5‑3

5 Cyber Security

Solutions for Cyber Security Challenges of
the Tokyo 2020 GamesTAMAI Kuniharu

NOJIRI Yasuhiro

HOSODA Naofumi
IBAYASHI Hiroaki

The Olympic and Paralympic Games Tokyo 2020 have been managed by a large number of systems In order to protect
the Olympic and Paralympic Games Tokyo 2020 it was necessary to strengthen security by hardening each system andimplementing defense in depth solutions for detecting preventing and responding to attacks as a security solution This
article describes how system hardening and security solutions have been implemented
Keywords：Tokyo 2020 Games Cyber attack Security solution

the Games This article introduces the details

1．Introduction
The Olympic and Paralympic Games Tokyo 2020
(hereinafter referred to as “Tokyo 2020 Games”) utilized

2．Common Security for All Domains

a large number of systems to manage the Games and

In Section 2 we introduce the common issues for allthese systems were located in various domains depend-domains and examples of countermeasures implemented

ing on their purposes The specific domains included theto solve them

Back Office Network (BON) used by Tokyo 2020

First a typical issue was the prevention of leakage ofOrganising Committee members for their work thecredential information such as authentication IDs andCompetition Network (CPN) that connects the venues

passwords as well as confidential information Ideally

the Olympic Technology Network (OTN) which was asystems should be implemented and operated in

network to accommodate various services

such ascompliance with predefined rules but unfortunately indedicated VLANs for games stakeholders

and thesome cases the rules could not be fully complied withwebsite domain in the Cloud By implementing security

because many organizations and companies were

solutions for the characteristics of each of these domains

involved in the implementation and operation of each

we aimed to comprehensively enhance security before

system in Tokyo 2020 Organising Committee For thisreason it was important to implement strict security

TAMAI Kuniharu
Technology Services Bureau The Tokyo Organising Committee of the Olympic
and Paralympic GamesNOJIRI Yasuhiro
Technology Services Bureau The Tokyo Organising Committee of the Olympic
and Paralympic GamesHOSODA Naofumi
Technology Services Bureau The Tokyo Organising Committee of the Olympic
and Paralympic GamesIBAYASHI Hiroaki
Technology Services Bureau The Tokyo Organising Committee of the Olympic
and Paralympic GamesThe Journal of The Institute of Electronics Information and Communication Engineers Vol 105 No 8 Supplement pp 264‑271 August 2022
© 2022 The Institute of Electronics Information and Communication Engineers264

functions and to organize systems to operate security
from the viewpoint of zero trust Zero trust refers to theconcept of taking security measures in advance without
trusting all communications

assuming that not all

attacks can be protected by the conventional approach ofdividing the network into trusted and untrusted areas
and restricting communications between the two areas
Specifically authentication methods were strengthened
to increase the durability against leakage of credential

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

information and the possessed data was encrypted

been reports of MFA being breached in some implemen-using mechanisms such as IRM (Information Rights

tations It is necessary to select credential protection

Management) so that files could not be viewed even if

methods in accordance with changes in attack methods

they are leaked to the outsideand corresponding countermeasure technologies

Other examples included configuration management
to quickly grasp the impact on the system when newrisks such as vulnerabilities were discovered

22

Management

andcountermeasures against DDoS (Distributed Denial of

Configuration Management and Vulnerability

Managing configurations and vulnerabilities are verysignificant challenges because each system consists ofService) attacks
These are described in detail below

wide variety of devices and software If newly discovered vulnerabilities are not addressed in a timely

21

Thorough Protection of Credential Information

In many cases

security incidents are caused byattackers exploiting the credentials they have obtainedmanner or if some of them remain unaddressed thevulnerabilities will be used as footholds for intrusion into
the system resulting in major damage

illegally pretending legitimate users and infiltrating

In order to take appropriate measures against

devices or systems In order to make it impossible tovulnerabilities configuration management and vulner-

break in easily even if some of the credential information

ability information gathering are essential Configuration

were leaked Tokyo 2020 Organising Committee hadmanagement is to comprehensively keep track of all thethoroughly strengthened authentication method bydevicesusing of Multi‑Factor Authentication (MFA) in princi-

information gathering is to promptly understand details

ple Even when MFA could not be used due to deviceof newly discovered vulnerabilities Furthermore it isrestrictions security had been reinforced by restricting

important to visualize the impact of vulnerabilities andthe source IP address

the progress of countermeasures of all systems Tokyosoftware and their versions

Vulnerability

In addition the use of shared accounts was prohibited2020 Organising Committee introduced several types ofand it was made to be thorough to use individual

configuration management systems according to theaccounts with the minimum privileges granted as

