Loading...
Loading...
Proposal 1: Japan should improve an environment that allows all citizens to access the Internet
Proposal 2: Japan should establish a scheme for personal authentication in the digital society
Proposal 3: Japan should allocate sufficient human resources and budget to manage the operation of the entire digital social system
Proposal 4: Japan should ensure the right of all citizens to user education
Proposal 5: Japan should avoid the pitfalls of pseudo-digital society
NEW! Dr Misumi talks with Mr Masahiko Kobayashi who served as director at the time of establishment of NISC, the National Information Security Center. NISC was established in 2005, at a time when the understanding of information security increased in various countries, but in Japan, the conditions of a comprehensive information security policy promotion system were not sufficient. Under such environment, how was the new organization aiming to ensure information security born, and with what philosophy did strategies and rules come into being?
NEW! Dr Ikuo Misumi, a well-known expert on cybersecurity policy, digs into a series of Japan's cybersecurity policies. As the volume two, Dr Misumi talks with Mr Tetsuya Yoshikawa, former assistant chief cabinet secretary (in charge of security and crisis management) / former director general of the National center of Incident readiness and Strategy for Cybersecurity (NISC), who formulated the "Information Security Strategy for Protecting the Nation" and promoted the construction of an initial response system and the development of an information aggregation system for large-scale cyber attacks, etc.
NEW! Dr Ikuo Misumi, a well-known expert on cybersecurity policy, digs into a series of Japan's cybersecurity policies. As the kickoff, Dr Misumi talks with Mr Tetsushi Yoshikawa, Deputy Director-General of Japan's National Center of Incident Readiness and Strategy for Cybersecurity (NISC) who is the key person of the latest cybersecurity strategy of Japan.
A DX with Security strategy is essential to promote DX, to increase companies’ productivity and efficiency, and to avoid financial loss. In order to develop and implement your DX with Security strategy, JCIC recommends you follow the approach below ;
● Visualize risks using a cyber-risk estimation model
● Develop a DX with Security strategy
- Use a framework to explain the strategy as a story
- Security investment should be 0.5% or more of consolidated sales revenue
- Security personnel should be 0.5% or more of the total number of employees
● Set security key performance indicators (KPIs) and monitor them regularly
・Probable Maximum Loss” cyber-risk estimation model
（Excel）
The "plus security human resources (person with security knowledge)" is a new concept proposed by JCIC. Now, the necessity of this concept has been recognized, and measures and policies for "plus security" are beginning to be discussed in many places. In addition to the necessity of "plus security human resources development," this report delves into the promotion of the visualization of security human resources and stresses the necessity of this. In order to become a competitive company by realizing DX with Security, which is an aggressive IT investment that takes safety into account in order to achieve a safe and secure society, it is essential to have a new way of thinking, "proactive security," which is not only the traditional realization of defense through regulations and prohibitions, but also a promoter of acceleration.
Due to the unexpected advent of COVID-19, many companies and organizations had their workers begin working remotely. As a result, the balance between convenience and security was lost. When JCIC conducted interviews and literature surveys to investigate company trends, it discovered great variation in the ways companies thought about convenience and security control. Each company can be classified as one of four types.
This report illustrates the necessity of "Offensive Plus Security Human Resources " in the DX era. Offensive Plus Security Human Resources (people who know about information security in addition to their digital innovation work) are required rather than deffensive security human resources.
Through panel discussion, professional interviews and research, JCIC summarized the key points of corporate cybersecurity disclosure. JCIC concluded that managements' attitude of dealing with cybersecurity is important to disclose. (Only available for Japanese version)
This report illustrates “Cybersecurity KPI Model” as our original model to visualize cybersecurity. Cybersecurity KPI Model is able to identify organization's KPIs according to their maturity level and to objectively evaluate performance and to reduce the potential financial impact.
・An Example of Cybersecurity KPIs (Japanese) （PDF）
This report illustrated that the often claimed shortage of human resources in the area of information security is not one of security specialists but rather plus security human resources (people who know about information security in addition to their primary tasks).
According to our survey, the stock value index declined by an average of 10% from the day on which a data breach was disclosed, and the companies experienced an average decrease of 21% in net profit. Japanese companies should discuss cyber risks as part of their corporate governance.
