Initiative of the Committee for
Essential Issues on Information Security(April 22, 2005)

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

Expert Panel on
Technological Strategy(November 17, 2005)
Considering the strategies for
R&D and technology development
in information security and use of
the results achievedExpert Panel on Critical
Infrastructures(December 13, 2005)
Considering specific measures
on information security measuresfor critical infrastructures6

Overall Picture of “The First National Strategy on Information Security”- Aiming to Make Japan an Information Security Advanced Nation
through Establishment of a New Public-Private Partnership Model - As a mid and long-term plan (“overall process schedule”) on information security issues, the government presented(1) basic principles against information security issues and (2) the direction of priority policies.
policies- The term for this plan is three years from FY2006 to FY2008.
FY2008 The government also formulates a promotion plan foreach fiscal year based on the medium and long-term plan.

Basic
Basicprinciples
principles
1<Points to be realized>

Information security for providing the
introduction of Japan as an economic state

2

Information security for more safe,
secure, and better lives for the people

3

Information security from a newperspective of ensuring national security

 A quarter of Japan’s economic base and commercial
transactions depends on IT.
 Japan is the world’s largest broadband communication
power with 80 million Internet users.
 There is a growing need for safety and security
measures including disaster control manners.
It is necessary to recognize both new threats tonational security regarding IT and strength of Japan.

Primary goal to be achievedin the next three years
Establish a “new public-private partnership model” in which both public and private play their roles appropriately- Under the initiative of the National Information Security Center (NISC), all entities concerned should be involved in this project -

Goals
Goals

To make Japan an “information security advanced nation”[Critical infrastructures]: The number of IT-malfunctions should be reduced[Central governments]: All government agencies should take measures according to
as close as possible to zero.
the “Standards for Measures.”[Individuals]: The number of “individuals who feel insecure about IT use” as[Businesses]: All public companies should take appropriate measures depending
close as possible to zero.
on risk.
Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.
7

“The First National Strategy on Information Security”- Priority Policies for the FY 2006-2008 - In the next three years, the government will strengthen various relevant measures based on the First National Strategy
on Information Security in order to establish a “new public-private partnership model” in which all entities
appropriately play their roles.

Central and local governments

Critical infrastructures

Businesses

Individuals

Giving “Best Practice” for
information security
measures

Ensuring stable supply of theirservices as the basis of people’ssocial lives and economic activities

Implementing information
security measures so as to behighly regarded by the market

Raising awareness as main
players of IT society

 Evaluating each ministry and agency
based on the Standards for Measures Increasing the ability to respond to
emergencies including cyber attacks

 Developing CEPTOAR* Establishing the CEPTOAR-Council
 Implementing cross-sectoral
exercises and analysis ofinterdependency

 Promoting usage of third-party
evaluation systems such as
information security audit
 Reinforcing the framework to
respond to threats regarding
information security including
computer viruses

Role

Priority
policies for
2006-2008(1)(for eachplayer)[Sectoral
Plan]Standards for Measures

Critical Infrastructures
Action Plan

Measures promoted by
Ministries and Agencies

 Promoting information security
education
 Enhancing publicity andawareness-raising by, for example,
establishing an “Information
Security Day”
 Improving the environment toprovide user-friendly services
Measures promoted by
Ministries and Agencies* CEPTOAR: Capability for Engineering of Protection, Technical Operation, Analysis and Response

Promoting information security technology strategy

Priority
policies for
2006-2008(2)(cross-sectoralissues) Developing technologies dedicated for government use
 Promoting technology development addressing “Grand Challenges”
Promoting international cooperation and collaboration
 Contributing to establishment of international bases for information
security and reassurance
 Making Japan-led international contributions

Developing human resources Developing human resources with practical skills and talents,
wide-ranging abilities
 Organizing qualification system for information security

Crime control and protection/remedial
measures for rights and interests
 Reinforcing cybercrime control and developing the relevant bases
 Developing technologies for improving security among cyberspace

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

8

Overall Picture of Milestones in the FY 2006 - 2008
- Through combination of the “overall process schedule” (National Strategy) and the “sectoral plan,”plan the government aims
to develop Japan into an “information security advanced nation,”
nation with clearly identified milestones to be achieved ineach fiscal year.
Overall plan Formulate an annual plan Set evaluation indexes Evaluate and review the implementation statusof the annual plan and review the plan

 Aim to make Japan an “information security
advanced nation”(Formulate the Second National Strategy)

Centralgovernment
agencies Clarify the cooperation with the Optimization Plan Ensure thorough implementation of measures for all
government systems
 Improve the Standards for Measures for overall
implementation

 Commence the implementation of e-Government
common infrastructure systems
 Conduct comprehensive and cross-sectoral evaluationof government systems

 Completely achieve the required information security
level under the Standards for Measures(Fulfill information security measures suitable for theworld’s highest level of e-Government

 Formulate and review the “ Safety standards, Guidelines,etc.” Develop functions for information sharing and analysis
 Implement cross-sectoral exercises

 Start full-fledged operation of information sharing
frameworks
 Establish the CEPTOAR-Council
 Implement cross-sectoral exercises

Truly dependable critical infrastructures(Update the Action Plan)

Criticalinfrastructures

Cross-sectoral
infrastructure
for businesses
andindividuals

 Enhance information security measures taken by bothbusinesses and individuals
 Carry out continuous technical strategies

i
Ach

ti
con
e
ev

en t
m
e
rov
mp
i
s
u
nuo

Ta

FY2006

a

t
ing
d
r
cc o

r
gove
r
o
f
re s

n

cr i t i
s for
e
r
u
s
mea

c

easu
ke m

ll
er a
v
o
e
o th

t ag emen

nc ie

rastrual i n fnplas

ct u r estructure
T ak esecurity infras
n
io
at
rm
fo
in
l
ss-sectora
Formulate crosand individual
s
se
es
n
si
u
b
r
fo

FY2007

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

FY20089

2-2 Secure Japan 2007

Outline of “The First National Strategy on Information Security”
and position of “Secure Japan 2007”“The“The FirstFirst National
National Strategy
Strategy on
on Information
Information Security”
Security” (Information(Information Security
SecurityPolicy
Policy Council,
Council,February
February 2,
2, 2006)
2006)

Critical Infrastructures

Businesses

Individuals

Objectives

All government agencies
should take measuresaccording to the “Standards
for Measures” by the
beginning of FY2009

The number of IT-malfunctions
should be reduced as close as
possible to zero by the
beginning of FY2009.

The state of implementationof information security
measures should be enhanced
to the world’s top level by the
beginning of FY2009.

The number of individuals“feeling insecure about ITuse” should be reduced as
close as possible to zero by
the beginning of FY2009.

 Evaluating each ministry andagency based on the Standards
for Measures etc.

 Developing CEPTOAR
 Establishing the CEPTOAR-Counciletc.

 Promoting usage of third-party
evaluation systems etc.

 Promoting information
security education
 Enhancing public relations

Key crosssectoral
policies

Central and local governments

Key sectoral
policies

ThreeThree-year program for FY2006FY2006-2008. Aimed at establishing a “new publicpublic-private partnership model”
model” where all entities share appropriate roles.

Developing and ensuring human resources
engaged in information security
Implementing crime control and protection/remedial
measures for rights and interests

Promoting strategy for
information security technology
Promoting international
cooperation and collaboration

FY2006etc.

Evaluation

FY2007

FY2008
Evaluation“Secure Japan 2006”“Secure Japan 2007”(1) Implementation plan for FY2006 (133(133 measures)(1) Implementation plan for FY2007 (159(159 measures)“Establishment of frameworks for security measuresin the public and private sectors”“Establishment of frameworks for security measuresin the public and private sectors”(2) Direction for the priority measures in FY2007(26 measures)(2) Direction for the priority measures in FY2008(24 measures)“Enhancement of security measures in the public and private sectors”

Secure Japan
Secure Japan
2008
2008

“Enhancement of security measures in the
public and private sectors”

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

11

Breakdown of Measures Listed in Secure Japan 2007
Secure Japan 2007
(SJ2007)(All 183 measures)New
measures48 measures

SJ2007 (Chapter 3–5)
Measures implemented in FY2007

SJ2007 (Chapter 6)
Measures listing the direction forthe priority measures in FY2008

24 measures

159 measures
Continuingmeasures
111 measures(Reference) Breakdown of
133 measures of SJ2006

Measures terminatedfor the better
Non-continuingmeasures22 measures

Secure Japan 2006 (SJ2006)

8 measures
Measures completed

14 measures

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

12

Key Points of “Secure Japan 2007”○ In light of the assessment and analysis of approaches based on Secure Japan 2006, efforts to be made in the second year are to besummarized to implement the First National Strategy on Information Security.
○ Facilitating constant implementation of measures, including maintenance of the organization that enforce security measures andapplication of the supplementary measures to the component to which measures are insufficiently employed.
○ Indicates specific action plan to be implemented in FY2007, and the direction for the priority measures in FY2008.

