Provisional translationCYBERSECURITY
ANNUAL REPORTFISCAL YEAR 2013
<OVERVIEW>

July 10, 2014

Information Security Policy Council
The Government of Japan

THE STATE OF CYBERSECURITY IN FY2013
17.2%

1.

Overall Status of Japan's Cybersecurity

These days, there has been remarkable progress in the sophistication of
information and communications technologies.

This has resulted in the widespreaduse of a variety of services harnessing information and communications technologies,
such as cloud computing and SNS, by organizations including enterprises as well as
people. For example, the use of cloud computing related services by small, medium
sized, and large enterprises — in other words, regardless of business size— rose, andit indicates the increasing dependence of business operations on cyberspace (Figure
1-1).

Figure 1-1

Trends in use of cloud-related services 1 (Utilization rate)

All enterprises
60%Enterprises with over 1000 employees

SaaS (Software as a Service)
PaaS (Platform as a Service)
IaaS (Infrastructure as a Service)

SaaS
PaaS
IaaS

60%

57.1%
57.1%

56.0%
56.0%

40%

26.9%
26.9%

22.7%
22.7%

33.7%
33.7%

31.8%
31.8%

14.6%
14.6%

20%

46.3%
46.3%

40%

44.3%
44.3%

20%

9.3%
9.3%
15.8%
15.8%

11.4%
11.4%

5.4%
5.4%

0%

FY2011FY2012

6.1%
6.1%

0%

FY2013Enterprises with 301-1000 employees

24.4%
24.4%

FY2011

12.7%
12.7%

FY2012

SaaS
PaaS
IaaS

60%
55.8%
55.8%

54.9%
54.9%

40%

47.9%
47.9%

40%
38.9%
38.9%

40.5%
40.5%
24.4%
24.4%
19.5%
19.5%

31.1%
31.1%

20%

20%

13.3%
13.3%

8.3%
8.3%

5.9%
5.9%
5.0%
5.0%

0%

FY2011FY2013Enterprises with less than 301 employees

SaaS
PaaS
IaaS

60%

17.2%
17.2%

12.9%
12.9%

10.6%
10.6%

FY2012

11.6%
11.6%

4.8%
4.8%

0%

FY2013

FY2011

12.5%
12.5%
10.4%
10.4%

FY2012

13.4%
13.4%

FY2013

Based on "Data: Survey results on IT human resources trends (for user enterprises)" in the "White Paper on IT
Human Resources" of the cited fiscal years by Information-Technology Promotion Agency, Japan (IPA).

1

1

As to the activities of people, the SNS utilization rate for communications andother purposes was on the rise not only among young people but also among othergenerations.

It indicates that individuals' social activities became deeply dependenton cyberspace (Figure 1-2).

In fact, local enterprises can operate global businessdirectly through the Internet, etc., and individuals can share common experiences inreal time with people all over the world with their smartphones and tablets. This willcertainly lead to the significant advancement in people's empowerment and potential
for development.

Figure 1-2

Trends in Use of SNS and Smartphones 2
SNS utilization rate

100%

91.0%
91.0%
76.3%
76.3%

80%
60%
40%

57.1%
57.1%

81.8%
81.8%

58.8%
58.8%

54.7%
54.7%

FY2012FY2013

80.8%
80.8%

41.4%
41.4%

60.5%
60.5%

37.1%
37.1%

20.6%
20.6%

20%
0%

36.7%
36.7%

all agesages10-19

ages20-29

ages30-39

ages40-49

ages50-59

14.3%
14.3%
10.0%
10.0%

ages60-69

Smartphone utilization rate
100%

87.9%
87.9%

63.3%
63.3%

60%
40%

FY2012FY2013

78.7%
78.7%

80%

68.4%
68.4%

58.8%
58.8%

52.8%
52.8%
32.0%
32.0%

49.0%
49.0%

36.7%
36.7%

20%
0%

32.4%
32.4%

28.8%
28.8%

13.7%
13.7%

all agesages10-19

ages20-29

ages30-39

ages40-49

ages50-59

8.7%

4.7% 8.7%
4.7%

ages60-69

These are the aspects towards positive evaluation on the explosive diffusion of
information and communications technologies.

On the other hand, increasing risks

in cyberspace cannot be overlooked. For example, in one fiscal year, namely FY2013,
there were more than 1 million cases of divulging users' information caused byunauthorized access to major Internet service providers.

In addition, there wereincidents involving unauthorized access (illegal logins) by third parties stealing login
IDs and passwords for online services, such as Internet banking and SNS, with somemethods.

General IT users were under threats.

In 2013, the number ofBased on preliminary data from "2013 Survey on utilization time of information telecommunications media andInformation activities" by Institute for Information and Communications.
22

unauthorized access attempts (the number of detected cases) was nearly 2.4 times
higher than 2012 (Figure 1-3).

In terms of the purposes of these malicious activities,

in 2012, the majority of cases was to manipulate online games; but in 2013, it shiftedto a monetary gain purpose targeting internet banking and/or shopping (Table 1-1).

Figure 1-3

Status of unauthorized access incidents 3:

Change in number of detected cases and arrests（cases）

3,000

2,951

Number of detected cases
Number of arrests

2,000
1,251
889

1,000

968
533

242

0

Table 1-1

FY2011FY2012FY2013

Malicious actions taken after unauthorized access
FY2011FY2012Illegal money transfers using Internet banking

188

95

1,325

Illegal online shopping

172

223

911

Manipulation of online games and community websites

358

662

379

Site manipulation/elimination

28

42

107

Illegally obtaining information

74

99

92

Manipulation of Internet auctions

22

29

36

Illegal information storage

4

1

20

Other

3

100

81

The tactics of unauthorized access became manipulative, too.

FY2013In terms of thenumber of arrests concerning unauthorized access to steal identification codes, suchas IDs and passwords, "verbal manipulation of authorized users or shoulder hacking"was the most frequently used tactic to obtain information in 2012, but "abuse of

Based on data of the “Status of occurrence of unauthorized access and R&D on technologies of access control
functions” (released on March 27, 2014, by the National Police Agency and the Ministry of Economy, Trade andIndustry).

3

3

insufficient setting/management of users' passwords" increased rapidly and became
the majority of the tactics in 2013 (Table 1-2).

Table 1-2

Unauthorized access-related crime by method 4

Number of arrests related to divulging identification codes
Abuse of insufficient setting/management of users' passwords
Verbal manipulation of authorized users or shoulder hacking
By someone previously having access to identification codes(ex-employees, friends, etc.)
Obtaining from malicious actors such as accomplice(s)Use of malware such as spyware
Use of phishing sites
Purchasing from the third person
Other
Number of arrests related to attacks by exploiting security holes

2011
241
59
29

2012
532
122
299

2013
965
767
64

52

101

56

38
1
59
0
3
1

22
29
18
0
11
1

35
25
9
7
2
3

This trend in the increase in malicious actions for monetary purposes was also
found in rapidly increasing phishing, that is, an attempt to fraudulently steal personal
information, such as login IDs and passwords, addresses, names, bank accountnumbers, credit numbers, by sending e-mails that appear to originate from alegitimate service providers. For example, in the continued rise of reported incidents
from the end of the year, the number of “phishing incidents” (including overseas
incidents) reported to the Council of Anti-Phishing Japan reached 4,181 in March2014 (Figure 1-4).

