In recent years, the risk of cyberattacks that inflict ... · < Efforts of Final project > ......

3
A core hub achieving world-class cyber security measures assembling OT and IT 産業サイバーセキュリティセンター (ICSCoE) Industrial Cyber Security Center of Excellence For radical strengthening cyber security for social and industrial infrastructure gathering human resources, technologies, and know-how Idealindustrialcybersecurityexpertstopursue Developthecapabilitytounderstandthenecessityofcyber securitymeasuresandpromoteprojectsintensively,based onbothOT(operationaltechnology)andIT(information technology)skills. Technologyskills (OT/IT) Management& leadership Businessskills Inrecentyears,theriskofcyberattacksthatinflictphysicaldamageonsocialandindustrial infrastructureisincreasing.Incidentsthreateningtheirsecurityduetocyberattacksfromforeign countrieshavealreadyoccurredoverseas. Strengtheningprotectionagainstcyberattacksinsocialandindustrialinfrastructureisapressing nationalissue. Identifythreatstocritical infrastructureandexamine defensivemeasures. Respondtoincidentsand ensurebusinesscontinuity. Understandthebusinessmodel andcompetitiveadvantagesofyour companies. Grasptheimpactofcyberdamage quantitatively. Calculatecost-efficiency. Prioritizemeasures. Understandthe fundamental p r i n c i p l e t o contribute knowledgeand skillsbackto society. Promoteprojectsintensively. Prioritizemeasuresto incorporateintothe businessplan. Createaroadmapofthe reformconcept. Riskassessmentactivities onthesafetyandreliability ofactualcontrolsystems Conductriskassessmentonthe safetyandreliabilityofcontrol systemsforsocialandindustrial infrastructureinJapan. Investigateallpossibilityof cyberattacksandplannecessary measures. Humanresourcedevelopmentprogram Provideprogramsforsocialandindustrialinfrastructureoperatorstodevelop humanresourcescapableofdeterminingthenecessarysecuritymeasures whilerecognizingtherisksofin-housesystems. Installsimulatedplantsthatassumeeverythingfromtheinformationsystemto theoperationalsystem.Conductexercisestogetherwithexpertstoverifythe safetyandreliabilityandtorecoverthesystempromptly. Learnthelatesttechnologiesandknow-howandcreatecommunitiesto promote collaboration with security leaders and experts in other industries andoverseas. Accumulateglobalknowledgeandcreateopportunitiestoexchange knowledgewithoverseasexpertsthroughactivecollaborationwithforeign countries. Disseminate information and provide training to corporate executives on the actualsituationofcyberattacksandthenecessityforindustrialcybersecurity measures. Investigationandanalysis ofcyberattacks Collectthelatestcyberattack information.(observationofdecoy systems,collectionofcyberattack informationfromprofessional organizationsintheprivatesector, etc.) Investigateandanalyzenewattack methodstoutilizeforhuman resourcesdevelopmentandsystem verificationactivities. Understandingof ethics,norms,and laws Professional networkformation

Transcript of In recent years, the risk of cyberattacks that inflict ... · < Efforts of Final project > ......

Page 1: In recent years, the risk of cyberattacks that inflict ... · < Efforts of Final project > ... Provide the one-year full-time program targeting “core human resources” who

<Composition�of�the�FY2019�(3rd-term)�trainees>

<�Efforts�of�Final�project�>

By�industry By�age�group

Results�of�Core�Human�Resource�Development�Program Program�for�managers�and�practitioners

<Supply chain security study>

The�team�prepared�a procurement specification�specific�to�the supply chain security�by�trainees�mainly� from�power� industry� together�with�important�infrastructure�operators�and�vendors,�which�deals�with�the�risk�of�possible�contamination�of�malicious�codes�and�malware�in�the�supply�chain� from�ordering�to�delivery.�Both�top-down� (systematical�and�comprehensive�reflection�of�procurement�specifications�based�on�national�and� international�security�standards)�approach�and�bottom-up� (enhancement�of� the�effectiveness�of�procurement�specifications�through� interviews�with� ICSCoE�trainees�and�organizations� in�Japan)�approach�are�combined.