- Cyber-risk estimation model "Probable Maximum Loss"（Excel）
Major countries of the world are encouraging the sharing of information on cybersecurity by enacting national cybersecurity laws and regulations. Japan should maintain a close watch on the status of these countries to see whether these laws and regulations enhance their cybersecurity levels and whether public-private partnerships are being conducted in a successful manner.
NEW! For China, data are resources, which subject to be protected by the country. Therefore, it is an important matter which should be placed at the center of national policies in order to protect sovereignty in cyberspace, public interest, and national security.
This paper aims to learn about China's digital, information and cybersecurity policies, then to understand its current trends and security perspectives.
The paper hopes to bring new insights to readers who are involved in overseas business, including in PRC, or who are interested in PRC's policies and cybersecurity situation.
This commentary introduces the practice which convinced the author of the importance of information security for DX promotion when he was responsible for security export licensing at METI. Based on the author’s administrative career, this commentary illustrates that DX will be more efficient and effective if information security is considered as an imperative part of DX from the very beginning of planning.
Through our interviews and surveys, we found that some financial sectors use KRIs (Key Risk Indicators) to visualize their cyber risks. This commentary illustrates the benefits of KRIs for cyber risk management.
・An Example of Cybersecurity KRIs (Japanese) （PDF）
Policy trends of cybersecurity and privacy protection. This column was written by Kenji Uesugi, Senior fellow of JCIC.
What is the difference between cybersecurity and information security? It is not much of an issue to operate them as generally the same. It is acceptable to say that some cybersecurity measures are equal to information security measures, and the reverse is true as well. However, the words are different because there are differences. If you are engaged in this field, you must be interested in the differences. This column discusses the relationship between the two, using the definitions in The Basic Act on Cybersecurity. In the course of the discussion, the history of NISC and the backstory of information security and cybersecurity policy in Japan will be touched upon.
JCIC analyzed 137 newsclips distributed in the 1st half of FY2022 and add some comments to the articles that may influence future trends.
Belfer Center for Science and International Affairs of Harvard Kennedy School released National Cyber Power Index 2022. Japan stepped down from 9th of the year 2020 to 16th. How to decipher this result? Does Japan need to take it seriously?
Large companies need to address cyber risks within their own companies while also looking at risks across their supply chains. However, it is difficult for SMEs , which are the members of supply chain, to invest sufficient funds to develop specialized functions and facilities for digital and security. This column discusses to promote cybersecurity measures for SMEs.
JCIC has been advocating the strengthening of cybersecurity measures from management perspective, and has been researching the role of management, HR development & utilization including proactive plus security human resources, and DX with security because of direct linkage between cybersecurity and business. We will continue to research these themes with a particular focus on the strengthening of cybersecurity countermeasures. JCIC will work toward " the improvement of resilience".
JCIC analyzed 139 newsclips distributed in the 2nd half of FY2021 and add some comments to the articles that may influence future trends.
When the society is severely affected by a serious cybersecurity attack against a private entity, what does the CEO state and what do lawmakers intend to ask when reviewing? A serious ransomware attack which targeted Colonial Pipeline Company in May, 2021 caused serious damage to the East Coast of the U.S. in terms of fuel provision. We examine the communication between CEO of Colonial Pipeline and lawmakers through the hearing at the Congress in June 2021.
JCIC analyzed 142 newsclips distributed in the 1st half of FY2021 and add some comments to the articles that may influence future trends.
Leader’s attitude, whether a company or a country, is always the key factor for tackling challenges. JCIC tries to find what countries’ top leaders think about cybersecurity through their real messages. Messages by the President Joseph Biden of the United States of America will be firstly examined to explore his thoughts on cybersecurity.
The main theme of this column is "DX with Security". This column was written by Toshinori Kajiura, President of JCIC.
In order to deepen our understanding of the recent developments and trends in the internet in China, Of the following two reports, one prepared by the China Internet Network Information Center (CNNIC), an organization directly under the jurisdiction of China's State Council (CAC), and the other prepared by China's CSIRT, which was established in 2001,JCIC exctracted information that may be of particular interest to Japanese companies in this document.
- "The 47th Statistical Report on China's Internet Development" (reported by CNNIC)
- "Internet security in China Monitoring Data Analysis Report in the first half of 2020" (reported by CN CERT/CC)
JCIC analyzed 184 newsclip distributed in FY2020 and add some comments to the articles that may influence future trends.
