Information Security Outreach and Awareness
ProgramJuly 8, 2011
Established by the Information Security Policy Council

Table of contents

1.

Preface ...................................................................................................................... 3

2.

People and enterprise awareness of information security ................................................ 4

3. Previous approaches and issues dissemination of and enlightenment on information
security ............................................................................................................................ 8

4.

5.

(1)

General pubic ...................................................................................................... 8(2)

Senior citizens ..................................................................................................... 8(3)

Teachers ............................................................................................................. 9(4)

Pupils and students .............................................................................................. 9(5)Households ......................................................................................................... 9(6)Enterprise management ........................................................................................ 9(7)Enterprise employees ......................................................................................... 10

Environmental changes around information security .................................................... 11(1)

Environmental changes ...................................................................................... 11(2)

User changes ..................................................................................................... 11(3)

Information security threats with more complexity and diversity ............................ 11

Basic approach ........................................................................................................ 13(1)

Definition of "Culture of Information Security" .................................................... 13(2)

6 principles of "Culture of Information Security" .................................................. 14

1)
Awareness ..................................................................................................... 14
2)
Responsibility ................................................................................................ 14
3)
Response ....................................................................................................... 14
4)
Cooperation ................................................................................................... 14
5)
Ethics............................................................................................................ 14
6)
Reassessment................................................................................................. 14(3)
Approach for establishing "Culture of Information Security" ................................. 15

6.

1)
Establishment of "Culture of Information Security" while promoting the use of information
communication technologies ........................................................................................ 15
2)
Establishment of constant endeavors ................................................................ 15
3)
Promotion of measures fine-tuned for the usage of information communication
technologies ............................................................................................................ 16
4)
Promotion for the IS indifferent group.............................................................. 16
Promotion system and scheme ................................................................................... 18(1)

Establishing the HR Expert Committee for Outreach and Awareness (tentative name)18(2)

Organization networks ....................................................................................... 18

1

7.

8.

(3)

Policy effectiveness measurements ...................................................................... 18(4)

Follow-up and review of the outreach and awareness program ............................... 18

Points in promoting the outreach and awareness program............................................. 20(1)

Reinforcement of public-private sector collaboration ............................................ 20(2)

Reinforcement of international collaboration ........................................................ 20

Specific efforts......................................................................................................... 21(1)

General and intensive outreach and awareness ...................................................... 21

1)
Enhancement of "Information Security Awareness Month"................................. 21
2)
October for the "Information Security Awareness Month" .................................. 21(2)
Dissemination among and enlightenment of general public .................................... 22
1)
Enhancement of "Website on Information Security Awareness Raising" .............. 22
2)
Self diagnosis check list .................................................................................. 22
3)
Materials for senior citizens ............................................................................ 22
4)
Dissemination among and enlightenment of the IS indifferent group and others ... 22
5)
Enhancement of Information Security Consultation Service ............................... 23
6)
Collecting and sharing information security incident cases ................................. 23(3)
Education enhancement and learning opportunities of information security ............. 24
1)
Enhancement of information security education ................................................ 24
2)
Enhancement of information security education materials .................................. 24(4)
Dissemination among and enlightenment of enterprises......................................... 24
1)
Awareness raising of management ................................................................... 24
2)
Measures for small to medium-sized enterprises................................................ 25(5)
Cyber crime prevention campaign ....................................................................... 25
1)
Information security courses ........................................................................... 25
2)
Promotion of cybercrime damage prevention measures ...................................... 25
3)
Promoting cyber volunteer training .................................................................. 25(6)
Incentive scheme for promoting outreach and awareness ....................................... 25
1)
Commendations and information security contests ............................................ 25(7)
Reinforcement of international collaboration ........................................................ 26
1)
2)
3)
4)

Reinforcement of Japan - ASEAN collaboration................................................ 26
Reinforcement of Japan - APEC collaboration .................................................. 26
Reinforcement of Japan - West collaboration .................................................... 27
Outreach and Awareness portal site in English .................................................. 27

2

1.