<Key points of “Secure Japan 2007” >Enhancement of information security measures for the central
government agencies<Enhancing the efforts to implement the basic plan>- Efforts to be made in the second year (including enhancement of[Primary Specific Measures]
efforts) to implement the First National Strategy on Information Priorities ¾ Establishment of the PDCA cycle and conducting a full-fledged assessment ofPriorities the progress of implemented measures based on the Government Standards for(FY2006–FY2008)<Direction of efforts based on the awareness and assessment ofprogress made by the end of FY2006>¾ Extension of the effort for a thorough and solid
implementation of measures within government agencies¾ Enhancement of measures for implementing bodies that tend
to lag behind in making efforts¾ Strengthening the system and personnel to reinforce thecomponent to which insufficient efforts were made in FY2006¾ Starting a full-scale response to international issues, in light ofdeepening mutual dependency of each country in theinternational community¾ As an urgent issue, promotion of efforts to enhance
information security of e-government in a rapid and intensive
mannerMeasures, and disclosure of the assessment results¾ Establishment of the Government Security Operation Coordination (GSOC)
concerning cyber attacks, etc. headed by the Cabinet Secretariat

Dissemination of measures for the bodies that are lagging behindin taking measures, as well as for the general public[Primary Specific Measures]¾ Providing information security education in elementary and junior- andsenior-high schools¾ Providing awareness-raising activities including “Internet safety lessons”¾ Promoting implementation of information security measures in small- andmedium-sized enterprises
Direction
Direction ¾ Consideration of the establishment of the CEPTOAR-Council, a cross-sector
ofof
council for critical infrastructures

Efforts
Efforts

Intensive efforts toward strengthening the information security
Platform
Direction of Priority Measures in FY2008.
[Primary Specific Measures]¾ Prioritization in securing manpower for information security in government
agencies¾ Intensive efforts towards global deployment of information security measures¾ Security assurance at the stage of system design of e-government

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

13

Specific Measures under “Secure Japan 2007” (1)Strengthening
StrengtheningInformation
InformationSecurity
SecurityMeasures
Measuresininthe
theFour
FourImplementation
ImplementationFields
Fields
1. Central and local governments

17 newly introduced measures ＋31 continuous measures ＝48 total measures

The central government will make efforts aiming to upgrade the level of the Standards for Measures to the world’s highest level by[Objectives] fiscal 2008, and to enable all the government agencies to implement measures at a level meeting the Standards for Measures by the
beginning of FY2009.
- Establishing the PDCA cycle based on the “Standards for Measures” and conducting full-scale evaluation of the measures and publicizing the evaluation results[Primarymeasures] (Cabinet Secretariat and all government agencies)- Cooperatively tackling to issues common for all government agencies and sharing best practices appropriately (Cabinet Secretariat and all government agencies)- Developing a next-generation OS environment that achieves higher security (Cabinet Secretariat, Cabinet Office, Ministry of Internal Affairs and Communications(MIC) and Ministry of Economy, Trade and Industry (METI))- Establishing inter-governmental response system concerning cyber attacks against government agencies (Cabinet Secretariat and all government agencies)- Developing manuals for information security measures in local governments (MIC)

2. Critical Infrastructures[Objectives][Primarymeasures]3 newly introduced measures ＋11 continuous measures ＝14 total measures

The central government will make efforts aiming to reduce IT-malfunctions in critical infrastructures as close as possible to zeroby the beginning of FY2009- Reviewing the “Safety Standards, Guidelines, etc.” for securing information security in each critical infrastructure sector. (Agencies overseeing critical infrastructure)- Examination on the state of dissemination of the “Safety Standards, Guidelines, etc.” (Cabinet Secretariat and all government agencies)- Consideration to establishing “CEPTOAR-Council (tentative)” to facilitate information sharing across business entities engaged in critical infrastructures(Cabinet Secretariat and Agencies overseeing critical infrastructure)- Conducting cross-sectoral functional exercises to improve capability of the structure for communication and cooperation between public and private sectors.
(Cabinet Secretariat and Agencies overseeing critical infrastructure)- Facilitating interdependency analysis for critical infrastructure sectors to improve capability to respond to IT- malfunctions and to ensure business continuity.
(Cabinet Secretariat and Agencies overseeing critical infrastructure)

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

14

Specific Measures under “Secure Japan 2007” (2)Strengthening
StrengtheningInformation
InformationSecurity
SecurityMeasures
Measuresininthe
theFour
FourImplementation
ImplementationFields
Fields(continued)(continued)

3. Businesses

11 newly introduced measures ＋12 continuous measures ＝23 total measures[Objectives] The government will make efforts aiming to improving the implementation of information security measures of businesses to theworld’s highest level by the beginning of FY2009.

[Primarymeasures]- Promoting the establishment of information security governance in private sectors （METI）- Facilitaing implementation of information security measures within small- and medium-sized companies (METI)- Considering the quantitative evaluation method for information security-related risks (METI)- Support for training businesses developing human resources specialize in security for information and communication (MIC)

4. Individuals

2 newly introduced measures ＋16 continuous measures ＝18 total measures[Objectives] The government will make efforts aiming to reduce the number of individuals who feel insecure about IT use as close as possible
to zero by the beginning of FY2009.

[Primarymeasures]- Promoting information security education in elementary and lower secondary school levels (Ministry of Education, Culture, Sports, Science andTechnology (MEXT))- Increasing and improving the content of “Internet safety lessons” and continuously holding the lessons nationwide (METI and National Police
Agency (NPA))- Implementing awareness-raising lessons for parents and teachers (e-Net-Caravan) nationwide (MIC and MEXT)- Holding events centered on “Information Security Day” (Cabinet Secretariat, NPA, MIC, MEXT and METI)- Giving lecture on cyber security (cyber security college) nationwide intended for the persons concerned with educational institute and employees of
local government (NPA)

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

15

Specific Measures under “Secure Japan 2007” (3)Formation of Cross-Sectoral
Information Security Infrastructure

1. Promoting information security technology strategy

11 newly introduced measures ＋
12 continuous measures ＝23 total measures[Primary - Considering the themes for “Grand Challenge” research projects aimed at achieving long-term and fundamental technological innovations (Cabinet Secretariat,
measures] Cabinet Office, MIC and METI)- Development of next generation OS environment that realize the advanced security functions (Cabinet Secretariat and Cabinet Office)6 newly introduced measures ＋
2 continuous measures ＝8 total measures

2. Development and securing of human resources engaged in information security[Primary - Facilitating unified information security education in the government (Cabinet Secretariat and all government agencies)
measures] - Setting up the council for industry-academia-government collaboration to conduct deliberations on the type of advanced IT human resources needed in the industry
and the methods of developing advanced IT human resources in the practical field (Ministry of Economy, Trade and Industry)

3. Promoting international cooperation and collaboration

4 newly introduced measures ＋
7 continuous measures ＝11 total measures[Primary - Consideration of basic policy and specific measure to strategically tackle with international partnership/cooperation throughout government agencies
measures] (Cabinet Secretariat)- Internationally publicizing and spreading best practices (Cabinet Secretariat and all government agencies)

4. Crime control and protection/remedial measures for rights and interests

3 newly introduced measures ＋
9 continuous measures ＝12 total measures[Primary - Promotion of collection and systematization of knowledge on digital forensics (NPA)
measures] - Research on foundation for protection and redemption of user’s rights and benefit in cyberspace (Cabinet Secretariat)
3 newly introduced measures ＋
3 continuous measures ＝6 total measures

Policy Promotion
System

1. Policy Promotion System and Partnerships with Other Related Organizations[Primary - The competent agency will also expand the functions to conduct examination/consideration for various trends of basic information necessary for promoting
measures] information security measures (Cabinet Secretariat)- Improvement of information security consulting functions to promote information security measures of government agencies (Cabinet Secretariat)- Intensify the exchange of opinions with other related organizations, such as the IT Strategic Headquarters, Council on Economic and Fiscal Policy, Council for
Science and Technology Policy, and Central Disaster Prevention Council . (Cabinet Secretariat and Cabinet Office)

2. Establishment of the Structure for Continuous Improvement

0 newly introduced measures ＋
5 continuous measures ＝5 total measures- Conducting evaluation of “Secure Japan 2007” and publishing the results (Cabinet Secretariat)[Primarymeasures] - Considering the milestones (schedule of regular evaluation and evaluation item) toward strengthening the information security measures of government agencies(Cabinet Secretariat)- Facilitating use of evaluation criteria for information security measures and consideration for improvement of the criteria (Cabinet Secretariat, MIC and METI)

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

16

Specific Measures under “Secure Japan 2007” (4)- Direction of the Measures to be implemented in FY2008 •Based on the improvement of the information security measures implemented in FY2007, in order to facilitate
intensive activity toward FY2008, “Secure Japan 2007” identifies the direction of the measures to be implemented
in FY2008, with priority on “intensive activity to strengthen the information security foundation.”

FY2008 : Intensive activity to strengthen the information security foundation
Intensive efforts for developing and ensuring
human resources engaged in information security- Establishing cross sectoral system that support human resource development
and supporting comprehensive development and ensuring of human resource- Program that facilitate development of advanced IT specialist- Ensuring human resources engaged in information security within government
agency with high priority

Intensive approaches for global diffusion of
information security policy- Enhancement of function of the NISC as a point of contact- Promoting Global Strategy to be developed in 2007.
- Strengthen capability of CSIRT and relevant organizations for
global response, and advancement of information coordination

9 measures

10 measurescomprehensive approaches to improving security of electoronic government- Enhancement of measures to ensure information security of E-Government from the stages of planning and design (Security by design)- Promotion of verification of information risks associated with E-Government and promotion of unification of verification methods- Steady operations of GSOC and strengthening of analysis functions

5 measures

Efforts in FY2008 (the final year of the First National Strategy)
Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

17

2-3 Framework for Assessment and Improvementof Information Security Measures

Basic Framework for Assessment and Analysis
based on Assessment IndicesInformation Security
Policy Council

National Information Security Center(in cooperation among government agencies)

Feedback on the annual plan,etc.