types of devices and software and always kept that allnecessary

This enabled the logging of privileged

devices and software were registered without omission

operations ensured traceability and enabled prompt

through security checks For vulnerability information

detection of any credential abuse

gathering in addition to dedicated platform for collecting

In addition to these measures we also prevented

vulnerability and threat information

we also took

credential leaks Tokyo 2020 Organising Committee set

advantage of Threat Intelligence from outside agencies

a password policy that was stronger than the generalsuch as the JPCERT/CC information sharing platforms

standard specifically passwords must have been atprovided by the government and the International

least 10 characters long and contain at least three

Olympic Committee etc By making maximum use ofdifferent types of characters This was intended tothem we established a system that enabled us to collectincrease the strength of passwords and prevent theira wide range of vulnerability information quickly and inreuse by making them stricter than the requirements fordetailgeneral services In addition we issued the warning that

In addition a centralized configuration deployment

the passwords were not to include words related to thesystem is essential to promptly complete actions such as

Tokyo 2020 Games

updates and workarounds after the discovery ofwhich were easily recalled byattackers and password cracking tests were conductedvulnerabilities

monthly to confirm the actual passwords Furthermore

Committee used centrally managed PCs to enable batch

just prior to the Games all staff membersʼ passwords

configuration changes For devices that are not subject

were reset

We believe that this has completely

In principle

to centralized management

Tokyo 2020 Organising

we clearly identified

invalided any credential information that might haveadministrator for each devices and direct them to takebeen passed to an attacker

appropriate action promptly for each vulnerabilities

However these measures cannot be applied directly
to future Games

Password policy standards are

becoming more complex every year and there have23

DDoS Protections

Any environment connected to the Internet must be

Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020265

prepared for DDoS attacks that aim to disrupt the use of

unnecessary functions and appropriately enabling secur-

the environment Although DDoS is known to target

ity functions and endpoint defense by anti‑malware

websites any environment connected to the Internet

software And based on the concept of zero‑trust we

can be a target

have managed privileges strictly and have introduced

Since DDoS protection requires large‑scale environment in the network infrastructure the Organisingmechanisms to detect suspicious behavior The details ofthese measures are described below

Committee implemented a common implementation
rather than individual protections For BON CPN and

31

Network Security

OTN we adopted a scrubbing center type of the service

The network was divided into zones such as Secure

which pulls in communications and separates offensive

Trusted Edge DMZ etc and communication between

communications from legitimate ones On the otherthese zones were restricted by using the whitelist to

hand for Web sites we adopted CDN (Content Delivery

block malicious communication on Proxy UTM (Unified

Network) By utilizing these services we protected ourThreat Management) IPS/IDS (Intrusion Protection/

services from DDoS attacks

Detection System) and firewalls according to the IT
security architecture The traffic flow was monitored by
NDR (Network Detection and Response) for early

3．BON and CPN Security
For both BON and CPN

detection of attacks and anomalous communications

a number of security

Even within the same zone communication between

solutions were implemented for the network andterminals was restricted to prevent lateral movement

endpoints such as PC terminals and servers based on thewhich was the expansion of the range of attacks andconcept of defense in depth (Figure 1) Basically we

infection in the case of internal intrusion

have prevented the intrusion of attackers by defense‑in‑authentication was also used to prevent unauthorized

depth through perimeter defense by network security

terminals from connecting to the network

hardening to minimize attackable points by stopping

Figure 1266

802 1xFor the use of Internet services the possibility of

Defense in Depth Solutions

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

access to malicious sites and the introduction of malware

execution of scripts whose use was prohibited in theinto the BON/CPN was reduced by DNS filtering URL

BON/CPN But it was not possible to determine whether

filtering functions of proxy anti‑virus functions sand-the detection result was an attack action or anbox functions and other functions Furthermore theoperational task by the system administrator so we

use of free Internet storage services and Internet e‑mailimplemented a process to check each time a detection

services which had been the target of attacks in the past

was made to see if the user had performed the detectedGames

and other services wereoperation In addition to SIEM logs were also incorpo-

restricted appropriately to reduce the risk of information

rated into UEBA which could detect not explicitly

leaks

suspicious behavior but unusual behavior

was prohibited

As security measures for network devices them-

The above was the basic policy but since CPN PC

selves they were configured in accordance with Tokyo

terminals handled competition data in real time the2020 Organising Committeeʼs configuration standard

design policy was adjusted to give priority to avoiding(Configuration Standard) to ensure uniform hardening

functional impact Specifically we decided to implement

Security logs of devices such as UTMs and proxies wereperiodic scans instead of real‑time scans for malware

captured by SIEM (Security Information and Eventcountermeasures

Management) and UEBA (User and Entity Behavior
33

Analytics)

