Information Security Human Resource Development
ProgramJuly 8, 2011
Information Security Policy Council

0Table of contents
Preface .............................................................................................................................. 3
Current status and issues concerning information security human resources ........................... 5(1)
Enlarging gap ............................................................................................................. 5
1) Shortage of human resources to deal with high-level and diverse information security
threats ............................................................................................................................... 52) Shortage of information security human resources in every area ..................................... 5(2)
Lack of understanding among organization bosses ........................................................ 5(3)
Risk management vulnerabilities ................................................................................. 6(4)
Insufficient university-industry collaboration (difference between needs of industry andseeds of educational bodies) ................................................................................................... 6(5)
Shortage of international players .................................................................................. 7(6)
Lagging information security human resource development system in Japan ................... 7(7)
Issues in areas ............................................................................................................ 7
1) Developing human resources in government agencies ................................................... 72) Developing human resources in enterprises .................................................................. 83) Developing human resources in postgraduate courses .................................................... 84) Education in universities ............................................................................................. 95) Education in elementary and secondary education stages ............................................... 96) Leadership of teachers ................................................................................................ 9
3. Basic approach .................................................................................................................11(1)
Developing and securing "hybrid human resources" and "problem-finding problem-solving
human resources" .................................................................................................................11(2)
Establishing the information security human resources development environment ......... 121) Awareness raising of management ............................................................................. 122) Visual representation of the value and effect of information security human resources ... 13(3)
Reinforcement of university-industry collaboration ..................................................... 13(4)
Developing human resources through advanced R&D and revitalization of the information
security industry .................................................................................................................. 14(5)
Developing human resources as international players .................................................. 15
4. Specific efforts ................................................................................................................ 16(1)
Establishing the HR Expert Committee for Dissemination and Enlightenment (tentativename) 16(2)
Developing advanced information security researchers and specialists .......................... 17(3)
Developing human resources in government agencies ................................................. 17(4)
Developing human resources in enterprises ................................................................ 171) Awareness raising of management ............................................................................. 172) Establishing the organization-wide human resource development environment ............. 173) Appointing CIO and CISO ........................................................................................ 18
4) Critical infrastructure providers ................................................................................. 185) Small and medium-sized enterprises .......................................................................... 19(5)
Developing human resources in educational bodies ..................................................... 191) Enhancing university education ................................................................................. 192) Enhancing information security education in universities ............................................. 193) Enhancing practical hands-on education ..................................................................... 20
4) Enhancing information security education in elementary and secondary education ........ 20
5) Enhancing information security seminars for teachers ................................................. 20(6)
Reinforcing university-industry and public-private collaboration.................................. 20
1) Promoting education by university-industry collaboration............................................ 20
2) Promoting collaboration for practical education .......................................................... 20
1.
2.

1

3)
4)
(7)

Taking advantage of information security contests ...................................................... 21
Promoting work experience opportunities in government agencies ............................... 21
Reinforcement of international alliances ..................................................................... 21

2

1.

Preface
As economic activities and social life have been increasingly relying on
information communication technologies in recent years, information security risks
have also been becoming more complex and diverse. Therefore, it is an urgent matterto establish information security that is far superior to the current practice.
In response to such changes in the social situation, the Information Security Policy
Council (Chairperson: Chief Cabinet Secretary) has developed the "Information
Security Strategy for Protecting the Nation" (May 11, 2010, hereinafter "Information
Security Strategy") and the annual plan of information security strategy the"Information Security 2010" (July 22, 2010, hereinafter "Annual Plan") to promote
general information security policies among public and private sectors.
Information security human resource development was discussed in the
Information Security Policy Council "Expert Committee on Human Resources
Development/Systemization of Qualifications" in 2006 and the "Expert Committee on
Human Resources Development/Systemization of Qualifications Report" (January
2007, hereinafter "HR Expert Committee Report") was produced as a result tosummarize the current status, issues, and future development policies of information
security human resources.

Since improvement of information security measures is an urgent matter, tasks to
be carried out at an early stage should be intensely examined and proposed.