Preface
As economic activities and social life have been increasingly relying on
information communication technologies in recent years, information security risks
have also been becoming more complex and diverse. Therefore, it is an urgent matterto establish information security that is far superior to the current practice. In response
to such changes in the social situation, the Information Security Policy Council(Chairperson: Chief Cabinet Secretary) has developed the "Information Security
Strategy for Protecting the Nation" (May 11, 2010, hereinafter "Strategy") and theannual plan of information security strategy the "Information Security 2010" (July 22,
2010, hereinafter "Annual Plan") to promote general information security policies
among public and private sectors.
Dissemination of and enlightenment on information security is one of theparticularly important policies and there have been various measures taken in theconcerned agencies in order to secure and improve the overall information security
level in Japan and to fulfill our role and responsibilities in the international society.
However, information security is a broad and varied area and cannot be understoodand correctly dealt with without technical and specialized knowledge. Also, effects of
our activities for outreach and awareness so far have not been enough.
Therefore, the "Information Security Outreach and Awareness Program"(hereinafter "Outreach and Awareness Program") is developed to systematicallyorganize outreach and awareness policies based on the Strategy and Annual Plan andexecute more effectively under close collaboration of public and private sectors.

3

2.

People and enterprise awareness of information security
Roles of "information" in people's lives have become very important and people's
lives are increasingly dependent on information communications technologies.
Protecting people's information assets and establishing information security havebecome more crucial than ever since rights and benefits of people as the users of theinformation communications technologies must be protected. At the same time anenvironment should be established for the people who are aware of risks concerning
information communications technologies can apply information security measures.
Currently, approximately 80% of individuals and enterprises have concerns in
information security, and this issue should be resolved quickly for the further promote
the use of information communication technologies. Therefore, it is extremely
important to vigorously promote dissemination of and enlightenment on information
security.

Figure 1-1. Concerns about safety of information communications (individuals)1

Figure 1-2. Concerns about safety of information communications (enterprises)2

1

Source: "Research on Safe and Secure Use of ICT in the Ubiquitous Net Society" (2009) by the Ministry of Internal Affairs andCommunications
2
Source: "Research on Safe and Secure Use of ICT in the Ubiquitous Net Society" (2009) by the Ministry of Internal Affairs andCommunications

4

While individuals and enterprises are highly concerned about information security
in Japan, approximately 80% of households have implemented some form of
information security measures.
0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

80.2%

Measure is taken

13.7%
6.1%

Nothing is done
No answer

Anti-virus installation

53.4%
37.6%

Not to open unsolicited e-mails, attachments, and HTML files

23.7%
13.8%
8.3%
4.9%
4.1%

OS and browser updates
File backup
E-mail software updates and changes
Different passwords for each account
Periodical password changes

Figure 2-1. Security measures application (households) (multiple-choice question)3
0%

10%

20%

30%

40%

50%

60%

70%

80%

Measure is taken
Nothing is done
Do not know

100%

96.4%
2.2%
1.4%

Anti-virus installation on terminals such as PCs (OSes, software, etc.)

83.6%
70.3%

Anti-virus installation to servers

45.3%
45.2%
38.8%

Security policy development
OS security patch application
Employee training
Data and network encryption

22.9%
21.9%

Security audit

Figure 2-2. Security measures application (enterprises) (multiple-choice question)

3

90%

Source: "Communications Usage Trend Report 2010" (2011) by the Ministry of Internal Affairs and Communications.

5International comparison shows Japanese have the least confidence in safety of
information communications as 34.3% among 7 most advanced countries in ICT(Japan, U.S.A., U.K., Korea, Singapore, Denmark, and Sweden).

Figure 3. International ranking of confidence in information communications4

Also another research over 12 countries found only 11% (lowest among 12
countries) of Japanese answered "My computer has been remotely hacked" whereas
55% (highest among 12 countries) of them answered "Concerned about safety of myprivate information". This shows that Japanese information communication
technology users do not always relate the secure state to the sense of security;
therefore, outreach and awareness should also target to improve the sense of security
in addition to the promoting security measures.

Figure 4. Relationships between "Experience of the own PC being hacked" and "Safety of private
information"545"International Comparison of ICT Trend" by the Ministry of Internal Affairs and Communications (2009)
Source: "Norton Online Living Report 2009" by Symantec (2009).

6

7

3.

Previous approaches and issues dissemination of and enlightenment on information
securityThis chapter describes the previous approaches and issues dissemination of andenlightenment on information security for each intended subject.