Figure 1-4

Change in reported phishing incidents 5（cases）

4,656

5,000

4,181

Reported cases

4,000
3,000
2,836

2,000
962

1,000
92

0

144

69

26

52

42

237

364

180

1,412

223

Jan. Feb. Mar. Apr. May June July Aug. Sep. Oct. Nov. Dec. Jan. Feb. Mar.
2013
2014

Based on data of the “Status of occurrence of unauthorized access and R&D on technologies of access control
functions” (released on March 27, 2014, by the National Police Agency and the Ministry of Economy, Trade andIndustry).
5 Based on the monthly status of phishing report of the Council of Anti-Phishing Japan.
44It is reported that most of them were phishing by masquerading as online
games and/or financial institutions (about 97 percent of the total reported incidents
in that month) 6; moreover, there were repeated media reports on phishing incidents
masquerading as major financial institutions. All these reports reveal thatunauthorized access for the monetary purposes became an immense cyber threat.
In organizations such as enterprises, managers are usually responsible for theoperation of information systems.

With regard to the number of unauthorized accessincidents reported by manager, private enterprises particularly became the largest
victims (Table 1-3).

In terms of motivation, while "illegally obtaining monetary gain"

was a marked motivation for unauthorized access, it is also noteworthy that "illegallyobtaining information such as clients’ data" was on the rise.

Table 1-3

Number of unauthorized access incidents reported by manager 7
2011
762
115
1
6
5

Private enterprises
Internet service providers
Universities, research institutes, etc.
Administrative organs, etc.
Other

2012
1,163
22
12
52
2

2013
2,893
9
9
24
16

In terms of the trends in targeted e-mail attacks, the number of targeted e-mailattacks identified by the National Police Agency during 2013 was 492 8; it was adecrease of 517 from the previous year (a year-on-year decline of 51 percent). With
these numbers, the threats of targeted e-mail attacks were seemingly declining.
According to an analysis made by the National Police Agency, however, while there
was a decline in “phishing email campaigns”, which are launched with a large numberof e-mails, there was an increase in so-called “spear-phishing” attacks, in a form ofsocial engineering.

The methods of attacks were evolving, too, due to emerging

tactics, for example, to avoid the detection of unauthorized external connections.

Based on the “Status of Phishing Report 2014/03” (released on April 1, 2014 by the Council of Anti-Phishing
Japan”).
7 Based on data of the “Status of occurrence of unauthorized access and R&D on technologies of access control
functions” (released on March 27, 2014, by the National Police Agency and the Ministry of Economy, Trade andIndustry).
8 Based on the “Status of cyber attacks and progress of countermeasures in 2013” (released on February 27, 2014
by the National Police Agency). The cases were those identified by the National Police Agency through the “CyberIntelligence Information Sharing Network” as targeted e-mail attacks aiming at divulging information.
65

Given that, it is also pointed out that the threats of targeted attacks became rather
greater than ever before.
Such targeted attacks mainly aim at security breaches, for example, stealing
critical information including confidential data on business operations, by infiltrating
malware into a targeted organization’s information systems.

There is an increase inattacks with such diversified and manipulative methods in recent years, and there isa growing concern of additional targeted attacks using the stolen information by theattacks.

Under these circumstances, in order to enhance the quality of enterprisemanagement, the Intellectual Property Strategy Headquarters has discussed the
topics including the use of case examples and best practices in the Trade SecretManagement Guidelines. 9

Based on “Report of Task Force for Trade Secret” (released on April 23, 2014, by the Task Force for Trade Secret,
the Verification, Evaluation, Planning Committee, the Intellectual Property Strategy Headquarters).

9

6

2.

Status of Cybersecurity Concerning Government-related
entities 10
andCritical Information Infrastructure
Operators(1) Status of cybersecurity concerning government-related entities
In fiscal year 2013, “external attacks” and “unintentional information leakages”
were the two main causes of information security incidents involving governmentrelated entities.

The following are the trends in information security incidents bymajor cause, in terms of cybersecurity concerning these entities in the fiscal year.
A. Information security incidents caused by external attacks
As same as the previous fiscal year, there were a large number of information
security incidents aiming at stealing critical information from the government bodies,
the incorporated administrative agencies, and so on, by attacks such as the use ofunauthorized access and malware.

In general, targeted e-mail attacks are

frequently used tactics in the initial stage of cyber attacks.

They are typicallyinitiated by sending targets e-mails that contain malware in an attached file or URL
links to malicious servers, and, as a result, e-mail recipients' terminals are infectedwith malware by opening these attached files or clicking the indicated URLs.
The GSOC 11 of the National Information Security Center or NISC has collected
information and issued alerts on suspicious e-mails received by the governmental
bodies, and it issued 381 alerts during fiscal year 2013 (Table 2-1).

Table 2-1

Change in alerts concerning suspicious e-mails
FY2011

Number of alerts
concerning suspicious e-mails

209

FY2012415

FY2013381

Besides governmental bodies, they include incorporated administrative agencies, national university
corporations, etc.
11 The Government Security Operation Coordination Team.
The GSOC's missions include: Government-wide
information gathering, analyses and diagnoses of cyber attacks and other cyber incidents, assistance for thegovernmental bodies, and the promotion of mutual coordination and information sharing among the governmental
bodies.
10

7

Putting aside an extraordinary situation where a large number of suspicious emails were sent to the governmental bodies in December 2012, there was a generaltendency towards increasing alerts over the past few years.
With regard to targeted attacks, in addition to targeted e-mail attacks, so-called“watering hole” attacks emerged in 2013. In this type of attack, malware is sent tosite viewers visiting from pre-selected IP address of the targeted organization, andthese viewers become sole victims of the infection.
reported by media as

In October 2013, this attack was”cyber attacks targeting at least twenty organizations such as

governmental bodies and major enterprises”.

In this incident, as to thegovernmental bodies, automatic virus downloads were detected in the terminals ofseven ministries and agencies, but no information leakage was confirmed.
Furthermore, the cyber attacks showed tendencies towards evolution anddiversification; for example, in February 2014, there was a report of an information
security incident or virus infection caused by updating a specific video player software(case confirmed at an incorporated administrative agency).

As for a targeted attack

taking advantages of vulnerabilities that have not been patched or made public, i.e.
before the release of security patches, or so-called a “Zero-day attack”, theprevention of malware infection is technically difficult.