Power�industry�team

< Activities to improve security levels in the Building Automation industry >The�team�prepared�an explanation book� for�"Guidelines�for�Cyber-Physical�Security�Measures� for�Building�Systems"*,� the�security�guideline�published�by�METI�(Ministry�of�Economy,�Trade�and�Industry)� in�June.�This�book�was�intended� for�various�stakeholders�across� the� industry�so� that�security� is�considered�as�a�common�language�and�their�own�issue.�It�would�encourage�them�to�take�the�“FIRST STEP” by accelerating the understanding of�security�risks,�impact�by�cyberattacks,�and�more�practical�countermeasures.The explanation book�offers�the�following�original�contents:① �Proposals�on�how�to�proceed�with�the�measures�using�the�guideline,

② �Measure�map�which�visualizes�the�control �points�of � the�whole�building�automation�system�and�around�it ,

③ �Measure�catalog�which�il lustrates�security �risks,� incidents,�measures,�and�mapping�to�the�guideline�with�easy-to-understand�diagrams,

④ �Case�studies�of �r isk�analysis� to�determine�the�priority �of �measures.

※�Guidel ines� for �Cyber -Phys ica l �Secur i ty �Measures� for �Bu i ld ing�Systems�https ://www.met i .go . jp/engl ish/press/2019/0617_005.html

Building�industry�team

◦ �"The content of the lectures is�practical,�and�it�is�easy�to�imagine�how�to�use�learned�knowledge�in�the�real�world."

◦ �"The� lecturers�are�very�enthusiastic�and�give�us�many�assignments,�making�us�realize�that�the level of training is high in quantity and quality."

◦ �"We�use�internationally�acclaimed�good�books�as�textbooks.�Although�it�was�tough�to�read�them�in�English,�we�can�tap�into�a globally high-level knowledge."

◦ �"By working closely with peers from other sectors, we can exchange information concerning issues and situations in unfamiliar industries, and it broadens our perspective."

Comments�from�trainees

This�exercise�aims�to�enhance�response�and�resilience�on�the�cyber�security�of�divisions�and�departments�and�to�strengthen�the�entire�corporates�with�an�awareness�of�industry�characteristics.This�exercise� is�distinctive�by� training� focused�on� the�hands-on�activities�using�scenarios,�assuming�a�virtual�company�by�industry.�Also,�intensive�lectures�will�explain�cybersecurity�regulations�and�guidelines,�which�overseas�subsidiaries,�affiliates,�and�business�partners� such�as�supply�chains�may�face.t

Cyber�Resilience�Enhancement�eXercise�by�industry�(CyberREX)…�2�days

Digital� transformation� in� business� is� proceeding.�Companies� increasingly�need� to� recognize� that�cyber�security�is�a�management�issue�correctly.This�seminar�targets�those�who�take�security�measures,�including�policy�planning�and� risk�management,�and�gives�lectures�on�the�organization�and�function�required�for� security�measures� from� the�viewpoint�of�business�continuity.

Strategic�Management�Seminar

This� exercise� uses� a� simulated� process� control�network.�Trainees�experience�cyberattacks�used� for�malicious�equipment�controls�as�well�as�defenses�by�countermeasures.�The�content� is�practical�and�gives�a�deeper�understanding�of�the�control�systems�security.Trainees� can� learn� the� security�of� industrial� control�systems�(such�as�the�IT�and�control�systems�architecture,�security�vulnerability,�and�measures�specific� to�control�systems.)