Figure 1 "HR Expert Committee Report" outline

3

Despite the government's efforts to enforce and promote human resource
development policies based on the HU Expert Committee Report, information
security risks derived from rapid changes in surrounding environments in recent years
have been overwhelmingly wide-ranging. It is also hard to say that information
security human resource development in organizations including that of international
players has been successful.
Therefore, the "Information Security Human Resource Development Program"(hereinafter "HR Development Program") is developed to examine the future
direction of the human resource development policies for various information security
issues described in the Information Security Strategy, Annual Plan, and HR Expert
Committee Report. This also points out areas that require more attention.
The HR Development Program assumes 3 years (2011 to 2013). Since humanresource development is a medium term project, the HR Development Program
contains this point of view. The HR Development Program is assessed by the "HR
Expert Committee for Dissemination and Enlightenment" (tentative name) which will
be described later, and the program may be revised as necessary.
Reference: Relationships between human resource development, and dissemination andenlightenment
Well balanced improvement of information security in Japan can only be achieved
when advanced human resource development for high-level information
communication technologies and dissemination and enlightenment policies forwide-ranging general public are both applied.
The human resource development program is aimed for information security
human resource development in government agencies, enterprises, educational bodies
and so on. Dissemination and enlightenment policies will be promoted based on the"Information Security Dissemination and Enlightenment Program". These two
programs will be implemented to improve information security in Japan in the same
time.

4

2.

Current status and issues concerning information security human resources
While the necessity and importance of information security human resource
development have increased, there are new issues and many unsolved issues. In thisway, there is a gap. A structural reorganization is required to resolve such issues andestablish effective and efficient human resource development.

(1) Enlarging gap
1) Shortage of human resources to deal with high-level and diverse information
security threats
There is a shortage of human resources to deal with rapid changes while
information security threats are complex and diverse then ever such as larger
scale cyber attacks, realization of them, and emerging "new types of attacks", andsecurity threats on cloud computing, smartphones, etc. In order to deal with suchrapid changes, active and dependable information systems should be
implemented and operated rather than taking a passive approach as before.
Therefore, information security human resources for researching, developing,
implementing, and operating such systems are vital. Also, human resources withwide information security knowledge to understand and effectively apply suchhigh-level information security technologies are required.
2) Shortage of information security human resources in every area
Information security knowledge is needed in every area, but there is a shortageof human resources who can correspond. Information communication
technologies play an important role as the social infrastructure in today's highly
developed society where the scale of information utilization is increasingly
expanding and the speed of information transfer is increasingly accelerating.
Dependency to the information technologies is so high that socioeconomic
activities and everyday life cannot be considered without them. Such a trend isdeemed to continue even faster and the importance of information security
technologies is increasing since they are essential for implementing and operating
secure and safe information systems.
Previously information security professionals had a very restrictive nature andcould be recognized as a special and separate occupation; however, awareness of
information security is required in all areas in today's world.
(2) Lack of understanding among organization bosses
It is considered that bosses of organizations rarely consider information security as
their strategic issues and often leave the risk management of information assets to theinformation system department or similar divisions in the workplace. Such attitude
will only result in the situation where the intention of management remains unclear in
addition to lagging application of information security measures in the workplace.
5

There may be lack of regulation in information security among management
themselves such as information security measures are not assessed properly to assist
decision-making of the management. Information security measures in organizations
have often been left to the information systems personnel in the workplace as it was
ridiculed as "chief clerk security". Such an approach is not sufficient to manage risks inorganizations.
The mass scale information system failure immediately after the Great East Japan
Earthquake eventually developed into organizations' top management crisis becauseof the handling error of the incident. Also, cases such as illegal access toorganizations' information systems resulted in private information leakage worth tensof millions of people over dozens of countries caused international debate. Such
media reports should be a wake-up call for management of organizations. They may
have previously thought it was acceptable to leave information security to thepersonnel in the workplace; however, they must understand that mis-handling of
security incidents may threaten the organization's operation and force themanagement to take responsibility in today's environment where organizations are
strategically using information communication technologies and business operations
are densely networked.
(3) Risk management vulnerabilities
The Japan Earthquake revealed risk management vulnerabilities in Japan. We must
learn important lessons from the earthquake. Therefore, in addition to existing
restrictive risks such as anti-virus, illegal access measures, and information leakage
measures, response capability to even more inclusive information security risks must
be reinforced through risk communication and risk management for a wider range of
information security risks such as how to reduce business continuity risks in anever-changing environment, etc. Consequently, it is important to develop humanresources to handle information security risks in such a broad sense.
While various issues concerning the response to the earthquake have been pointed
out, a number of helpful cases have also been reported such as the good use of the
new media such as social networking services (SNS) and voluntary work in
information communication areas. Risk response capabilities will improve with such
selfless and creative action from each member.
(4) Insufficient university-industry collaboration (difference between needs of industry
and seeds of educational bodies)