(1)

General pubic

Most popular concerns about Internet among general public are "Virus infection","Don't know which security measures are needed", and "Security threats are too difficult
to understand"6.
On the other hand, another research shows7 the sense of insecurity in the use of
information communication technologies is higher among users with little andinfrequent experience in the Internet whereas it becomes lower as users gain moreexperience and use information communications more frequently.
Therefore, it is important to promote the proactive use of information
communication technologies and encourage users with little interest in information
security (hereinafter "IS indifferent group") to gain more experience and naturally
learn the necessary practice. Information security should be communicated with plain
and simple languages without causing the sense of anxiety unnecessarily. A point ofcontact may be established to give advice to users concerned about information
security.
It is also very important that users should be made aware that leaving their own
virus infection makes themselves part of the attackers such as spreading the virus,
transmitting e-mail spam, illegal access, DoS attacks, etc. without knowing as it was
shown in the recent spread of bots8.
The government has been making outreach and awareness efforts though various
seminars and websites. Appropriate information should be provided to all individuals
though different methods to promote understanding of the IS indifferent group.

(2)

Senior citizens

Aging is rapidly progressing in Japan and it is very important to accelerate
information security measures in senior citizens. The approach should be worked out
carefully and must be communicated intelligibly, in plain language, and patiently forsenior citizens. Special consideration should be given to avoid the situation where
they feel scared of using information communications technologies due to difficult
terminologies in the Internet and fail to get the benefit they could have enjoyed.

6

Source: "Communications Usage Trend Report 2009" (April 2010) by the Ministry of Internal Affairs and Communications.
Source: "Research on Safe and Secure Use of ICT in the Ubiquitous Net Society" (March 2009) by the Ministry of Internal
Affairs and Communications
8"Bots" were malware that the malicious third party can remotely control the infected computer through the internet.
7

8

(3)

Teachers

According to the research by the Ministry of Education, Culture, Sports, Scienceand Technology, 30% of teachers9 are not confident in their educational abilities in
information ethics 10 and the use of information communication technologies.
Teachers' knowledge in information security is not sufficient to teach pupils andstudents who are digital native. Also, schools are the place where sensitive personal
information of students is handled, and teachers are responsible for appropriately
managing the information. It is important to provide appropriate information
concerning information security at the right time to teachers who are guiding pupils
and students, and managing information.
(4)

Pupils and students

Outreach and awareness in schools should be effective to raise awareness of
information security among the young generation. Education on information ethics
has been incorporated into Government course Guidelines and proactive outreach andawareness efforts to promote information security should be continuously made.
(5)

Households

Outreach and awareness in households should be necessary to raise awareness of
information security among the young generation. According to the research by the
Cabinet Secretariat 11 parents' concerns on the children's use of the Internet are"Giving the name and address too easily" and "Virus infection". To the question who
knows the Internet more, the answer is increasingly "Children" as the children's grade
increases. Meanwhile, only about a half of households have any rules for the use ofmobile phones and personal computers in place. This shows that outreach andawareness in households are still an important issue.
(6)Enterprise management

Enterprise management should develop profound understanding that establishingand maintaining information security is the enterprise's management issue. Should alarge scale information leakage occur in today's environment where nationalawareness of information security such as private information protection is high, it isunavoidable that the leakage will become a critical problem that directly impacts theenterprise management.
On the other hand, establishing and maintaining information security is vital forenterprise management regardless of the size of the enterprise in order to protect
intellectual assets such as technical information, remain highly competitive, anddevelop the enterprise further.
Vitality of Japanese economy depends upon management ' attitude to proactively
establish and maintain information security as their own problem without leaving it to9

Teachers in public schools (elementally, junior high, high, secondary education, and special support education schools) in Japan.
Basic concept and attitude for appropriate activities in the information society
11
Source: "Internet Usage by Youth Report 2009" (March 2010) by the Cabinet Secretariat
109employees or related companies.
(7)

Enterprise employees

More than 40% of enterprises identified low security awareness among employees
as the problem in the use of information communication networks. This is particularly
serious problem in small to medium-sized enterprises with limited human resources,
and special considerations should be given in dissemination of and enlightenment on
information security.
The following common issues are also pointed out in addition to the above issues
specific to the subject.
Sharing lessons learned from information security incidents
In today's world with highly developed information communication technologies,
an information security incident on an individual or enterprise may spread across thewhole society. It is very important for everyone to apply information security
measures to prevent an incident from occurring, and be ready to respond swiftly after
an incident.
However, currently the lessons learned from information security incidents are notshared among organizations and individuals. It is important to learn from such lessons
to reinforce information security measures.

10

4.

Environmental changes around information security
The implemented environments and users of information communication
technologies, and changes in information security threats should be considered as
described below when examining the specific approach for dissemination of andenlightenment on information security.