Therefore, it cannot be

overemphasized that it is indispensable to implement preventive measures against
the penetration of malware into information systems, including the enhancement of
the network monitoring and communication systems.

Figure 2-1

Examples of emerging threats (targeted attacks)

Attacks abusing software updates

Attackers direct users
to springboard

Remote control site Springboard

Official site

Redirect

Stealing
information byremote control

InstallingmalwareInternet
Accessing an
update server

Confidential

Detection is difficult, as no damage may be done even
if organizations that are not targets visit the same site.

8

To remind government-related entities to be vigilant against cyber threats, theGSOC has disseminated security tips on countermeasures to tackle software
vulnerabilities that would possibly be targeted by cyber attacks such as web attacks.
In fiscal year 2013, the GSOC provided 78 security tips including information onvulnerabilities (Table 2-2).

Table 2-2

Change in number of GSOC security tips on software vulnerabilities, etc.
FY2011

Number of disseminated security
tips on vulnerabilities, etc.

FY201268

74

FY201378

Website manipulation is one of the major attacks exploiting vulnerabilities.
Previously, ensuring the governmental bodies' security measures was the top priority.
However, since attacks targeting the incorporated administrative agencies have been
expanding, the enhancement of security measures not only for the governmental
bodies but also for the incorporated administrative agencies is currently most needed.
As a countermeasure against cyber attacks targeting the governmental bodies,
the GSOC has carried out the detection of cyber attacks or signs of cyber attacks byusing a government-wide information collection and monitoring function, namely, the“GSOC Sensor”.

The number of detected incidents that were considered as threatsagainst the governmental bodies through this detection function was approximately
5.08 million in fiscal year 2013 (Table 2-3).

Table 2-3
Change in number of threats to governmental bodies detected through GSOC Sensor

Approximate number of threats togovernmental bodies

FY2011FY2012FY2013660,000

1,080,000

5,080,000

The number was almost five times higher, compared with fiscal year 2012; andit made up roughly one detection per every six seconds.

It is considered that thisrise was affected by the increasing threats to the governmental bodies; and that the
improvements made during the fiscal year such as the improvement of sensor

9capability also contributed to this rise.

It is critical to capture and analyze cyberthreats in more detail by continuously improving the GSOC Sensor, and so on.
The GSOC has sent a notification to a relevant governmental body when
detecting unauthorized access (including suspected cases) through its monitoring
activities with the GSOC Sensor, etc.

In fiscal year 2013, the number of thenotifications reported to the relevant bodies was 139 (Table 2-4).

Table 2-4
Change in number of notifications reported through monitoring by GSOC Sensor, etc.
FY2011

Number of notifications throughmonitoring by GSOC Sensor, etc.

FY2012139

FY2013

175

139

The number of notifications in fiscal year 2012 was particularly high, because alarge number of suspicious e-mails were sent to the governmental bodies in
December 2012, as previously stated.

As a result, more than half of thesenotifications were concerned with the detection of targeted e-mails.
In fiscal year 2013, the notifications concerning targeted e-mails accounted for
one-fourth of the total notifications.

The detection of suspicious communications 12

was one of the significant figures of this fiscal year.

It was significant because there

was almost no detection of such a communication prior to fiscal year 2013, but, incontrast, the number represented 30 percent of the total in fiscal year 2013.

It isconsidered that “malware infections by targeted e-mail attacks” and “malware
downloading by viewing manipulated websites like web-based watering hole attacks”
were possibly the major causes of the detection of these suspicious communications.
With regard to targeted attacks, although they had been existing dangers inprior years, most of them had been “e-mail phishing campaigns” and their successrate against the governmental bodies had remained low.

However, it is consideredthat the detection of suspicious communications increased due to the rising successrate of customized targeted e-mail attacks to specific organizations and/or employees,

Not all of "suspicious communications" are necessarily "malicious communications". For example, if
connectivity tests to access blacklisted websites are conducted without previous notice, it could be considered assuspicious communications by the GSOC.

1210

as significantly observed in fiscal year 2013.

The number of notifications reportedby the GSOC in this fiscal year remained same as the previous years, if excluding theextraordinary factor such as the numerous suspicious e-mails.

Meanwhile, aspreviously stated, there were the changes in the types and the ratio of threats, e.g.
unauthorized access, reported by the GSOC.

Indeed, risks in cyberspace appeared

to be spreading with acceleration. Since targeted e-mails and watering hole attacks
are mostly combined with Zero-Day attacks, it is hard to block all penetration of
malware.

Hence, further enhancement of the GSOC is a must.

Figure 2-2

Outline of GSOC

< The Government Security Operation Coordination team> (GSOC)
April 2008: GSOC became operational (8 hours per weekday).
April 2009: GSOC began 24/7 operation (throughout the year).
April 2013: GSOC began the operation of its current system.
2017: GSOC is scheduled to launch its next generation system.

GSOC
sensors

MinistryA

CSOC Sensors

Attack andpreparation for
attackInternet

Sending e-mailwith malware
attached

Attacker

NISC

Government-wide
Information collection
and monitoring
GSOC
sensors

MinistryB

MinistryC

1. Real timegovernment-widemonitoring

Monitoring governmental homepages
and requesting response against risks

2. Warnings and advices
for enhanced
response capabilities

Disseminating security tips regarding
software vulnerabilities, etc.

3. Malware analyses andsecurity informationcollection

Analyzing unknown virus anddefending with anti-virus software11

B. Information security incidents caused by unintentional information
leakages
While cyber attacks by external actors increased, there were occasional
information security incidents concerning unintentional information leakages causedby employees’ low awareness of cybersecurity or mistakes, and so on.

Previously,

the majority of these incidents was accidental and caused by careless mistakes suchas the loss of computers or USB flash drives or sending e-mails to wrong e-mailaddresses.

Recently, however, different types of incidents have occurred in relation

to the improper use of Internet connected devices and/or cloud-based services andthe inadequate connection settings of these devices and/or cloud-based services.
The following are examples of such incidents:
A case, made public in July 2013, in which personal information and internal
information of the central governmental bodies stored in a free cloud service toshare e-mails on the Internet remained accessible by everyone;A case, made public in November 2013, in which personal information of students
and others scanned or faxed at universities remained viewable to everyone on
the Internet; and,A case, made public in December 2013, in which the computer systems ofgovernment-related entities were compromised with a Japanese input software
automatically transmitting all characters entered with the software to thesoftware company’s cloud server.
As to the case involving the free-cloud service, this free cloud-based service

enabled e-mail sharing on the Internet, and the root cause of this incident was thatthe service was used by the employees of multiple governmental bodies on businesstrips to share internal information with their colleagues or for communications withexternal persons.
In the past, from a viewpoint of information security assurance, thegovernment-related entities used to be conservative in utilizing external cloudservices.

On the other hand, the needs for highly convenient services have been

rising in business operations.

The above-mentioned incident can be considered as

an example that such needs produced undesirable results in terms of information
security.