6University-industry collaboration is desired since practical education is essential
for development of information security human resources. However, it has been
pointed out that there are differences in the nature of human resources educational
bodies are aiming to develop and industry requires. These differences must be
resolved urgently. Others also pointed out the difficulty in attaining cooperation fromenterprises because the human resource development in educational bodies has nodirect benefit for them.
In order to develop human resources with response capacity to risks such as
business continuity, it may be effective to establish inter-faculty courses that coversecurity and risk management and to actively introduce internship at enterprises.
(5) Shortage of international players
As globalization is progressing worldwide in every area, the information
communication industry and information security industry have gained greater
mobility over national boundaries. Information security professionals in Japan are
also required to be international players in such a social environment. Therefore,
Japanese information security industry must aim at human resource development forinternational players from the early stage in order to improve international
competitiveness.
Universities should actively provide internship opportunities at overseas security
concerned organizations as part of their information security education.
(6) Lagging information security human resource development system in Japan
Our study of overseas international security human resource development foundtheir various implementations. Information security human resources are developedby public and private sector collaboration, through events such as information
security technology contests, and by higher education institutions' own initiatives.
Meanwhile awareness of information security human resource development in Japanis not high, and the development is lagging far behind other countries despite it is amatter of strategic areas.
(7) Issues in areas
1) Developing human resources in government agencies
With regard to information security human resource development ingovernment agencies, officers and administrators such as the chief information
security officer have been appointed and the human resource development system
for information security measures has been established based on the "Standards
for Information Security Measures for the Central Government Computer
Systems" (hereinafter "Standards") which were developed and revised by the
Information Security Policy Council.
7

However, it takes a long time to train someone to be a highly skilled
information security professional. Such staff may not be appointed to take chargeof information security measures in many agencies. Also, it is difficult to build acareer path for information security staff due to the personnel transfers every twoor three years.
2) Developing human resources in enterprises
Almost all enterprises use the Internet 1; however, "difficult to establish security
measures", "virus threats", and "low security awareness among employees" arelisted as main issues in the use of the Internet and corporate LANs. 2
Most of enterprises which use the Internet or corporate LANs have some forms
of security measures in place; however, these are normally just conventional
measures such as installing anti-virus software.
OJT (On the job training) is the only means of human resource development inmany enterprises without expertise to establish human resource development
strategies. Planned approach is rarely taken thus opportunities of human resource
development are scarce due to the recent reduction in OJT opportunities and alack of awareness of information security human resource development.
Information communication technologies have permeated throughout corporate
activities and the impact caused by the response to information security risks on
corporate business is increasingly critical. Development of human resources todeal with ever more complex and diverse information security treats is desired.
3) Developing human resources in postgraduate courses
Postgraduate courses mainly carry out high-level R&D concerning information
security, whereas industry requires practical information security technologies as
the component technology to embed into products and services. Differences inwhat they pursue prevent those researchers from entering industry. Also,
differences in the research subjects and human resource types discourage humanresource exchange and joint research between industry and academia.

1 Reporting "98.8% of enterprises use the Internet" in the "Communications Usage Trend Survey in 2011" by the
Ministry of Internal Affairs and Communications on May 18, 2011.

