Standardization in Cybersecurity

Koji Nakao
Distinguished Researcher, Cybersecurity Research InstituteNational Institute of Information and Communications Technology (NICT)
Guest Professor, Yokohama National University
Cybersecurity Advisor, NISC

Research Topics in NICT
NICT: Sole national research institute in the field of ICT in Japan

Japan Standard Time (JST)（Leap second on Jan 1, 2017）

Bio/Nano ICT(Self-organizing bio molecule)

Optical Communication(Peta bps class multi-core fiber)

Brain ICT
(Brain-machine Interface)

Satellite Communication（Internet Satellite WINDS）

Multi-lingual Machine Translation(VoiceTra)

Science Cloud（Reai-time Web of Himawari-8）

Ultra Realistic Communication(Electronic Holography)

Remote Sensing（Pi-SAR2 image after 3.11）

Cybersecurity(DAEDALUS)

2

3

What is “Cybersecurity”

4

ITU-T Recommendation
X.1205:
Overview of Cybersecurity

5

Definition of Cybersecurity in 2008 (X.1205)
3.2.5 cybersecurity:
Cybersecurity is the collection of tools, policies, security concepts, security
safeguards, guidelines, risk management approaches, actions, training, bestpractices, assurance and technologies that can be used to protect the cyberenvironment and organization and user's assets. Organization and user's assets
include connected computing devices, personnel, infrastructure, applications,services, telecommunications systems, and the totality of transmitted and/or
stored information in the cyber environment. Cybersecurity strives to ensure theattainment and maintenance of the security properties of the organization anduser's assets against relevant security risks in the cyber environment.
The general security objectives comprise the following:• Availability• Integrity, which may include authenticity and non-repudiation• Confidentiality.

6

ISO/IEC 27032: Guideline for Cybersecurity
4.20
Cybersecurity(Cyberspace security)preservation of confidentiality,
integrity and availability of informationin the Cyberspace
NOTE 1 In addition, other properties,
such as authenticity, accountability,
non-repudiation, and reliability canalso be involved.
NOTE 2 Adapted from the definition
for information security in ISO/IEC
27000:2009.

8

ISO/IEC TS 27100 (2020) : Cybersecurity – Overview and Concept
3.2
cybersecurity
safeguarding of people, society, organizations and nations from cyber risks (3.7)
Note 1 to entry: Safeguarding means to keep cyber risks at a tolerable level.
3.7
risk
effect of uncertainty on objectives
Note 1 to entry: Cyber risk can be expressed as effect of uncertainty on
objectives of entities in cyberspace (3.5).
Note 2 to entry: Cyber risk is associated with the potential that threats will
exploit vulnerabilities in cyberspace and thereby cause harm to entities incyberspace.

9

ISO/IEC TS 27100: Cybersecurity – Overview and Concep

10

Cybersecurity standards:
Objectives, Cyber Risk, Benefits

11International CYBER Standards
The aim of the global cyberspace community, developers andinterested parties is to develop international CYBER SECURITY and
PRIVACY standards to help fight against CYBER CRIME

Implementation of international cyber standards can helporganisations, governments to:• Reduce and minimise the cyber risks• Minimise the impact and destructive effects of cyber attacks• Protect their investment in the IT-based systems, services andinfrastructure they use and to protect their sensitive and criticalinformation
Source: Slides from Dr. Edward Humphrey in ISO workshop

12

Cyber Security Risk
• THREATS AND RISKS• Risks to operations, information, people, processes,
services, applications, and technology• Threats to society and consumers• Threats to national infrastructure• IMPACT• Financial loss, disruption or damage to systems andservices due to the destructive power of cyberattack/incident• Leakage, theft, destruction of critical and sensitive
information• CYBER SECURITY RISK THRESHOLDS• Limiting the disruptive and destructive power andenergy of the cyber attack• Cyber defence/preparedness, response and recovery

Source: Slides from Dr. Edward Humphrey in ISO workshop• マスタ テキストの書式設定– 第 2 レベル• 第 3 レベル– 第 4 レベル» 第 5 レベルNICTER- is an integrated security system for countering indiscriminate cyberattacks- based on a large-scale darknet monitoring, an automated malware analysis and their correlation
13

14

Some Benefits of Cyber Space Standards
The development of INTERNATIONAL CYBER STANDARDS
through cooperation, joint sharing and learning, andconsensus building, provides:• Improved protection, security and safety for all interested parties• Basis for conformity assessments (certification, testing andinspection)• Basis of mutual understanding and a common language tofacilitate communications, innovation, trading and global
governance• Complements and supports national cyber policies andprogrammes
Source: Slides from Dr. Edward Humphrey in ISO workshop

15

Asia-PacificWorld Standards
Cooperation (WSC)

Europe (CEN, CENELEC, ETSI)
Americasgroups, consumer
groups etc.)