Consequently, with regard to information and data that require extra carein handling, it is an upmost necessity to create an IT environment to respond tobusiness operational needs and, at the same time, to assure information security.

12Figure 2-3

Example of emerging threats (unintentional information leakages)
Information leakages caused byTerms and Conditions of external services
In plainview…

unintentional
access to
information

Group mailservices

Using services
withoutchanging
default settingas ”open to
public”

Confidential
dataInternet

Information
sharing permitted

Internal LAN

Storing confidential
data in the cloud

confidential(2) Status of cybersecurity concerning critical information infrastructure
operators
In terms of situational reports such as in the event of accidents involving IT
system failures at critical information infrastructure (CII) operators and relevant
parties 13 , the number of communications to NISC via the governmental bodies

In the first and second Action Plans on Information Security Measures Concerning Critical Infrastructure, thefollowing were identified as critical infrastructure sectors: "information and communication services", "financial
services", "aviation services", "railways services", "electrical power supply services", "gas supply services","governmental and public administrative services (including local government organizations)", "medical services","water services", and "logistics services". Among business operators and other relevant parties of these sectors,
critical information infrastructure operators and relevant parties mean a body comprised of those specified in the
Action Plans. From fiscal year 2014, in line with the newly established third edition, "chemical industries", "credit
card services", and "petroleum industries" industries are added to the critical information infrastructure sectors.

13

13

responsible for CII increased by 1.5 times, from 110 in fiscal year 2012 to 153 in
fiscal year 2013. Among those, communications on cyber attacks (intentional cases)
also increased to 133 in fiscal year 2013, up from 76 in the previous fiscal year (Table
2-5).

It should be noted that these increases do not necessarily illustrate the more

frequent failures of IT systems caused by cyber attacks and so on; rather, it can beconsidered that the increased awareness of the importance of information sharing
among critical information infrastructure operators and others as well as a more
active use of the information sharing system with NISC largely contributed to theseincreases.

Table 2-5
Number of communications to NISC from critical information infrastructure operators
FY2011FY2012FY2013

Number of communications from
CII operators

43

110

153

Communications on cyber attacks

15

76

133

Communications on
unauthorized access and Dos attacks

12

55

121

Communications on
computer virus infections

2

6

7

Communications on other intentional
cases (suspicious e-mails, etc.)

1

15

5

The cyber attacks concerning CII can be broken down into two common
categories: unauthorized access and DoS attacks.

The following are examples ofthese attacks.
The login IDs and encrypted passwords to access a membership website
managedbyabusiness

operator

wereleakedby

exploitingthevulnerabilities of middleware.


Due to website manipulation caused by the exploitation of vulnerabilities ina website managing system, the visitors of the said website were directed
to external malicious websites.



Website display speed became unusually slow due to a huge number ofaccess requests from various overseas regions, presumably caused by DNS
server-related insufficient settings (related to open resolvers).

14

The “Initiative for Cyber Security Information sharing Partnership of Japan (JCSIP)” is an initiative for information sharing among the member organizations of
this partnership through IPA as an information hub.

The number of information

provided from the member organizations to IPA regarding suspicious e-mails, whichwere apparently targeted e-mail attacks, through J-CSIP was 385.

It increased byapproximately 1.5 times from 246 in the previous fiscal year.

The number of

information sharing conducted by IPA for member organizations based on theprovided information, etc. was 180 (Table 2-6).

It is required that CII operators willcontinuously enhance information security measures, taking into account thesesituations.

Table 2-6

Number of provided and shared information through J-CSIP
FY2012FY2013

Provision of informationfrom member organizations to IPA

246

385

Information sharing
with member organizations

160

180

15

3.

Major governmental policies and achievements in FY 2013

In June 2013, the Information Security Policy Council chaired by the Chief
Cabinet Secretary established the “Cybersecurity Strategy”, as a new national
strategy to respond to increasing risks in cyberspace.
The basic principles of this strategy, which covers the triennium FY2013 FY2015, are: (1) Ensuring the free flow of information; (2) adapting to growing risks;(3) enhancing risk-based responses; (4) actions with a sense of social responsibility
and reciprocal assistance.

Based on these principles, the Strategy illustrates its

overarching goal to build "the most advanced cybersecurity nation” with efforts madeby stakeholders,e.g.

governmental

bodies and

CII

operators,

for mutual

collaboration, while harnessing NISC as the focal point, and establish a world-leading
cyberspace, which is resilient and dynamic, by promoting such activities: upgrading
cybersecurity standards, expanding capabilities to counter cyber attacks, improving
the basic capabilities related to cybersecurity, for example, with the promotions ofhuman resources development and R&D, the enhancement of international
collaboration, and the betterment of the Government’s organizational system (Figure
3-1).
This Strategy incorporates such approaches: for stakeholders, including thegovernmental bodies, the incorporated administrative agencies, CII operators andrelevant organizations, enterprises, and the public, to take enhanced protection forachieving resilient cyberspace; for Japan to build dynamic cyberspace by enhancing
the information security related foundations to develop corecapabilities for IT

utilization, for example, human resources development and the advancement oftechnological capabilities; and for Japan to play a leading role in the world, e.g. tocontribute the international community, bearing in mind that cyberspace is a global
domain (Figure 3-2).

16

17

Integration of cyberspace and real space

Growing risks
in cyberspace(1) Measures for government-related entities(2) Measures for critical information
infrastructure, etc.
(3) Measures for enterprises, research
institutes, etc.
(4) Cyber hygiene(5) Countermeasures against cyber crime(6) Cyber defense

Strengthening cyber defense capability
and cyber resilience

1. Resilient cyberspace

CYBERSPACE(1) Diplomacy(2) Global outreach(3) International collaboration

Strengthening capabilities to contributeand lead to cybersecurity

3. World-leading cyberspace

Globalization

Critical Infrastructure Educational Organizations
Research Institutes
Operators

PrivateCompanies

Small and MediumSized Businesses

Cyberspace-related Business Operators

Government

General Users

Strengthening NISC’s
functions, etc.

System to promote
cybersecurity, etc.

(1) Industrial rejuvenation(2) R&D(3) Human resources development(4) Improving digital literacy

Strengthening creativity andknowledge in cyberspace

2. Dynamic cyberspace

Ensuring Development

Promoting growth by further
facilitating integration with real space(1) Ensuring the free flow of information(2) Adapting to growing risks(3) Enhancing risk-based
responses (4) Actions with a sense of social responsibility and reciprocal assistance

For national security and crisis management, the development of socioeconomic activities, and safe andworry-free living, Japan will pursue the “world-leading”, “resilient” and “dynamic” cyberspace and build asociety, resilient against cyber attacks, full of innovation, and respected in the world.