Server Security

In the server environment security was reinforced at
32

a higher level not only by the same hardening and

PC Security

Tokyo 2020 Organising Committee also had a Configu-

security solutions as for PC terminals but also by

ration Standard to fortify PC terminals The Standard

implementing auditing mechanism to check the validity

defined Windows OS security features such as credentialof settings and patch application status and installing

protection execution control by application whitelisting

IDS/IPS software

vulnerability mitigation and disk encryption and Win-In particular AD (Active Directory) which was thedows Group Policies such as restrictions on macro

core of operation and management was more carefully

execution restrictions on account synchronization andsecured than general servers Specifically AD security

extension usage of browser randomization of privileged

was strengthened by introducing a tier model thatadministrator passwords etc Security was enhanced

classify administrators based on the resources they

through the use of the Standard

manage by access control of requiring connections via asecurity was further

dedicated stepping stone server for AD operation and byenhanced by deploying multiple perspectives by instal-a dedicated mechanism to detect suspicious activity fromling multiple security solutions

specifically anti‑

the contents of AD‑related communications AD logs

EDR (Endpoint Detection andwere also imported into SIEM and monitored with

In addition to the above

malware software

special attention by implementing logic to detect

Response) SIEM and UEBA
Although some of the functions of anti‑malware

suspicious behavior related to AD authentication

the anti‑

Based on the same approach as for PC security we didmalware software was mainly used for restrictions on

not implement IDS/IPS for CPNs which would havescript execution such as PowerShell and on external

placed a heavy load on the system

software overlapped with those of EDR

device connection and flexible policy application according to the connected network while EDR was mainly

4．OTN Security

used for incident response such as PC terminal
investigation

specimen acquisition and quarantine

41

Network Security

There was a difference in the scope of deployment

The OTN network was divided into separate net-

between anti‑malware software and EDRs which will

works for each service Moreover as in the case of thebe discussed in detail in Section 4

BON and CPN UTM was installed at the connection

SIEM was used not only to collect logs of network

points to the Internet traffic flows were monitored bydevices but also to obtain PC security logs and output

NDR DNS filtering was performed and hardening was

logs of anti‑malware software for analysis and visualiza-

performed according to the Configuration Standard

tion SIEM could detect the use of privileges and the

However because of the wide range of applications it

Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020267

was difficult to use the whitelist which registered inin advance by stipulating in the OTN terms of use that

advance the communications to be allowed

they must cooperate with response in the event of anso theblacklist was adopted where communications determined to be malicious by security operations were added
sequentially

incident
As a result several incidents actually occurred during
the Games Time but we were able to respond promptly

In addition since a large number of devices brought inby guests were connected to the OTN there was a highas expected and deal with them without causing any
damagerisk that malicious devices might be connected by

In addition there were some issues to be consideredslipping into them Based on this premise multiple

for future Games regarding the selection of anti‑

countermeasures against malicious device connections

malware and EDR solutions for loaner PC terminals

were implemented For example when connecting toThis is explained in Section 4 3

services such as broadcasting and press MAC address
authentication was performed and communication
between terminals was restricted to mitigate the risk of

43Consideration of Solution Configuration and
Scalability

lateral movement attacks Captive portal authentication

In deciding on a security solution for OTN PC

using accreditation IDs (IDs used to control theterminals managed by Tokyo 2020 Organising Commit-

admission of Games stakeholders to the venue etc )tee we considered the possibility of expanding thewas introduced in the guest network to connect to the

BON/CPN solution but we had to give up due toterminals brought in by guests

limitations imposed by the solution architecture
Many security solutions require not only an agent

42

PC Security

installed in each PC terminal but also a manager that

Each user had various requirements for PC terminals

manages the group of agents The manager can bebrought into the OTN and it was very difficult to

deployed on‑premises (hereinafter referred to as “on‑implement uniform security measures

premise solution”) or in the cloud (hereinafter referred

Considering

these conditions to prevent infection of PC terminals

to as “cloud‑based solution”)

and the spread of infection between terminals a security

Based on the technological trends at the time wereview was conducted for each system to determine theadopted the on‑premise solution of anti‑malware

minimum requirements for PCs used in the system andsoftware for BON/CPN that could be configured ineach system was strongly requested to comply withdetail In this configuration the connection between thethese requirements