(1) Environmental changes
There are 94 million Internet users in Japan in 2010. The diffusion rate is 78.0% of
the population, and more than 60% use the Internet with their mobile phones. The
number of SNS users are expected to raise rapidly due to the development of themobile environment as their functionalities develop further such as smartphones,
while new media such as social network services (hereinafter "SNS") are becoming
popular.
The environment of information communications technologies is rapidly becoming
more complex and diverse as indicated by the expanding use of cloud computing.
Information security threats to users are changing day-to-day as new services emerge
and information communication devices become diverse.
(2)

User changes

The Internet usage is growing most rapidly in the generation over 60. The Internet
usage of senior citizens is expected to continue rising as the aging progresses.
Also, 80% of elementary school pupils, approximately 85% of junior high school
pupils, and 90% of high school pupils use personal computers and most of those use
the Internet. Also the use of the Internet with mobile phones is high in the young
generation. Those digital natives12 are building the network using SNS through newsocial media such as social games, micro blogs.
While emerging new users and diverse life styles will increase socioeconomic
activities' dependency on the Internet, a growing number of users with low
information security awareness will also increase risks such as unintended personal
information leakage and malicious falsification of information.
(3)

Information security threats with more complexity and diversity

12"Digital natives" are the generation who were born in and grew up in the environment with the Internet and personal computers.
They have familiarized themselves with mobile phones, homepages, and Internet search engines ever since they were very young,and are able to skillfully use social media such as blogs, SNS, and movie sharing sites, and cloud computing. (Source: Researchcommissioned by the Ministry of Internal Affairs and Communications "Social Media Usage Report" on March, 24, 2010)11

Previously computer viruses only caused problems on the infected computers andspread themselves; however, in recent years, a type of viruses called Bots is spreading.
The malicious third party can remotely control the infected computers via the Internet.
The attackers launch DoS attacks on web sites and transmit e-mail spam by remotely
controlling many infected computers.
Meanwhile, viruses with multiple infection routes and viruses designed to attack a
specific organization or system have emerged and there was an extremely
sophisticated large scale attack (Stuxnet) on the control system of plants which are
not connected to the Internet occurred overseas. Therefore, we must respond to
attacks which were previously unthinkable.

12

5.

Basic approach
The following describes the government's basic approach to promote disseminationof and enlightenment on information security based on the environmental changes of
information security and the past approach and issues concerning information security
outreach and awareness.

Basic policies
Information security measures for government agencies and critical infrastructure
are the area where the government takes initiative. On the contrary, information
security measures for individuals and enterprises are their initiative based on theindividual's behavioral principles, and are the area where the government should
provide active support. Therefore, dissemination of and enlightenment on information
security are not particular matters which should be left to individuals or enterprises.
The outreach and awareness program defines common sense, manners, and customsof information security for each subject as "Culture of Information Security", anddescribes where to focus and what to do in order to spread this "Culture ofInformation Security". When this "Culture of Information Security" takes root inJapan, dissemination of and enlightenment of information security are in progress.
"Culture of Security" is a concept proposed in OECD (Organization for Economic
Co-operation and Development) in 2002. It is defined as "a focus on security in thedevelopment of information systems and networks, and the adoption of new ways ofthinking and behaving when using and interacting within information systems andnetworks". This concept is very important in dealing with the ever-changing
information security environment and it has been mentioned in the "First National
Strategy on Information Security" (February 2006) to disseminate it.
However, public awareness of information security has not been raised as it was
revealed by the recent events. We should renew our efforts to define and spread"Culture of Information Security".
(1) Definition of "Culture of Information Security""Culture of Information Security" in Japan is defined as follows based on the Basic
Act on the Formation of an Advanced Information and Telecommunications Network
Society (Act No. 144 of 2000) Article 22 (Ensuring of Security of Advanced
Information and Telecommunications Networks, etc.)13.
"Culture of Information Security" is "ways of thinking and behaving for security
and reliability in development and operation of information communication networks,
and the safe and secure use of people's information networks".

13

Basic Act on the Formation of an Advanced Information and Telecommunications Network Society
Article 22
Strategies developed to form an advanced information and telecommunications network society shall ensure that action is taken
to achieve and maintain security and reliability of advanced information and telecommunications networks, to protect personal
information and other actions necessary to enable citizens to use such networks without anxiety.