The main theme of this column is the China Personal Information Protection Law (PIPL) and impact on Japanese Businesses.
Cybersecurity has something in common with coronavirus (COVID-19). This column illustrates lesson learned from COVID-19, written by Toshihiro Hirayama, Senior fellow of JCIC.
In this column, reviewing the discussion about the visualization of cybersecurity countermeasures in Japan, and summarizing the way of thinking of information security / cybersecurity disclosure. This column was written by Yumi Aoki, Senior fellow of JCIC.
This column aim to summarize OECD Digital Security policy.
The main theme of this column is the cyber risks related to 5G technology. This column was written by Toshinori Kajiura, President of JCIC.
Describing digital utilization of medical industry and cybersecurity This column was written by Toshinori Kajiura, President of JCIC.
The main theme of this column is COVID-19 Data Privacy policy trend.
Japan should learn from the U.S. Cybersecurity Information Sharing Act (CISA) to improve cybersecurity information sharing. This column was written by Kenji Uesugi, Senior fellow of JCIC.
Describing about Supplychain Cyber-risk Guidelines. This column was written by Yumi Aoki, Senior fellow of JCIC.
The main theme of this column is the global policy trends of critical infrastructure protection against cyber attacks. This column was written by Yumi Aoki, Senior fellow of JCIC.
What should Japan learn from South Korea's Cybersecurity Strategy? It is very useful to understand it in the geopolitical point of view. This column was written by Kenji Uesugi, Senior fellow of JCIC.
The main theme of this column is the challenge of investment in risk management. This column was written by Toshinori Kajiura, President of JCIC.
Describing the human development of cybersecurity industry. This column was written by Toshihiro Hirayama, Senior fellow of JCIC.
Describing a paradox of the cyber risk management. This column was written by Toshinori Kajiura, President of JCIC.
JCIC hosted the JCIC Executive Breakfast Meeting on April 26th.
JCIC held the Anual Meeting on March 3rd, 2022.
JCIC hosted the JCIC Executive Breakfast Meeting on Dec. 23th.
JCIC held the Anual Meeting on February 19th, 2021.
JCIC and ITRI hosted the Second Japan-Taiwan Cybersecurity Dialogue on October 10th.
JCIC hosted the JCIC Executive Breakfast Meeting on August 30th.
JCIC held the Anual Meeting on January 27th, 2020.
JCIC hosted the 4th JCIC Executive Breakfast Meeting on Dec 20th.
JCIC hosted a panel discussion at the International Cybersecurity Symposium, Keio University Mita Campus (Dec. 12th)
JCIC made three lectures in Showa Women's University about digital innovation and cybersecurity.
JCIC invited a former NHK announcer, Kazuya Matsumoto to give JCIC members a lecture about communication and presentation on September 2nd.
JCIC hosted the JCIC Human Development Roundtable on August 5th. The main theme was re-education of working people.
JCIC hosted a panel discussion at the International Cybersecurity Symposium, Keio University Mita Campus (Jul. 11th)
JCIC attended the Information Security Forum (ISF) UK Spring Conference in March. This event report illustrated that the overview of the conference and what Japanese companies should learn.
JCIC hosted the 3rd JCIC Executive Breakfast Meeting on Mar 19th.
1st JCIC Anual Meeting was held at the International Cybersecurity Symposium, Keio University Mita Campus (Nov. 28th and 29th)
JCIC hosted the 1st Ad-Hoc Meeting on October 25th.
JCIC hosted the 2nd JCIC Executive Breakfast Meeting on July 19th.
JCIC made a presentation at Seoul, South Korea on July 12th, 2018.
JCIC hosted the 2nd Human Development Roundtable at JCIC office on July 5th.
JCIC hosted the 1st JCIC Human Development Roundtable at Keio University Mita Campus on April 27th.
JCIC hosted the 1st JCIC Executive Breakfast Meeting on April 18th.
JCIC joined the panel discussion at the International Cybersecurity Symposium, Keio University Mita Campus (Mar. 29th).
Overseas' cybersecurity news are compiled and distributed to the JCIC members on a weekly basis. Please see the Japanese website for the detailed information.
To promote private sector’s cybersecurity / More tangible approaches / Practical measures for SMEs
To identify effective HR and make proposals for training / To develop HR who lead the global discussion