Provisional Translation

Environmental
ChangeMerger and Integration ofCyberspace and Real-space

Increasing Serious Risks Surrounding
Cyberspace［expansion/penetration, progress of the use/application, global］ ［more severe, more widespread, more globalized］～Realization of a “Cybersecurity Nation”～
Vision to aim
as a Goal

Basic Principles

For national security/crisis management; social/economic development; and safety/security ofpublic, realizing the society that is strong against cyber attacks, full of innovations and that its
public will be proud of, through constructing a world-leading, resilient and vigorous cyberspace① Ensuring free flow of information ② Responding to increasingly serious risks③ Enhancing risk-based approach ④ Acting in partnership based on shared
responsibilities

Areas of Efforts
Increasing serious risks
surrounding cyberspace

Individualusers

Gov'tAssuring
Sustainability

１．“Resilient” cyberspace

Strengthening ability of protection
and recovery

SMEs

Ｃｙｂｅｒｓｐａｃｅ
Cyberspace-related
Operators

Critical Infrastructure
Providers (CIPs)

Strengthening growth by further
facilitating
merger and integration ofcyberspace and real-space
PrivateCompanies

Educational/Research Institutes

GlobalizationAssuring
Expansivity

２．“Vigorous” Cyberspace
Strengthen Creativity and Knowledge①Activation of Industry①Measures in Gov’t Institutions
３．“World-leading” Cyberspace ②Research and Development②Measures in CIPs
Strengthening ability of contribution③Measures in Private companies③Human Resource Development
and outreachand Educational/Research Institutes①Diplomacy④Literacy Improvement④Cyberspace Hygiene②Global Outreach⑤Crime countermeasures forEnhancement ofPromotion
Cyberspace③International Cooperation
the functions ofSystems etc. NISC
⑥Defense of Cyberspace1１．Environmental Changes
Merger and integration of cyberspace andreal-space► expansion/penetration, progress of the use/application, global

Increasing serious risks surrounding cyberspace► more severe, more widespread, more globalized

２．Basic Policy(1) Vision to aim as a goal: ‘Realization of a Cybersecurity Nation’
For national security/crisis management; social/economic development; and safety/security ofpublic, realizing the society that is strong against cyber attacks, full of innovations and of which
its public will be proud, through constructing a world-leading, resilient and vigorous cyberspace(2) Basic Principles① Ensuring free flow of information► Ensure freedom of speech and privacy protection, and enjoy economic development etc.

② Responding to increasingly serious risks► Multi-layered efforts are necessary to respond to the changing risks promptly and precisely►Through dynamic response capabilities, strengthening of the response based on the risk
characteristics is necessary.
► Each actor in multi-stakeholder needs to serve its role for proper④ Acting in partnership based on shared responsibilities
mutual cooperation and assistance③ Enhancing risk-based approach(３) Roles of Each Actor► Diplomacy, defense and crime countermeasures of cyberspace, strengthening the measures and preparations for coping withsituations etc.
② Critical infrastructure Providers ► Strengthening the efforts within the current target 10 sectors, providing necessary measures to new sectors etc.

① Government(10 sectors: ICT, Finance, Aviation, Railway, Electricity, Gas, Gov't/Gov't Services (incl. regional municipalities), Medical, Water, Logistics)► Collective measures such as information sharing, industry - academia partnership fordevelopment advanced technologies and human resources etc.
recognition of "Do not trouble others", self-governing measures such ad literacy④ Individual users, Small/medium-sized enterprises ► Fostering
improvement, and information sharing, etc.
► Dealing with vulnerabilities in products etc., recognition and analysis of incidents, increasing the⑤ Cyberspace-related operatorscompetitiveness in the global market etc.
2

③ Private companies, Educational/research institutions

３．Areas of Efforts※About details on the efforts, see the Cybersecurity Strategy (ISPC, June 10, 2013)(1) Construction of “Resilient” Cyberspace※GSOC: Government Security Operation Coordination team
CSIRT: Computer Security Incident Response TeamCYMAT: CYber incident Mobile Assistant Team

① Measures in Gov’t Institutions: Strengthening measures in information systems and preparations for coping with cyber attacks.

Ex.

▸ Construction of system base that is strong against cyber attacks by moving information systems into the government common platformcloud▸ Emphasizing measures depending on the degree of importance etc. for information such as state secrets and information systems.
▸ Strengthening handling of critical info. on national safety by operators other than government, measures by independent administrative
institutions etc.
▸ Increase capabilities of the GSOC to better detect and analyze incidents and share information between government agencies▸ Strengthening system to share info. and respond incidents in government by strengthening of cooperation between CYMAT and CSIRT
etc.
▸ Strengthening preparation of coping with situations by implementation of the training every year for large-scale cyber attack situation etc.

② Measures in Critical Infrastructure Providers: Measures in accordance with the ones for government institutions
Ex.

▸ Promotion of information sharing between critical infrastructure providers and cyberspace-related operators on such matters as cyberattacks▸ Establishment of framework for sharing the incident information possessed by GSOC with critical infrastructure providers▸ Development of the new "Action Plan" by re-considering the scope of critical infrastructure and measures in such providers etc.