Cybersecurity�Exercise�for�Control�Systems�…2�days

Program�for�managers

Program�for�practitioners

<Contact>�Business�Promotion�Department,�Industrial�Cyber�Security�Center�of���������������Excellence,�Information-technology�Promotion�Agency

Tel:03-5978-7554��Mail:[email protected]��Web:https://www.ipa.go.jp/icscoe/activities/

The�advanced�cyber� threat� is� increasing.�This�exercise�gives� lectures� and� table� top�exercises�on� the�best�way� to�protect�companies�with�control� systems,� risk�analysis�providing�the�basis�for�cyber�security�investment�applicable�to�own�organization�and�execution�framework�of�incident�management.�Former�United�States�Cyber�Command�experts�conduct�table� top�exercises� in� the�war�game� format.�Trainees�learn�skills�and�methods� to�protect�corporates�while�experiencing�the�roles�such�as�CISO,�plant�manager,�and�public�relations�representative.

Cyber�Crisis�Response�Table�Top�Exercise�(formerly�Global�Training)…�2�days

Example�of�the�explanation�book�(measure�catalog)

The�Points�of�Procurement�Specification

Power 19%

Others 4%

Insurance vendor 4%

Broadcasting and communications 7%

Railway 6%

Iron and Steel 4%Gas 1%

Oil 3%

Chemicals 9%

Automobile and car parts 10%

Industry vendor 28%

Construction and building 1%

20s 24

50s 1

30s 34

40s 10

n = 69

A core hub achieving world-class cyber security measures assembling OT and IT

産業サイバーセキュリティセンター(ICSCoE)Industrial Cyber Security Center of Excellence

For radical strength

ening cyber securit

y for social and ind

ustrial infrastructur

e

gathering human re

sources, technolog

ies, and know-how

Bunkyo Green Court Center Office2-28-8 Honkomagome, Bunkyo-ku Tokyo 113-6591Tel. 03-5978-7554 Fax. 03-5978-7513

2019.11.19

FY2018�(2nd-term)�Results

September● �US-Japan�Cybersecurity�Joint�Training�with�ASEAN�Member�States�(Tokyo)�

● �Overseas�dispatching�exercise�I(Paris)

Sep.10-14Sep.17-18

October

● �External�facility�exercise�(Tokyo)●CSS2018�(Nagano)●External�facility�visit�(Tokyo)●CODE�BLUE�2018�(Tokyo)

Oct.�16,�Nov.�16,�Jan.11Oct.�22-25Oct.�24Oct.�29-Nov.�2

November ● �Hardening�Project�2018�(Okinawa) Nov.�21-22

December

●External�facility�visit�(Okayama)● �Overseas� dispatching� exercise� Ⅱ(London)

●Black�Hat�Europe(London)

Dec.�3Dec.�3-4Dec.�4-7

January●S4x19�Conference�(Florida)●External�facility�visit�(Mie)●SCIS�2019(Shiga)

Jan.�15-17Jan.�21Jan.�22-25

March� ●DHS301Training(Idaho)●Black�Hat�Asia(Singapore)

Mar.�11-15Mar.�26-29

●Participation�by�all�trainees�(any�one�of�the�days) ●Participation�by�applicants ●Selection�from�applicants �●Lecturer�recommended�events(Participation�by�applicants)

Ideal�industrial�cyber�security�experts�to�pursueDevelop�the�capability�to�understand�the�necessity�of�cyber�security�measures�and�promote�projects�intensively,�based�on�both�OT�(operational�technology)�and�IT�(information�

technology)�skills.

Technology�skills�(OT/IT)

Management�&�leadership Business�skills

In� recent� years,� the� risk�of� cyberattacks� that� inflict�physical�damage�on� social� and� industrial�infrastructure� is� increasing.� Incidents� threatening� their�security�due� to�cyberattacks� from� foreign�countries�have�already�occurred�overseas.Strengthening�protection�against�cyberattacks� in�social�and� industrial� infrastructure� is�a�pressing�national�issue.

◦�Identify� threats� to� critical�infrastructure�and�examine�d e f e n s i v e � m e a s u r e s .◦�Respond� to� incidents� and�ensure�business�continuity.