13

(2)

6 principles of "Culture of Information Security"

The following are 6 principles of "Culture of Information Security" and should beestablished in day-to-day socioeconomic activities.
1) Awareness
Users of information communication technologies should be aware of what
they can do to secure and reinforce safety and reliability in the development,
operation, and use of information communication networks. Users should beaware of information security risks and available preventive measures first. Also
they should be aware that they might cause a nuisance to other users by not
applying their own information security measures because they are all connected
via information communication networks.
2) Responsibility
Users of information communication technologies should be aware of their
responsibilities to secure safety and reliability of information communication
networks according to their roles. They should be aware of their responsibilities
according to their roles such as ones who implements should endeavor to
implement and operate safe and secure information communication network
systems, and ones who uses should endeavor to use the information
communication networks in the latest and safe status.
3) Response
Users of information communication technologies should be aware of thechanges caused by the progress of information communication technologies andrespond appropriately. They should take swift and effective action for preventing,detecting, and responding to information security issues.
4) Cooperation
Users of information communication technologies should cooperate with otherusers to resolve information security problems and issues. They should be awarethat the damage may spread rapidly and widely because they are connected via
information communication networks. Users should be encouraged to cooperate
through appropriate information sharing and coordinated responses inpublic-private sector collaboration and international collaboration.
5) Ethics
Inappropriate information security measures may cause a nuisance to third
parties in addition to the user himself. Each user should have autonomous
standards of conduct and take social responsibilities without being forced byothers. Safe and secure society can only be implemented by everyone's
autonomous cooperation.
6) Reassessment
14

Users of information communication technologies should assess the safety andreliability of information communication networks and adjust the response to theinformation security issues.

Figure 5. 6 principles of "Culture of Information Security"(3)

Approach for establishing "Culture of Information Security"

The following basic approaches are taken to establish "Culture of Information
Security".
1) Establishment of "Culture of Information Security" while promoting the use of
information communication technologies
We should not scare the users and deter them from using information
communication technologies when explaining the importance of information
security by putting too much emphasis. All users should share basic
understanding that outreach and awareness are designed to help them use
information communication technologies better.
2) Establishment of constant endeavors
15

The government has established "Information Security Awareness Month" tooutreach and awareness and intensive efforts are made within the time. While thisis an effective approach, continuous activities throughout the year to establish
constant endeavors are important.
3) Promotion of measures fine-tuned for the usage of information
communication technologies
The way they use the Internet and mobile phones varies widely depending on
the user's age group and who they are. Therefore measures should be fine-tuned
for different age groups and different types of users.
4) Promotion for the IS indifferent group
How to approach the IS indifferent group is a big issue. As the internet has
spread, all users are connected via networks. Even if part of users apply advanced
information security measures, a weakness can be created by other users' notapplying measures and may result in computer virus infection in the entire
network. It is important for all users to understand that information security
cannot improve unless all users apply measures.

Reference: Relationships between "Outreach and Awareness" and "Human Resource
Development"
Dissemination of and enlightenment on information security also play a role as thefoundation for developing excellent human resources. Well balanced improvement of
information security in Japan can only be achieved when outreach and awarenesspolicies for wide-ranging general public and advanced human resource development
for high-level information communication technologies are both applied.
Information security human resource development policies are promoted based onthe "Information Security Human Resources Development Program" and we areplanning to improve information security measures in Japan by executing thisprogram together with the Outreach and Awareness Program.

16

Figure 6. Relationships between "Outreach and Awareness" and "Human Resource Development" ininformation security

17

6.

Promotion system and scheme
The following promotion system and scheme should be implemented in order toendorse outreach and awareness policies to establish "Culture of Information
Security".

(1) Establishing the HR Expert Committee for Outreach and Awareness (tentative
name)
The "Information Security Policy Council" specializes dissemination of andenlightenment on information security. In order to clarify its "control tower" function,the "HR Expert Committee for Outreach and Awareness" (tentative name) will beestablished to advice and assess the outreach and awareness, and human resource
development policies for information security. Also, the "Public-Private Sector
Alliance Working Group" (tentative name) will be established under the "HR Expert
Committee for Outreach and Awareness" (tentative name) to plan and promote
public-private collaboration projects since public-private sector collaboration isessential to endorse outreach and awareness.