2 "Communications Usage Trend Survey in 2011" by the Ministry of Internal Affairs and Communications on May
18, 2011.
"Issues in the use of the Internet and corporate LANs (enterprises) (multiple-choice question) (end of 2010)"

84) Education in universities
Universities have important social responsibility as the base where knowledge
is created and transmitted from. Information communication technologies havebecome vital for education and research in universities and they are required touse information safely with common recognition on information security.
Information security is becoming no longer a special concept for corporate
personnel and human resources for inclusive information security risks are in
need; however, it is considered there is a shortage of such human resources.
The subject information security requires knowledge on various peripherals in
addition to specialized knowledge in information security itself. Therefore, it isimportant to establish the collaboration framework and education system wherestudents are able to gain in-depth knowledge in his own area while cooperating
and liaising with specialists in other areas.
5) Education in elementary and secondary education stages
With regard to information security education in schools, the "Government
Course Guidelines" revision in 19983 promoted information education such asactive application of computers and information communication networks and the"Government Course Guidelines" revision in 2008 and 2009 4 promoted
application of information communication technologies in information educationand on guidance in school courses including full guidance on information ethics 5.
As the performance of mobile devices has improved, the use of Internet withthese devices is rapidly spreading. This has resulted in problems such as slander
and bully on the Internet, Internet crime, distribution of illegal or harmful
information, and private information leakage. The importance of information
security is also increasing.
It is becoming increasingly important to approach information ethics educationon thorough understanding of both glory and danger of the Internet. The basic
concept and attitude such as basic rules and manners in information society andthe safe use of information communication technologies should be taught throughall subjects in addition to the moral lessons.
6) Leadership of teachers
Each teacher should understand that they should improve their abilities to teachhow to use information communication technologies. They should actively take
3 The "Government Course Guidelines" for elementary and junior high schools were revised in December 1998 andthe "Government Course Guidelines" for high schools were revised in March 1999. Specifically, "Information andcomputers" was made the mandatory item in the manual training and domestic science subjects (technical subjects)
in junior high schools and the new subject "Information" was made mandatory and another technical subject"Information" was also introduced in high schools.
4 The "New Government Course Guidelines" for elementary and junior high schools were revised in March 2008
and the "New Government Course Guidelines" for high schools and special support schools were revised in March
2009.
5 "Information ethics" is "the basic concept and attitude for appropriate activities in the information society"9advantage of the school's internal seminars as well as carry out their own study.
The education board should also be involved in schools' seminars and enhancetheir own seminars. Public schools are equipped with nearly one computer perteacher at the end of March 2010. Therefore, information security has become an
unavoidable issue in today's computerized school operations.
Teachers' knowledge and teaching ability of information security may vary, butteachers may not have enough opportunities to learn about information security
due to the pressure of education tasks.

10

3.

Basic approach
The following describes the government's basic approach to promote humanresource development based on the environmental changes of information security
and the past approach and issues concerning information security human resources
development.

1. Developing and securing "hybrid human resources" and "problem-finding problem-solving humanresources"
1) Hybrid human resources: People who can combine knowledge from various specialized areas todeal with dynamically changing information security risks.
2) Problem-finding problem-solving human resources: People who can find and solve problems
by establishing a high-level view of information security risks such as exploring the optimum solution
by comparing against other risks.
2. Establishing the information security human resources development environment1.) Awareness raising of management: "Chief clerk security" to "CEO security"
2.) Visual representation of the value and effect of information security human resources:
Clarification of necessary human resources, systematization and standardization of the required
knowledge and skills, clarification of relationships between the qualification system, work conditions,and career paths, and consideration on the incentive scheme such as an allowance.
3. Reinforcing university-industry collaboration- Resolving differences in the required human resources by educational bodies and industry- Enhancing the university education including university-industry collaboration
4. Developing human resources through advanced R&D and revitalization of the information security industry

Aiming at implementation of a structure that allows active interaction between advanced technology
development, high-level information security human resource development, and the information
security industry.
5. Developing human resources as international players
Developing human resources as international players who can deal with information security threats
and establish international liaison with other countries and concerned organizations including
communications and information sharing.

Figure 2 Basic concept of information security human resource development (outline)(1) Developing and securing "hybrid human resources" and "problem-finding
problem-solving human resources"
The area of information security human resources is closely related to other areas
such as mathematics, computer science, and communications engineering for thetechnical aspect, and economics, law, accounting, sociology, and group psychology
from the management aspect. Also, information security measures cannot be
implemented just technically from the information systems' viewpoint since they arealso closely related to audit and legal operations in enterprises. Therefore, information
security human resources are required to possess management and risk management
expertise in addition to technical expertise concerning information systems andinformation security. Since technological innovations occur frequently in information
communication technologies compared to other areas, information security specialists
should be able to understand the future technical trends and their impact in the event11

