Hitachi Incident Response Team2014.05.26 11:04:45 +09'00'
HIRT: Annual Report 2011

HIRT: Annual Report 2011
Hitachi Incident Response Team (HIRT)
http://www.hitachi.com/hirt/
Kashimada 1-1-2, Saiwai, Kawasaki, Kanagawa, 212-8567 Japan

1

Introduction

The year 2011 saw the occurrence of a diversity of
security incidents and developed into a transitional period
in which cyber attack countermeasures were put underreview (Table 1).
Table 1: Typical security incidents.
Time
March
2011
April
2011
August2011
September
2011
November
2011

OutlineCirculation of virus emails, riding on the back of theearthquake
Unauthorized accessing of Japanese enterprises’
overseas websites, resulting in information leakage
Unauthorized accessing of internet banking sites
Targeted attacks on defense industry enterprises
Denial-of-service attacks on clouds

Particularly salient were the incidents of April 2011,
which forced a rigorous implementation of security
measures that needed to be taken (especially vulnerability
countermeasures), and the incidents of September 2011,
which forced a fresh consideration of introducing of
security measures (especially Egress countermeasures)
grounded in information security.
Alongside of this, attention in the area of security
measures in Japan in 2011 was focused on "Egresscountermeasures" that will achieve multi-layered defense oforganization-internal systems. Whereas the emphasis in
security measures hitherto had been placed on "Ingresscountermeasures" that protect against intrusion, theemphasis with multi-layered defense that incorporates"Egress countermeasures" is on promoting countermeasuresfrom three perspectives:

Organization-internal network

Ingress(1)Intrusion

Ingress
countermeasures

Ingress countermeasures - strengthening intrusion
prevention;

Deployment countermeasures - preventing the spreadof an invasive action in an organization-internal
network, so as to guard against intrusion; andEgress countermeasures - preventing progression ofinvasive action, or leakage of information, and so forthetc., via back door communication, so as to guard
against intrusion.

We believe that in the times ahead, such changes incountermeasures will have no small impact oninter-organizational collaboration - especially informationexchange - among CSIRTs (Computer Security Incident
Readiness/Response Teams).
We consider that the requirements for CSIRTs in carryingout vulnerability countermeasures and incident responses
are to possess the capabilities for "predicting and alertingfrom a technical point of view", "making technicaladjustments" and "collaborating with external communities
on the technical aspects". We are not envisioning special
requirements here. The role of CSIRTs is to make use of
their experience in incident operations (the series of
security measure actions implemented in order to predictand prevent damage from incidents and to lessen the
expansion of damage after incidents occur) so as to"implement measures at an early stage in an effort to catchany sign of future threats".
As an organization that possesses these capabilities androles, HIRT (Hitachi Incident Response Team) leads theway in countermeasures for product and service
vulnerability countermeasures and incident responses formalware infection and information leakage, besides being
responsible – as the Hitachi Group's integrated CSIRT
liaison organization - for implementing activities,
mechanisms and framework for enhancing Hitachi’s brandin the field of security. This report will present an overview
of the vulnerabilities and threats, and HIRT’s activities, in2011.

Egress(2)Installation(3)Theft

Deployment
countermeasures

Egresscountermeasures

Figure 1: Multi-layered defense of an organization-internal
system.
Copyright © Hitachi Incident Response Team(HIRT). 2011. All rights reserved.

HIRT: Annual Report 2011

Overview of activities in 2011

2(2)Exploit code injection
to the attached file (3)Re-sent email includes
attached malware file
as targeted email attack

This section focuses on the threats and vulnerabilities, andHIRT's activities, in 2011.

2.1

Overview of Threats and Vulnerabilities(1)A forwarded email
is intercepted(1) Overview of Threats
In Japan there occurred a varied slew of security incidents,
including targeted attacks and website invasive actions. Of
those, the known threats like USB memory type malware(e.g. Conficker) have continued to cause damage.

Figure 3: Social engineering attack - using a genuine item -.

A feature of 2011 was that security incidents relating todigital certification, which could be termed the basis of thedigital society, became steady occurrences. These wereincidents such as fraudulent issuance of digital certificatesby means of invasive activities (March and August 2011)
and use of stolen digital certificates in malware (November2011).


A feature of the website invasive incidents reported in2011 was that the information acquired was made public on
the website by the attacker (Table 2). A collateral issue ofsuch incidents is that the information so published may beutilized in targeted attacks or the like described earlier.

Targeted attacks

Figure 2 shows a scenario for one of the targeted attacks
reported in 2011 that had stealing information as objective.
The distinctive features of this attack include the targetedemail that uses social engineering (to be discussed later);system intrusion that uses a hashed Windows password,called a "pass-the-hash" attack; and remote control of an
infected PC by means of Poison Ivy or some other RAT[*a]tool.

Table 2: Cases of leaked information being made public on
websites.
Time
July
2011
November
2011

RAT(1) Intrusion
Infection of PC using
targeted email

Attacker(1)
Malwareinfected email

December
2011(2)(2) Installation
Intrusion using infected PC,
and keeping the stealth mode
into organization-internal
network
Employee(3) Theft(3)(2)
Windows
PC/Server

Gathering and taking away dataOutlineBooz Allen Hamilton
On the order of 90,000 email addresses andpasswords
OhMedia
On the order of 60,000 email addresses andpasswords
China Software Developer Network (CSDN)
On the order of 6 million email addresses andpasswords
Strategic Forecasting Inc. (Stratfor)
On the order of 860,000 items of customer
information and 75,000 of credit card
information

Conficker

Conficker emerged as a worn that exploited Vulnerability
in Windows, "Server Service Could Allow Remote Code
Execution (MS08-067)" in around November 2008. In
December 2008, by modification of Conficker (enhancedwith the feature to infect via a USB memory stick),
infection spread to the closed networks via a physicalmeditational means. Since 2009, the number of reports on
the USB malware infection in Japan has been decreasing(Figure 4) [1]. However, according to the report of theConficker Work Group, the number of computers infectedwith Conficker is about 3 million on the IP address base(Figure 5) [2].

Information
resources

Figure 2: Example of targeted attack scenario.

A particularly sophisticated method has been reported besides the simple one of disguised icon and file name - fortargeted email that uses social engineering. Namely, aforwarded email is stolen and then sent on again with
exploit code injected in its attached file (Figure 3).

[*a] RAT: stands for Remote Access Trojan or Remote Administration
Tool. Program for operating a system that has been penetrated from aremote location. Used for stealth/theft activities and so on.

Copyright © HIRT. 2011. All rights reserved.

Collateral issue observed in website invasive
incidents

2

HIRT: Annual Report 2011

Number of Vulnerabilities

7 (M)
6
5
4
3
2

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Cross-Site Request Forgery (CSRF)
Path Traversal
SQL Injection
Cross-Site Scripting (XSS)

2,500
2,000
1,500

1,000
500
0
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011

1

0
2009/04 2009/10 2010/04 2010/10 2011/04 2011/10

Figure 7: Changes in the number of vulnerabilities reported
for software products of web application(Source: NIST NVD).