– Building the Most Advanced Cybersecurity Nation –Wide-spreading, Proliferation, and Globalization

Growing risks in cyberspace

Outline of the “Cybersecurity Strategy”

Diffusion, Sophistication, Evolution, Global Expansion & Popularization

Securing Sustainability

Strategic Perspectives

Basic Principles

National Vision

Environmental Changes

Figure 3-1

18

Organizational
Reform Adoption ofinternational
strategy(International
strategy)

Cyberspace

Worldleading(Basic capability)

Cyberspace

Dynamic(Enhanced
protection)

Cyberspace

Resilient Implementation of cross-sectoral
exercises to ensure business
continuity

 Implementation of Incident response
drills; specification of roles of relatedparties such as the police and the
Self Defense Forces Assurance of cyber crime traceability,e.g. by examining log storage methods

 Promotion of IT related business
operations’ activities, e.g. security
advice such as virus warnings for users
by Internet service providers

 Promotion of security investment bysmall and medium-sized businesses
through incentives such as tax systems

 Revision of the Information Security
Outreach and Awareness Program of2011 (Information Security Policy
Council) Launch of Information Security
Awareness Month (February) and“Cyber Security Day”

 Adoption of countermeasures against
malicious smartphone applications

Enterprises and Individuals

 MERIDIAN(*2)

 Enhancement of NISC’s functions (scheduled to be reorganized as“Cybersecurity Center” [tentative], targeting FY2015）

 IWWN (*1)

 Conferences on international norms and rulemaking in cyberspace, etc.

 Japan-ASEAN

 Japan-EU

 Japan-India Japan-UK

 Japan-US

Main purposes: Enhancement of GSOC; arrangement of
information sharing between GSOC and CII operators;
enhancement of cybersecurity human resources, etc.

 Joint awareness raising activities in October*１ Dialogues for the promotion ofinternational activities to counter
vulnerabilities, threats, and attacks incyberspace among governmental
entities and CERTs of the US, Germany,
the UK, Japan, etc.
*2 Dialogues on best practices andinternational coordination, etc. among
the US, the UK, Germany, Japan, etc.

 Review of Information Security Research and Development Strategy 2011 (Information Security Policy Council)

 Revision of Information Security Human Resource Development Program 2011 (Information Security Policy Council)

 The 3.18 Cyber Training

 Creation of platforms for assessment
and authentication systems, such as
control systems used by criticalinformation infrastructure, incompliance with international
standards

 Improvement of information sharing
among governmental bodies, systemvendors, etc.

 Reinforcement of GSOC; accurate
and quick responses throughcooperation with CYMAT and CSIRT Arrangement of countermeasuresfor emerging threats related to newservices such as SNS and group mails

 Review of the Basic Policy including
expanding the scope of criticalinformation infrastructure andreview of the Safety Standards

 Review of the Common Standards
and adoption of risk assessment
methodology to protect sensitive
information

Critical Information
Infrastructure Operators

Primary approaches of the "Cybersecurity Strategy" (FY2013 - FY2014)

Government Bodies, Incorporated
Administrative Agencies, etc.

Figure 3-2

The following are the summary of main activities promoted in fiscal year 2013
in line with the Strategy.

As for a set of the Common Standards of Information

Security Measures for Government Agencies, after reviews were conducted for the
purpose of enhancing the responses to emerging threats and technologies as well as
improving the effectiveness of the management standards, a revision was made in
May 2014.

As one of the responses to emerging threats, and so on,theadjustments of the provisions have been carried out to counter the threats of targeted
attacks.

Together with the common standards related guidelines 14 , which werediscussed separately, they specifically aim to: identify prioritized tasks, etc. for theprotection from targeted attacks; detect malicious infiltration into the inner
information systems concerned; and prepare contingency plans to deactivate suchattacks.

Additionally, in view of recent environmental changes, new provisions wereadded in relation to: supply chain risk management, so to speak, to require strict
management systems to prevent the infusion of malicious actors into information
systems of outsourcing contractors, etc.; the strict management of the use of
personal smartphones and other devices for business purposes; the prohibition ofsending confidential information in use of the governmental SNS and relevant
services; the management of USB flash devices, multifunction devices, and so on.
In the revision process, special attentions were paid to making the standards
better understood and more respected, with such efforts, e.g. the clarification andsimplification of definitions and terms, the non-use of lengthy descriptions, thecompiling the employee compliance provisions by each staff category; thereexamination of the obsolete provisions (Figure 3-3).

Figure 3-3 Example of reexamined provision<Sample provision of the previous Common Standards>

Employees must inform the concerned parties and the chief
information security officer according to the reporting procedureformulated by the head of information security officers through theincident response officer when a failure, accident, etc., or the likecomes to their notice. However, if it is impossible to report to theperson in charge of failure, accident etc. due to unavoidable emergency
circumstances, they should report to the chief information security
officer according to the defined procedure.
<After reexamination>

Administrative employees shall report to the ministry’s reporting pointof contact when an information security incident is discovered and shallact in accordance with instructions received.

14
The guidelines for risk management of countering advanced cyber attacks, etc. They became preliminarily
operational in October 2013, and are scheduled to become officially operational in fiscal year 2014.

19

Furthermore, the governmental bodies made progress in the expansion andenhancement of risk management systems in the event of cyber attacks, byimproving the coordination among the GSOC, the CYMAT, and the CSIRT and
implementing the 3.18 Cyber training, and so on (Figures 3-4 and 3-5).
In terms of information security measures concerning CII operators, certain
results were achieved based on the second edition of “the Basic Policy of Critical
Information Infrastructure Protection” 15 .

However, since there were various

environmental changes in societal and technological aspects, compared with when
the second edition had been adopted, discussions were made on a new policy in linewith the Cybersecurity Strategy.

Figure 3-4

Enhancement of coordination among GSOC, CYMAT, and CSIRTNational/Governmental CSIRTs

Government Security Operation Coordination Team (GSOC)
FY2007: GSOC preparation started.
FY2008: GSOC operation launched.
FY2009: 24/7 full operation started.

March 2013: Preparation completed.
System for prompt damage control and earlyrecovery in case of information security
failure or incident at a governmental body

Providing information on
detected incidents, etc.

Real time government-widemonitoring (24/7) andanalysesWarning & advice for
ehnaced response capability
by accurate and prompt
information sharing
Malware analyses andsecurity informationcollection

CYMAT Members
GSOC Staff, etc.

Mutualcollaboration system

Reporting incidents, etc.
ＧＳＯＣ
SensorMonitoring

PoC

Mutualcollaboration

A ministry
CSIRT

ＧＳＯＣ
SensorTechnical assistanceand advice

CYber incident Mobile Assistance Team (CYMAT)
Established on June 29, 2012
CYMAT consists of staff with advanced experiences of and knowledge
on information security, dispatched by governmental bodies.
CYMAT deals with information security incidents that require
government-wide responses in the event or potential risks of cyberattacks concerning information system failures of the entities
assisted by CYMAT.

(1) Situational awareness to get an accurate understanding of what
is happening(2) Technical assistance and advice for damage control, recovery,
Assistanceand preventive measures(3) Activities in normal times to improve incident response
capabilities ( implementing workshops, training, etc.)