of paradigm shifts, and to deal with dynamically changing risks of increasingly
complex and diverse information security threats. Therefore, information security
specialists need to be the humanities and sciences "hybrid" type who can combine
expertise of various areas rather than being a specialist of one area.
Information security risks cannot be dealt with a single measure but a combinationof various measures. Also, as the situation changes dynamically, the acceptable risk
level changes significantly thus information security specialists should be able to takethe optimum risk response even to a sudden violent change of the situation. Also, ameasure to a certain risk may create another risk. Therefore the specialists need to be
the "problem-finding problem-solving" type who are able to see the whole picture of
relationships between ever-changing information security risks and find the optimum
solution.
The Great East Japan Earthquake made us realize the importance of risk
communications and risk management, and nationwide reinforcement of risk response
abilities is desired. Since information security must assume the risks that change
constantly and globally, the knowledge we can acquire through human resource
development of this area can be applied to develop human resources to deal with massscale disasters.
Previously technical abilities are preferred for information security humanresources. However, developing "hybrid" and "problem-finding problem-solving"
human resources is important in the environments where enterprises are relying
heavily on information communication technologies both for business management
and strategies while information security is also positioned as the infrastructuretechnology for information communication technologies.
(2) Establishing the information security human resources development environment
1) Awareness raising of management- "Chief clerk security" to "CEO security" 6 Management must change their attitude and stop leaving information security
measures to information systems personnel in the workplace ("chief clerk
security").
While management is aware that they are responsible for the organization's risk
management, they do not normally recognize information security risk measuresin the same way. However, critical parts of corporate activities are relying on
information communication technologies and their risk measures are for
information security, thus information security measures are crucial issue for thebusiness. Establishing and maintaining information security is vital for the
corporate management in order to protect intellectual assets such as technicalinformation, remain highly competitive, and grow the enterprise. Since
information security is risk measures, it optimizes organization-wide costeffectiveness and there is nothing different from other issues that require
6 Koichiro Hayashi "Chief Clerk Security to CEO Security: Japanese Management and Information Security (InJapanese)" available at :http://www.iisec.ac.jp/proc/vol0002/iisec_proc_002_p001.pdf (last visited July 2011)12management decisions. Finally information security measures must conform andintegrated with the governance of overall business and responsibilities (internal
control, compliance, quality management, environmental adaptation,organization's social responsibilities).
The above leads to the need of "CEO security" for information security
measures in today's changeable situation. No need to mention the recent massscale information system failure in private sectors and large scale private
information leakages in the chapter describing issues concerning information
security.
In order to promote information security measures, all employees including
management should share the same awareness of risk management and establish
an environment that can sustain the morals and motivation.
Also, it is important to develop human resource for more active
communications between employees and management for smooth governanceconcerning information security.
"CEO security" will probably contribute towards solving existing problems in
information security human resource development in enterprises such as i)
Unrelated to the working conditions, and ii) Difficult to improve work
satisfaction and motivation. This may improve the social status of people whowork for information security and will make it an attractive occupation.
2) Visual representation of the value and effect of information security humanresources
It is difficult to secure human resources in the environment of decreasing
birthrate and aging population and the working condition is harsh. Industry andenterprises need to clarify the required information security human resources andvisually represent the effects. The required knowledge and skills are neither
systematized nor standardized in many enterprises and as a result the skills are
retained on individual basis.
The review of the qualification system and training program should continue as
it was pointed out in the HR Expert Committee in 2007. It is important to clarify
the relationships between the qualification system, work conditions, and career
paths in order to secure information security human resources. Also,
considerations should be given to the incentive scheme such as an allowance(information security personnel assessment, preferential treatment system, etc.).
(3) Reinforcement of university-industry collaboration
It has been pointed out that there are differences in the nature of human resources
educational bodies are aiming to develop and industry requires. These differencesmust be resolved urgently. University education including the fruit ofuniversity-industry collaboration has been criticized to lack practical information
security education. In order to solve these issues, the Ministry of Education, Culture,
Sports, Science and Technology took initiative in the "Leading IT Expert
Development Promotion Program" in 2006. In response to that, the "ISS Square"13

(Institute of Information Security, Chuo University, Tokyo University) and "IT Keys"(Nara Institute of Science and Technology, Chuo University, Tokyo University, Japan
Advanced Institute of Science and Technology, Osaka University, Kyoto University)
were selected as the programs to develop human resources on the world highest levelin information security by combining study and business practice beyond boundaries
of universities and between universities and industry in 2007.