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

1998

The total number of vulnerabilities entered in the NIST
NVD (National Vulnerability Database) was 4,151 in 2012[3]. About 20% (902) of the vulnerabilities were in web
software application products (Figure 6). Breaking thesedown, cross-site scripting (XSS) and SQL injection accountfor about 80%, which is a continuing trend (Figure 7).
Likewise, some 60% of the vulnerabilities in operational
websites that were reported to the IPA (Information
Promotion Agency, Japan) are accounted for by cross-site
scripting (XSS) and SQL injection, and this too is acontinuing trend, with close to 600 a year of thesevulnerabilities being reported (Figure 8) [4].

2001

Overall Trend

2000(2) Overview of Vulnerabilities

Cross-Site Request Forgery (CSRF)
Path Traversal
SQL Injection
Cross-Site Scripting (XSS)

1,600
1,400
1,200
1,000
800
600
400
200
0

1999

Number of Vulnerabilities

Figure 5: Number of Infection of ConfickerA+B(per day).

Figure 8: Changes in the number of vulnerabilities reported
for websites (Source: IPA and JPCERT/CC).

11/11

11/09

11/07

11/05

11/03

11/01

10/11

10/09

ICS-CERT Alert

10/01

The ICS-CERT (Industrial Control System-CERT) has
issued 37 alerts and 64 advisories concerning vulnerabilities(Figure 9). 12 of the advisories (accounting for 19%)
pointed out vulnerabilities in the ActiveX control that ispresent in control system products.

ICS-CERT Advisory

10/07

Control System Products

18
16
14
12
10
8
6
4
2
0

10/05

Number of reports



2001

Figure 6: Number of Vulnerabilities Reported(Source: NIST NVD).

Figure 4: Number of Infection of USB Malware(per month).



2000

08/01
08/04
08/07
08/10
09/01
09/04
09/07
09/10
10/01
10/04
10/07
10/10
11/01
11/04
11/07
11/10

0

1999

200

1998

400

Web Application
Other

10/03

Number of reports

600

7,000
6,000
5,000
4,000
3,000
2,000
1,000
0

Number of vulnerabilities

WORM_DOWNAD(Conflicker)
WORM_AUTORUN
MAL_OTORUN

800

Figure 9: Change in the number of control systemvulnerabilities reported (Source: ICS-CERT).
3

Copyright © HIRT. 2011. All rights reserved.

HIRT: Annual Report 2011

2.2

HIRT Activities

Phase 3
Establish a virtual, horizontal incident response framework(HIRT Center - IRT - IRT supporting staff) >>> Install and promote theincident operations throughout the whole Hitachi Group

This subsection describes the HIRT activities in 2011.
(1) Improvement of Hitachi Group CSIRT activities(Phase 1)

All Business Divisions of Hitachi & Groups Companies
SI Vender IRT
Business Division orGroupcompany IRT
事業部・グループ会社IRT

In 2010, we started improvements of Hitachi GroupCSIRT activities with the goal of "instilling incident
operation into the whole Hitachi Group" (Figure 11).

Operation Chief

HIRT
Center2011 was the second and concluding year of Phase 1, andin it we concentrated our efforts on entrenching a support
activity cycle (issue identification, analysis, countermeasuredeliberation and dissemination) that links with the businessdivisions and the Group company IRTs (Figure 10).

Phase 1

Drawing-up of Must-reconfirm Check Points for
FY 2010

In entrenching the cycle, we narrowed down to a few
typical Check Points the issues that had been brought tolight through the security reviews and incident response
support, and utilized them for countermeasure
dissemination.


Expansion of technology-themed HIRT OPEN
Meetings

Phase 2

As a part of countermeasure dissemination, we effected anenhancement of the "technical meetings", mainly throughworkshops providing a Guide to Drawing Up Basic
Security Specifications that is intended to encourage
utilization of existing documents, and lectures by external
instructors with a view to objectively rethinking efforts
regarding security measures (Table 3) [*b].

Product Vendor IRT

HIRTCenterSections that needsupportInternal User IRT

Phase 3

FY 2011

FY 2010All Business Divisions of Hitachi & Group Companies
・Security information
・Security review consulting
・Technical support for evaluation tools
SI Vender IRT
・Education planning and provision

Issue identification
Reconsideration of security
review consulting and incident
response experiences

IRT supporting staff

Product Vendor IRT

Phase 2

Internal User IRT

Strengthen Partnershipwith IRT supporting staff

IRT supporting staff

Concrete Measures
Improve Collaboration with IRT of Business
Divisions and Group Companies- Promote support activities with the collaboration
between the IRT of Business Divisions and Group
Companies- Establish an IRT coalition framework andmechanism to share technological know-how using
the HIRT OPEN Meetings- Disseminate information about
solutions/countermeasures for the problems
discussed in the security review consultation.
Strengthen Partnership with IRT supporting staffs- Trial collaboration with IRT supporting staffs (ofbusiness divisions and group companies)- Bottom up the IRT activities with the IRT
supporting staffs as a starting point
Establish Virtual, Horizontal Incident Response
System- Promote various support activities by the HIRT
Center, IRTs and IRT collision support members- Develop a HIRT in a broad sense (virtualorganization model) by combining the user
collaboration model (Phase 1 and 2) and entity
collaboration model (Phase 3).

Analysis, study ofcountermeasures
Collaboration with IRTs and
IRT supporting staff(2) Publishing of Information on Vulnerability inControl System Products

Utilization of HIRT OPEN
Meetings

The ICS-CERT's alert and advisory issuance activities are
now in their second year, and reports of vulnerabilities incontrol system products have increased. Accordingly, inorder to keep regular track of the trends in thevulnerabilities reported, in September 2011 we begandealing with control system product vulnerabilities on amonthly basis in our company-internal informationtransmission activities. This has resulted in a slight increasein the number of HIRT security information items issued(Figure 14).

Figure 10: Phase 1 activities.

[*b] HIRT OPEN Meeting
HIRT OPEN Meeting is an activity is to popularize the HIRT community
on the basis of relationships of trust. The meetings are held in line with
policies of "offering an opportunity for HIRT Center members to share
information about HIRT activities", "offering an open event for people ofthe Hitachi Group to learn about the HIRT Center's activities for the HIRT
Center members to share information with and get opinions from non
HIRT Center members", and "providing an opportunity to call forparticipation in the HIRT community on the basis of relationships of trust".
HIRT OPEN Meeting (Technical Meeting)Technical Meeting is for designers, system engineers and persons willingto share their technical expertise come together to share and learn thetechnical know-how necessary to build security into products and services.

Copyright © HIRT. 2011. All rights reserved.

Units that need support

ハンドリング責任者
IRT連絡窓口担当者

IRT Liaison Staf f

Figure 11: Scenario on a Virtual, Horizontal
Incident Response System.