・Information collection andanalyses on incidents, risk
management for emergency
response
・Report/communications toChief Officers, etc.
・Staff education and training
・Collaboration with
relevant organs
Response
Coordination
among CSIRTs

C ministry
PoC CSIRT

ＧＳＯＣ
Sensor

PoC

Focal
point

B ministry

CSIRT

NISC
Collaboration,
information sharing

Private CSIRTs, etc.

Originally entitled as “The Second Action Plan on Information Security Measures for Critical Infrastructures”(February 3, 2009).

15

20

Figure 3-5

The 3.18 Cyber Training

Under the circumstances where cyber attacks against Japan had become more complex
and manipulative, training was carried out to handle multiple simultaneous cyber attacks
against various governmental bodies. Aiming to improve the coordination among
relevant parties, the training was conducted with a combination of (a) information
gathering and sharing exercises among NISC, governmental entities, and CII operators, etc.,
and (b) emergency response drills by the CYMAT members.
Chief Cabinet Secretary’s Speech

Training Scene

In the third edition of “the Basic Policy of Critical Information Infrastructure
Protection” that was established in May 2014, each component was revised andreinforced, while the basic framework of the second edition was maintained.

More

specifically, the third edition includes: the creation of guidelines to enable relevant
parties, especially, small and medium-sized enterprises to upgrade their standards ofinformation security measures step by step; the establishment of an information
sharing system in the event of accidents including extensive IT system failures, as
the extension of the system in normal times; the expansion of the scope of CII fromthe existing ten sectors to thirteen sectors, with addition of three sectors, namely,
chemical industries, credit card services, and petroleum industries.

Furthermore,

the overall contents were elaborately structured, for example, in a way that enables
top business management to obtain the full picture of information security measuresby adding a chapter summarizing the Basic Policy (Figure 3-6).
In addition, with regard to CII, necessary measures, such as the implementationof cross-sectoral exercises, have been undertaken.

21

Figure 3-6
Highlights: “The Basic Policy of Critical Information Infrastructure Protection (3rd edition)”
Components and major points
1. Maintenance and promotion of safety principles: Appealing to CII operators in the process of preparing
measures as well as small and medium-sized CII operators, etc. for the importance to develop information
security measure with a “growth model”.
2. Enhancement of information sharing system: Clarification of information sharing system in case of IT crisis,
as an extension of the system in normal times.
3. Enhancement of incident response capability: Overall enhancement of incident response capability byobtaining the full picture of exercises/training by stakeholders and mutual coordination.
4. Risk management: Comprehensive risk management support for CII operators, etc., including risk assessment.
5. Enhancement of basis for CIIP: Preparation, utilization, and international development of relevantinternational standards, regulations and references, etc.
 Expanding the scope of critical infrastructure from 10 to 13 sectors (with addition of chemical industries, credit card
services, and petroleum industries).
 Showcasing the major points, e.g. “expectation for executive management”; making a list of CII operators’ sample
measures based on the PDCA cycle and related governmental programs/activities.
Developing objective assessment criteria and implementing periodic assessment and review based on these criteria.

In terms of the promotion of information security measures used byenterprises and people, it is critical to build awareness of the safe utilization of
information and communications technologies without making trouble for otherpeople.

As to outreach and awareness raising on information security, various

activities were promoted for the enhanced public awareness raising of information
security, in addition to publicity activities using the homepages of the governmental
bodies and relevant organizations as well as their information security related events.
With respect to the “Information Security Awareness Month” that has been
implemented in February since fiscal year 2009, the first working day of this Monthwas designated as “the Cybersecurity Day” in the fifth celebration in fiscal year 2013,
with the aim to raise public awareness more widely about the main idea of this Month.
At the same time, creative approaches have been taken to make the activities peoplefriendly, by using PR tools such as the newly created “Information Security Outreachand Awareness Raising” logomark and animation videos (Figure 3-7).
Given the recent situation where cyberspace has growingly expanded andspread to all generations, in all places, and in all activities, the “Information Security
Outreach and Awareness Program” (established in July 2011) was revised with aim
to enhance national awareness of, understanding of, and response capabilities for
information security, and the “New Information Security Outreach Awareness
Program” was established in July 2014 (Figure 3-8).

22

Figure 3-7 Information security outreach and awareness raising activities
Information Security Month
PosterInformation Security Outreachand Awareness Raising
Logomark

Outreach and Awareness Raising
Animation

Website on information Security
Awareness Raising(Trademark registration numbers
5648615 and 5648616)

http://www.nisc.go.jp/securitysite/eng/index.html

Figure 3-8
Highlights of the “New Information Security Outreach and Awareness Program”

23

Similarly, with respect to human resources development, the “Information
Security Human Resource Development Program” (established in July 2011) was also
revised and the “New Information Security Human Resources Development Program”
was established in May 2014.

This new program sets its goal to create a virtuous

cycle of “supply” of information security experts to meet “demand” in Japan, and it
incorporates activities aiming to: resolve the qualitative and quantitative shortagesof information security professionals; and promote a culture of information security
awareness among executive and senior management for the inclusion of information
security in strategic business planning (Figure 3-9).

Figure 3-9Highlights of the “New Information Security Human Resource Development Program”
Main Objective

Creating a virtuous circle of human resources supply and demand
to improve the national level of information security【Demand】 Information Security Awareness Raising among Executive Management
Executive Management Raising information security awareness for the incorporation of information security in strategic business planning.
 Encouraging investment to create human resources demand by setting out information security requirements in
products/services procurement.
Leading Professionals
 Strategic thinking on information security challenges and future directions, and building communication capabilities tofacilitate relationships between executive management and professionals.

【Supply】 Quantitative Expansion and Qualitative Improvement of Human Resources Encouraging existing IT engineers to consider information security as essential capability, and carrying out reviews to create
training materials and to establish performance evaluation criteria and a qualification system.
 Finding and nurturing highly skilled and outstanding human resources, and promoting their activities as cybersecurity
experts in society.
 Creating human resources development environment by providing international learning opportunity and sharing information,
for the purpose of developing world-class human resources.
 Enhancing employment, development, training/education of information security experts by and in governmental bodies.
 Enhancing practical IT education in educational institutes/schools, and promoting teacher training on information security.

With regard to research and development, the “Information Security Researchand Development Strategy” (established in July 2011) was revised in July 2014,
based on the analyses of the current environmental changes in cyberspace as well as
the opinions of the Technological Strategy Special Committee.

The revised strategy

includes not only the review on R&D priorities but also the approaches for the
improvement of detection and prevention capabilities against cyber attacks, theenhancement of security technologies to protect social systems, etc. (Figure 3-10).