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

Efforts toward improvement

Complementary study[Study andAnalysis Results]

Report to the Policy Council[Assessment andAnalysis Results]

Analysis (on as-needed basis)

Assessment

Understanding data basedon assessment indicesComplementary
study

Developing operation policies

Assessment based on
assessment indices[Data]NISC

Government
Agencies

Annual Plan

National
Strategy

19

PDCA cycle for Information Security Measures[Specific Tasks]

PLAN

Development
Developmentofofbasic
basicplan
plan(three-year
period)(three-year period)

DO

Formulation
Formulationofofannual
annualplan/implementation
plan/implementationofof
ministerial
ministerialmeasures
measures

CHECK

Assessment,
Assessment,etc.
etc.ininaccordance
accordancewithassessment
indiceswith assessment indices(assessment,(assessment,complementarycomplementary
study,
analysis)study, analysis)
Efforts
Effortsfor
forimprovement
improvement

ACT

Feedback
Feedbackon
onthe
thenext
nextplanplan(annual
plan
or
basic
plan)
(annual plan or basic plan)
Basic framework for Assessment,
Analysis and Improvement

PLAN

V
of isua
Aw liza
are tionness

Basic Goal, Necessity for PDCA
Cycle (Chapter 1, Chapter 2)

Risks identified at the time offormulating the basic plan (2006)
Aims in the target year (2009)(Chapter 4)

Procedure
Manual

Details on efforts towards
improvement, such as assessment(Chapter 5)・Assessment Index
・Assessment Procedures, etc.
・Points to Consider When
Conducting Assessment, etc.

The Best Forms of JapaneseSociety and Policy Assessment
from the Perspective ofInformation Security(decided on February 2, 2007)

Formulation
Formulationofofthe
thenext
nextbasic
basic
plan
(three-year
period)plan (three-year period)

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

20

3. Efforts made based on Secure Japan 2007

3-1 Standards for Information Security Measures
for the Central Government Computer Systems

Outline of “Standards for Information Security Measures
for the Central Government Computer Systems”- To achieve sectoral plan for raising the information security level of the whole government, the government
formulates the “Standards for Information Security Measures for the Central Government Computer Systems”(‘Standards for Measures’).
- Each government agencies implements measures according to the Standards for Measures, and the NISC inspects andevaluates the implementation status at the central governments. The ISPC makes recommendations for
improvement based on the inspection/evaluation results.
(1) Supplement standards of government agencies
with the Standards for Measures

Standards for Measures
Providing for the minimum
required standards for themeasures to be taken by thecentral government agencies.

Recommendations for
improvement
Plan• Review standards ofgovernment agencies
according to theStandards for Measures
Plan

Check
Inspect and evaluate theimplementation status

National Information
Security Center (NISC)(Future)Agency A

Standards ofof government
government agency
agencyStandards

Do

Act

Governmental
Agencies

Review of standards ofgovernment agency incompliance with theStandards for Measures

The NISC inspects and evaluates
the implementation status at thecentral government agencies, andthe ISPC makes recommendations
for improvement based on theinspection/evaluation results.

Act(2) Raise each agency’s information security level(Present)
Minimum
required level

Information
security level• Formulate the Standards for Measures• Make recommendations for improvement
based on the results of evaluation on themeasures taken by the central government
agencies.

Agency A

Standards ofof government
government agency
agencyStandards

Current
lowest level

Do
Agency A Agency B Agency CAgency D Agency E Agency F

Check(Future)Information
security level

Information Security
Policy Council (ISPC)(Present)

Defects in information security measures(absence or insufficiency)

Agency A Agency B Agency CAgency D Agency E Agency F
Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

Review of standards ofgovernment agency incompliance with theStandards for Measures
Achievementof higher level

Raise thelowest level23

Framework of Information Security Measures of the Government
Policies of central government
Adopted by the
Information Security
Policy Council on
Sep. 15, 2005

Policy for Enhancement of Information
Security Measures for the Central
Government Computer Systems

Each Government agency
Implementation
framework

Adopted by the
Information Security
Policy Council on
Sep. 15, 2005

Limited version
adopted by the
Information Security
Policy Council on
Sep. 15, 2005.
Full version, firstedition, adopted by
the Information
Security Policy
Council on Dec. 13,
2005.

Guidelines for Formulation
and Implementation ofStandards for Measures（Indicating the implementation
framework）

Basic policies of
the government
agencyFormulating the“standards of thegovernment agency”
completed by all
government agencies
in April, 2006.

Standards for Measures

Standards for measures
implemented by thegovernment agency

Set of individual manuals

Operation procedures by
the government agency(Provided by the NISC)
Providing 25 typesof drafts for the
relevant government
agencies by March,
2006.

Policies of thegovernment agency

To be established by around theend of the first quarter of FY2006
so that selfself-inspection can get
started from the second quarter.
Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

24

3-2 Critical Infrastructure Protection

Outline of “Action Plan on Information Security Measures
for Critical Infrastructures”- The “Special
Special Action Plan on Countermeasures to CyberCyber-terrorism for Critical Infrastructures,”
Infrastructures formulated in December 2000, provided the firstever framework for public and private sector cooperation in protecting seven critical infrastructure sectors from the growing threat of cyber-terrorism.
- However, because of the rapid spread in IT use and increased IT dependence in the critical infrastructure sectors as well as growing interdependence
between these critical infrastructures, a new action plan was formulated based on the “Basic
Basic Concept on Information Security Measures for Critical
Infrastructures (adopted by the ISPC on September 15, 2005).”
2005)
Reviewing
Reviewing thethe target
target sectors
sectors andand threats
threats

Basic Stance

Action Plan¾

Critical infrastructure sectors expanded to ten by adding medical services, water
works, and logistics.

¾

Ten sectors* designated as critical infrastructure sectors and boundaries of the target essential services clearly
demarcated.

¾

Assumed threats expanded from “cyber attacks” to also cover “unintentional
factors” such as human errors and “disasters.”¾

Examples shown of assumed threats and the critical information systems in each sector.

¾

The National Information Security Center (NISC) will formulate the “A Principle for Formulation of ‘Safety
Standards, Guidelines, etc.’ concerning Assurance of Information Security of Critical Infrastructures” by theend of fiscal 2005.

¾

Each infrastructure sector will make efforts to clearly indicate the necessary or desirable standards for
information security measures in the “Safety Standard, Guidelines, etc.” based on the above Principle byaround September 2006.

¾

The systems of information sharing, liaison, and coordination between the public and private sectors, such as
the liaison system used at times of IT-malfunctions, are prescribed in detail.

¾

Efforts will be made to develop CEPTOAR** in each critical infrastructure sector by the end of fiscal
2006.***¾

The discussion about the establishment of the “CEPTOAR-Council” (tentative) will be initiated within the
Cabinet Secretariat.

¾

The effects and the implementation flow of analyses of interdependency are outlined.

¾

Trial analyses of interdependency will be conducted under the initiative of the NISC, starting in fiscal 2006.

¾“Exercises for research” and “tabletop exercises” will be implemented in fiscal 2006 and “functional¾“Exercise implementation plans” will be drawn up in the Cabinet Secretariat. The plans will be made under

Building
Building aa new
new framework
framework1.
1. Raising
Raising thethe information
information security
security level
level¾“Safety Standard, Guidelines, etc.” on technical standards and operational
standards will be formulated and reviewed.

2.
2. Strengthening
Strengthening thethe information
information sharing
sharing frameworks
frameworks¾

The information sharing frameworks will be reorganized and strengthened, andthe quantity and quality of the available information will be increased.

¾

Information-sharing organizations such as a “ISAC (Information sharing andanalysis center)” (tentative) will be established in the respective criticalinfrastructure sectors.
Cross-sectoral information sharing will be promoted (e.g., establishment of the“CEPTOAR-Council” [tentative]).

¾

3.
3. Analyses
Analyses ofof interdependency
interdependency¾

Cross-sectoral status assessment (e.g., analyses of interdependency) of the criticalinfrastructures will be conducted under the initiative of the NISC.

4.
-sectoral exercises
cross
4. Implementation
Implementation ofof crosscross-sectoral
exercises¾

Cross-sectoral exercises will be implemented every fiscal year based on concrete
threat scenarios corresponding to the assumed threats.

exercises” in fiscal 2007.
the supervision of the Cabinet Secretariat with participation by the respective critical infrastructures.

* Telecommunications, finance, civil aviation, railways, electricity, gas, government/administrative
services (including local governments), medical services, water works, and logistics.

** Capability for Engineering of Protection, Technical Operation, Analysis and Response*** The plan for the new sectors is to build the basic consensus on CEPTOAR developmentby the end of 2006 fiscal year and launch the actual development in fiscal 2007.