Countermeasure
dissemination
Staff combining HIRTwith other duties

実行責任者

Vulnerability
Handling Chief
脆弱性関連情報

Improve Collaboration with Business Divisionsand Group Companies' IRT

Category
Phase 1- Security information- Security review consulting- Technical support for evaluation tools- Education planning and offering

4

HIRT: Annual Report 2011

Table 3: HIRT OPEN Meeting (Technical meeting) in
2011.
Month
April
June

July

September

November
December

we have moved ahead with publishing the U.S. FDCC
(Federal Desktop Core Configuration) efforts and the JVN
and MyJVN efforts in Japan, as use cases in the Appendix
to X.cybex (X.1500) [8].

OutlineHands-on: Forensics of USB virus infection
Guide to Drawing Up Basic Security Specifications- introductory session- Overview of the guidelines and how to use them
Guide to Drawing Up Basic Security Specifications- hands-on session- Group discussion using Worksheet 1
Guide to Drawing Up Basic Security Specifications- application session[External instructor]
Mr. Hiroshi Tokumaru (HASH Consulting
Corporation)
Defining Security Requirements for Web
Application Development[External instructor]
Mr. Toshifumi Tokuda (IBM Japan)
Difficulties and Actual Practice in the
Information Leakage Countermeasure Field Tracking Down Malicious Data Diffusion Crimes
How to Interpret and Effectively Utilize
Vulnerability Information[External instructor]
Mr. Norihiko Maeda (Kaspersky Labs Japan)
Circumstances Surrounding Android (Trends in
the Android Malware)(5) Other Activities
Sponsored (as part of the recommending team) the
membership of MBSD-SIRT (Mitsui Bussan Secure
Directions) and of UFG-CERT (Mitsubishi UFJ
Financial Group) in FIRST.



Contributed an article on vulnerability
countermeasures titled "Vulnerability Information to
Keep in Mind", to the ITpro CSIRT Forum held by
Nikkei Business Publications, Inc.[9].



Posted a report on HIRT's activities on our security
information portal (Table 4).
Table 4: Reports Published on the Security Information
Portal.

Number
HIRT-PUB10008(English version)
HIRT-PUB11003
HIRT-PUB11002
HIRT-PUB11001(3) Strengthening of Partnership with the CSIRT
Community3

A specific instance of the strengthening of this partnershipis the periodic gatherings with NTT-CERT [5] that we haveheld continuously since 2006 to exchange information forimproving the CSIRT activities themselves. Also, we
carried out information transmission in cooperation with the
Nippon CSIRT Association’s Incident Information
Utilization Framework Working Group [6].




Title
Hitachi Vulnerability Disclosure Process
Malware Circulating in P2P File-Sharing
Environment (2011)
HIRT Annual Report 2010
Zero-Day Response (2011)

HIRT

To give you an in-depth understanding of HIRT, thissection describes the organizational model adopted, the
HIRT/CC, a coordinating unit, and the activities currently
promoted by the HIRT/CC.

3.1

Organizational Model

We have adopted an organizational model that consists offour IRTs (Figure 12 and Table 5). There are three IRTs forthe case with Hitachi Group itself; Product Vendor IRT; SI
Vendor IRT, and Internal User IRT; each corresponding to
one of the IRT's aspects: the Product Vendor IRT
corresponds to the aspect of developer of products such as
information systems and control systems, the SI Vendor
IRT to that of a system integrator/service provider that uses
those products, and the Internal User IRT to that of aninternet user that operates and manages its own enterprise.
By adding to these a fourth IRT - the HIRT/CC (HIRT
Coordination Center), which carries out coordination work
among the others - a model is obtained which we
considered would be able to implement efficient andeffective security measure activities that achieve
collaboration among the IRTs, while making clear theirindividual functions. The name "HIRT" signifies theincident operation activities promoted by the Hitachi Group
as a whole, in the broad sense, and signifies the HIRT/CC(HIRT Center) in the narrow sense.

Regarding attack mstmp via websites using web
service linkage(4) Cooperation with the Standardization Activities for
ITU-T’s Cybersecurity Information Exchange
Framework ("CYBEX")
ITU-T, which is the Standardization Sector of theInternational Telecommunication Union (ITU), is
proceeding with the CYBEX series of standardizations oftechnical specifications for telecommunications - formats,numbering schemes and so forth pertaining to vulnerability
countermeasure information and incident responses. The
spread of these technical specifications will promotemechanical processing of vulnerability countermeasuresand incident responses. Meanwhile in Japan, efforts havebeen underway since 2008 to put in place, by means of
MyJVN [ 7 ], a mechanical processing infrastructure forvulnerability countermeasures that use SCAP (Security
Content Automation Protocol), a component of the CYBEX
series. To assist with putting the mechanical processing
infrastructure for vulnerability countermeasures in place,5

Copyright © HIRT. 2011. All rights reserved.

HIRT: Annual Report 2011

In fact, four phases (set forth inTable 6) had to be gone through in order to put the four
IRTs in place. For each phase, there was an "impetus" thatencouraged organizational formation. For instance, theimpetus for the second phase - establishing of the ProductVendor IRT - was the fact that the vulnerability in SNMP
[10] reported by CERT/CC had affected large numbers ofHitachi products. The impetus for the third phase establishing of the SI Vendor IRT - was the commencementof the Information Security Early Warning Partnership.

Table 6: Phases until the organization was formed.
Phase
April 1998
1st phase
Establishing theInternal User IRT(1998 - 2002)

2nd phase
Establishing the
Product Vendor
IRT(From 2002 -)3rd phase
Establishing the
SI Vendor IRT(From 2004 -)October 2004

Overview
We started CSIRT activities as a project toestablish a Hitachi CSIRT framework.
In order to run a Hitachi CSIRT on a trial
basis, we formed a cross-sectional virtual
team within the Hitachi group to start
mailing list based activities. Most of themembers comprised internal security experts
and those from sections administeringinternal infrastructures.
In order to start conducting activities
seriously as a Hitachi CSIRT, the sections
developing products played a central role inestablishing an organizational structure of
the Product Vendor IRT with related
business sites through cooperation frominternal security experts, the sections
administering internal infrastructures, thesections developing products and the Quality
Assurance Department.
We started to form an SI Vendor IRT withthe sections providing SI/services. In order toswiftly implement proactive measuresagainst vulnerabilities, as well as reactive
measures against incidents, via partnershipwith Internet communities, we started toform HIRT/CC, which provides a point ofcontact for external organizations andenhances coordination among Internal IRTs.
We established the HIRT/CC.

Figure 12: Four IRTs as an organizational model.
The HIRT Center was set up to play the role ofcoordinator inside Hitachi and with external entities, after
the other three IRTs had largely taken shape.