Regional Standards Bodies

Liaisons (industry

Players

National Standards Bodies (AFNOR, ANSI, BSI, DIN, SAC etc.)
Regulatory Bodies, Government Bodies …
Source: Slides from Dr. Edward Humphrey in ISO workshop

16

Cybersecurity standards in ISO/IEC
JTC1/SC27

17

ISO/IEC JTC 1/SC 27 (Information security,
cybersecurity and privacy protection)
WG 1

WG 2

WG 3

WG 4

WG 5

Information
security
management
systems

Cryptography
and security
mechanisms

Security
evaluation,
testing andspecification

Security
controls andservice

Identity
management
and privacy
technologies

Cover the area of Cyber Security
Source: Slides from Dr. Edward Humphrey in ISO workshop

18

ISO/IEC 27001 ISMS
The on-going management ofcyber risk through the processof continual improvement:• Anticipate• Prepare• Protect• Reactive & Responsive• Adaptive (business plasticity)• CONTINUAL IMPROVEMENTBusiness
Context, Risk
Strategy

identify

Monitoring,
Review and
Improvement of review
Cyber Risk
Management

plan

Risk
Assessment
andTreatment

executeThe on-going management of Cyber Risk
through the process of continual improvement

Implement
Cyber Risk
Controls,
Processes andProcedures

Source: Slides from Dr. Edward Humphrey in ISO workshop

ISO/IEC 27001 ISMS Managing Cyber Risk
IDENTIFY

REVIEW

PLAN

ISMS
CONTINUALIMPROVEMENT
Identify
Plan
ExecuteCYBER DEFENCEFUNCTIONS
Identify
Protect
DetectRespond

Monitor/review

Recover

Reactive/adaptive

19

ISO/IEC 27103
IDENTIFY

Business Environment andContext
Risk Assessment
Risk Management Strategy
Governance
Asset management

PROTECT

Access Control
Aware and Training
Data Security
Information Protection Policies,
Processes and Procedures
Maintaining Controls

DETECT

Monitoring and Detection
Processes
Incident Handling Management
Processes

RESPOND

Response Planning andManagement Process
Continual Improvements
Communications

RECOVER

Recovery Planning andManagement Processes
Continual Improvements
Communications

EXECUTEISMS Continual
Improvement
Framework
Source: Slides from Dr. Edward
Humphrey in ISO workshop

ISMS continual
improvement
Reducecyber risks

20

WG 1 Projects related to Cybersecurity
Cybersecurity
ISO/IEC TS 27100:
2020
ISO/IEC 27102:2019

Cybersecurity – Overview and Concepts

ISO/IEC TR 27103:
2018
ISO/IEC TS 27110:
2021

Cybersecurity and ISO and IEC Standards

Information security management — Guidelines forcyber-insurance

Cybersecurity framework development guidelines

NICTER
Network Incident analysis Center for Tactical Emergency Response

21

WG 4 Projects 1/11
Guidance for information security controls

1/2

ISO/IEC 27031:2011 Guidelines for information and communication[Revision: DIS] technology (ICT) readiness for business continuity
ISO/IEC 27033,
Part 1 – Part 6
ISO/IEC 27034,
Part 1 – Part 7

Network security

ISO/IEC 27035,
Part 1 – Part 4

Information security incident management

ISO/IEC 27036,
Part 1 – Part 4

Information security for supplier relationships

Application security

NICTER
Network Incident analysis Center for Tactical Emergency Response

22

WG 4 Projects 2/11
Guidance for information security controls
ISO/IEC 27039:2015

2/2

Selection, deployment and operations of intrusion
detection and prevention systems (IDPS)

ISO/IEC 27040:2015 Storage security[Revision: FDIS]NICTER
Network Incident analysis Center for Tactical Emergency Response