24

Figure 3-10 Highlights of the “Information Security Research and Development Strategy”
Priority issues of information security R&D

Promotion policy of information security R&D
１．Improvement of capabilities to detect and defend against cyber attacks• Strengthening collaboration among relevant bodies to share information, including
information on cyber attacks, which are held separately and not yet shared.
• Sharing cyber-attack samples from the Government to researchers, etc. (to be considered)

２．Reinforcement of security technology to protect social systems• Promoting international standardization and certification system of security technology
such as control systems.

３．Security R&D on new services which lead to industrial vitalization• Promoting the inclusion of security quality in the upper process (R&D planning anddesigning stage) in the filed of IT utilization, which is expected to be growing.

４．Maintenance of core information security technology• In view of the creation of Japan’s new industries, national security, etc., it is important tomaintain and enhance core technology including cryptographic technology.

５．Enhancement of research and development through international collaboration• Promoting international collaboration, for example, hosting foreign researchers, in order
to integrate and progress “advanced” technologies of various countries.

Approaches to advanced R&D effectiveness and achievement
１．Promoting the utilization of R&D achievement for society
２．Securing necessary R&D resources and flexibility
３．Integrating information security technology and other fields such as social science

Figure 3-11（※ identified based on the promotion policy ）（１）Improvement of security of entire informationand telecommunications system
Detection of cyber attacks, authentication,next-generation network security, etc.

（２）Improvement of hardware and software
security
Control system , devices, safety assurance of software, etc.

（３）Realization of secured management of
personal information, etc.
Privacy protection, utilization of personal data, etc.

（４）Establishment of R&D promotion base andcreation of a new paradigm
Theory systematization, research and studies,
standardization , evaluation, cryptographic technology etc.

（５）Information security R&D in growthindustries

Medical/ health, agriculture, next-generation infrastructure,
Big Data, connected vehicle, etc.

Achievements of international collaboration25

In terms of international collaboration, in addition to the periodic “ASEAN-Japan
Information Security Policy Meeting” and bilateral cyber meetings with the U.K. andIndia, a cybersecurity dialogue with the U.S. was held in fiscal year 2013.

Inparticular, with respect to ASEAN, the “ASEAN-Japan Ministerial Policy Meeting on
Cyber Security Cooperation” was held in Tokyo in September 2013, and the joint
ministerial statement for the enhancement of cybersecurity was declared (Figure 311).

Similar dialogues are scheduled to be held with other countries, including

Russia, Estonia, Australia, and France.

In this way, international partnerships havebeen substantially developed over the years.
In October 2013, in accordance with the “Cybersecurity Strategy”, the“International Strategy on Cybersecurity Cooperation”, which identifies the future
directions of Japan’s international contributions towards enhanced international
collaboration, was established. This international strategy indicates its aim to foster
common global understanding of cybersecurity by using all occasions including thebilateral, multilateral, and regional frameworks and UN meetings, and demonstrates
Japan’s commitment to active engagement in international collaboration (Figure 312).

Figure 3-12

Highlights of the “International Strategy on Cybersecurity Cooperation”

Meanwhile, in order to tackle information security challenges in cooperation andcoordination with foreign partners, the “International Cybersecurity Campaign” hasbeen carried out every October since 2012.

26

For further promotion of information

security measures in ASEAN countries, focused activities have been implemented,
includingcollaborativeinternational

eventsawarenessorganized

raising

activities

thegovernmental

by

with

ASEAN

bodiescountries,

andrelevantorganizations, and the provision of information on information security measures.
In fiscal year 2013, in addition to the posters and the leaflets, the animation videos
for awareness raising of smartphone information security (in Japanese, English, andwith subtitles in ASEAN languages) and a video portal site were created (Figure 313).

Figure 3-13
Organizing/cosponsoring
eventsJoint Awareness raising activities with ASEAN countries
Outreach and Awareness raising through international collaboration

Collaborative awareness raising with ASEAN(posters, education materials, etc.) since October 2012

Joint SymposiumVideo portal site

Security Tips

Chief Cabinet Secretary’s
Messages on Homepage

Awareness raising posters

Awareness raising animation
Brunei Darussalam Cambodia

Indonesia

Malaysia

Philippines

Singapore

Presentation of animation DVD
Lao PDR

MyanmarThailand

Awareness raising leaflets

Viet Nam

27

The Information Security Policy Council has discussed a wide range of issues in
its subcommittees and with relevant parties.

In order to make the action plansconcerning these issues more effective and more sustainable, it is required thatprofessionals with various specialties take part in discussions in a cross-sectoral
manner, deepen their mutual understandings, and strengthen coordination among
them.

Given that cybersecurity risks increase as socio-economic activities become

more dependent on information and communications technologies, in pursuit of theworld’s most advanced IT-based society, it is indispensable to comprehensively andstrategically promote the policies with a good balance between the promotion of IT
utilization and the assurance of cybersecurity.

From this viewpoint, the “Executive

Panel on Security Strategy Promotion for IT Utilization” chaired by the Minister incharge of Information Technology Policy was newly created under the Information
Security Policy Council, with coordination between the National Strategy Office ofInformation and Communications Technology and NISC, and the Panel has actively
engaged in cross-sectoral discussions on necessary measures and activities.

28

4. Future Policy Directions(1)

Organizational enhancement to promote Japan’s cybersecurity
Making NISC as the focal point, the Government has tirelessly worked topromote its information security policies in the Information Security Policy Council,
and is now observing diverse demands for the reinforcement of its command center
functions, in consideration of spreading cyber threats as well as the needs for
improving national capabilities in organizing the Olympic and Paralympic Games
coming to Tokyo in 2020.

In this circumstance, for the purpose of enhancing thesystem to promote nation’s cybersecurity (scheduled in fiscal year 2015), as
illustrated in the “Cybersecurity Strategy”, the Information Security Policy Council
and relevant parties have engaged in a series of discussions since January 2014. At
present, the following are the three major issues found in these discussions.
i. Capacity building for incident readiness to expanding cyber threats: It isnecessary to create a framework to make the knowledge and experiences
accumulated in NISC available for the use by governmental and relevant
entities; and, it is also necessary to strengthen the governmental system wellin advance to prepare the Tokyo Olympic and Paralympic Games.

For these

purposes, further consideration should be given to: the reinforcement of the
GSOC’s functions; the enhancement of post-incident analysis functions to
identify the causes of critical incidents; and, the development and deploymentof cybersecurity human resources, etc. to conduct research and analyses oncybersecurity policies and cyber trends of other countries.
ii. Need, expected role, and aim for government-wide functional enhancement:
There is a need for the enhancement of inter-governmental cross-functional
approaches in response to the proliferation of cyber threats; NISC should makeactive contributions to upgrade the security standards of the governmental
bodies and other relevant parties; and, concerted efforts of relevant
governmental bodies should be made to assure inter-governmental crosssectoral effectiveness of their cybersecurity policies.