Table 5: Role of each IRT.
Category
HIRT/CC

SI Vendor
IRT

Product
Vendor IRT

Internal
User IRT

Role
Corresponding sections: HIRT/CC- Provides a point of contact to external CSIRT
organizations, such as FIRST, JPCERT/CC andCERT/CC.
- Provides coordination among the SI Vendor,
Product Vendor and Internal User IRTs.
Corresponding sections: Sections providing
SI/services- Promotes CSIRT activities for customer systems.
- Provides customer systems with equivalent
security against reported vulnerabilities to thatfor internal systems.
Corresponding sections: Sections developing
products- Provides support to promote vulnerability
measures for Hitachi products and the release of
information concerning such countermeasures- Promptly investigates whether a reported
vulnerability has an impact on Hitachi products,
notifies users of the impact, if any, and provides
a security fix.
Corresponding sections: Sections administeringinternal infrastructures- Provide support to promote security measures forinternal networks lest Hitachi websites should be
used as a base for making unauthorized access.

Copyright © HIRT. 2011. All rights reserved.

3.2

Position of HIRT/CC

The HIRT/CC is positioned under Information andTelecommunication Systems Company and has the role of
not only a coordinator within and with the entities outside
Hitachi but also a leader in promoting security technology.
The main area of activity is to support the Product andService Security Committee technically, to promotesecurity efforts from the technical and institutional aspect incooperation with the IT and Security Strategy Division,
Information Technology Division and Quality Assurance
Division.
Moreover, it also includes helping each business divisionand group company implement proactive security measuresagainst vulnerabilities, as well as reactive measures against
incidents, and promoting security measures throughpartnerships among organizations as a point of contact for
CSIRT activities in the Hitachi group (Figure 13).
The organization of the HIRT/CC features the
combination of vertical and horizontal collaboration ofpeople and units. More specifically, this model has
achieved a flat and cross-sectional organizational system
6

HIRT: Annual Report 2011

for implementing measures and coordinating ability throughdistribution if functions by creating a virtual organizationconsisting of dedicated personnel and those who areassigned to HIRT as an additional task. Such organization
is based on the concept that the performance of duties by
each section and cooperation among sections are necessary
to solve security issues, given the great diversification
among components in the information systems.

3.3

Table 7: (Internally) promoting projects.
Category
Collecting,analyzing andproviding security
information

Main Activities of HIRT Center

The main activities of the HIRT center currently being
promoted include CSIRT activities for internalorganizations (Table 7) and those for external organizations(Table 8). The internally-oriented CSIRT activities
comprise issuing alerts and advisories that embody theknow-how obtained through gathering and analyzing
security information. Besides those, we are currently
engaged in activities to feed such knowledge back into
product development processes in the form of various
guidelines and support tools.

Promotingproactive measuresagainstvulnerabilities, aswell as reactive
measures against
incidents for
products/services

Enhancing security
technology for
products/services

HIRT security information in internally-oriented alerts andadvisories has been broken down into two types since June
2005. One is HIRT security information that aims to
distribute alerts and hot topics widely, and the other is
HIRT-FUP information, which is used to request individual
sections to take counter-action. This distinction is for thesake of information propagation and priority ranking.
(Table 9 and Figure 14). To communicate information
efficiently, we condense it to reduce the number of
information items and release it in tandem with the IT &Security Strategy Division and the Quality Assurance
Division.
Information
Information andand Telecommunication
Telecommunication Systems
Systems
Information Management
Headquarters
Information Management
Committee

Information Technology
Division

Product and Service Security
Committee- Providing support for vulnerability
and incidents response- Providing information, consulting
and cooperation

Point of contact for Hitachi IRTs
(Mutual corporation among organizations)

Strengthening theoverseas
partnership for
CSIRT activities

Quality Assurance Division
Mutual cooperation in technicaland system aspects

Leader of a technical aspect

Table 8: (Externally) promoting projects.
Category
Strengthening thedomestic
partnership for
CSIRT activities

Leader of a
Headquarters
system aspect Headquarters
IT & Security
Strategy Division

Information Security Planning
CommitteeHIRTHIRTCenter
CenterDeveloping aframework forresearch activities

Overview- Promoting Information Security Early
Warning Partnership (Information
concerning proactive measures against
vulnerabilities, as well as reactive
measures against incidents/horizontal
deployment of know-how)- Building a wide area observation network
based on the Hitachi Security Operation
Center Information eXchange (SOC-IX)- Reinforcing the security foundation
within the Hitachi Group througheducation for sections addressing security
within the companies- Accumulating and deploying technicalknow-how for countermeasures against
vulnerabilities and incident response- Promoting the publication of security
information from external websites using
the Security Information Integration Site
- Improving the process to provide security(each guideline for development,
inspection and operation)- Enhancing and expanding support andprocesses though internal support
activities- Enhancing web application security- Developing a framework for joint
research with the Yokohama ResearchLaboratory (for P2P observation, etc)

Operation Chief
Vulnerability
Handling Chief
IRT Liaison Staff

Developing aframework forresearch activitiesAll
All BusinessBusiness Divi
Divisionssionsofof Hitachi
Hitachi&& Groups
Groups Companies
Companies

External
External IRT
IRT communities
communities-- CSIRT
CSIRTorganizationsorganizations (CERT/CC(CERT/CC (US),(US), CPNICPNI (UK),(UK), JPCERT/CC
JPCERT/CC (JP))(JP))-- Governmental
Governmental organizationsorganizations (Cabinet(Cabinet Secretariat,
Secretariat, Ministry
Ministry ofofEc
Economy,onomy, Trade
Trade andandIndustry,
Industry, Ministry
Ministry ofofInternalInternal Affairs
Affairs andand Communications,
Communications, National
National Police
Police Agency,
Agency,etc.)
etc.)-- ProductProduct andand software
software vendors
vendors (Mic
(Microsoft,rosoft, FFR,
FFR, etc.)
etc.)-- ISP
ISP (NTT,(NTT, IIJ,
IIJ, etc.)
etc.)-- Security
vendors(IBM-ISS,
LAC,
Trend
Micro,
SecureSecurity vendors (IBM-ISS, LAC, Trend Micro, Secure Brain)
Brain)

Figure 13: Position of HIRT Center.

Overview- Deploying proactive measures against
vulnerabilities based on the Information
Security Early Warning Partnership- Promoting activities related to the Nippon
CSIRT Association- Improving partnerships with overseas
CSIRT organizations/product vendor
IRTs through lectures or events at FIRST
conferences- Promoting UK WARP related activities.
- Countermeasures against vulnerabilities,
such as CVE and CVSS, andstandardization of incident response (ISO,ITU-T) [*c]- Establish a joint research between Tokai
University (Professor Hiroaki Kikuchi)
and HIRT.
- Participating in academic research
activities, such as a workshop to develop
human resources for research on malware
countermeasures (MWS) [11][*c] Work had begun in 2007 in ISO SC27/WG3 to develop aninternational standard "Vulnerability Disclosure (29147)". Work had begun
in 2009 in ITU-T SG17 Q.4 to develop an international standard "Cyber
security Information Exchange Framework (X.cybex)".