Figure 3 Leading IT Specialist Development Promotion Program (selected programs in 2007)""Leading IT Specialist Development Promotion Program " selection status" by Ministry of Education, Culture, Sports, Science andTechnology, September 2007

The budget measure finished in 2010; however, this program was the model case todevelop high-level information security human resources in Japan. Since humanresource development is a medium to long term project, this should not be recognized
as a one-off project but the beginning of the continuing effort to develop information
security human resources on the world highest level. This project is the best practicethat has come out of university-industry collaboration and we hope the budget will be
provided in some way.
(4) Developing human resources through advanced R&D and revitalization of theinformation security industry
As it is pointed out in the "Information Security Research and Development
Strategy" we should lead the world in research and development concerning "Newdependability" to combat information security issues in cloud computing andsmartphones and complex and diverse threats from new types of attacks.
High-level information security human resources are required to carry out suchresearch and development. We will be able to contribute towards the international
competitiveness of Japanese information communication and information security
industries and their global development if the research and development produce
pioneering results. Therefore, we should take an active approach to implement a
structure that allows active interaction between advanced technology development,
14high-level information security human resource development, and the information
security industry.

(5) Developing human resources as international players
Globalization of Japanese enterprises is advanced and many enterprises haveentered into overseas markets. Information communication networks act as thenervous system between those enterprises and their overseas branches, and the needs
for information security is increasing. International liaison such as information
sharing with concerned organizations is essential for accurately dealing with cyberattacks and computer viruses since they have no international boundaries. The status
of information security technologies should be understood from the global viewpoint
since they also have no international boundaries. It is a matter of urgency to develop
information security human resources as international players since such trend will
only accelerate.

15

4.

Specific efforts(1) Establishing the HR Expert Committee for Dissemination and Enlightenment(tentative name)
The "Information Security Policy Council" specializes development andassignment of information security human resources. In order to clarify its "control
tower" function, the "HR Expert Committee for Dissemination and Enlightenment"(tentative name) will be established to advice and assess the dissemination andenlightenment, and human resource development policies for information security.
The "HR Expert Committee for Dissemination and Enlightenment" (tentative name)will advice and assess as follows.
i) Review if the specific approach of the human resource development program iscontributing towards development of the "hybrid" and "problem-finding
problem-solving" types as described in "3. Basic approach".
ii) Monitor the progress of human resource development programs in government
agencies, enterprises, and educational bodies. Discuss the cause and solution andprovide advice as necessary if the progress is not satisfactory.
iii) Review the effect of various qualification systems and educational programs as
many as possible and provide advice for improvement as necessary.
iv) Review the relationships between qualification systems, career paths, and working
conditions as necessary if possible.
v) Advice on policy reviews and new policies based on the environmental changes in
information security.
Chairperson

Chief Cabinet Secretary

Deputy Chairperson

Minister of State for Science andTechnology Policy
Minister of Internal Affairs andCommunications
National Public Safety Commissioner
Minister of Economy, Trade and Industry
Minister of Defense

Six knowledgeable persons

Figure 4 Positioning of the "HR Expert Committee for Dissemination and Enlightenment"(tentative name)16

