A lot of smart people with theoretical knowledge about security issues work at the big Japanese players, but very few of these Japanese experts have been tested. Japanese companies here in the information security industry are quickly partnering up with foreign system security consultants to keep pace with a huge demand from their current clientele. This would seem to make sense. Consider that in 1995 there were approximately 250,000 attacks on American Department of Defense systems alone. All totaled, CERT dealt with 2,134 incidents affecting over 146,484 sites.
Popular sites utilizing e-commerce suffer about five such attacks per month.
With their development of the TruSecure suite of analysis tools, ICSA's methodology has emerged as the de facto standard for testing and certifying the security of enterprise information systems. Their products check everything from the security of a company's Web servers, firewalls, and email systems, to vulnerabilities and misconfigurations in the utility and infrastructure systems that support a company's Internet presence. ICSA Japan manager Akira Watanabe, through his authoring of several books on the subject as well as in an advisory role to both MITI and MPT, is a well-respected and tireless advocate of smart security practices in Japan. We now have six people, and we expect to have up to 20 people next year. Network security is so complicated, people cannot keep up with the issues as well as the technology.