BON/CPN and OTN was limited so OTN PC terminals

In addition to the terminals brought into the OTN
there were also loaner PC terminals managed by Tokyo
2020 Organising Committee for the use of Gamesand the manager could not be connected and the BON/
CPN solution could not be deployed on the OTN
On the other hand

many EDRs were originallystakeholders The loaner PC terminals were used by thedesigned as cloud‑based solutions and EDR adopted forathletes staying in the athletesʼ village and by critical

BON/CPN was also cloud‑based solution In the case of

infrastructure providers and like the terminals brought

cloud‑based solutions a common solution could be usedin they must be able to use for a variety of purposes On

in any environment as long as there was connectivity

the other hand because of the wide range of users it

between the manager in the cloud and the PC terminal

was difficult to disseminate the policies of Tokyo 2020

so the same level of security measures could be deployed

Organising Committee to all users which could haveby extending the BON/CPN solution to OTN The cost

resulted in numerous security incidents Consideringof the solution was also low because it required only athese conditions

small increase in the number of licenses

we decided to avoid using strict

security settings with anti‑malware software in order to

Although it was assumed that the requirements formaintain the usability of PC terminals and instead wesecurity measures for OTN PC terminals managed byhave adopted a policy of implementing EDR of the same

Tokyo 2020 Organising Committee would be different

level as BON/CPN to detect and respond to incidents asfrom those for BON/CPN PC terminals in consideration

soon as they occurred Furthermore since the coopera-of the above‑mentioned restrictions on deployment ittion of PC terminal users was indispensable for incident

was finally decided to expand the EDR solution for BON/

response we have obtained an agreement with the users

CPN to apply it to the OTN and to select the minimum

268

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

necessary security measures to meet the requirements

policyof OTN in addition to the EDR

protection for large‑scale attacks

The difference between on‑premise solution andcloud‑based solution was also evident during theit is necessary to have additional dedicated
The Organising

Committee has decided to procure CDN to cover all
public web systems of the Organising Committee

software upgrade process The anti‑malware software

CDN is a service that delivers content from a web

was operated for a long period of time from the early

server (origin) located in a data centre or cloud to end

stages including the preparation period of the Games

users from delivery servers (edges) distributed aroundresulting in two version upgrades during the period of

the world By delivering content from edges which isuse The on‑premise environment required a large scalecloser to the end user CDN improves the access speed

and long term project In addition it was necessary toto the website and reduces the load of the origin by

re‑distribute the agent software for the version up-

aggregating a large number of accesses at the edge andgrades but the anti‑malware software itself did notaccessing the origin only when necessary It is also very

have an agent distribution function resulting in a large

useful for cyber attacks protection as it reduces direct

workload On the other hand the EDR of cloud‑based

attacks by cloaking the origin and attacks via edges cansolution had a mechanism for easy distribution so thebe handled in a decentralized manner at each edge

workload for version upgrades was small

We minimized damage of DDoS attack by CDN edge

In consideration of long‑term use it is inevitable thatstructure while at the same time utilizing three filtering

OS versions of PC terminals and servers must get

functions to block other attacks The first is rule‑based

upgraded and the security solution itself will need to be

filtering which examines the contents of traffic andupgraded to cover the new versions The workload toblocks them if unique characteristics

upgrade such a solution should be one of the indicators toinclusion of attack code are contained The second isselect a solution

rate‑based filtering which blocks continuous access tosuch as theAt that time on‑premise solution was adopted forgenerate heavy load on the origin such as intensiveanti‑malware software but since then technology has

access to search pages The third is reputation‑based

advanced and cloud‑based solution has become afiltering which blocks access from blacklisted sources

realistic option of solution Considering cost advantages

The blacklist is created and maintained by the CDN

and the convenience of long‑term use including version

provider with their own knowledge such as attacks for

upgrades future Games will change to focus on cloud‑other websites All of these filters were used in a blockbased operational designmode which immediately blocked malicious communications as soon as they were detected In addition since
the origin cannot be fully concealed and can be directly

5．Website Domain Security

targeted

Websites operated by the Organising Committee

all origin set their firewalls to deny all

connections except the edges

In addition to theinclude not only official sites and ticket sales sites that

firewalls scrubbing center‑type services and DDoS

are open to the public but also many systems that are

mitigation options provided by cloud services are also

open only to specific users such as games information

used DDoS attacks that target the gateway network of

distribution systems for the media The composition of

the origins By combining these measures we con-these systems varies widely and security measures

structed a defense infrastructure that can respond to aneed to be implemented for each site individuallywide variety of attack methods

However

there are solutions that can be applied

Howeverthese security measures were only acentrally to many of them which can be very effective

baseline Each website adopted defense‑in‑depth design

This section introduces CDN as a typical example

and implemented various of countermeasures depending
on its configuration and characteristics Although CDN