To these ends, further

consideration should be given to: the reinforcement of the governmental bodies’
information security monitoring functions in accordance with the CommonStandards of Information Security Measures for Government Agencies and other29relevant guidelines and regulations; the enhancement of the assessment
function related to IT security investment, in collaboration with Deputy Chief
Cabinet Secretary for Information Technology Policy, for the improvement of theidentified matters, etc.; and, the advancement of the overall coordination
functions regarding cybersecurity policies.
iii. The needs for the enhancement of information gathering and international
collaboration operations to respond to globalized cyber threats: From thisviewpoint, further consideration should be given to such issues; theenhancement of functions for information gathering on cybersecurity incidents
among the governmental bodies as well as among CII operators; the possible
consolidation of multiple international contact points currently existing acrossthe public and private sectors; and, the increase in personnel in charge of intergovernmental coordination.
During fiscal year 2013, several steps were taken to pass a cybersecurity
legislation by the Diet 16, and given that, discussions were made on the directions of
the operational system reinforcement. For instance,

it was discussed that it would

be necessary to reorganize the Information Security Policy Council, currently underthe IT Strategic Headquarters (or the Strategic Headquarters for the Promotion of an
Advanced Information and Telecommunications Network Society), as a headquarters
stationed in Prime Minister’s Cabinet; and that the new headquarters should be given
legal authorities including those to conduct information security monitoring andexaminations on the causes of critical incidents involving the governmental bodies,etc., to request governmental entities’ mandatory submission of documents, and, tomake recommendations to governmental entities.

In addition, considerations weremade on other issues including a need for establishing a new organ acting as asecretariat of the new headquarters.
Based on these discussions, the Information Security Policy Council undertakes
further debates for the establishment of the “Policy directions for the functional
enhancement of the system to promote Japan’s cybersecurity” (Figure 4-1).

A cybersecurity bill was passed on June 13, 2014 by the Lower House and was sent to the Upper House that
decided on June 20 to carry it over to the next legislative session.

16

30

(2)

Promotion of other cybersecurity policies
For the systematical promotion of the cybersecurity policies, the annual plans

have been periodically adopted and implemented in line with the “Cybersecurity
Strategy” that is a medium-term plan covering about three years.

In fiscal year

2014, based on the results of activities implemented during fiscal year 2013 andother relevant factors, the “Cybersecurity 2014” was established in July. In line withthis annual plan, the governmental bodies will make a concerted effort to promote
specific cybersecurity policies (Figure 4-2).
For example, with regard to countermeasures concerning the governmental
bodies, while the cloud-based services had been considered as a form of outsourcing
in the set of the Common Standards of Information Security Measures for
Government Agencies, it was pointed out that these standards could not be
considered as applicable standards for the diversified cloud services such as SaaS,
PaaS, and IaaS.

In addition, foreign governments have begun to set out therequirements of cloud-based services for government procurement.

Given that, theGovernment will make its effort to carry out activities for examining necessary
information security requirements in the use of these services, taking into account acharacteristic of the services that the location and the management status of
information are critical from a security perspective but hard to be known by users ofthe diversified cloud-based services.
Moreover, aiming at improving Japan's information security environment, as for
CII, the Government makes its effort, for example, to develop the information sharing
system of the newly added three sectors, i.e., petroleum industries, chemicalindustries, and credit card services; and, as for human resources development, theGovernment promotes activities including those to increase the strategic awarenessof information security at the board level that has a strong influence on organizational
information security management, including the recruitment of cybersecurity
specialists.

31

32

Figure 4-1

Summary of the “Policy Directions for the Functional Enhancement of the System to Promote Japan’s Cybersecurity” (proposal)

33

Revision of “the Information Security Human
Resource Development Program” (May 19, 2014)“Policy Directions for the Functional
Enhancement of the System to Promote
Japan’s Cybersecurity (under review) Reinforcement of NISC’s functions (CAS) Further promotion of information sharing between the public and private sectors (CAS, RLV)<Basic Principles> Participation in development of international cyber norms (CAS, MIC, MOFA, METI, RLV) Promotion of bilateral dialogues on cybersecurity policies (CAS, MIC, MOFA, METI, RLV) Promotion of international coordination/collaboration in multilateral frameworks (CAS, MOFA, RLV) Enhancement of coordination regarding cyber attacks with foreign organizations (NPA, MOJ) Enhancement of collaboration with CSIRTs of foreign countries (METI)<Basic Principles> R&D Promotion of information security R&D strategy (CAS, RLV) Promotion of the New Information Security Human Resource Development Program (CAS) Promotion of activities for cyber attack prevention and early response measures (MIC) Organization of information security contests/exercises (MIC, METI) Review on current information technology engineers examination system (METI)<Basic Principles>

Revision of “the Information Security Researchand Development Strategy” (July 10, 2014)

Revision of “the Information Security Outreachand Awareness Program” （July 10,2014）

Establishment of “the Basic Policy of Critical
Information Infrastructure Protection”(3rd edition) （May 19, 2014）

 Information security policy review based on the set of the revised Common Standards (CAS, ALL)* Enhancement of cloud computing security measures used by governmental bodies (CAS, MIC)
 Promotion of information security measures/requirements to be included in procurement (CAS) Fundamental reinforcement of GSOC (CAS, ALL) Regarding critical infrastructure; maintenance and promotion of the safety principles,enhancement of information sharing system, enhancement of incident response capability, risk
management, and enhancement of basis for CIIP (CAS, RLV) Establishment and promotion of the new outreach and awareness program (CAS, RLV) Establishment of frameworks for advanced malware detection/removal/prevention (MIC) Creation of Japanese version of NCFTA (NPA) Defense Information Infrastructure (DII) (MOD) Enhancement of readiness against cyber attacks to the nation (CAS, NPA, MIC, MOFA, METI, MOD, RLV)<Basic Principles>• Promoting each activity for its specific purposes, based on the new policies & programs“Cybersecurity 2014” (July 10, 2014)

Revision of “the Common Standards ofInformation Security Measures for Government
Agencies” （May 19, 2014）

Establishing new policies andprograms, based on the strategy“Cybersecurity 2013” (June 27, 2013)

•

2015

* CAS:Cabinet Secretariat; MIC:Ministry of Internal Affairs and Communications; METI:Ministry of Economy, Trade and Industry; NPA:National Police Agency;
MOD:Ministry of Defense; MOFA:Ministry of Foreign Affairs; MOJ:Ministry of Justice; ALL: All governmental bodies; RLV: Relevant governmental bodies

Cybersecurity
Promotion
System, etc.

2014

“Cybersecurity Strategy” (June 10, 2013)“World-leading” Establishment of “International Strategy on
Cybersecurity Cooperation”(Oct. 2, 2013)
Cyberspace

Cyberspace“Dynamic”

Cyberspace“Resilient”

AnnualPlan

Strategy

2013

Second year of the “Cybersecurity Strategy” (Targeted period: FY 2013 - FY2015)

Figure 4-2 Outlines of the “Cybersecurity 2014”