(2) Developing advanced information security researchers and specialists
In order to improve the nation-wide information security level and reinforce
international competitiveness of the information security area, we must develop a
number of advanced information security researchers and specialists who are able tolead the world. This issue is closely related to enhancement of university educationand the direction of R&D in various research organizations. Human resources foradvanced researchers and specialists should be developed with strategic promotion of
the newly developed "Information Security Research and Development Strategy" incooperation with the Science and Technology Basic Plan since the research anddevelopment involve the internationally acceptable Japanese technologies anduniversity technologies which may influence products and business in industries.
Also, public and private sectors should collaborate on promotion of the researchand development to develop new technologies to solve information security issues incloud computing, smartphones, IPv6, and SNS, and contribute towards developmentof high-level information security human resources though implementation of
coordinated human resource network using a cyber security research testbed.
(3) Developing human resources in government agencies
Government agencies have decided the Information Security Standards in the
Information Security Policy Council as the new basic policies to cope with changes inawareness, technologies, and environments of today's information security, and tohelp understanding information security measures by the chief information security
officer.
The human resource development policies should be promoted based on these
Information Security Standards among legal employees. Specifically, enhancement ofstandardized education programs and material templates, and drills concerning
targeted e-mail attacks to improve information security knowledge of legal
employees.
(4) Developing human resources in enterprises
1) Awareness raising of management
Fundamental reform must take place in enterprises to turn "chief clerk
security" to "CEO security" where management of enterprises take initiative in
information security. In order to assist them it will be useful to establish a system
where they can share success and failure cases in information security measuresin business operations including overseas examples. Also, discussion should beheld on information security measures and human resource development policies
from the organizational risk management viewpoint in places where managementof enterprises may meet.
2) Establishing the organization-wide human resource development environment
Development and permeation of human resource development plans that define
information security human resource development policies and clear career paths
should be promoted in enterprises. Human resource development in enterprises
17

will be promoted by clarifying relationships between i) Required human resource
definition, ii) Qualification systems and education programs, iii) Career paths, iv)
Work conditions (assessment system).
The person who makes the human resource development plan should examine
the type of human resources required in his organization and refer to required
capabilities and education programs. Also, it is important to clarify the type of theinformation security human resources required in each organization within theenterprise, and systematize and standardize the required knowledge and skills.
Information security requirements should be reviewed in parallel with thebusiness reform and system reform and the human resources who can carry out
such requirements should be developed.
It is effective to collect, analyze, and share best practice concerning
information security human resource development plans internally and externally.
Also, it is helpful to introduce a professional system to grant working conditions
according to a certain assessment system for human resource development. It isneedless to say that the human resource development plan should be reviewed
whenever a change occurs in the information security environment andorganizational strategies.
It is also effective to introduce recurrent education where working adults
re-learn in high-level educational organizations to obtain systematic knowledge
and to avoid the information security skills remaining as individual's possession.
3) Appointing CIO and CISO
CIO 7 and CISO 8 have authority to make final decisions concerning
information security. They understand the overall status of information risks inthe organization, determine the acceptable risk levels, procure and assign
resources for information security measures, monitor the information security
management status, and instruct improvements. Issues concerning information
security may span over many business areas and often cause inconvenience oraffect efficiency of business. It is important to position CIO and CISO properly inan organization for strategy development, decision making, and execution
concerning information security across divisions from the organization-wide
optimization viewpoint in increasingly complex corporate management.
Considering information security threats will be increasingly globalized,
sophisticated, and complex, it may be a good idea to look into systems such as"information security insurance" in private sectors.
4) Critical infrastructure providers
Critical infrastructure providers should proactively develop human resources
with high-level information security knowledge though cross-sectional drills and7 "CIO" is the abbreviation of Chief Information Officer and is the person who has the ultimate responsibility inimplementation and operations of information communication technologies of the enterprise and is in charge ofplanning and executing IT strategies according to the enterprise's management principle.
8 "CISO" is the abbreviation of Chief Information Security Officer and is in charge of planning and executing
information security strategies according to the enterprise's management principle.

18

seminars in order to reinforce the information security infrastructure and sharethe status information among them.
5) Small and medium-sized enterprises
Events such as "information security leader seminar for small to medium-sizedenterprises" will be held to attain information security in small to medium-sizedenterprises.
(5) Developing human resources in educational bodies
It is desirable that educational bodies also focus on development andattainment of "hybrid" and "problem-finding problem-solving" types of humanresources. In addition to inter-faculty, inter-university, and university-industry
collaboration, it will be advantageous to deploy methods which encourage
students to find and solve problems rather than being restricted within theknowledge passing method.
1) Enhancing university education"ISS Square" and "IT Keys" aim at development of the best information
security human resources in the world and they are extremely valuable in many
aspects such as university-industry collaboration, inter-university collaboration,
high-level information security human resource development, and international
competitiveness. It is important to correctly assess and continuously develop suchsuccess cases. Human resources who are highly specialized in information
security should be developed in graduate schools. Also adult education program
should be enhanced in liaison with industries by establishing information security
risk management courses where humanities and sciences are both integrated.
It is desirable to establish a systematic and balanced curriculum of theoreticaland practical education of economics, management, information communicationengineering, information security engineering, and enhance education contents
with consideration to various needs from students from different backgrounds
such as new graduates and working adults based on information security in a
broad sense including risk management in enterprise/organization management,in order to develop high-level specialists who can understand management andtechnologies.
2) Enhancing information security education in universities
It is important to have awareness of information security when students go out
in the world. Universities may take initiative in providing more opportunities tolearn information security in their core and general education. Therefore,
universities should be encouraged to provide minimum necessary education for
information security though subjects such as information ethics. Also it may be
helpful to enhance teaching materials and tools, and to establish an environment
where students can widely learn the concept of risk management, intellectual
properties, privacy, etc.
19