7

Copyright © HIRT. 2011. All rights reserved.

HIRT: Annual Report 2011

We are now promoting activities to expand the HitachiGroup's commitment to product and service security toInternet users via our security portal website, as a proactive
measure against vulnerabilities, as well as reactive
measures against incidents.

4

This section describes the activities for each year from1998 when the HIRT project started.

In particular, for issuing security information forvulnerabilities and incidents, to external entities, we also
adopt an approach in which an "Emergency Level" of
information is determined and a "Website Level" at which
the information is to be published is selected, in addition tojust routinely publishing security information via our
security portal website (Figure 15).

4.1

HIRT-yynnn

We began activities for Phase 1 of the improvement of
Hitachi Group CSIRT activities, with the goal of "installingincident operation into the whole Hitachi Group". In 2010,
the initial year of Phase 1, we concentrated our efforts onentrenching the liaison meetings (operational and technicalmeetings) for the vulnerability-related information handlingofficers and IRT liaison staff.

Usage
Priority: Urgent
Distributed to: Only relevant sections
Is used to notify relevant sections ofvulnerability when an HIRT member has
found such vulnerability in a Hitachi groupproduct or a website, or received suchinformation.
Priority: Middle - HighDistributed to: No restriction
Is used to widely call attention to proactive
measures against vulnerabilities, as well asreactive measures against incidents.
Priority: Low
Distributed to: No restriction
Is used to notify people of HIRT OPEN
Meetings or lecture meetings.

180
160
140
120
100
80
60
40
20
0

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

HIRT

1999

Operational Meeting (once/term): for thevulnerability-related information handling officers and
IRT liaison staff, held with the objectives of sharing
and passing on the operational know-how necessary
for IRT activitiesTechnical Meeting (2-4 times/term): for designers,
system engineers and persons able to assist with
disseminating technological expertise, held in order todisseminate the technological expertise necessary forbuilding security into products and services.

In December 2012, we provided support for the holding of
the Nippon CSIRT Association's International Partnership
Workshop Also, in cooperation with the Nippon CSIRT
Association's Incident Information Utilization Framework
Working Group, we carried out information disseminated[6]:

HIRT-FUP

A website with the information about Gumblar
countermeasureInformation on the SSL attack by the Botnet PushDo

Information about Stuxnet(3) Other activity

Figure 14: Number of issues of security information
by ID number.

Figure 15: Conceptual view of issuing information based on"Emergency Level" x "Website Level".

Copyright © HIRT. 2011. All rights reserved.

(2) Strengthening of Partnership with the CSIRT
Community

HIRT-FYI

1998

Number of issues

HIRT-FYIyynnn

The Year 2010

(1) Start of Improvement of Hitachi Group CSIRT
Activities (Phase 1)

Table 9: Classification of security information
issued by HIRT.
ID number
HIRT-FUPyynnn

Activity Summary from 1998 to 20108

In July 2010, we provided backing for the organizingof an "Academy CERT Meeting" in collaboration with
JPCERT/CC, to help Indonesia's academic CSIRT
activities [12].

"Survey on Malware Circulating Within the P2P File
Exchange Environment" [13]

Since 2007, many Antinny-type known malwares thatare liable to cause information leakage have beenswarming on the "Winny" P2P file-sharing
environment (Figure 16).

HIRT: Annual Report 2011

4.3

Information leakage malware ratio in all files
Information leakage malware ratio in archive files

20%(1) Supporting countermeasures against DNS cachepoisoning vulnerability

15%

We held an HIRT OPEN Meeting "Roles of DNS and Useof Related Tools" in December as a countermeasure to DNS
cache poisoning vulnerability, in order to describe DNS
behavior and how to use tools. To help promote DNS cachepoisoning countermeasures in Japan, the materials prepared
for the HIRT OPEN Meeting were provided as a reference,
based on which "Countermeasures against DNS Cache
Poisoning vulnerability" [ 16 ] issued from the IPA in
January, 2009, was created.

10%
5%
2010

2009

2008

2007

0%

Figure 16: Change in Malware Circulating in Winny That
Causes Information Leakage.

4.2(2) Holding JWS2008

The Year 2009

March 25-28, 2008, we held the FIRST Technical
Colloquium, a FIRST technical meeting, and Joint
Workshop on Security 2008, Tokyo (JWS2008), a domestic
CSIRT technical workshop, with a team of domestic FIRST
members [17].

(1) Start of Product/Service Security Feedback
To give feedback to the product development processes
about the know-how we learned from the experience ofvulnerability fighting and incident response, we started toprovide support for each process (Figure 17).

Basicknowledge

Quotation

Basic
on
Basic
courseBasic course
course on
on
web
web
application
web application
application
security
security
security

DesignSupport ofSupportSupport ofof
security
review
security
security review
review

Implementationand construction

Test
Hands-onHands-oncourse
Hands-oncoursecourse ofof webwebofapplication
web application
application
security
inspection
inspection
inspection
Training in theTrainingininthe
theTraining
use
inspectionuse ofinspectionuseofofinspecti
on
tools
tools
tools

(3) Participation in the domestic COMCHECK Drill
2008
With a view to ensuring that in-house information security
departments of various organizations could communicate
with each other, we participated in a domestic
COMCHECK Drill (Drill name: SHIWASU, was held by
the Nippon CSIRT Association on December 4, 2008).

Operation
Support for

Support for
Supportfor
adpopting
adpoptingadopting
contermeasurescontermeasurescountermeasuresinin incidents
incidents
in incidents
Support of log

Supportofof loglog
Supportchecking
checking
checking(4) Award with the Commerce and Information Policy
Bureau Chief Prize, Ministry of Economy, Trade andIndustry (Information Security Promotion Section)

Figure 17: Systematizing HIRT support activities(Web application security).

In the 2008 Information Technology Promotion Monthly
Period memorial ceremony held by Information
Technology Promotion Conference (Ministry of Economy,
Trade and Industry, Cabinet Office, Ministry of Internal
Affairs and Communications, Ministry of Finance Japan,
Ministry of Education, Culture, Sports, Science andTechnology, Ministry of Land, Infrastructure andTransport) on October 1, 2008. We were awarded with the"Commerce and Information Policy Bureau Chief Prize,
Ministry of Economy, Trade and Industry (Information
Security Promotion Section)" [18].

(2) Providing Security Engineer Training
As part of the security engineer training program utilizing
the CSIRT activities, we accepted a trainee and trained him
for six months with the focus on web system security.
(3) Lectures
July 2009: "Web Application Security" by Hiromitsu
Takagi, National Institute of Advanced Industrial
Science and Technology (AIST)

July 2009: "NTT-CERT Activity" by, Takehiko
Yoshida, NTT-CERT(5) Lectures
(4) Other Activities
"Survey on Malware Circulating within the P2P File
Exchange Environment" [14]February 2009: Gave an web application development
exercise for NTT Group at a workshop organized by
NTT-CERTThe Year 2008

April 2008: "Management of High Reliability
Organizations" by Aki Nakanishi, the Faculty ofBusiness Administration, Meiji University.

