5‑8

5 Cyber Security

Applying a Reference Documentof the Organizational Structure for Cyber
Security Operation
TAKEI Shigenori

This article presents applying a reference document of the organizational structure of the cyber security operations for
the Olympic and Paralympic Games Tokyo 2020 which was commissioned to perform by NTT Group What issues were
found in actual operational situations after the establishment of the system? Based on the experience of the actual
operations of the Olympic and Paralympic Games Tokyo 2020 and the differences between the assumptions in thereference document and the actual operations of the Olympic and Paralympic Games Tokyo 2020 this article discusses
points to be noted in future large‑scale events
Keywords：Tokyo 2020 Games Security operation SOC CSIRT

1．Introduction
The security monitoring and operation of the back‑office network (Back Office Network) used by themembers of the Tokyo Organising Committee of theOlympic and Paralympic Games of the Olympic andNTT‑SOC from April to the end of September 2021

2．Organizational Structure with
Reference Documents
Reference () is a document in Japan that shows theParalympic Games Tokyo 2020 (hereinafter referred tooverview of security activities in the organization

as “Tokyo 2020 Games”) was conducted by the Tokyo

including the SOC (Security Operation Centre) and2020 Organising Committee and the NTT Group which

CSIRT (Computer Security Incident Response Team)was entrusted with the security operation The “Text-It comprehensively describes the functions roles andbook for Security Response Organizations Version 2 1”

operations to be performed in the organization The(Reference (contents of Reference ()) published by the Information Security) were subsequently contrib-

Operation providers Group Japan (ISOG‑J) was applied

uted to the International Telecommunication Union

as a reference document for building the security

Telecommunication Standardization Sector (hereinafteroperation team I am one of the authors of Reference

referred to as ITU‑T) and incorporated into ITU‑T(Recommendation X 1060 (hereinafter referred to as) This article discusses the operational issues as theauthor of Reference () during the actual operation inReference ()) in the field of security management

Preparations for security operations for the Tokyo
2020 Games began around 2016 and NTT‑SOC was
TAKEI Shigenori
Secure System Business Department NTT TechnoCross Corporation
E‑mail takei shigenori@ntt‑tx co jp

The Journal of The Institute of Electronics Information and Communication Engineers Vol 105 No 8 Supplement pp 291‑293 August 2022

responsible for the formulation and operation of thefollowing tasks out of 10 categories of tasks referring toReference ()© 2022 The Institute of Electronics Information and Communication EngineersSpecial Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020

291

B

Real‑time analysisof the organization and operations is closed within theDIncident response

team due to the time limit of the organization As aE

Checking and evaluation

result the entire organization had not been optimizedFCollection

through improvement At the management process inG

analysis and evaluation of threat

intelligence

Reference (Development and maintenance of security opera-improvements at the field level but also continuous

tion platforms

improvements at the organizational level will be) and () it is assumed that not only

continued In this case the organizational structure had
NTT‑SOC implemented SOC and CSIRT functions inalready been decided and it was not possible to makecooperation with the organising committee The author

improvements such as reorganizing the organization toworked in the “Incident Response Senior Expert”(IRSE)

match the actual situation of the business during theteam in an advisory position supporting the SOC andpreparation and holding periods On the other hand

CSIRT teams

since preparations are made over a period of several
years it is necessary to assume that the organizational

3．Operational considerations during
the operation period
The organizational structure was established during

structure will change from the initial assumption andthat the allocation of resources can be changed byorganizing teams and reviewing operations even if theorganizational structure cannot be changed

the preliminary preparation period and the members
assigned ahead of the others were performing theirIssue (3) : The understanding of the characteristics ofduties and developing procedures for operations In Junesecurity‑related operations was not fully

2021 other members were assigned and increased theunified as a preliminary image of the work

maturity of operations at last Tokyo 2020 Games were

to be performed by the personnel

and theExperts with various backgrounds and skills wereworkflow and procedures had been prepared in thegathered as members Experts with experience in SOC

organizational structure But there were three major

operations and the other experts with experience inoperational issues during the operation period

common system and network operations got training in

held

The operations were well‑organized

SOC operations before being assigned to the team In
Issue (1) : Due to the siloed organization and teams

common system and network operations the causes ofnecessary collaboration was not sufficientpossible failures are sudden and unexpected such as