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

26

Outline of Principles for Formulating the “Safety Standards, Guidelines, etc.”
concerning Assurance of Information Security of Critical Infrastructures
Increased threats of
IT-malfunctions in criticalinfrastructures

Growing interdependence

Increased diversity
in the respective criticalinfrastructure sectors

I Purpose and position
1. For the assurance of information security of critical infrastructures

Critical infrastructures as the basis of people’
people’s social lives
and economic activities

2. Necessity for “Safety Standards, Guidelines, etc”

Since their effects are not obvious, the types and theextent of information security measures to be
implemented is difficult to determine.

3. What is the “Safety Standards, Guidelines, etc.”?
4. Position of the Principles

Cabinet Secretariat

5. Expectations for the formulation and revision of the “Safety Standards, Guidelines,etc.” based on the Principles

Formulation of the Principles
II Items to be defined in the“Safety Standards, Guidelines, etc.”

Purpose: Supporting the formulation and revision of the “Safety
Standards, Guidelines, etc.” in critical infrastructures

1. Scope of the “Safety Standards, Guidelines, etc.” and targeted threats
2. Disclosure of the “Safety Standards, Guidelines, etc.”

The Principles list the desirable issues to be addressed in implementing
information security measures, from a cross-sectoral viewpoint

3. Detailed items

Reviewed annually or as needed(1) Purpose for formulating the“Safety Standards, Guidelines, etc.”

PP

Each critical infrastructure sector
Presiding Ministry or Agency of AA
the relevant critical infrastructure“mandatory standards”, “industry standards”

D
D
C
C

Formulation and revision of
the “Safety Standards, Guidelines, etc.”(2) Targeted scope and assumed threats(3) Respective roles of business entities
engaged in critical infrastructures,
etc.

“Safety Standards, Guidelines, etc.” clearly indicates the level of thenecessary or desirable information security measures in each criticalinfrastructure sector according to the characteristics of the sector.

Reviewed as needed according to the environmental changes
surrounding information security
Business entities engaged
in critical infrastructures“information security measures
implementation standards”(4) Targeted items
1) Four policies
i) Establishment of organizations/frameworks,
and the securing of resourcesii) Measures for protecting informationiii) Measures based on the clarification of
security requirementsiv) Measures taken for information systems
2) Three prioritized itemsi) Measures for ensuring business continuity
when IT-malfunctions occurii) Measures for preventing information leakageiii) Measures for ensuring information security
upon outsourcing

III Follow-ups
Business associations“industry guidelines”(1) Reviewing the Principles (annually or as needed)(2) Continuous verification of the “Safety Standards, Guidelines, etc.”

Making continuous and verifiable efforts toward achieving
Copyrightinfrastructures(c) 2007 National Information Security Center (NISC). All Rights Reserved.
truly reliable critical27

Critical Infrastructures Action Plan
- As respective design drawings for raising the information security level of the ten critical infrastructure
infrastructure sectors (telecommunication, finance,
civil aviation, railways, electricity, gas, administrative services, medical services, water works, and logistics), the government formulates the“ActionAction Plan on Information Security Measures for Critical Infrastructures
Infrastructures..”- The Action Plan aims to protect critical infrastructures not only from (1) cyber attacks but also from (2) suspended services and reduced
function caused by dysfunction of IT arising from unintentional factors and (3) those arising from disasters (ITIT--malfunctions).
malfunctions

New framework to be built under the Action Plan (supported by the four policies)
Strengthening measures at ordinary times

Reflecting theanalysis results

1. Safety Standards, Guidelines, etc.
Safety standard guidelines to be formulated by
the Cabinet Secretariat in 2006
Safety standards to be formulated andreviewed for each sector by September 2006

2. Information sharing frameworks
1. Safety Standards,
Guidelines, etc.
3. Analyses ofinterdependency

Sector A
分野B

Standards for self-inspection of information
security measures used by business entities
engaged in critical infrastructures

Sector B

Sector C

3. Analysis of Interdependency

Inquiry into the possible spread of
threats and IT-malfunctions fromone sector to other sectors

CEPTOAR-Council
4. Cross-sectoral
exercises
Inspection of the effectiveness of
the Action Plan based on analysis
of interdependency

Comprehensive inspections
and improvements

Functions for information sharing and analysis
to be developed for each sector by the end of
FY2006 (basic agreements to be made for thesectors of medical services, water works, andlogistics by the end of FY2006)
Trial analysis of interdependency to be started
by the Cabinet Secretariat in FY2006

4. Cross-sectoral exercises

CEPTOAR

CEPTOAR

2. Information sharing
frameworks
Appropriate sharing of information
on IT-malfunctions through publicprivate partnership

Improving IT-malfunctions
response capabilities

Government

CEPTOAR

Flow ofinformation“Exercises for research” and “tabletop
exercises” to be implemented by the Cabinet
Secretariat in FY2006“Functional exercises” to be implemented by
the Cabinet Secretariat in FY2007

Making a new framework forcritical infrastructure protection
based on public-private partnership
through the implementation of the
Action Plan

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

28

Outline of the “Detailed Rules on Information Connection/Provision under the‘Action Plan on Information Security Measures for Critical Infrastructures’ ”- Critical infrastructures,(*1) which serve as the basis of people’s social lives and economic activities, have recently faced frequent ITITmalfunctions(*2) including information system failures related to securities trading and aviation, and leakage of important confidential
information.
- The “Action Plan on Information Security Measures for Critical Infrastructures” was formulated as an overall plan for protecting criticalinfrastructures against IT-malfunctions (adopted by the ISPC on Dec. 13, 2005).
- Among the items covered, the “Detailed Rules on Information Connection/Provision” provide for the specific items to be implemented by
the framework centering on the Cabinet Secretariat, in order to promote smooth information sharing under the cooperation between the
public and private sectors.
(*1) 10 critical infrastructure sectors: telecommunications, finance, civil aviation, railways, electricity, gas, government/administrative services, medical services, water works, and logistics(*2) “IT-malfunction” is any malfunction (suspended services, reduced function, etc.)that occurs in the operation of critical infrastructures caused by a dysfunction of IT.

Detailed Rules on Information Connection/Provision
Action Plan on Information Security
Measures for Critical Infrastructures(Adopted by the ISPC on December 13, 2005)[Four policies]
1. Improving the “Safety Standards, Guidelines, etc.”
2. Establishing the information sharing system(1) Information provision/connection between
public and private sectors

Promoting smooth information sharing with cooperation between the public
and private sectors so as to make it easier for business entities engaged in
critical infrastructures to maintain and restore their services
Stipulating rules on information provision/connection between the NISC andthe presiding Ministries and Agencies of the relevant critical infrastructures- Setting the extent of information sharing (using the Traffic Light Protocol[see the following page])- Setting the procedures for information connection¾ Setting the common classification/categorization concerning IT-malfunctions for
information connection¾ Acquiring statistical information on occurrences of IT-malfunctions- Setting the procedures for information provision(2) CEPTOAR(3) CEPTOAR-Council
3. Implementing analysis of interdependence
4. Implementing cross-sectoral exercises

Implementing information connection/provision
concerning IT-malfunctions in the respective
critical infrastructure sectors

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

29

(Reference) Outline of the Traffic Light Protocol(Ministry or Agency providing information)[Scope of information sharing](Whole critical infrastructure sector/general public)(Limited)

RED

AMBER

GREEN

WHITE

Information source**[Scope of people

handling information]

Deputy directors general, directors,
NISC ( officials, or liaison personnel)
directly in charge of the sector
relevant to the information source

Information for only
the persons whoneed to know it

Directly-concerned critical infrastructure sectors

Information thatcan be shared
among the persons
concerned at eachlayer

- Presiding Ministry or Agency of the relevant critical infrastructure- CEPTOAR- Members of the business entities constituting the CEPTOAR
directors general, directors, officials, or liaison
NISC ( Deputy
personnel in charge of a directly-concerned sector

Information forthe public(including
publication via
the Internet or
broadcasting))

Other critical infrastructure sectors- Presiding Ministry or Agency of the relevant critical infrastructure- CEPTOAR- Business entities constituting the CEPTOAR

Individuals and associations involved in information security
Deputy directors general, directors, officials, or

NISC ( liaison personnel in charge of the sectors concerned )(Open)***

When the information sharing level to be applied is not specified:
information shall be treated as “AMBER” and the information source (name of the information provider) shall be treated as “RED.”
When the presiding Ministry or Agency of the relevant critical infrastructure implements information connection of “RED” information, theinformation source shall be the presiding Ministry or Agency of the relevant critical infrastructure.

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

30

3-3 International Cooperation/Contribution
concerning Information Security

Circumstances toward the Efforts forInternational Cooperation/Contribution○ Consideration at Information Security Policy Council
・At the meeting of Information Security Policy Council etc, committee member with professional
expertise repeatedly presented opinion that "Adoption of Japanese efforts for information security on
an International Scale is necessary."
・Based on the "First National Strategy on Information Security", it is clearly described to establish basic
concepts for strategic commitment to international cooperation/contribution in "Secure Japan 2007".