(6) Other Activity
In order to partially reveal the actual circumstances oftargeted attack as a part of efforts to develop a newinter-organization collaboration, we provided relatedorganizations with a malware-attached e-mail, which faked
itself as Call for Papers (CFP) for the symposium held by
the Computer Security Symposium 2008 of Information
Processing Societies Japan as a sample.

In cooperation with the Incident Information
Utilization Framework Working Group of Nippon
CSIRT Association, information dissemination using
cNotes (Current Status Notes) [15] which tries tovisualize the observational data.
9

Copyright © HIRT. 2011. All rights reserved.

HIRT: Annual Report 2011

4.4

The Year 2007

(2) Enhancing Web Application Security
In October 2006, as part of security measures of web
application in the Hitachi group, we created guidelines andchecklists and provided support for their implementation in
the Hitachi group. We updated "Web Application Security
Guide (Development) V2.0" by adding new vulnerabilities,
such as LDAP injection and XML injection, and a method
for checking the existence of such vulnerabilities.

(1) Starting Hands-on Security Training at HIRT OPEN
Meetings
In 2007, to promote the practical use of the guideline"Web Application Security Guideline", we provided ahands-on, exercise-based HIRT OPEN Meeting twice inMarch and June for the web application developer.
(2) Founding the Nippon CSIRT Association(3) Calling Attention to Information Leakage Caused by
P2P File Exchange Software

In order to develop a system based on a strong trusting
relationship among CSIRTs that can successfully andpromptly react to events that single CSIRTs find it difficult
to solve, we founded the Nippon CSIRT Association withIIJ-SECT (IIJ), JPCERT/CC, JSOC (LAC), NTT-CERT(NTT) and SBCSIRT (Softbank) in April 2007 [19]. As of
December 2012, 31 teams have been joined (Figure 18).

Antinny is a virus that has penetrated widely via "Winny",
file exchange software that appeared in August 2003. The
virus causes infected PCs to leak information and attack
particular websites. In April 2006, HIRT issued a security
alert entitled "Prevention of Information Leakage Causedby Winny and Proactive Measures against It" based on
previous experience of threats.
(4) Starting Product Security Activities for Intelligent
Home Appliance and embedded Products

Total number of teams

30
25

We have started product security activities for intelligent
home appliance and embedded products. HIRT focused on
the Session Initiation Protocol (SIP), a call control protocol
used for Internet telephony, and summarized related
security tools and measures into a report.

20
15
10
5

(5) Strengthening Partnership with the CSIRT
Community

1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011

0

In March 2006, we introduced Hitachi's CSIRT activities
in a workshop held by NTT-CERT to exchange information
to improve CSIRT activities with each other.

Figure 18: Change in Number of Nippon CSIRT
Association Members.
(3) Joining UK WARP

(6) Lectures

In order to strengthen the overseas partnership on CSIRT
activities, we joined the Warning, Advice and Reporting
Point (WARP), promoted by the Centre for the Protectionof National Infrastructure (CPNI), a British government
security organization, in May 2007 [20].

May 2006: "Security for embedded systems", by Yuji
Ukai, eEye Digital Security



September 2006: "Measures against Botnet inTelecom-ISAC Japan", by Satoru Koyama,
Telecom-ISAC Japan(4) Lectures(7) Other Activities





4.5

July 2008: "Vulnerability Assessment through Static
Analysis" by Yuji Ukai, Fourteenforty ResearchInstitute, Inc.

4.6

The Year 2006

Starting to sign a digital signature to technicaldocuments (PDF files) issued from HIRT [21]The Year 2005

(1) Joining FIRST(1) Providing a Unified Point of Contact for
Vulnerability Reporting

In January 2005, to boost experience in CSIRT activities
while creating an organizational structure to addressincidents in partnership with CSIRT organizations overseas,
we joined the Forum of Incident Response and Security
Teams (FIRST), an international community for computer
incident handling teams [ 22 ]. The preparation period
extended for about one year, since any team wishing to join
the community must obtain recommendations from two
member teams before doing so.

In
November
2006,
in
order
to
circulatevulnerability-related information properly in the Hitachigroup and thereby promote measures against vulnerabilities
in Hitachi software products and websites, we provided aunified point of contact for receiving reports onvulnerabilities found in software products and web
applications.
Copyright © HIRT. 2011. All rights reserved.

10

HIRT: Annual Report 2011

As of December 2013, a total of 289 teams have joined
this community, including 23 Japanese teams (Figure 19)[*d].
Total number of teams

The Information Security Early Warning Partnership
started in July 2004 when the "Standard for Handling
Information Related to Vulnerabilities in Software, etc."
was implemented [23][24].

25

200

20

150

15

100

10

50

5

0

0

Total number of Japanese teams

Total number of Japanese teams

250

The Hitachi group registered itself as a productdevelopment vendor to the Partnership, using HIRT as apoint of contact, and started publishing Hitachi'svulnerability handling status on JP Vulnerability Notes(JVN) [25].
(2) Enhancing Web Application Security
In November 2004, we created the "Web Application
Security Guide (Development), V1.0" and distributed it
throughout the Hitachi group. The guide summarizes
typical problems that need to be considered when designingand developing web applications, and provides an overview
of measures taken to solve such problems.

Figure 19: Changes in the number of members of FIRST.
(2) Setting Up a Security Information Portal Site
In September 2005, in order to provide Internet users withcomprehensive information on security problems applicableto the products and service of the Hitachi group, we set up a
security information portal site within which the security
information provided through the websites of Hitachi
business divisions and group companies is integrated(Figure 20). We also created "Guidance for Providing
Security Information from Websites to External Users,
V1.0".

(3) Lectures

4.8

Releasing information to the public Request for investigation

Information
disclosure

Affected products
and mesurements

Providing security
information via adomestic security portalsite

HIRT/CC
Aggregating
statusInformation
disclosure

Request forinvestigation

Sections developing
products

Affected
products

Investigationand measures
Preparing for
information
disclosure

Measurements

Providing security
information via Hitachigroup security potal site

The Year 2003

We started to consider a method for enhancing web
application security and developed the "Procedure forCreating a Security Measure Standard for Web Application
Development V1.0" with business divisions.

The Hitachi group
Request forinvestigation

January 2004: "Security business affairs after Blasterin the US", by Tom Noonan, President and CEO ofInternet Security Systems (ISS)(1) Starting Web Application Security Activities

Security information portal site:
Japanese: http://www.hitachi.co.jp/hirt/
English: http://www.hitachi.com/hirt/
IPA, JPCERT/CC
Information
Security Early
Warning
Partnership

The Year 2004

(1) Participating in the Information Security Early
Warning Partnership

30

1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011

Total number of teams

300

4.7

(2) Disseminating Vulnerability Information fromNISCC throughout Hitachi
Following the dissemination of vulnerability informationfrom CERT/CC in 2002, we started obtaining/publishing
information in accordance with the NISCC (currently,
CPNI) Vulnerability Disclosure Policy. 006489/H323 ofJanuary 2004 for security information on a Hitachi productwas first published in NISCC Vulnerability Advisory after
starting the activity [26].