(2)

Organization networks

Information security outreach and awareness policies are promoted in government
agencies, incorporated administrative agencies, groups, and enterprises; however,these organizations should be networked for even more efficient and effective
implementation. Also, the use of volunteers such as information security supporters
would be effective to promote information security outreach and awareness policies.
(3)

Policy effectiveness measurements

Although no internationally standardized method is established for quantifying theeffects of outreach and awareness, we can improve the policy assessment andimprove the effectiveness of outreach and awareness using the results of periodical
questionnaires. Other assessment methods for the effect of policies will be examined.
The results of the assessment of outreach and awareness policies will be reported tothe "HR Expert Committee for Outreach and Awareness" (tentative name) to request
their advice.
(4)

Follow-up and review of the outreach and awareness program

18

The outreach and awareness program is a 3 years long (2011 to 2013) program.
Related measures are reviewed at the same timing as the "Information Security 20xx"
and the results are reflected on the subsequent measures. The outreach and awarenessprogram is reviewed as necessary in order to understand the current status of
information security in Japan, the current status of information security education,outreach and awareness, and awareness of general public and enterprises, as well as torespond appropriately to the changes in domestic socioeconomic status and theinternational trend.

19

7.

Points in promoting the outreach and awareness program
It is important to reinforce public-private sector collaboration and international
collaboration to promote the outreach and awareness program under the above
system.

(1) Reinforcement of public-private sector collaboration
It is important to reinforce public-private sector collaboration since outreach andawareness will be more effective when more organizations are proactively working
together. Specific plan should be made to reinforce public-private sector
collaboration.

(2)

Reinforcement of international collaboration

International cooperation is essential in promoting information security policies
since information is freely moving beyond international boundaries today. Eachcountry should take specific actions for international collaboration in information
security outreach and awareness such as sharing domestic and overseas best practice.
Specific measures will be described later.

20

8.

Specific efforts
The outreach and awareness program focuses on the continuity of measures and thefollowing actions will be taken over its lifespan of 3 years.

(1) General and intensive outreach and awareness1) Enhancement of "Information Security Awareness Month""Information Security Awareness Month" has been established since 2009 by
the Cabinet Secretariat in collaboration with other concerned government
agencies in order to encourage everyone's interest and understanding as part ofoutreach and awareness policies. However, "Information Security AwarenessMonth" has not been promoted fully and is still relatively unknown. Therefore,
the government should publicize "Information Security Awareness Month" moreand enhance the associated events during this month.
"Information Security Awareness Month" in 2010 involved new approach suchas posters, stickers, web banners, "Website on Information Security AwarenessRaising", and the government Internet TV. The effects will be reviewed forfurther enhancement.
The "Public-Private Sector Alliance Working Group" (tentative name) will be
newly established to reinforce public-private sector collaboration. They will
exchange information and advice on plans for events during "Information
Security Awareness Month".
2) October for the "Information Security Awareness Month"
October is "National Cyber security Awareness Month" in the U.S.A. while
APEC (Asia-Pacific Economic Cooperation) has instituted "APEC Annual Cyber
Security Awareness Day" towards the end of October. The Japan - ASEAN
Information Security Policy Meeting is considering to establish "Japan - ASEAN
Information Security Awareness Week" (tentative name). It may be more
effective for international collaboration that our "Information Security AwarenessMonth" be moved from February to October from 2012, or newly establish"International Collaboration Information Security Awareness Week" in Octoberwhile retaining February's event.

21

(2)

Dissemination among and enlightenment of general public
1) Enhancement of "Website on Information Security Awareness Raising"A portal site was established during "Information Security Awareness Month"in 2010 to introduce information security measures for different users such as
home, school, and work users. The site should be enhanced further. It is
important to continue the endeavors based on the slogan for "Information
Security Awareness Month" in 2010, "Aware, Secure, Vigilant"14.
"Aware" of how to implement safe and secure Internet environments

It is essential that each person have correct awareness and knowledge of
information security in order to respond appropriately. Accurate and intelligible
information according to the user's needs should be provided.
"Secure" oneself from information security threats

Knowing information security is not enough; it should be practiced. Therefore,
specific and practical information should be provided.
"Vigilant" measures against ever-changing information security threats

Information communication technologies progress day-to-day and the same
apply to threats and measures of information security. Associated information
should be provided in a timely manner to make users aware of the necessity ofcontinuous measures.
2) Self diagnosis check list
It is important for individuals to know where they are objectively in theinformation security roadmap in order to encourage people's interest and further
outreach and awareness. Therefore, a self diagnosis check list will be designed
for general public and users in 2012.
3) Materials for senior citizens
Aging is rapidly progressing in Japan. Information security outreach andawareness should be accelerated among senior citizens to encourage their use of
information communication technologies. Care should be taken not to
unnecessarily scare senior citizens. Materials to describe information security
measures written in plain language should be prepared in 2012. Also deployment
and support of senior volunteers should be examined.
4) Dissemination among and enlightenment of the IS indifferent group andothers14"Aware, Secure, Vigilant" was the slogan to communicate 6 principles of "Culture of Information Security" to general public.
"Aware" indicates "1. Awareness", "2. Responsibility" and "5. Ethics", "Secure" indicates "3. Response" and "4. Cooperation", and"Continue" indicates "3. response" and "6. Reassessment".