23

WG 4 Projects 3/11
ISO/IEC 27033, Network security
Part 1:2015, Overview and concepts
Part 2:2012, Guidelines for the design and implementation of network security
Part 3:2010, Reference networking scenarios -- Threats, design techniques and control
issuesPart 4:2014,Securing communications between networks using security gateways
Part 5:2013, Securing communications across networks using Virtual Private Networks(VPNs)Part 6:2016, Securing wireless IP network accessPart 7: Guidelines for network virtualization security [FDIS]NICTER
Network Incident analysis Center for Tactical Emergency Response

24

WG 4 Projects 4/11
ISO/IEC 27035, Information security incident management
Part 1:2023, Principles and processes[Revision]

Part 2:2023, Guidelines to plan and prepare for incident response[Revision]
Part 3:2020, Guidelines for ICT incident response operations
Part 4, Coordination[DIS]

NICTER
Network Incident analysis Center for Tactical Emergency Response

25

WG 4 Projects 5/11
Investigation, digital evidence and electronic discovery
ISO/IEC 27037:2012

Guidelines for identification, collection, acquisition andpreservation of digital evidence

ISO/IEC 27041:2015

Guidance on assuring suitability and adequacy of
incident investigative method
Guidelines for the analysis and interpretation of digital
evidence

ISO/IEC 27042:2015
ISO/IEC 27043:2015
ISO/IEC 27050,
Part 1 – Part 4

Incident investigation principles and processes
Electronic discovery

NICTER
Network Incident analysis Center for Tactical Emergency Response

26

WG 4 Projects 6/11
Cybersecurity
ISO/IEC 27032:2012[Revision: FDIS]

Guidelines for cybersecurity
Revision:
Cybersecurity — Guidelines for Internet security

ISO/IEC 24392 [IS]Security reference model for industrial internet platform

NICTER
Network Incident analysis Center for Tactical Emergency Response

27

WG 4 Projects 7/11
IoT security and privacy, CPS
ISO/IEC 27400:2022

IoT security and privacy – Guidelines

ISO/IEC 27402 [FDIS]IoT security and privacy – Device baseline requirements

ISO/IEC 27403 [DIS]

IoT security and privacy – Guidelines for IoT-domotics

ISO/IEC 27404[WD2]

IoT security and privacy – Cybersecurity labelling framework for
consumer IoT

ISO/IEC 5689 [PWI→NP]

Security frameworks and use cases for cyber physical systems• Base documents of SC 41 “Internet of Things and digital twin”• ISO/IEC 30141:2018, Internet of Things (IoT) – Reference architecture• ISO/IEC 20924:2021, Internet of things (IoT) – Vocabulary

NICTER
Network Incident analysis Center for Tactical Emergency Response28ISO/IEC 27400 – PublishedThis was initially proposed by Japan based on the guideline produced in IoTpromotion consortium of Japan.

• Title: Cybersecurity – IoT security and privacy –Guidelines• ScopeThis document provides guidelines on risks, principles and controls forsecurity and privacy of Internet of Things (IoT) solutions.

• Main Structure
Clause 5：IoT concept and reference model
Clause 6：Risk management for IoT systems
Clause 7：Security controls and privacy controls29

RA (Domain model) used in ISO/IEC 27400（based on ISO/IEC 30141）
IoT
user

IoT
serviceproviderand
IoT
servicedeveloper

User Domain (UD)Operations ＆Management
Domain(OMD)Application &Service Domain(ASD)

Resource Access &Interchange
Domain(RAID)

Sensing & Controlling Domain (SCD)

Physical Entity Domain (FED)
IEC

30

31

Security Controls in ISO/IEC 27400
Security controls for IoT service developer and IoT service
provider24 controls
7.1.2.1 Policy for IoT security
7.1.2.2 Organization of IoT security
7.1.2.3 Asset management
7.1.2.4 Equipment and assets located outside physicalsecured areas
7.1.2.5 Secure disposal or re-use of equipment
7.1.2.6 Learning from security incidents
7.1.2.8 Secure development environment and procedures
7.1.2.9 Security of IoT systems in support of safety
7.1.2.10 Security in connecting varied IoT devices
7.1.2.11 Verification of IoT devices and systems design
7.1.2.12 Monitoring and logging
7.1.2.13 Protection of logs
7.1.2.14 Use of suitable networks for the IoT systems
7.1.2.15 Secure settings and configurations in delivery of
IoT devices and services
7.1.2.16 User authentication
7.1.2.17 Provision of software and firmware updates