③ Measures in Private Companies and Educational/Research Institutions: Strengthening of recognition and information
sharing of incidents, promotion of building CSIRTs and performing exercises
Ex.

▸ Increase the ability that medium/small-sized companies recognize cyber attacks, by considering incentives to promote investment insecurity▸ Increase the responsive ability against cyber attacks of private companies by performing exercises using a practice test bed▸ Increase the responsive ability to counter incidents by promoting the creation of CSIRTs in private companies and research institutions.

④ Cyberspace Hygiene : Implementation of preventative measures that society as a whole participatesEx.

▸ Promotion ensuring hygiene of cyberspace as a national movement by creation of "Cyber Clean Day" (tentative) etc.
▸ Building framework which ISPs can warn individual users that may access malicious sites.
▸ Considering flexible ways of operation in related systems, such as possibility of communication analysis for security purpose inconsideration to the secrecy of communication etc.

⑤ Crime Countermeasures for Cyberspace: Strengthening of ability to cope with cyber crimes and preparations by utilizing
knowledge from private sector etc.
▸ Create Japanese NCFTA, and strengthening of the framework for information sharing with anti-virus vendors

Ex. ▸ Considering ways of saving logs such as communication ones and measures to promote digital forensics by related operators andorganizations※NCFTA: National Cyber-Forensics and Training Alliance3(1) Construction of “Resilient” Cyberspace (cont.)⑥ Defense of Cyberspace: Strengthening capabilities to defend Japan-related cyberspace from national level cyber attacks▸ Organizing the roles of related organizations such as JSDF in such emergency situations as information systems of criticalEx.
infrastructures are attacked, establishing of organizational structure and systems etc. that handle those situations, and arranging
application of specific international laws.
▸ Strengthening capability and preparation of JSDF etc. to counter cyber attacks implemented as part of armed attacks.

(２) Construction of “Vigorous” Cyberspace① Activation of Industry: Strengthening the global competitiveness of cybersecurity industry in Japan that is highly dependent
on foreign products etc.
Ex.

▸ Participating proactively in the formation of international framework for international standardization, mutual recognition in assessment
and certifications, and establishing an organization that assesses and certifies industrial control systems▸ Aggressively procuring products etc. that utilize cutting edge technologies within government② Research and Development: Creation of security technologies that are creative and imaginative to counter the changing risks
Ex▸ Accelerating research and development of technologies for detection and advanced analysis for cyber attacks to hold and develop
cutting-edge research and development▸ Developing cutting-edge technologies to establish groundbreaking countermeasures against increasingly diverse and sophisticatedcyber attacks such as hidden malware③ Human Resource Development: Development of security professionals that are high-quality and with international talentEx▸ Conducting by public-private cooperation training camps and competition contests of practical skills in order to explore individuals withgreat skills in software development, etc,
▸ Supporting the attending of international conferences and studying at graduate schools abroad in order to develop human resourcesthat can compete globally④ Literacy Improvement： Increase the literacy of the publicEx▸ Promote practical initiatives at elementary and secondary schools such as teaching information morals including information security
and software programming, use of digital textbooks. Development of supporters to increase security awareness to the elderly▸ Developing framework where individual users can recognize risks and determine its use on their own for smartphone applications4(３) Construction of “World-leading” Cyberspace① Diplomacy： Multilaterally constructing and strengthening partnerships with such nations as share the same basic values
Ex.

▸ Continuously deliberating on how to apply specific international laws such as the Charter of the United Nations, International
Humanitarian Laws for conducts in cyberspace.
▸ Deepening on discussions about details on how to deal with cyber sector and establishing international codes of conducts with the othercountries such as the US.

② Global Outreach: Developing relationships that can grow together with such partners as ASEAN member states, andsupporting responsive capabilities against cyber attacks
Ex▸ Developing a network to collect information about cyber attacks by collaborating with other nations, then implementing research anddevelopment on methods for prediction and quick response of cyber attacks .
▸ Introducing success cases of botnet countermeasure projects that were conducted through public-private partnership, and conducting
tabletop exercises, joint projects③ International Cooperation: Strengthening to deal with incidents related to cyber attacks across borders in cooperation
Ex.

▸ Continuously exchanging information about cyber crime with foreign agencies, and sending officers for such purpose as strong
collaboration▸ Internationally communicate the basic stance of our nation in order to avoid contingency due mutual distrust, and building frompeacetime contact channels, and implementing collaborative research projects and cyber exercises among plurilateral nations.

４．Promotion Systems and others● As for the NISC (National Information Security Center), the necessary organizational structure such as functions and authority
will be developed and reorganized to establish "Cyber Security Center" (tentative) around FY2015.
● Developing framework that promotes the sharing of information related to cyber attacks between government agencies andcritical infrastructure providers.
● Properly managing the specific mid and long term goals (FY2015 and 2020) to promote the efforts.
Ex.

▸ By FY2015, increase the coverage of cyber attacks related information sharing network in government agencies etc.,
decrease malware infection rates and citizen concerns, and increase the number of such nations as participating in international
incident coordination▸ By 2020, double the size of domestic information security market, and decrease the lack of proportion in security professionals● Targeting three years until FY2015, and Implementing development and assessment of annual action plans.
● Developing international strategy for cybersecurity.

5