◦�Understand� the� business�model�and�competitive�advantages�of�your�companies.

◦�Grasp� the� impact�of�cyber�damage�quantitatively.

◦Calculate�cost-efficiency.

◦Prioritize�measures.

◦�Understand�the�f u n d am e n t a l�p r i n c i p l e � t o�c o n t r i b u t e�knowledge�and�sk i l l s� back� to�society. ◦�Promote�projects�intensively.

◦�P r i o r i t i z e � mea su re s � to�i n c o r p o r a t e � i n t o � t h e�business�plan.

◦�Create�a� road�map�of� the�reform�concept.

Provide�the�one-year�full-time�program�targeting�“core�human�resources”�who�will�connect�field�personnel�and�corporate�executives�in�the�future.◦�Develop�human�resources�with�a�well-balanced�ability�to�understand�the�necessity�of�cyber�security�measures�and�promote�projects� intensively,�based�on�both�control�systems�(OT:�Operational�Technology)�and�information�systems�(IT:�Information�Technology)�skills.◦�State�your�opinions�regarding�security�measures�resolutely�to�your�executives.�Negotiate�steadily�without�losing�the�viewpoint�of�minimizing�the�risk�of�the�entire�organization�even�if�the�business�department�demands�the�responsibility�for�the�possible�burden�and�loss�of�business�due�to�the�security�measures.

◦�Learn�the�basis�of�control�systems�security�and�IT�security.

◦�Understand� the� idea�of� control� systems� security,� IT�security,�BCP,�etc.�comprehensively.

◦�Understanding�security�risk�specific�to�control�systems�and�defense�technologies�against�attack,� learning� relevant� security�and�defense� technologies�of�control�systems,�and�planning�measures�using�simulated�plants.

◦�OT�incident�response�exercise�balancing�both�safety�and�business�continuity,�and�BCP�response�exercise�for�control�systems.◦�Safety�and�security�management�of�plant�and�control�systems,�utilization�of�BCM�under�the�stress�conditions,�and�BCM�response�exercise.※BCM(Bus iness�Cont inu i ty �Management)

◦�IT�design,�IT�incident�response,�system�establishment�for�control�systems�security.◦�Understanding�and�experiencing�attack�detection�methods� to�control�systems,�utilizing� the�state-of-the-art� technologies,�and�exercising� incident� response� to�attacks.

◦�Enhance�knowledge�and�experience�through�practical�training�and�exercise.◦�Deepen�knowledge� through� two�elective�technology�topics.

◦�Set�a�task�theme�related�to�industrial�cyber�security�for�companies�and� industries,�and�tackle�the�task�with�a�focus�on� group�work,� by�leveraging� the� acquired�knowledge�and�experience.

◦�Learning�skills�necessary� to�plan�cyber�security�strategies�and�explain� issues� including�business�administration�and�financial� risks� to�corporate�executives,�such�as� “business�skill� related� to� security� investment� decisions”� and�“management�skill�to�influence�the�field�personnel.”

◦�Understanding� cybersecurity-related� acts� correctly,�cultivating�high�ethical�standards�and�developing�the�ability�to�contribute�to�both�companies�and�society.

◦�Introduction�of�domestic�and�overseas�advanced�cases,�and�special�lectures�with�invited�experts.◦�On-site� dispatching� experience� to� France� and� the�UK�(FY2018).

Core�Human�Resources�Development�Program

FY2019�(3rd-term)�Program�Calendar

Completion�cerem

ony

July August September October November December January February March April May June

Opening�cerem

ony

Basic�(basic�exercise)

Primary�(Basic�Knowledge�Review)

Advanced�(advanced�exercise)

Business,�Management,�Ethics

Business,�Management,�Ethics

Professional�network

Efforts�after�the�completion�of�the�Core�Human�Resource�Development�Program

Primary Basic Advanced Final�project

Professional�network�(including�overseas�networks)

Defense�techniques�and�penetration�methods

Defense�techniques�and�penetration�methods

OT�incident�response�&�BCP

IT�security

Defense�techniques�and�penetration�methods

OT�incident�response�&�BCP OT�incident�response�&�BCP

IT�security IT�security

Final�project

Elective�course

Build�a�collaboration�network�on�control�

systems�security�across�the�sectors

Alumni�Community�(Kanae-kai)

◦�Update�knowledge�even�after�the�completion.◦�Build�personal�network�beyond�the�completion�year.