7.1.2.18 Sharing vulnerability information
7.1.2.19 Security measures adapted tolifecycle of IoT system and services

the7.1.2.20 Guidance for IoT users on the proper use
of IoT devices and services

7.1.2.21 Determination of security roles forstakeholders
7.1.2.22 Management of vulnerable devices
7.1.2.23

Management of supplier relationships
in IoT security

7.1.2.24 Information security in IoT devices
Security controls for IoT user

4 controls

7.1.3.1 Contacts and support service

7.1.3.2 Initial settings of IoT device and service
7.1.3.3 Deactivate unused devices
7.1.3.4 Secure disposal or re-use of IoT device

32

Privacy controls in ISO/IEC 27400
Privacy controls for IoT service developer and IoT
service provider
14 controls

7.2.2.10
preferences

Communicationof

7.2.2.2 IoT privacy by default

7.2.2.11
decision

Verification

automated

7.2.2.3 Collection and use of personal data

7.2.2.12

Accountability
stakeholders

7.2.2.1 Prevention of privacy invasive events

7.2.2.4 Verification of IoT functionalityofprivacyfor

7.2.2.5 Consideration of IoT users

7.2.2.13 Unlinkability of PII

7.2.2.6 Management of IoT privacy controls

7.2.2.14 PII protection in IoT devices

7.2.2.7 Unique device identity
7.2.2.8 Fail-safe authentication

Privacy controls for IoT user

7.2.2.9 Minimization of indirect data collection

7.2.3.1 User consent

3 controls

7.2.3.2 Connecting with other devices andservices
7.2.3.3 Certification/validation of PII
protection

Example 7.1.2.10

Security in connecting varied IoT devices

33

Control-10
Control-10
An IoT system should be designed and implemented to ensure and maintain security in connecting varied IoT devices.
An
IoT system should be designed and implemented to ensure and maintain security in
Purposeconnecting
varied IoT devices.
To maintain security of IoT system in connecting varied IoT devices including those not necessarily verified by the IoT
Purposeservice developer or the IoT service provider.
To
maintainsecurityof IoTin connecting varied IoT devices including those not
Audience:
IoT service
developeror IoTsystemservice provider
necessarily
IoT service
developeror theIoT service
provider.
IoT Domain: verified
Operationsby
andtheManagement,
Applicationand Service,
Resource
Access andInterchange or Sensing andControlling
Guidance
Guidance• The IoT service developer and the IoT service provider design and implement an IoT system and require the IoT…
devices to meet defined specifications. The IoT devices are tested as components of the IoT system.
The
IoT service developer and the IoT service provider should design and implement• There is possibility that the IoT devices not yet tested as components of the IoT system are adopted. This is possible
securesystemwhich
is preparedforthe cansituation.
The IoT
systemhave canthebecauseIoT
testing
all of the
new models
of supported
devices
be impracticable.
Or, IoT
users, ascan
consumers,choose thecapabilities
devices availableas
at necessary:
market.
followinga)connect
devicea whitelist;• selectively
The IoT service
developertheand IoT
the IoT
serviceusing
providershould designorand implement secure IoT system which isprepared applicable,
for the situation.obtain
The IoTthe
systemcan have the following
capabilities
as e.g.,necessary:b) where
specificationsof thedevice,name of provider, model,a) yearselectively
connect the IoTand
deviceconformanceusing a whitelist; orof production
to relevant standard, when negotiating with theb) devicewhere applicable,
obtain the andspecificationsof the ifdevice,e.g., name of provider,year of production
andfor connection,
determinethe connection
requestmodel,
is acceptedor rejected,
conformance to relevant standard, when negotiating with the device for connection, and determine if the connection
or
confinethe scopeof orfunction,or information
to be madeavailable.
requestis acceptedor rejected,
confine theservice
scope of function,
service or information
to be madeavailable.

34

ISO/IEC 27402 – FDIS

• Title: Cybersecurity – IoT security and privacy – Device
baseline requirements• ScopeThis document provides baseline requirements for IoT devices and theirdevelopers to support security and privacy controls.
Excluding any of the requirements specified in 5.1 is not acceptable when an
organization claims conformity to this document.