51

is a very useful security measure we should not beContent Delivery Network (CDN)

Web systems are very attractive targets for attackers

overconfident that they alone are sufficientand are frequently subjected to DDoS attacks intrusion
attempts for data falsification and exploitation

and

52

DoS Simulation

reconnaissance attacks as a preliminary step Although

Security measures are implemented in a defense‑in‑each website is hardened in accordance with its security

depth design but it is also important to check whether

Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020269

they work together as expected and whether theuse of a shared infrastructure requires careful research

expected protection effect is achievedon the specifications of authorization settings andAlthough the Organising Committee system undergoes sufficient functional and load tests prior to releaseelaborate authorization design tailored to the intendedusecyber attacks are very different from normal access in

The second issue is the impact of service failures If

terms of both quality and quantity so dedicated tests are

the common infrastructure fails many services will beneeded to measure attack resistance Penetration tests

affected simultaneously resulting in extensive damage

measure resistance to malicious communications such as

Since the infrastructure itself will be large‑scale it will

injection attacks in addition other tests were conducted

be difficult to prepare a secondary system equivalent toto measure resistance to the load of large accesses

the current system and switch to them when primarycaused by DDoS attacks

system gets in trouble It is necessary to select a service

we prepared an environment whichwith sufficient stability carefully prepare countermeas-

generated the simulation of DDoS traffic and checked

ures in the event of failure and build a system that can

whether each DDoS protections worked as expected forpromptly coordinate information with infrastructure

the generated traffic Because this is only a simulation

operators so that appropriate measures can be selected

and the scale is limited to some extent we call the test

in a timely mannerSpecifically“DoS simulation” rather than a DDoS However the test
was well arranged so that it could cause a sufficient load

6．Conclusion

by appropriately adjusting the system configuration
during the test according Because this test involved not

In the BON CPN OTN and website domains system

only the security operation centre but also the data

hardening has been achieved through the implementa-

centre and cloud service provider where the CDN andtion of MFA the elimination of vulnerable configura-origin servers were located the target systems weretions

limited to critical systems only For example there weremanagement In addition with the implementation ofconfiguration management

and vulnerability

cases in which security measures activated simultane-

defense in depth and visualization solutions for each

ously interfered with each other and unexpectedly

system as well as continuous activities to prevent theblocked legitimate connections and cases in which theobsolescence of solutions by version upgrades of them

activation of protective functions was delayed beyond

we could have increased defenses and resulted in the

expectations By optimizing the settings based on thecompletion of the Games without any major security

knowledge obtained here we were able to set up a stateincidents

in which the expected defense effect could be achieved(Received February 28 2022 ; Revised April 5 2022)

53

Notes on Shared Infrastructure

While 4 3 describes the advantages of cloud based
solutions in terms of scalability there are some points tonote when many systems use a shared infrastructure asin the case of cloud based solutions These are described
below
The first issue is the authorization design In a multi‑
tenant configuration where the infrastructure is sharedby multiple systems it is essential to separate theauthorization so that the resources for each system canbe freely accessed by its owner while the others cannot
be accessed In the case of CDN the management
functions for filtering falls into this category Fortunately this was not a problem because the security

TAMAI Kuniharu
TAMAI Kuniharu has engaged in providing
solutions for corporations at NTT Communications Corporation and has been seconded to theTokyo 2020 Organising Committee as the
Project Director of Cyber Security Department Technology Services Bureau since 2018
During the Games he oversaw the operation of
security solutions at the SOC
NOJIRI Yasuhiro
NOJIRI Yasuhiro has been working for
CSIRT start‑up support and education at NEC
Solution Innovators He has been seconded to
the Tokyo 2020 Organising Committee as
security solutions manager since 2019 in the
Cyber Security Department of the Technology
Services Bureau During the Games he oversaw the operation of security solutions at the
SOC

function originally needed to be managed by the Cyber
Security Team centrally and we could hide themanagement function for each system operators The
270

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERSHOSODA Naofumi
HOSODA Naofumi has been working for ISP
backbone operation and analysis of cyberthreats at NTT Communications Corporation
He was seconded to the Tokyo 2020 Organising
Committee as Security Operations Manager of
the Cyber Security Department Technology
Services Bureau since 2014 During the Gameshe was in charge of web security operations at
the SOCIBAYASHI Hiroaki
IBAYASHI Hiroaki has been working in theservice development of cloud and security
businesses at NTT Communications Corporation since 2014 and has been seconded to theTokyo 2020 Organising Committee as the
Director of Cyber Security Department Technology Services Bureau During the Games he
was responsible for the overall security operations in the SOC㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇

Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020271