22



Dissemination among and enlightenment of the IS indifferent group

Spread of various information security related devices and services may cause
an increase in the number of users with little knowledge in information
communication technologies and little awareness of information security. Suchusers may make setting mistakes, or may even be targeted by attackers.
Dissemination of and enlightenment on information security among generalpublic should also be intensified for this IS indifferent group; however, currently
no specific measures are in place. Therefore, the first step would be to create thecommon consensus to recognize the importance of measures for the IS indifferent
group.
It will be followed by the promotion of outreach and awareness policies athome and school, and other innovative endeavors, for example, using mass media,
with help of information security supporters, and application of overseas bestpractice.


Dissemination among and enlightenment of beginners

Basic knowledge of information security should be provided to Internet
beginners by establishing "Internet safety classes" and via the Internet.
5) Enhancement of Information Security Consultation Service
Information Security Consultation Services which are established bygovernment agencies should be enhanced to be more helpful for users such as
reinforcing the collaboration between them. Also improving the ability to provide
consumer advice should be examined in between the Consumer Affairs Agency
which is in change of consumer protection in general, Cabinet Secretariat, andconcerned government agencies.
The "Information Security Consultation Service" 15 , established by the
Information-technology Promotion Agency (hereinafter "IPA") in 2010 toprovide general advice on malware16 and illegal access should be publicizedwidely. Also, "Frequently Asked Questions (FAQ)" on the IPA website should be
improved.
6) Collecting and sharing information security incident cases
Examining information security incidents in the past, learning lessons, andsharing such lessons are important for preventing information security incidents
and taking appropriate actions in the event of an incident. We should collectpublicized cases, and consider the method such as anonymity to collect other

15

The general term for illegal programs which do what the computer user does not intend. It includes computer viruses, spyware
such as keyloggers which steal private information and backdoors which enable the attackers to remotely operate the personal
computer, rogue security software which provides fake information and prompts the user to purchase it, and one-click ware which
continuously display billing screens for adult sites. (Source: IPA website)16
http://www.ipa.go.jp/security/anshin/index.html

23

unobtainable cases due to company secrets or privacy protection. The collected
information security incidents should be made available for everyone bypublicizing on websites.
(3)

Education enhancement and learning opportunities of information security
1) Enhancement of information security education
The necessary foundation should be arranged and related policies should bepracticed to improve information security education in schools. Pupils' basic
knowledge and skills in information security should be improved and they shouldbe able to actively use information communication technologies.
Information ethics should be continuously taught to pupils and students
throughout school education according to their development stages. It is
important to consider collaboration with their families and local communities forthe ethics education. Also individual teachers should improve their teachingability in information security in order to further enhance the contents of
information security education.
2) Enhancement of information security education materials
Education materials for information security should be developed anddisseminated. Providing information which pupils and students could not have
before will motivate their learning and help their understanding. Beneficial
education materials should be made available in information security portal sitesof various organizations including the National Information Security Center in2012 to encourage education and learning through the Internet.

(4)

Dissemination among and enlightenment of enterprises
1) Awareness raising of management
Stakeholders such as society and customers are increasingly demandingtransparency and information disclosure, and enterprises are under pressure todisclose information such as risks, and to fulfill accountability. It is consideredthat leaders of organizations rarely consider information security as their strategic
issues and often leave the risk management of information assets to theinformation system department or similar divisions in the workplace. Such
attitude will only result in the situation where the intention of management
remains unclear in addition to lagging application of information security
measures in the workplace. There may be lack of regulation in information
security among management themselves such as information security measures
are not assessed properly to assist decision-making of the management.
Information security measures in organizations have often been left to theinformation systems personnel in the workplace as it was ridiculed as "chief clerk
security". This is not the way to manage risks in enterprises. Enterprises should
move away from "chief clerk security" towards "CEO security" where24management of enterprises takes initiative in information security.
The above recognition should be shared and information security should betaken as an important issue in activities in economic organizations.
2) Measures for small to medium-sized enterprises
It is especially important to enhance dissemination among and enlightenmentof small to medium-sized enterprises than others. Specifically, enhancing events
such as "information security leadership nurturing seminar for small to
medium-sized enterprises" and provide information security guidelines andvarious tools along the lifecycle of information systems (planning, design anddevelopment, operation and using, disposal).
(5)