Note:
This figure is depicted from“introduction” of ISO/IEC 27402

Security Baseline Requirements in ISO/IEC 27402
5 Requirements
5.1 Requirements for IoT device developers
5.1.1 Risk management
5.1.2 Information disclosure
5.1.3 Vulnerability disclosure and handling processes
5.2 Requirements for IoT devices
5.2.1 General
5.2.2 Configuration
5.2.3 Software reset
5.2.4 User data removal
5.2.5 Protection of data
5.2.6 Interface access5.2.7 Software and firmware updates
5.2.8 User notifications

35

ISO/IEC 27403 – DIS• Title: Cybersecurity – IoT security and privacy –Guidelines for IoT-domotics• ScopeThis document provides guidelines to analyse security and privacy risks andidentifies controls that need to be implemented in IoT-domotics systems.
Note:
IoT-domotics:
IoT system composed of networks, devices, services and users typically usedin the domicile or as electronic wearables

36ISO/IEC 27404 – WD2• Title: Information technology — Security techniques —Cybersecurity labelling framework for consumer IoT• ScopeThis document defines a cybersecurity labelling framework for the development andimplementation of cybersecurity labelling programmes for consumer IoT products andincludes guidance on the following topics:• Risks and threats associated with consumer IoT products;• Stakeholders, roles and responsibilities;• Relevant standards and guidance documents;• Conformity assessment options;• Labelling issuance and maintenance requirements; and• Mutual recognition considerations.

The scope of this document is limited to consumer IoT products, such as IoT gateways, basestations and hubs to which multiple devices connect; smart cameras, televisions, and speakers;
wearable health trackers; connected smoke detectors, door locks and window sensors;connected home automation and alarm systems, especially their gateways and hubs;
connected appliances, such as washing machines and fridges; smart home assistants; andconnected children's toys and baby monitors. …..

37

This figure is an example and wasused in the NWIP from Singapore…

Approach to global standardization of IoT security
ISO/IEC JTC1/SC2727400, 27402 (FDIS), and 27404 (WD)US – CTIA
IoT Cybersecurity
Certification,
SP 800-213(NIST)IoT Device
Cybersecurity
Guidance for theFederal Government

Common parts••••

Terminologies
Reference Architecture
Use Cases
Certification Framework• Risk Analysis• Security/Privacy Controls

UK – IASME IoTCyber Scheme, etc
EU – ETSI, Cyber
Security for Consumer
IoT: Baseline Req. EN
303 645
EU – ENISA
Cybersecurity
Certification - EUCC
Candidate Scheme

Japan – CPSF (METI), Device Requirements (MIC), IoT device
Certification Scheme (under study), etc.

39

40

WG 4 Projects 8/11
AI and big data security and privacy
ISO/IEC 20547-4:2020

Big data reference architecture — Part 4: Security and privacy

ISO/IEC 27045 [PWI]

Big data security and privacy — Processes

ISO/IEC 27046 [CD]Big data security and privacy — Implementation guidelines

ISO/IEC 27090 [WD4]Cybersecurity — Artificial Intelligence — Guidance for addressing security threats to
artificial intelligence systems

ISO/IEC 5181 [WD]Information technology – Security and privacy – Data provenance

ISO/IEC 6109 [PWI]

Guidelines for data security monitoring based on logging (Proposed title)

ISO/IEC TS 7709 [PWI]Security and privacy-preserving guidelines for multi-sourced data processing• Base documents of SC 42 “Artificial intelligence”• ISO/IEC FDIS 22989:2022, Artificial intelligence — Artificial intelligence concepts and terminology• ISO/IEC 20546:2019, Big data — Overview and vocabulary• ISO/IEC 20547-3:2020, Big data reference architecture — Part 3: Reference architecture

NICTER
Network Incident analysis Center for Tactical Emergency Response

41

WG 4 Projects 9/11
Cloud computing security and privacy
ISO/IEC 19086,
Part 4:2019

Cloud computing — Service level agreement (SLA)
framework —Part 4: Components of security and of protection of PII• Base documents of SC 38 “Cloud computing and distributed platforms”• ISO/IEC 19086, Cloud computing — Service level agreement (SLA) framework
Part 1: Overview and concepts
Part 2: Metric modelPart 3: Core conformance requirements

NICTER
Network Incident analysis Center for Tactical Emergency Response

42

WG 4 Projects 10/11
Security in virtualization technologies
ISO/IEC 21878:2018

ISO/IEC 27070:2021
ISO/IEC 27071 [IS]Security guidelines for design and implementation ofvirtualized servers
Requirements for establishing virtualized roots of trust
Security recommendations for establishing trusted
connections between devices and services