Providing businessdivisions and subsidiarycompanies with security
information

Figure 20: Providing security informationon the Hitachi security information portal.
[*d] CDI-CIRT (Cyber Defense Institute), CFC (Cyber Force Center of the
National Police Agency's Info-Communications Bureau), DeNA CERT(DeNA)，FJC-CERT (Fujitsu)，HIRT (Hitachi)，IIJ-SECT (IIJ)，IPA-CERT(Information-technology Promotion Agency), JPCERT/CC，JSOC (LAC)，
KDDI-CSIRT (KDDI)，KKCSIRT (Kakaku.com)，MBSD-SIRT (Mitsui
Bussan Secure Directions)，MIXIRT (Mixi)，MUFG-CERT (Mitsubishi
UFJ Financial Group)，NCSIRT (NRI Secure Technologies), NISC
(National Information Security Center)，NTT-CERT (NTT)，NTTDATA-CERT (NTT Data)，Panasonic PSIRT (Panasonic)，
Rakuten-CERT (Rakuten)，RicohPSIRT (Ricoh)，SBCSIRT (Softbank) and
YIRD (Yahoo).

(3) Strengthening the Domestic Partnership for CSIRT
Activities
To strengthen the domestic partnership for CSIRT
activities, we hold meetings with domestic teams that are
members of FIRST, and individual meetings with
NTT-CERT and Microsoft Product Security Team (PST) to
exchange opinions, and have established a contact network
to be used, for example, when a website is found to havebeen tampered with.
11

Copyright © HIRT. 2011. All rights reserved.

HIRT: Annual Report 2011

With the implementation of the "Standard for Handling
Information Related to Vulnerabilities in Software, etc." inJuly 2004, the roles of the trial site were transferred toJapan Vulnerability Notes (JVN), a site releasing
information on reported vulnerabilities (http://jvn.jp/).

(3) Providing a Point of Contact for External
Organizations
In line with the more active reporting and releasing of
information concerning the discovery of a vulnerability [27],we provided a point of contact, as shown in Table 10, that
initiates actions when vulnerabilities or malicious actions in
Hitachi products and Hitachi-related websites are pointedout.

4.10 The Year 2001

Table 10: Information on point of contact.
Name
Address(1) Investigating the Activities of Worms Attacking Web
Services"HIRT": Hitachi Incident Response Team.
Kashimada 1-1-2, Saiwai, Kawasaki City,
Kanagawa, 212-8567 Japan

We investigated the activities of worms attacking web
services in 2001, CodeRed I, CodeRed II and Nimda, from
June 15, 2001 to June 30, 2002, based on the log data fromthe websites on the Internet. For CodeRed II and Nimda(Figure 22), which caused significant damage in Japan, thelog reveals that the time span between the time at which theattack was first logged and the date on which attacks
occurred most frequently was only approximately two days,
indicating that damage caused by the worms had spread
rapidly and widely.

E-mailPGP key

The Year 2002

2,000
Number of access counts

4.9

KeyID = 2301A5FA
Key fingerprint
7BE3 ECBF 173E 3106 F55A
011D F6CD EB6B 2301 A5FA
pub 1024D/ 2003-09-17
HIRT: Hitachi Incident Response Team(1) Disseminating Vulnerability Information from
CERT/CC throughout Hitachi

1,500

SNMP vulnerability [10] reported from CERT/CC in 2002
affected a wide range of software and devices. This
provided an opportunity to start the Product Vendor IRT
and obtaining/publishing information based on the
CERT/CC Vulnerability Disclosure Policy [ 28 ].
VU#459371 of October 2002 for security information on
Hitachi product was first published in the CERT/CC
Vulnerability Notes Database after commencing thisactivity [29].

1,000

We provided support to build and operate a trial website,
JPCERT/CC Vendor Status Notes (JVN)(http://jvn.doi.ics.keio.ac.jp/), in February 2003, as an
attempt to improve the domestic circulation of security
information (Figure 21) [30][31].
2003

2004

4.11 The Year 2000
(1) Investigating the Severity Metrics for Vulnerabilities
In order to measure the severity level of vulnerability
exploited for destructive or security-compromising
activities, we investigated the severity metrics used byrelevant organizations and summarized the results into areport.

2005
2004/07/08~
Running official website

2003/02/03~2004/07/07
Trial site running period

CERT/CC publishes notes called "Vulnerability Notes"[ 32 ] for vulnerability. It provides the Severity Metricindicating the severity of vulnerability [ 33 ] Common
Vulnerabilities and Exposures (CVE) classified information
security vulnerabilities into "Vulnerabilities" and"Exposures" and focuses on the former [34]. The former isdefined as mistakes in software to violate a reasonablesecurity policy and the latter as environment-specific,
configuration issues or mistakes in software used to violatea specific policy. The National Institute of Standards andTechnology (NIST) uses whether or not a CERT advisory
and CVE identifier number has been issued as a guide to▲ JVN working group formed in June 2002
▲ Trial site (jvn.doi.ics.keio.ac.jp) to the public in February 2003
▲ JVNRSS stared in July 2003
▲ VN-CIAC stared in December 2003
▲ TRnotes stared in January 2004
▲ jvn.jp to the public in June 2004

Figure 21: Building and running a JVN trial site.

Copyright © HIRT. 2011. All rights reserved.

0

Figure 22: Changes in the number of Nimda log counts
found during the observation period (for Nimda).

(2) Assisting JPCERT/CC in Building Vendor Status
Notes

2002

500

12

HIRT: Annual Report 2011

determine the severity of vulnerability, and classifies
vulnerabilities into three levels in the ICAT Metabase [35],a predecessor of NVD.

5

Conclusion

Rigorously implementing all information security
measures lowers degrees of freedom and makes it
impossible to respond to business speed. And taking
information security measures individually on one's own
responsibility can lead to a single failure causing multiple
knock-on security incidents. We believe that CSIRTs canbe used as a balanced means of implementing cyber attack
countermeasures.

Note that as severity metrics for vulnerabilities vary,depending on organizations, the Common Vulnerability
Scoring System (CVSS) [36] was proposed as a common
language with which to evaluate the severity ofvulnerability in a comprehensive and general way in 2004.

In line with changes in the incident occurrence situation,
HIRT will be proceeding with activities to disseminate
countermeasures early as part of its efforts to "catch any
sign of future threats". We also plan, via leadership
activities in the CSIRT community, to progressively
develop into a real practice the utilization of CSIRTs forcyber attack countermeasures.

4.12 The Year 1999
(1) Launch of the hirt.hitachi.co.jp domain
To improve the provision of security information to the
Hitachi group, we created an internal domain for HIRT
projects to set up a website (hirt.hitachi.co.jp) in December
1999.