Although NTT‑SOC implemented the functions“disasters” and “failures ” and most of the response

described above there were some difficulty points toprocedures follow procedure manuals On the otherhandle One was to deal with unanticipated or newly

hand security operations are often caused by “humanadded tasks and products and the other was to developfactors” and require continuous monitoring of changing

new team collaboration

attacks Therefore it is not always possible to analyze

On the other hand the IRSE team was able to supportand respond to attacks using only assumed procedures

collaboration and cover a wide range of work because of

It is necessary to be constantly aware of new methods

its broad scope Not only that but each team member

and responses to new attacks and to keep updating

also collaborated with the organising committee at thework flows and procedures

The work flows andfield to implement a series of workflows as one teamprocedures are almost same in the operations such as

Nevertheless these efforts were largely due to themonitoring and responding to any anomalies Howeverefforts of human resources onsite and the system for

it is necessary to conduct training that includes caseorganizational solutions will be needed in the futurestudies that make it easier to recognize the differences insecurity thinking and to improve the ability to respond toIssue (2) : Because of the time‑limited organization
there was a tendency for the improvementand deal with security issues by daily awareness of themafter being assigned to a SOC

cycle to optimize the entire organizationand operations to be difficult to implement
Related to issue (292) above the scope of improvement

If we consider similar large‑scale events in the future
we can refer to the new guidelines and documents

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

related to Reference () and METI

organising committee for providing me with theCyber Security Management Guidelines (3) can be used as) Reference (opportunity to utilize and discuss the documents I wasreferences

involved within a large‑scale event even it happened

An entity that can provide comprehensive support forcybersecurity of the business as a whole is needed
Reference () also defines a framework for continu-

consequently We hope that this document will serve asa reference for those who are involved in the security oflarge‑scale events that take several years to prepare

ous evaluation and improvement If it takes several
years including preparation it is necessary to have theorganization that can review and improve according toReferences()()()

the changes based on the assumption that the surrounding conditions will certainly change

4．In closing
The organization structure and operations weredesigned based on Reference (1) and a comprehensive
definition and assignment of operations were established On the other hand the operational aspects were

Textbook for security response organizations, Version 2.1, security
operations chaos working group (WG6) of the information security
operation providers group Japan, 2018.
Available at : https://isog-j.org/output/2017/Textbook_soc-csirt_v2.
html“X.1060 : Framework for the creation and operation of a cyber defence
centre,” ITU-T.2021.
https://www.itu.int/rec/T-REC-X.1060-202106-I
Ministry of economy, trade and industry, cybersecurity management
guidelines appendix F : guidance for establishing cyber security systemand securing human resources, version 1.1, 2021.
https://www.meti.go.jp/policy/netsecurity/mng_guide.html(Received February 28 2022 last received March 15 2022)

not the best and the good and bad points became thelessons examples and references for the future (so‑called “legacy”) The good points can be used as areference for future work by the members involved inSOC and CSIRT operations As for the bad points thateach member felt the need to improve they can refer tothem when they return to their work These will lead tothe next large‑scale event and daily operations
Finally I would like to thank the team members who
worked positively in this difficult situation as well as themembers of the organising committee for their cooperation and support

TAKEI Shigenori
TAKEI Shigenori graduated from Shinshu
University in 1998 with a bachelorʼs degree inengineering and information technology andcompleted a masterʼs degree at Shinshu University in 2000 He joined NTT Software Corporation (now NTT TechnoCross Corporation) in
the same year where he was engaged insecurity consulting He is a principal grade of
NTT Group security certificate a CISSP aRegistered Information Security Specialist
Vice President and the leader of WG6 of theInformation Security Operation providers
Group Japan The editor of ITU‑T SG17 WP3Q3 X 1060

I would also like to thank the㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020

293