◦�Contribute� graduates'� knowledge� back� to�society.

Learning�the�security�basics�by�group�education.

Exercise�using�simulated�plants. Simulated�plants�in�use�in�group�work. Result�reporting�meeting�with�superiors�from�the�dispatching�companies.

US-Japan�Cybersecurity�J o i n t � T r a i n i n g � w i t h�ASEAN�Member�States

Networking� events� with�security�professionals� in�the�UK

Those�who�completed�the�Core�Human�Resource�Development�Program�are�entitled�to:◦�Total�exemptions� from� the Registered Information Security Specialist�Examination,� based� on� the� provisions� of� the�Act� on� Facilitation� of�Information�Processing.◦�Use�of�the�logo�mark.(Registration�number�of�the�trademark:�6023942)◦�Use�of�the�titles.産業サイバーセキュリティエキスパート(Registration�number�of�the�trademark:�6158314)Industrial�Cyber�Security�Expert(Registration�number�of�the�trademark:�6158313)

Risk�assessment�activities�on�the�safety�and�reliability�of�actual�control�systems◦�Conduct� risk� assessment�on� the�safety� and� reliability� of� control�systems� for� social� and� industrial�infrastructure�in�Japan.

◦�I nves t i ga te � a l l � poss ib i l i t y � o f�cyberattacks�and�plan�necessary�measures.

Human�resource�development�program◦�Provide�programs�for�social�and�industrial�infrastructure�operators�to�develop�human�resources�capable�of�determining� the�necessary�security�measures�while�recognizing�the�risks�of�in-house�systems.

◦�Install�simulated�plants�that�assume�everything�from�the�information�system�to�the�operational�system.�Conduct�exercises�together�with�experts�to�verify�the�safety�and�reliability�and�to�recover�the�system�promptly.◦�Learn� the� latest� technologies�and�know-how�and�create�communities� to�promote�collaboration�with�security� leaders�and�experts� in�other� industries�and�overseas.

◦�Accumulate� global� knowledge� and� create� opportunities� to� exchange�knowledge�with�overseas�experts� through�active�collaboration�with� foreign�countries.◦�Disseminate� information�and�provide�training�to�corporate�executives�on�the�actual�situation�of�cyberattacks�and�the�necessity�for�industrial�cyber�security�measures.

Investigation�and�analysis�of�cyberattacks

◦�Collect� the� latest� cyberattack�information.� (observation�of�decoy�systems,�collection�of�cyberattack�information� from� professional�organizations� in�the�private�sector,�etc.)

◦�Investigate�and�analyze�new�attack�methods� to� ut i l ize� for� human�resources�development�and�system�verification�activities.

Understanding�of�ethics,�norms,�and�

lawsProfessional�

network�formation

Page 2: In recent years, the risk of cyberattacks that inflict ... · < Efforts of Final project > ... Provide the one-year full-time program targeting “core human resources” who

FY2018�(2nd-term)�Results

September● �US-Japan�Cybersecurity�Joint�Training�with�ASEAN�Member�States�(Tokyo)�

● �Overseas�dispatching�exercise�I(Paris)

Sep.10-14Sep.17-18

October

● �External�facility�exercise�(Tokyo)●CSS2018�(Nagano)●External�facility�visit�(Tokyo)●CODE�BLUE�2018�(Tokyo)