○ Consideration at Council on Economic and Fiscal Policy
・On April 20, 2007, Chief Cabinet Secretary announced "Importance of security infrastructure which
support innovation of productivity by utilizing IT - facilitating domestic measures and adoption ofJapanese measures on an International Scale -".
・Decision was made to establish international strategy for cooperation/contribution concerning
information security by July 2007 in the "Program for Enhancing Growth Potential" (April 25, 2007).
・In the Structural Reform of the Japanese Economy : Basic Policies for Macroeconomic Management(June 19, 2007, so-called "Honebuto" policy), it is clearly described that cooperation/contribution with
relevant countries to improve information security posture will be promoted.

○ Establishing efforts for international cooperation/contribution
・Based on the effort and coordination made at that time, intermediary report was submitted at the policy
council held on August 3, 2007.
・Based on the discussion at policy council, with promptly adding specific measures and gaining
cooperation of relevant
agencies,
efforts
for international
cooperation/contribution
will be established.
Copyright(c) 2007 National
Information
Security Center (NISC).
All Rights Reserved.
32

Positioning and Basic Concept of “Efforts for International
Cooperation/Contribution concerning Information Security"
Creating"Global"GlobalEnvironment
Environmentwhere
where
Creating
ITcan
canbe
besafelysafelyandandsecurely
securelyused"
used"
IT

International
International
Cooperation/Contribution
Cooperation/Contribution
Clearly defining
efforts some of which
are not specific enoughup to this time.

（”Effortsfor
forInternational
International（”Efforts
Cooperation/Contribution
Cooperation/Contribution
concerningInformation
Information
concerning
Security”）
Security”）

Items that can be sharedafter verifying effectivenessand efficiency of policy
system and coordinating withthe policy of other countries.
International
Cooperation/
Contribution

First National Strategy
on Information Security

Since IT infrastructure stays
connected to the world for 24 hours
a day, 365 days a year (so-calledborderless), "Global environment
where IT can be safely and securelyused" is important.

① As one of the world's top levelcountries with regard to the usageof IT, Japan should significantly
contribute to establishing "Global
environment where IT can besafely and comfortably used".
② Realizing "Global environment
where IT can be safely andsecurely used" will lead to ensuringsafety and security of Japanesepeople's lives and social andeconomic activity

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

33

“Efforts for International Cooperation/Contribution
concerning Information Security”～5 Directions of the Efforts～○Promoting○Promotingcooperation/contribution
cooperation/contributiontoward
towardimprovement
improvementof
ofbusinessbusinessenvironment
environmentof
ofAsianAsianregion
regionwhere
where
economic
relationships
arecontinuously
being
deepened(SecureAsian
Business
Environment
Initiative)
economic relationships are continuously being deepened (Secure Asian Business Environment Initiative)
・ Through the cultivation of security culture and improvement of the level of information security measures,developing an environment that enables safe and secure business activity.
・ Performing cooperation/contribution such as human resource developments, awareness raising of the generalusers, spreading the best practice of information security measures and promoting voluntary outreaching activities
by regional countries.
○Contributing○Contributingto
toconsiderationconsiderationand
anddiscussion
discussionconcerning
concerningnew
newrights
rightswith
withregard
regardto
toinformation
informationsecurity
security
・ Contribution to global discussion from the point of view of relations with IT usage without any limitation andredemption of the person who suffered from the threat resulting from IT usage.
○Promoting○Promotingefforts
effortsto
torespond
respondto
tothe
thethreats
threatssuch
suchasascybercyberattack
attack(ICT(ICTRisk-free
Risk-freeInitiative)
Initiative)
・ Sharing awareness at high level of international forum with regard to threats resulting from IT such as cyberattack and actively attending to and thus contributing to the discussion to appropriately respond to the threats.
・ Continuously promoting multinational discussion with regard to measures against cyber crimes that will becommitted across border.
○Contributing○Contributingto
toglobal
globalrule
ruleandandstandard
standardwith
withregard
regardto
toinformation
informationsecurity
security
・ Understanding advanced field concerning Japan‘s efforts on information security and identifying ongoing rulesthat can be referred as the best practices.
・ Actively participating in discussion held at international forums and thus contributing to the activity.
○Actively○Activelysubmitting
submittingproposal
proposalto
toand
andparticipating
participatingin
indiscussion
discussionat
atvarious
variousinternational
internationalforums
forums・ More active participation and involvement with existing global frameworks in order to share necessary
information timely and appropriately.
・ Making effort to take the initiative in multinational forums by hosting a multinational forum and leading a
discussion among them.
Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

34

ＡＰＰＥＮＤＩＸ

History and Agenda ofInformation Security Policy Council

History of Information Security Policy Planning at Government
Year
2000

2001

Action Plan to Protect Information Systems against CyberCyber-attacks (2000.1)
Critical Infrastructure Protection

Ensuring IT Security of Government

Special Action Plan on Countermeasures against
CyberCyber-terrorism on Critical Infrastructure (2000.12)

Guidelines for IT Security Policy (2000.7)

Partnership with Private Sector on Countermeasures against
CyberCyber-terrorism on Critical Infrastructure (2001.10)

Action Plan for ensuring IT Security of ee-Gov (2001.10)

Promotion of Measures Related to the Special
Action Plan (2002.11)

Evaluation of Implementation Status of IT Security
Policies of Ministries and Agencies, etc. (2002.11)

2002

2003

2004

Implementation of Vulnerability Test on the Information
Systems of Ministries, Agencies, etc. (2003.8(2003.8-)

e-Japan Strategy II Acceleration Package (2004.2)
Establishment of Advisor on Information Security (2004.4)
Settlement of The Committee for Essential
Issues on Information Security (2004.7)

2005

IT Strategic HQ Decision (2004.12)(2004.12)

2nd Initiative of the Committee for Essential Issues
on Information Security (2005.4)

1st Initiative of the Committee for Essential Issues
on Information Security (2004.11)

Establishment of NISC (2005.4)

Establishment of ISPC under IT Strategic HQ (2005.5)

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

37

History of Information Security Policy Planning at Government(cont’d)Year
2005

Establishment of NISC (2005.4)

Establishment of ISPC under IT Strategic HQ (2005.5)
National Strategy on Information Security

Ensuring Information Security of Government

Critical Infrastructure Protection

Expert Panel on Culture of
Security (2005.11)
Expert Panel on Critical
Infrastructure (2005.12)

Expert Panel on Technological
Strategy (2005.11)

Standards for Information Security Measures for theCentral Government Computer Systems (2005.12)

Action Plan on Information Security Measures
for Critical Infrastructures (2005.12)

2006

The First National Strategy on Information Security- Toward the creation of a trustworthy society - (2006.2)

Secure Japan 2006 (annual plan)- The first step toward a Trustworthy Society - (2006.6)

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

38

Agenda Overview - the Information Security Policy Council
Government Agencies The First Initiative of the Committee
for Essential Issues on Information
Security (November 16, 2004)

Critical infrastructures The Second Initiative of the Committee
for Essential Issues on Information
Unified, cross-governmental
al challenges
Security (April 22, 2005)
to be addressed promptly<Responses to immediate issues>
Adopted by the ISPC on July 14, 2005

Government Agencies
First
First
session Establishment of a comprehensive
session(July 14,2005)

SecondSecondsessionsession(Sept. 15,
2005)

Critical infrastructures

Businesses and individuals

 Establishment of a Principle for the Formulation of“Safety Standards, Guidelines, etc.,” and others
 Discussions toward the revision of the “Special
Action Plan on Countermeasures to Cyberterrorism for Critical Infrastructures”

 Efforts to improve people’s literacy of
information security
 Measures to combat newly emerging
threats, and others

monitoring/warning system, and others
 Formulation of unified
ed standards for
information security measures andcreation of related manuals
Standards for Information Security Measures
for the Central Government Computer Systems

Basic Concept on Information Security
Measures for Critical Infrastructures

Direction of the National Strategy(2005 limited version) Policy for the Enhancement of Information
Security Measures
 Unified standards for information security
measures in the government
Invitation of
public comments

Outline and direction of “The First National
Strategy on Information Security”

 Review of critical infrastructure sectors
 Concrete measures for improving the level of
security

The First National Strategy on Information Security (draft)* Mid and long-term strategy with an overview of information security issues

Measures for critical infrastructure sectors

Third
Third
sessionsession(Dec. 13,
2005)

Standards for Information Security Measures
for the Central Government Computer Systems(December 2005 version [full version; first edition]) Addition of items and improvement ofrules provided in the limited version
 Incorporation of public comments
received
Final decision

 Establishment of a “new public-private
partnership model”
“Realization of an advanced information
security nation”
 Participation of all entities under the
Cabinet Secretariat’s initiative
Decision of putting into practice a draft
public comment

Action plan

Final decision

Invitation of
public comments

The plan-do-check-act cycle
implemented from this fiscal year

Support for the establishment
and review of “Safety
Standards, Guidelines, etc.”