Cyber crime prevention campaign
1) Information security courses
In order to plan for the improvement of information security awareness andknowledge, lectures with topics including cybercrime situations and arrest cases
will be held throughout the country. Also, cyber crime measures including
information security measures should be promoted through various councils incollaboration with concerned vendors.
2) Promotion of cybercrime damage prevention measures
Pamphlets for cybercrime prevention and leaflets for crime prevention in
online dating sites for junior and senior high school pupils should be created anddistributed. PR activities such as publishing basic measures for common Internet
problems and cybercrime methods on websites should be encouraged.
3) Promoting cyber volunteer training
Activities and training methods of volunteers should be examined in order tocreate safe and secure cyberspace. We should encourage cyber volunteers incyberspace and support their activities.

(6)

Incentive scheme for promoting outreach and awareness1) Commendations and information security contests
Incentive scheme such as financial support for information security outreachand awareness should be considered in order to reinforce public-private sector
collaboration and international collaboration. Also, commending individuals andenterprises who have contributed greatly towards information security will
strengthen public-private sector collaboration in outreach and awareness.
Technology contests concerning Information security are popular in overseas
25

countries and winners will receive commendation or a grant. We should consider
nation-wide information security contests since it will give incentive to superior
human resources in information security.

(7)

Reinforcement of international collaboration

Dissemination of and enlightenment on information security are proactively
promoted in Asian countries as well as Western countries. No geographical or
temporal restriction applies to cyber attacks on the Internet and the impact of an
attack may spread everywhere in the world spontaneously. Therefore, international
collaboration for information security improvement is urgently required in addition tomeasures in each country.
We have collaborated with the U.S.A., APEC, and ASEAN in several frameworks
for information security outreach and awareness, and we will also focus on thefollowing in the future.
1) Reinforcement of Japan - ASEAN collaboration
Specific actions have been discussed with ASEAN though the framework suchas "Japan - ASEAN Information Security Policy Meeting. Resolutions17 from the"Third Japan - ASEAN Information Security Policy Meeting" in March 2011 will
be steadily executed and enhanced.


Establishment of "Japan - ASEAN Information Security AwarenessMonth/Week"

Establishment of "Japan - ASEAN Information Security Awareness Month" or"Japan - ASEAN Information Security Awareness Week" from 2012 should beconsidered since the use of the Internet is rapidly spreading in ASEAN countries.
The pre-events such as information security awareness poster exhibitions in 2011
should be considered.


PR media preparation

PR media should be prepared within 2011 to promote Japan - ASEAN
information security awareness policies. For example, a common logo, andrecommended information security measures to help general users use theInternet safely and securely and disseminate them widely.
2) Reinforcement of Japan - APEC collaboration
APEC Cyber Security Awareness Day was established18 in APEC Ministerial
Meeting on Telecommunications and Information Industry was held in Okinawa
in October 2010 and the "APEC Cyber Security Awareness Poster Exhibition"

17

Resolutions from the Third Japan - ASEAN Information Security Policy Meeting
http://www.nisc.go.jp/press/pdf/3rd_aseanj_meeting_result_press.pdf
18
Establishment of APEC Cyber Security Awareness Day
http://www.nisc.go.jp/press/pdf/apec_csaday_press.pdf

26was held jointly by Japan and Korea. We will support such activities andcontribute towards improvement of information security awareness in the APEC
region.
3) Reinforcement of Japan - West collaboration
Dissemination of and enlightenment on information security are promoted also
in the U.S.A., Australia, Canada, and EU countries with various activities such as
establishing awareness months and creating and distributing education materials.
It is important to promote information security outreach and awareness withinternational collaboration. We should aim at further reinforcement ofcollaboration and examine issues such as sharing best practice concerning thosecountries' activities and specific collaboration areas by 2013.
4) Outreach and Awareness portal site in English
The English version of "Website on Information Security Awareness Raising"was established in April 2011. This site should be positioned as the outreach andawareness portal site and used to introduce various overseas efforts in addition toactivities of outreach and awareness in Japan.

27

28

29