Teaching structures and materials for faculties concerning information
processing should be enhanced by inter-university liaison to cover sophisticatedand wide-ranging information security threats. Also, it is effective to provide
opportunities for students to participate in overseas academic meetings andinternships to develop information security human resources as international
players, to improve mutual understanding with other countries, and to form
human networks.
3) Enhancing practical hands-on education
Information security often require hands-on experience and its education
should be practical rather than simply attaining the knowledge. Increasing
hands-on exercises and inviting lecturers from enterprises will be useful and will
also improve university-industry collaboration.
4) Enhancing information security education in elementary and secondary
education
Information security education for elementary and secondary educationaccording to pupils' each development stage though a common subject"Information" and others has been enhanced by 2008 and 2009 revisions of"Government Course Guidelines" It is important to provide education in line with
the information security trends.
5) Enhancing information security seminars for teachers
A seminar system should be established for teachers to learn information
security. Also, the latest trends of information security should be notified to themthough meetings such as the information education staff meeting to ensure thatthey can provide appropriate education to students.
(6) Reinforcing university-industry and public-private collaboration
1) Promoting education by university-industry collaboration
Differences in the needs of industry and educational bodies should be resolved
by mutually clarifying and understanding advantages of each other's argument.
Educational bodies should promote and continue education to develop practicalhuman resources who can work in the global market with the cooperation ofenterprises. The approach taken by "ISS Square" and "IT Keys" can be used as
the reference. Also it will be effective to actively take advantage of internships indomestic and overseas enterprises.
2) Promoting collaboration for practical education
University-industry collaboration should be reinforced to establish practicalinformation security education, such as jointly designing education curriculum,
inviting lecturers from enterprises, and encouraging interaction employees in20

enterprises, university teachers, and students. Personnel interaction between theinformation security industry and other industries may also be encouraged.
3) Taking advantage of information security contests
Approaches such as making a public recognition of individuals' or enterprises'
exceptional contribution towards information security, or awarding a grant to thewinner of information security contests can be seen in Japan and overseas. Suchincentive programs and nation-wide information security contests should be
examined to secure advanced information security human resources and developinternational players.
4) Promoting work experience opportunities in government agencies
Government agencies with science graduate executive officers will be
encouraged to increase the internship opportunities in information security
concerned departments to provide work experience for students who areinterested in information security.
(7) Reinforcement of international alliancesInternational cooperation is essential in information security policies since
information is freely moving beyond international boundaries today. It is important toliaise with other countries while reinforcing international competitiveness when theinformation communication infrastructure for business environments and economic
activities is rapidly globalizing.
The National Information Security Center has been reinforcing the international
collaboration especially with ASEAN countries in various areas though the liaison
framework since 2009. Efforts for Information security human resource development
in ASEAN materialized as the "Japan and ASEAN Information Security Seminar" and"Japan and ASEAN Government Network Security Workshop" in 2010, and willcontinue to develop.
Information security human resource development is also promoted in Europeanand countries and the U.S.A. Various types of activities are taking place such as
education programs in higher educational bodies and technical contests. It is desirable
to share best practice and study the specific collaboration areas without limiting ouractivities within Japan in order to develop international players.
Measures taken by one country are not effective for threats beyond internationalboundaries and internationally coordinated information security measures are required.
Therefore, human resource development though international liaison is important forcases such as cyber attacks.

21