Decision of putting into
practice a draft
public comment

Invitation of
public comments

Public comment

Public comment(final decision planned for around theend of January 2006)

Guidelines

 Safety Standards, Guidelines, etc.
 Strengthening the information
sharing framework
 Cross-sectoral exercises, andothersCommenced from this fiscal year
Evaluated and verified every year

The annual plan formulated
Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

(final decision planned for around theend of January 2006)

Formulated and reviewed
in each sector

39Agenda Overview - the Information Security Policy Council (cont’d)Standards for Information Security
Measures for the Central Government
Computer Systems(December 2005

FourthFourthSessionSession(held in rotation)(held in rotation)version [full version; first edition])

The First National Strategy
on Information Security(Dec.13, 2005)(Feb.2, 2006)

Fifth
Fifth
sessionsessionStatus of the establishment ofstandards for measures implemented
by each government agency and also
the practical framework of its
organization for the implementation(April 28,
2006) Completed by all government agencies(by April, 2006)

Secure Japan 2006 (draft)(held in rotation)(held in rotation)(June 15, 2006)(July 25,
2006)

EighthEighthsessionsession(Oct. 25, 2006)

Giving the publicity to the inspection/evaluation
results regarding the status of information
security measures in each government agency
 Synthetic evaluation of information security
measures regarding terminals and web servers
 Strength/improvement of measures regarding
information control(Feb.2, 2006)(held in rotation)(held in rotation)
Principles for Formulating the “Safety Standards,
Action Plan on Information Security
Guidelines, etc.” concerning Assurance of
Measures for Critical Infrastructures
Information Security of Critical Infrastructures(Dec.13, 2005)(Feb.2, 2006)

 Implementation Plan for FY2006; 133 policies“Establishment of frameworks for security measures in the public
and private sectors”
 Direction for the Priority Measures in FY2007; 26 policies“Enhancing the information security measures in the public andprivate sectors”
Decision of putting into practice a draft public comment

Sixth
Sixth
SessionSessionSeventhSeventhsessionsession(Feb.2, 2006)

FourthFourthsessionsessionDetailed Rules on Information
Connection/Provision Promoting smooth information sharing with cooperation
between the public and private sectors
 Stipulating rules on information provision/connection
between the NISC and the presiding Ministries andAgencies of the relevant critical infrastructures

Implementationof public comments

Secure Japan 2006
(June 15, 2006)

Deciding the establishment of the following expert panels for considering
considering the specific measures
 Expert Panel on Evaluation Indices regarding Businesses and Individuals
Individuals¾ Inspecting/considering evaluation indices with respect to information security measures in the fields of businesses and individuals
 Expert Panel on Systematization of Training Material and Qualification
Qualification¾ Inspecting/considering how to systematize training material and qualification with respect to information security

 Expert Panel on Evaluation Indices regarding the Government Agencies
Agencies¾ Inspecting/considering evaluation indices with respect to information security measures in the government agencies

Presentation on the progress of Secure Japan 2006
 Assessing the progress of the 133 specific measures→ Almost all of the measures are expected to be implemented within
this fiscal year (or within the scheduled date), and Secure Japan 2006
is progressing smoothly overall.

Establishing the Information Security Day

 February 2 is designated as the annual Information Security Day.
 Activities with participation at every level of society are held intensively during
the period around Information Security Day.
 Individuals and groups with outstanding contributions and achievements areawarded.

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

40

Agenda Overview - the Information Security Policy Council (cont’d)Establishing expert panels

Establishing “Information
Security Day”
Day”

Implementation

Secure Japan 2006

Considering concretemeasures(June 15, 2006)(October 25, 2006)

The Best Forms of Japanese Society and Policy Assessment
from the Perspective of Information Security (draft)

Ninth
Ninth
sessionsession(Dec. 13, 2006)

 Expert Panel on Evaluation Indices Regarding
Businesses and Individuals
 Expert Panel on Systematization of Training
Material and Qualification
 Expert Panel on Evaluation Indices Regarding
Government Agencies(July 25, 2006)

Formulation and review ofsafety standards, etc.

 Basic policy for the modality of assessment, “Assessment ofApproaches to Realization of Secure Japan and Promotion of Rationaland Sustainable Improvement”
 Modality of assessment and details of assessment guidelines, “The Best
Forms of Japanese Society and Policy Assessment from the Perspectiveof Information Security”
Decision of putting into practice a draft of public comment

 Report on progress in the formulation
and review of safety standards, etc. in
critical infrastructures
 Explanation on the concept of thereview of the Standards for Measures

Tenth
Tenth
sessionsession(Feb. 2, 2007)

 Reward to contributors to the
Information Security Day Organizing events related toInformation Security Day“Assessment“AssessmentofofApproaches
ApproachestotoRealization
Realizationofof
SecureSecureJapan
Japanand
andPromotion
PromotionofofRational
RationalandandSustainable
Improvement”
Sustainable Improvement”“The“TheBest
BestForms
FormsofofJapaneseJapaneseSociety
Societyand
andPolicy
PolicyAssessment
fromthe
PerspectiveofInformation
Assessment from the Perspective of Information
Security”
Security”(Final decision)

Secure Japan 2007 (draft)
 Implementation plan for FY2007
FY2007； 159 measures

Eleventh
Eleventhsessionsession(Apr. 23, 2007)→ Enhancement of security measures in the public
and private sectors

 Direction for priority measures in FY2007；
FY2007； 24
measures→ Intensive efforts for the enhancement of security
infrastructures

Decision of putting into practice a draft of
public comment

Assessment/Report on
Secure Japan 2006

Feed Assessment/analysis of the result ofback efforts for measures based on four
aspects of Secure Japan 2006:
overall information security policy,
four implementing areas ofmeasures, cross-sectoral
information security infrastructures,and social conditions.

Decision of putting into practicea draft of public comment

Implementation of
public comments

Implementation of
public comments

Report on Information
Security Day

Report of the Expert
Panel on Systematizationof Training Material andQualification (draft)

Presentation on the progress ofthe FY2006 review of theStandards for Measures Consideration of changes intechnology/environment and review inline with practical work are under way.
 Draft revisions of the Governmental
Standards for Measures are scheduled to
be prepared in April 2007.

Standards for Measures(April 2007 version)(draft revision)
 Addition of new items

Preparing for IPv6 migration, measures to avoid
being used as a springboard, development of
information system repository.
 Change/refinement of part of the items

Decision of putting into practice adraft of public comment

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

“Report of the Expert
Panel on
Systematization ofTraining Material andQualification”
Qualification”(Final decision)

Measures for critical infrastructure sectors

Report on the development
progress of safety standards,
etc. and CEPTOAR
Guidelines (draft revision)

Revision of ten sections in the
Safety Standards, etc.
Decision of putting into practice adraft of public comment

41

Agenda Overview - the Information Security Policy Council (cont’d)
TwelfthTwelfthsessionsession(held(heldininrotation)
rotation)

Secure Japan 2007
(Final decision)decision)

Principles for Formulating of ‘Safety
Standards, Guidelines, etc.’
etc.’ concerning
Assurance of Information Security of Critical
Infrastructures (revision) (Final decision)Standards for Measures(Second edition)(Final decision)(June 15, 2007)

Thirteenth
Thirteenthsessionsession(2007.8.3)

Fourteenth
Fourteenthsessionsession(2007.10.3)

Report of theExpert Panel on
Technological
Strategy （Report）
Report）

Setting of specificGoals in Information
Security Measure

International Cooperation
Cooperation
and Contributions inInformation Security

 Setting of goals for the C(Check) in the PDCA cycle
every four priority fields

 Report on progress in theconsideration of our strategy
relating to the International
Cooperation and Contributions

Presentation on the progress of Secure Japan 2007
 Assessing the progress of the 159 specific measures→ Almost all of the measures are expected to be implemented
within this fiscal year (or within the scheduled date), andSecure Japan 2007 is progressing smoothly overall.

Assessment/Report on
Information Security
Management in thegovernment agencies
 Selecting of 44 exemplary
activities
 Of them, five were chosen for
BEST PRACTICE 2007.

Giving the publicity to the inspection/ evaluation results regarding thestatus of information security
measures in each government agency
 Quantitative evaluation of information security
measures regarding terminals and web servers
 Substantial improvement of evaluation results
and advancement of information security
measures in each government agency

Efforts for International Cooperation/Contribution
concerning Information Security (Final decision)
 Secure Asian Business Environment Initiative

Promoting cooperation/contribution toward improvement of business environment of Asian region
 Contributing to consideration and discussion concerning new rights withregard to information security
 ICT Risk-free Initiative

Promoting efforts to respond to the threats resulted from IT such as cyber attack

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

42

Efforts made based on Secure Japan 2006

“Information Security Day”
Decisions made at the eighth session of the Information Security Policy Council on October 25, 2006
From the point of view of disseminating/enlightening widely to the general public on the importance of information security,
February 2 has been designated as annual “Information Security Day.” (* Date on which the First National Strategy on
Information was decided)

During the period before and after Information Security Day, various related events will be intensively held undercooperation among government agencies and other related organizations and institutions.
The Chair will award individuals and groups that have been committed to the promotion of information security andhave particularly made outstanding contributions and achievements.