NICTER
Network Incident analysis Center for Tactical Emergency Response

43

WG 4 Projects 11/11
Other projects for emerging areas
ISO/IEC 13133 [PWI] Information technology – Security techniques – Security
reference model for digital currency hardware wallet
ISO/IEC 17603 [PWI] Information security – Security techniques –Confidential computing

NICTER
Network Incident analysis Center for Tactical Emergency Response

PWI 5689 – NP ISO/IEC TS 5689
Title: Cybersecurity –Security frameworks and use cases
for cyber physical systems
Scope

This document provides the followings:
CPS conceptual model and its specific characteristics– a conceptual model of cyber-physical systems (CPS) and its general features;– specific characteristics of CPS compared to other related concepts;
Concerns and security frameworks– security concerns as the basis for the discussion of security risks and security controls for
the CPS based on the conceptual model;– several security frameworks to address those security concerns;
Practical use cases for CPS– use cases based on the respective security frameworks for CPS;
– provision of visibility of use cases into the specific use of the security frameworks, etc.

44

45

Connections incyber spaceDatatranscription
in Cyber/Physical(Integrated analysis of data collected at multiple points, processing
and accumulation, and feedback of appropriate analysis results to
IoT consumers in Physical space)

Camera data

Data Environmental
datatransmission
Healthcare data

Manufacture IoT
devices

Sell IoT devices

Use IoT
devices

Device manufacturer

Mass retailer

IoT consumer

Fig.1

Analysis servers

Data processing, analysis, management

Feedbackof analysis
results
Datatransmission…

Camera data

Feedbackof analysis
results

Activity Log
Location data

Use IoT
devices

IoT consumer

Connections in physical space
Conceptual Model of CPS (This is not included in the text of 5689)

Figure 3. An example of 3-tierconceptual model with 3 cyber
physical systems

46

Another Application of CPS
framework (will be described in 7.3)

48

IoT Security Solutions with IoT various stages
1. Security for IoT devices prior to shipment
ISO/IEC 27400, 27402, 27404, etc.

2. Security Design of IoT system before operation
ISO/IEC 27400, etc.
3. Security of IoT system (devices) in use (in operation)
Finding Vulnerable IoT devices, ISO/IEC 27400, etc.
4. IoT system out of life-time
ISO/IEC 27400, 27402, etc.

49

Policy, Strategy, Regulation: Governments, Organizations

Security Governance/Management- Risk Management (Assessment and Treatment)
Security Design and Engineering

Event Monitoring and Attack behavior analysis
Research andTechnology
Development

Fundamental Security (Cryptography such as PQC..)
Environmental Security: Cloud, 5G, CPS/DT, IoT/IIoT…

Emerging Security: AI, BigData, Zero Trust…
Human factor Security: Usable Security, Awareness …

Physical Security (Entrance Control, Sidechannel…)
Conformance Assessment: ISMS, CC, IoT labeling…

Collaborative Activities:- Establishment ofTrust Relationship- Information Sharing:
Vulnerability Information,
Attack behavior, incidents- Joint Technology
development & Research- Common Standard &Guidelines development- Joint Conference
and Workshop- Joint Awareness Program- Joint security contest- Experts exchanges

Implementation, Operation, Education – Practical actions by Organizations, Governments

Conclusion
1.

2.
3.

IoT is not limited to IoT devices. There are various implementation forms as IoT systems
and their combinations. Further, its applications in 5G, CPS / DT, smart city, etc. are being
actively considered worldwide.
With the above environments, ensuring “cybersecurity” is an urgent issue.
In this context, active information sharing among ASEAN countries and JP can be an
extremely effective means of countermeasures:• Sharing is a risk management activity- You can get (and provide) early warnings by sharing• Collaboration can reduce the cost of defense- You can identify actors and threats that you may not have been tracking• By sharing information, you can help your suppliers, partners and competitors secure theirenterprises

4.

Not only sharing information, following activities can also be expected among ASEAN-JP:• Improving risk management based on the related standards for new environments such as CPS• Joint Research activities: establish a good scheme for the joint research and development andthe results can be shared and utilized for each country.
• Continuous information exchange like this event should be held periodically.

50

Thank you for listening
Implement & use
Security＊

Monitor &review
Security＊

DesignSecurity＊

Maintain &improve
Security＊