Oct.�16,�Nov.�16,�Jan.11Oct.�22-25Oct.�24Oct.�29-Nov.�2

November ● �Hardening�Project�2018�(Okinawa) Nov.�21-22

December

●External�facility�visit�(Okayama)● �Overseas� dispatching� exercise� Ⅱ(London)

●Black�Hat�Europe(London)

Dec.�3Dec.�3-4Dec.�4-7

January●S4x19�Conference�(Florida)●External�facility�visit�(Mie)●SCIS�2019(Shiga)

Jan.�15-17Jan.�21Jan.�22-25

March� ●DHS301Training(Idaho)●Black�Hat�Asia(Singapore)

Mar.�11-15Mar.�26-29

●Participation�by�all�trainees�(any�one�of�the�days) ●Participation�by�applicants ●Selection�from�applicants �●Lecturer�recommended�events(Participation�by�applicants)

Ideal�industrial�cyber�security�experts�to�pursueDevelop�the�capability�to�understand�the�necessity�of�cyber�security�measures�and�promote�projects�intensively,�based�on�both�OT�(operational�technology)�and�IT�(information�

technology)�skills.

Technology�skills�(OT/IT)

Management�&�leadership Business�skills

In� recent� years,� the� risk�of� cyberattacks� that� inflict�physical�damage�on� social� and� industrial�infrastructure� is� increasing.� Incidents� threatening� their�security�due� to�cyberattacks� from� foreign�countries�have�already�occurred�overseas.Strengthening�protection�against�cyberattacks� in�social�and� industrial� infrastructure� is�a�pressing�national�issue.

◦�Identify� threats� to� critical�infrastructure�and�examine�d e f e n s i v e � m e a s u r e s .◦�Respond� to� incidents� and�ensure�business�continuity.

◦�Understand� the� business�model�and�competitive�advantages�of�your�companies.

◦�Grasp� the� impact�of�cyber�damage�quantitatively.

◦Calculate�cost-efficiency.

◦Prioritize�measures.

◦�Understand�the�f u n d am e n t a l�p r i n c i p l e � t o�c o n t r i b u t e�knowledge�and�sk i l l s� back� to�society. ◦�Promote�projects�intensively.

◦�P r i o r i t i z e � mea su re s � to�i n c o r p o r a t e � i n t o � t h e�business�plan.

◦�Create�a� road�map�of� the�reform�concept.

Provide�the�one-year�full-time�program�targeting�“core�human�resources”�who�will�connect�field�personnel�and�corporate�executives�in�the�future.◦�Develop�human�resources�with�a�well-balanced�ability�to�understand�the�necessity�of�cyber�security�measures�and�promote�projects� intensively,�based�on�both�control�systems�(OT:�Operational�Technology)�and�information�systems�(IT:�Information�Technology)�skills.◦�State�your�opinions�regarding�security�measures�resolutely�to�your�executives.�Negotiate�steadily�without�losing�the�viewpoint�of�minimizing�the�risk�of�the�entire�organization�even�if�the�business�department�demands�the�responsibility�for�the�possible�burden�and�loss�of�business�due�to�the�security�measures.

◦�Learn�the�basis�of�control�systems�security�and�IT�security.

◦�Understand� the� idea�of� control� systems� security,� IT�security,�BCP,�etc.�comprehensively.

◦�Understanding�security�risk�specific�to�control�systems�and�defense�technologies�against�attack,� learning� relevant� security�and�defense� technologies�of�control�systems,�and�planning�measures�using�simulated�plants.

◦�OT�incident�response�exercise�balancing�both�safety�and�business�continuity,�and�BCP�response�exercise�for�control�systems.◦�Safety�and�security�management�of�plant�and�control�systems,�utilization�of�BCM�under�the�stress�conditions,�and�BCM�response�exercise.※BCM(Bus iness�Cont inu i ty �Management)

◦�IT�design,�IT�incident�response,�system�establishment�for�control�systems�security.◦�Understanding�and�experiencing�attack�detection�methods� to�control�systems,�utilizing� the�state-of-the-art� technologies,�and�exercising� incident� response� to�attacks.