[Details of the efforts for Information Security Day in FY2006]
Awarding the Information Security Day Award Winners
The Selection Committee was set up in the National Information
Security Center, Cabinet Secretarial to compile the list of the award
nominees, based on the recommendations made by the relevant
ministries that promote Information Security Day (National Police
Agency, Ministry of Internal Affairs and Communications, Ministry of Education,
Culture, Sports, Science and Technology, and Ministry of Economy, Industry andTrade) and the private and public efforts recognized by the Cabinet

Secretariat, pursuant to the decisions made at the eighth session of
the Policy Council.
The Chairman selected the winner of the award from the list of thenominees.
[Award Winners]
Shigeo Tsujii (president, institute of information security)
Norihisa Doi (professor, Chuo University)
Hiroyuki Kuwako (Chairman, Business Morals and Internet Committee,
Telecom Services Association)
Akinobu Kanasugi (the deceased, former president, NEC Corporation)
Toyonaka City, Osaka (local government)

Events related to Information Security Day
With help widely from public and private sectors, events
centered on Information Security Day were held. Awareness of
information security is expected to increase at every level ofsociety.
○Total number of events: 311○Event Period
From January 26 to March 2, 2006
○Locations of Events: 47 prefectures throughout Japan○Types of Events
Seminars, lectures, TV commercials, radio programs, etc.

Cross-sectoral Exercises in the Critical Infrastructure Sectors
Implemented on February 7, 2007 in line with the concept ofInformation Security Day, in view of establishing a framework
for the public and private sectors to work together andimproving its effectiveness

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

44

Overview of the Report of the Expert Panel on Systematization of Training
Material and Qualification(1) Process of Discussions at the Committee
In
In principle,
principle, itit isis necessary
necessary to
to examine
examine thethe best
best forms
forms ofof measures
measures forfor human-resource
human-resource development
development fromfrom thethe long
long term
term view
view point
point by
by
the
state
as
a
whole,
including
the
forms
of
education
inthepracticeofelementary
andsecondaryeducation.
the state as a whole, including the forms of education in the practice of elementary and secondary education.
However,
However, since
since thethe improvement
improvement ofof information
information security
security measures
measures isis anan urgenturgent issue,
issue, thethe committee
committee conducts
conducts intensive
intensive discussions
discussions andandprovidesrecommendations
ontheissuestobeaddressed
andtackled
at
an
early
stage
with
an
aim
to
improve
the
level
of
measuresbyprovides recommendations on the issues to be addressed and tackled at an early stage with an aim to improve the level of measures bydeveloping
developing human
human resources
resources currently
currently available
available inin Japan.
Japan.

It is necessary to secure and improve the awareness and capacity of players who engaged with theiroperations in various social and economic activities, in order to promote the overall information security
Organization (government,
criticalmeasuresof Japan.
Provider of products, etc.
infrastructures, private companies, etc.)

Consultants

Educational
services

Auditors

Consultants

Lecturers(2) Provider of security
products, etc.
(1) Researchers and developersof cutting-edge technologies andadvanced management methods

Vendors, etc. specializing in security
Researchers

General vendors, etc.

Doctoral or
postdoctoral
courses

Graduateschools

Master’s
courses

System Engineers (SEs)
Sales and Marketing

Researchers

Adult
Education
Program

SEs
Sales and Marketing

Provision of products/services/solutions, etc.

Audit
companies

Executive
officers

Directors

Directors

Staff

Staff

(3) Personnel
conducting security
measures(1)Researchers(1)Researchersand
anddevelopers
developersofof
cutting-edge
cutting-edgeinformation
informationsecurity
securitytechnologies
andproducts
technologies and productsand
andadvancedmanagement
methods
advanced management methods

Executive
officers

CISO
Security
Department

Directors

Directors

Staff

Staff

Qualification
SystemFreshman
Employees

Universities

Part-timeWorkers
Unemployed
Persons

Vocational schools
High schools

Three
Threecategories
categoriesofofpersonnel
personnel
engagedininformation
engaged in informationsecurity
security
operations
operations(2)Human(2)Humanresources
resourcesininprivate
privatecompanies,
etc.
that
providecompanies, etc. that provide
products,
products,services,
services,solutions,solutions,etc.
etc.
for
information
security
for information security(3)Human(3)Humanresources
resourcesengaged
engagedinin
information
informationsecurity
securitymeasures
measuresininorganizationsorganizationssuch
suchasasgovernment
government
agencies,
privatecompanies,
agencies, private companies,etc.
etc.

In each human resource category, current situations and issues are analyzed and necessary response measures are considered.
Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

45

Framework of Critical Infrastructure Measures～Promotion through Organic Coordination of Four Measures～• •As
Asrespective
respectivedesign
designdrawings
drawingsforforraisingraisingthe
theinformation
informationsecurity
securitylevel
levelofofthe
thetentencriticalcriticalinfrastructure
infrastructuresectors
sectors(telecommunication,(telecommunication,finance,
finance,civil
aviation,railways,electricity,gas,administrative
services,
medicalservices,
water
works
and
logistics),
thegovernment
formulates
civil aviation, railways, electricity, gas, administrative services, medical services, water works and logistics), the government formulatesthethe“Action“ActionPlan
PlanononInformation
InformationSecurity
SecurityMeasures
Measuresfor
forCritical
CriticalInfrastructures.”
Infrastructures.”• •TheTheAction
ActionPlan
Planaims
aimstotoprotect
protectcriticalcriticalinfrastructures
infrastructuresnot
notonly
onlyfromfrom(1)(1)cybercyberattacks
attacksbut
butalsoalsofromfrom(2)(2)suspended
suspendedservices
servicesand
andreduced
reducedfunctioncausedbydysfunctionofIT
arising
fromunintentional
factors
and
(3)
those
arisingfromdisasters(IT-malfunctions).
function caused by dysfunction of IT arising from unintentional factors and (3) those arising from disasters (IT-malfunctions).Promotion
Promotion
throughthroughorganicorganiccoordination
coordinationofoffour
fourmeasures,
measures,while
whilemaintaining
maintainingclose
closerelations
relationsbetween
betweenpublic
publicand
andprivate
privatesectors.
sectors.
[The Situation to Be Achieved in Three Years]
Cyberattacks

Action Plan on Information Security
Measures for Critical Infrastructures

Realization of more solid and truly dependable
IT infrastructures in critical infrastructures
through the organic coordination of fourmeasuresIT-malfunctions
caused bydisasters(Adopted by the ISPC on Dec. 13, 2005)[Four policies]
1. Enhancement of the “Safety
Standards, Guidelines, etc.”
2. Establishment of the information
sharing system
3. Implementation of analysis ofinterdependence
4. Implementation of cross-sectoral
exercises[Objectives]

IT-malfunctions
caused byunintentional
factors

Yearly improvement in aspiral manner

Do

Plan

Act

Check

[Current Situations]・Importance of an approach to foster common awareness about basic concepts ofcritical infrastructures protection and required measures, taking
taking thecharacteristics of threats causing IT malfunctions into account・Necessity of expanding potential supposed threats and enhancing measuresagainst events that may potentially have a largelarge-scale impact on a wide area
・Necessity of enhancing information security measures within the framework ofcommunication/cooperation and information sharing

The central government will make efforts aiming to reduce the number of occurrence of ITmalfunctions in critical infrastructures as close as possible to zero by the beginning of FY2009
Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

46

Formulation and Review of Safety Standards, Guidelines,
etc. for Critical Infrastructures
Formulation and review of the Safety Standards, etc. were completed in all the areas within FY2006, including theareas in which there had not been Safety Standards, Guidelines, etc. at the time of the formulation of the action plan.
Sectors

Telecommunic

The Fourth Session of the Information
ation
Security Policy Council(February 2, 2006)
A decision was made on the “Principles
for Formulating ‘Safety Standards,
Guidelines, etc,’ concerning Information
Security Assurance of Critical
Finance
Infrastructures”

Critical infrastructures
Stipulation of the required or desirable
level of information security measures inthe ‘Safety Standards, Guidelines, etc.’

Plan
Act

Do
Check

Formulation/
Names in the Safety Standards, Guidelines, etc. [Main body of issuance] Review
StatusTelecommunication Business Act, Regulations for Enforcement of the Telecommunication Business
Act, and Regulations for Telecommunications Facilities for Telecommunications Business, etc.
Implementation(including related notices)
CompletedStandards for Information and Communication Network Security/Reliability [MIC]
Safety Standards for Information Security Assurance in Telecommunication (1st edition) [ISeCT] (*1)
Guidelines for Formulating “Safety Standards, Guidelines, etc.” for Information Security Assurance of
Implementation
Information Infrastructure in Broadcasting [Japan Broadcasting Corporation (NHK), National
Completed
Association of Commercial Broadcasters in Japan ]Manual for Formulating Security Policies in Financial Institutions, etc. [FISC] (*2)
Implementation
FISC Security Guidelines on Computer Systems for Financial Institutions [FISC]
Completed
Manual for Formulating Contingency Plan in Financial Institutions, etc. [FISC]

Civil aviation

Safety Guidelines for Information Security Assurance in Air Cargo Business [MLIT]
Safety Guidelines for Information Security Assurance in Air Traffic Control System [MLIT]

Implementation
Completed

Railways

Safety Guidelines for Information Security Assurance in Railway Area [Railway businesses, etc.]