(April 30, 2013)(2) Investigation of website defacement

Number of website defacements

Website defacement was a major type of incidents since it
occurred for the first time in the US in 1996 until the
network worm era started (2001 - 2004). We conducted a
research on webpage defacing from 1999 to 2002 to findout how malicious activities were performed (Figure 23).
3,000
2,500
2,000
1,500

1,000
500

0
1995 1996 1997 1998 1999 2000 2001 2002

Figure 23: Changes in the number of websites defacements.

4.13 The Year 1998
(1) Starting to provide HIRT security information
In April 1998, we started to provide information on
security measures mainly using an internal mailing list andan internal website for HIRT projects. This information isbased on the security information issued by CERT/CC,
JPCERT/CC, and product vendors (Cisco, HP, Microsoft,
Netscape, Sun Microsystems, etc.).
(2) Lectures
On June 25 - 26, 1998, we provided "Network security"
training for Hitachi. We invited an US security expert who
had also participated in the US Security Conference
DEFCON [37] as a speaker as an instructor.

13

Copyright © HIRT. 2011. All rights reserved.

HIRT: Annual Report 201123) Ministry of Economy, Trade and Industry, Notification
No. 235: Standard for Handling Information Related toVulnerabilities in Software, etc., (2004/7),

References

http://www.meti.go.jp/policy/netsecurity/downloadfiles/vulhandlingG.pdf

1) Trend Micro Incorporated: Report on Internet Threat,24) Information-technology Promotion Agency, Japan:
Information Security Early Warning Partnership Guideline(2004/7), http://www.ipa.go.jp/security/ciadr/partnership_guide.html
25) JVN (Japan Vulnerability Notes), http://jvn.jp/
26) NISCC: NISCC Vulnerability Advisory 006489/H323:
Vulnerability Issues in Implementations of the H.323
Protocol (2004/1), http://www.kb.cert.org/vuls/id/JSHA-5V6H7S
27) Information-Technology Promotion Agency, Japan:
Research Reports on Policy for Security Vulnerability
Information Disclosure (2003/9),

http://jp.trendmicro.com/jp/threat/security_news/monthlyreport/index.html

2) Conficker Work Group - ANY - Infection Tracking,
http://www.confickerworkinggroup.org/wiki/pmwiki.php/ANY/InfectionT
racking3) NIST NVD (National Vulnerability Database),
http://nvd.nist.gov/

4) Information-Technology Promotion Agency, Japan:
Quarterly Reports,
http://www.ipa.go.jp/security/english/quarterlyrep_vuln.html

5) NTT-CERT (NTT Computer Security Incident Response
and Readiness Coordination Team), http://www.ntt-cert.org/
6) Nippon CSIRT Association: incident response,

http://www.ipa.go.jp/security/awareness/vendor/vulnerability200309012.p
df (not available)

http://www.nca.gr.jp/2010/incidentresponse.html

28) CERT/CC Vulnerability Disclosure Policy,7) Information-technology Promotion Agency, Japan:
Security Content Automation Framework,

http://www.cert.org/kb/vul_disclosure.html

29) US-CERT: Vulnerability Note VU#459371: Multiple
IPsec implementations do not adequately validate
authentication data" (2002/10),

http://jvndb.jvn.jp/en/apis/myjvn/index.html

8) ITU-T X.1500 : Overview of cybersecurity informationexchange, http://www.itu.int/rec/T-REC-X.1500-201104-I
9) ITpro Security, http://itpro.nikkeibp.co.jp/security/
10) CERT Advisory CA-2002-03, "Multiple Vulnerabilities
in Many Implementations of the Simple Network
Management Protocol(SNMP)" (2002/2),

http://www.kb.cert.org/vuls/id/459371

30) Considerations on JPCERT/CC Vendor Status Notes
DB: JVN, CSS2002 (2002/10),
http://jvn.doi.ics.keio.ac.jp/nav/CSS02-P-97.pdf

http://www.cert.org/advisories/CA-2002-03.html

31) Development of JVN to Support Dissemination of
Security Information (2005/5),11) anti Malware engineering workshop,

http://www.hitachi.co.jp/hirt/csirt/jvn/index.html

http://www.iwsec.org/mws/2012/32) CERT/CC Vulnerability Notes Database,12) SGU MIT Workshop Academy CERT Meeting(2010/7),

http://www.kb.cert.org/vuls

http://academy-cert-indonesia.blogspot.jp/2010/06/academy-cert-meeting.html33) CERT/CC Vulnerability Note Field Descriptions,13) Malware Circulating in P2P File Exchange Software
Environment (2011) (2011/9),

34) CVE (Common Vulnerabilities and Exposures),http://www.kb.cert.org/vuls/html/fieldhelp
http://cve.mitre.org/
35) ICAT, http://icat.nist.gov/(not available)

http://www.hitachi.co.jp/hirt/publications/hirt-pub11003/index.html

14) 2009 Survey on information leakage via P2P File
Exchange Software Environment (2009/12),

36) CVSS (Common Vulnerability Scoring System),
http://www.first.org/cvss/
37) DEFCON, http://www.defcon.org/

http://www.hitachi.co.jp/hirt/publications/hirt-pub09008/index.html

15) cNotes: Current Status Notes,
http://jvnrss.ise.chuo-u.ac.jp/csn/index.cgi16) Information-Technology Promotion Agency, Japan:
Countermeasures against DNS Cache Poisoning (2009/2),
http://www.ipa.go.jp/security/vuln/DNS_security.html

17) Recording Site for Joint Workshop on Security 2008,
Tokyo (2008/3), http://www.nca.gr.jp/jws2008/index.html
18) 2008 Information Technology Period Promotion Awarding companies that have contributed to thepromotion of information technology in 2008 (2008/10),
http://www.jipdec.or.jp/archives/project/gekkan/2008/ceremony/prize02.ht
ml19) CSIRT - Nippon CSIRT Association, http://www.nca.gr.jp/[Author]Masato Terada
After launching HIRT activities in 1998 on a trial basis, he launched aresearch site (http://jvn.doi.ics.keio.ac.jp/), a predecessor of JVN(http://jvn.jp/), in 2002 and acted as a point of contact for HIRT in order topromote external CSIRT activities, including participation in FIRST, aninternational CSIRT organization in 2005. Presently, he works as atechnical member of the JPCERT Coordination Center, a researcher of theInformation Technology Promotion Agency, Japan, Telecom ISAC asteering committee member, and vice chief of the steering committee for the
Nippon CSIRT Association.

20) WARP (Warning, Advice and Reporting Point),
http://www.warp.gov.uk/21) GlobalSign Adobe Certified Document Services,
http://jp.globalsign.com/solution/example/hitachi.html

22) FIRST (Forum of Incident Response and Security
Teams), http://www.first.org/

Copyright © HIRT. 2011. All rights reserved.

14