## (iii) Measures and issues for corporate information security

Although 95.1% of companies implement some form of measure relating to information security, the flip side of the growing penetration of security measures for system and technology is the delay in measures relating to information security for operations and organization (Figure 1-4-10). It is becoming impossible to insure proper information security in information and communications networks that are moving to high-speed networks with security measures aimed only at systems and technology. That is why, to ensure information security, it is important that there be organizational steps taken inside and outside companies, an improvement both in the awareness and knowledge of employees and their information literacy, the formulation of security policies, and regular implementations of information security audits, as information security measures at the operational and organizational levels.

## (iv) International approaches for insuring information security

Since there are no actual borders to information and communications networks, it is possible that an attack on information and communications networks will go beyond one country to cause increasing damage. This is why there is growing awareness of information security among international organizations and various countries, and they are strengthening their approach to insuring information security.

At the International Telecommunication Union (ITU), there was a Japan-led investigation into a framework for information security in the telecommunications field and, in March 2004, there was agreement on developing requirements for information security management for telecommunications bodies. In addition, the Council of Europe adopted “Convention on Cybercrime” in November 2001 at its Committee of Ministers. As of March 2004, 37 countries, including Japan, had signed the convention and five had concluded it.

According to the OECD’s DSTI/ICCP (2003) 10/Final report, 18 of the OECD member countries, including Japan, the United States, the United Kingdom, and the Republic of Korea, had established spam-related laws as of January 2004, and other countries were preparing legislation. The ten countries which have not established laws, including France and Germany, are dealing with the issue by applying laws that are already in place and developing measures against spam by preparing bills. The United States approved the spam-preventing CAN-SPAM Act of 2003: Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 in December 2003, and it came into force in January 2004.

## (4) Trends in Individual and Corporate Responsibility

With the penetration of mobile phones with digital camera, new social problems have arisen such as “taking photos of people without permission using a mobile phone with camera”, or “taking pictures of books or magazines without permission using a mobile phone with camera”, so that as we head into a ubiquitous network society, the personal manners of network users are becoming important. At 80.5%, “spam mail” comes at the top of the list of conducts that should be avoided when using information and communications networks

Figure 1-4-10 Status of Information Security Measures Taken by Companies (multiple responses possible)

Source: Communications Usage Trend Survey in 2003, MPHPT