Implementation
Completed

Electricity

Guidelines for Technical Levels/Operation Standards in Electronic Control System, etc.
[Federation of Electric Power Companies ]Implementation
Completed

Gas

Guidelines for Information Security Measures for Control Systems for Production/Supply[Japan Gas Association]

Implementation
Completed

Administrative Guidelines for Information Security Policy in Local Governments [MIC]
services
Medical
Guidelines concerning Safety Control of Medical Information Systems [MHLW]
services

Implementation
Completed

Implementation
Completed
Implementation
Water works Information Security Guidelines for Water Systems [MHLW]
Completed
Implementation
Safety Guidelines for Information Security Assurance in Distribution Systems [MLIT]
Logistics
Completed(*1) ISeCT: Information Security Conference on Telecommunications （*2) FISC: Center for Financial Industry Information Systems

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

47

Revision of the “Principles for Formulating ‘Safety Standards, Guidelines, etc.’
concerning Information Security Assurance of Critical Infrastructures”
By regularly following the occurrences of [stationary] IT malfunctions, analyses and examinations were conductedon the cross-sectoral issues related to the measures commonly found in each critical infrastructure; then, therevisions in the Principles were made on the following points (June 2007).

１．Analysis of occurrences of stationary IT malfunctions(1) Suspension/reduction of services due to system malfunction
z Load balancing and redundancy to ensure availability
z Ensuring processing performance and system quality as an exemplification of
measures(2) Communication disruption due to Taiwan earthquakez The threats which may cause IT failure do not always come from within the country(3) Information leakage by using file-swapping softwarez Prevention of occurrence and recurrencez Preventive measures against information leakage applied for contractors

2. Examination of related documents(1) Safety Standards, Guidelines, etc. in each critical infrastructurez Conducting self-assessments and audits

3. Examination of changes in social conditions (environment)(1) Movements regarding risk managementz Deployment of PDCA cycle (Business Continuity Plan)(2) Movements in the overall critical infrastructuresz IT-dependent black-boxing and expansion and advancement of the scope of
application(3) Efforts based on the Action Plan for Critical Infrastructuresz Consensus on the development of CEPTOAR

Revised partsz “Four pillars: iii) Measures based on theclarification of security requirements”
z “Four pillars: iv) Measures taken for
information systems”
z “Four pillars: iv) Measures taken for
information systems”
z “Three prioritized items: ii) Measures forpreventing information leakage”
z “Three prioritized items: iii) Measures for
ensuring information security by outsourcing”

z “Four pillars: i) Establishment oforganizations/frameworks, and the securingof resources”

z “Three prioritized items: i) Measures for
ensuring business continuity when ITmalfunctions occur”
z “Four pillars: iv) Measures taken for
information systems”
z “Follow-ups”

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

48

Overview of “Cross-sectoral Exercise” and “Analysis of
Mutual Dependency” in Critical Infrastructures
 With respect to “Cross-sectoral Exercise” and “Analysis of Mutual Dependency,” functional exercises (*1) will be conducted in FY2007 based on the practical With respect to “Cross-sectoral Exercise” and “Analysis of Mutual Dependency,” functional exercises (*1) will be conducted in FY2007 based on the practicalscenario in common and in different areas to examine the issues in organizational management and technologies. Mutual dependency will be analyzed to deepen the
scenario in common and in different areas to examine the issues in organizational management and technologies. Mutual dependency will be analyzed to deepen thediscussion about types of threats, causal relationships between threats and malfunctions, and relationships between malfunctions and business continuity, and to
discussion about types of threats, causal relationships between threats and malfunctions, and relationships between malfunctions and business continuity, and to
examine and conduct dynamic analyses of those elements, following consideration of the conducting method.
examine and conduct dynamic analyses of those elements, following consideration of the conducting method.
 In FY2007, study groups will be set up in the Information Security Center, Cabinet Secretariat in order to conduct specific discussions in line with the action plan, In FY2007, study groups will be set up in the Information Security Center, Cabinet Secretariat in order to conduct specific discussions in line with the action plan,with the help of competent agencies of critical infrastructures, business entities associated with critical infrastructures, CEPTOAR, etc. The study groups (*2) willwith the help of competent agencies of critical infrastructures, business entities associated with critical infrastructures, CEPTOAR, etc. The study groups (*2) willconsists of intellectuals with professional knowledge, competent agencies of critical infrastructures, business entities associated with critical infrastructures,consists of intellectuals with professional knowledge, competent agencies of critical infrastructures, business entities associated with critical infrastructures,
CEPTOAR, etc.
CEPTOAR, etc.
(*1) Exercises to examine in a simulated manner using the command and decision-making function of the actual organization(*2) The Cross-sectoral Exercise Study Group consists of exercise coordinators, and researchers and specialists with knowledge on systems and functions in various sectors, such as disaster prevention, crisis
management, risk management and BCP. The Study Group for Analysis of Mutual Dependency consists of researchers and experts with knowledge on systems and functions in such areas as mutual
dependency analysis, and researchers and experts in BCP, etc.

<FY2007 and Onward><FY2006>

Action Plan on Information
Security Measures for Critical
Infrastructures(Adopted by the ISPC on Dec. 13, 2005)[Four policies]
1. Enhancement of the “Safety Standards,
Guidelines, etc.”
2. Establishment of the information sharing
system(1) Information provision/connection
between public and private sectors(2) CEPTOAR(3) CEPTOAR-Council
3. Conducting analysis of interdependence
4. Conducting cross-sectoral exercises<Establishing Collaboration>~Efforts contributing to thesetting of a framework for public
and private collaboration~<Examination and Improvementof Communication>~Efforts for improving
effectiveness of the framework of
public and private collaboration~<Examination and Improvement ofcapabilities>~ Efforts to improve the capability of apublic and private collaboration
framework ~Research-oriented Exercises
Research-oriented
Creationof scenariosExercisesforCreationof scenarios
for ondesktop exercises,
focusing
desktop
exercises,
focusing on
theconceptof implementation
conceptsettingof implementation
ofthe
exercises,of exerciseof exercises,
setting of of
exercisetasks
and understandingthetasks and
understanding
exercisemethod,etc, thus of theexercise method,
etc, thus
contributing
to the development
the development
ofcontributing
a public andtoprivateof a public andprivatecollaboration
framework
collaboration framework

Desktop Exercises
Desktop Exercises
Contribution
to improvement ofContribution
improvementofeffectivenessofto
a public
and private
effectivenessframeworkof a publicthroughand private
collaboration
collaboration
throughexaminationof framework
the information
examinationof public
the information
sharing
betweenand private
sharing between public and private
sectors, etc. and identification ofand identification
sectors
issues,in, aetc.
setting
where exerciseof
issues, in adiscuss
setting issues
where inexerciseparticipantsaparticipants
discuss
issuesin aconference, based on one scenario
conference, based on one scenario

Functional Exercise
Functional Exercise
After developing CEPTOAR, capability
After developing CEPTOAR, capability
examining exercise will be conductedexamining exercise will be conductedbased on the exercise scenario in common
based on the exercise scenario in commonand different areas to examine the issues
and different areas to examine the issues
involved in organizational management andinvolved in organizational management andtechnologies, thus contributing to thetechnologies, thus contributing to theimprovement of a public and private
improvement of a public and private
collaboration framework capability.
collaboration framework capability.

*3*4

Static Analysis
Static Analysis
Qualitative
understanding of potential threats to critical
Qualitative understandingof potential
threatsconcerning
to critical theinfrastructures
and the relations
among sectors
infrastructuresandtherelationsamong
sectorstheoccurrence of and recovery from malfunctions inconcerning
criticaloccurrence of and recovery from malfunctions in criticalinfrastructures
infrastructures*3*4

Dynamic Analysis
Dynamicand
Analysis
Temporalquantitative
Temporal andunderstanding
ofquantitative
chain transmissions ofunderstanding
of in
chain
transmissions ofdynamic obstacles
critical
dynamic
obstaclesincriticalinfrastructures
infrastructures(*3) Knowledge of assumed threats and scenario assumption(*4) Provision of viewpoints of analysis at the next step through examinations of issues

Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

49

Review of the FY2007 Standards for Measures
The following revisions were made at the Information Security Policy Council - 12th session (June 2007):
1. Feedback of the changes in technology and environment1) Responses to the deployment of IPv6 into information systems (6.2.3) (new)Addition of measures for information systems where IPv4 and IPv6 co-exist, in response to the penetration of IPv6 products2) Measures to avoid being used as a springboard (4.2.4) (new)Addition of measures to prevent the government information systems from being used by a third party for unintended purposes (springboard)3) Use of encryption module test and authentication system (4.1.6)
Stipulation in view of full-scale use of an encryption module test and authentication system in Japan based on ISO/IED 19790

2. Review, etc. for practical operation

1) Development of an information system repository (4.3.1) (new)Regarding government agency information systems, rule is added defining that information handled by those systems must be
managed and classified in an integrated fashion.

2) Review of rules concerning handling information (1.1.3 3.2.4 3.2.5, etc.)
Review of the scope of confidentiality class-2, approval/notification procedures for transfer/provision of information

3) Enhancement of physical measures of information systems (5.1.1)
Changing the category of “physical isolation and access control of information systems and theft-prevention measures” from the
Enhanced Requirements to the Basic Requirements

4) Stipulation of an information security auditing system (2.3.2)
Positioning of the information auditing system and clarification of the relationship with self-assessment

5) Stipulation of the management and control method of data encryption (4.1.6)
Stipulation that the management and control method of data encryption shall be determined by the government, instead of being selected at
the discretion of each employee6) Other
Improvement in the wording
Copyright (c) 2007 National Information Security Center (NISC). All Rights Reserved.

50