◦�Enhance�knowledge�and�experience�through�practical�training�and�exercise.◦�Deepen�knowledge� through� two�elective�technology�topics.

◦�Set�a�task�theme�related�to�industrial�cyber�security�for�companies�and� industries,�and�tackle�the�task�with�a�focus�on� group�work,� by�leveraging� the� acquired�knowledge�and�experience.

◦�Learning�skills�necessary� to�plan�cyber�security�strategies�and�explain� issues� including�business�administration�and�financial� risks� to�corporate�executives,�such�as� “business�skill� related� to� security� investment� decisions”� and�“management�skill�to�influence�the�field�personnel.”

◦�Understanding� cybersecurity-related� acts� correctly,�cultivating�high�ethical�standards�and�developing�the�ability�to�contribute�to�both�companies�and�society.

◦�Introduction�of�domestic�and�overseas�advanced�cases,�and�special�lectures�with�invited�experts.◦�On-site� dispatching� experience� to� France� and� the�UK�(FY2018).

Core�Human�Resources�Development�Program

FY2019�(3rd-term)�Program�Calendar

Completion�cerem

ony

July August September October November December January February March April May June

Opening�cerem

ony

Basic�(basic�exercise)

Primary�(Basic�Knowledge�Review)

Advanced�(advanced�exercise)

Business,�Management,�Ethics

Business,�Management,�Ethics

Professional�network

Efforts�after�the�completion�of�the�Core�Human�Resource�Development�Program

Primary Basic Advanced Final�project

Professional�network�(including�overseas�networks)

Defense�techniques�and�penetration�methods

Defense�techniques�and�penetration�methods

OT�incident�response�&�BCP

IT�security

Defense�techniques�and�penetration�methods

OT�incident�response�&�BCP OT�incident�response�&�BCP

IT�security IT�security

Final�project

Elective�course

Build�a�collaboration�network�on�control�

systems�security�across�the�sectors

Alumni�Community�(Kanae-kai)

◦�Update�knowledge�even�after�the�completion.◦�Build�personal�network�beyond�the�completion�year.

◦�Contribute� graduates'� knowledge� back� to�society.

Learning�the�security�basics�by�group�education.

Exercise�using�simulated�plants. Simulated�plants�in�use�in�group�work. Result�reporting�meeting�with�superiors�from�the�dispatching�companies.

US-Japan�Cybersecurity�J o i n t � T r a i n i n g � w i t h�ASEAN�Member�States

Networking� events� with�security�professionals� in�the�UK

Those�who�completed�the�Core�Human�Resource�Development�Program�are�entitled�to:◦�Total�exemptions� from� the Registered Information Security Specialist�Examination,� based� on� the� provisions� of� the�Act� on� Facilitation� of�Information�Processing.◦�Use�of�the�logo�mark.(Registration�number�of�the�trademark:�6023942)◦�Use�of�the�titles.産業サイバーセキュリティエキスパート(Registration�number�of�the�trademark:�6158314)Industrial�Cyber�Security�Expert(Registration�number�of�the�trademark:�6158313)

Risk�assessment�activities�on�the�safety�and�reliability�of�actual�control�systems◦�Conduct� risk� assessment�on� the�safety� and� reliability� of� control�systems� for� social� and� industrial�infrastructure�in�Japan.

◦�I nves t i ga te � a l l � poss ib i l i t y � o f�cyberattacks�and�plan�necessary�measures.

Human�resource�development�program◦�Provide�programs�for�social�and�industrial�infrastructure�operators�to�develop�human�resources�capable�of�determining� the�necessary�security�measures�while�recognizing�the�risks�of�in-house�systems.

◦�Install�simulated�plants�that�assume�everything�from�the�information�system�to�the�operational�system.�Conduct�exercises�together�with�experts�to�verify�the�safety�and�reliability�and�to�recover�the�system�promptly.◦�Learn� the� latest� technologies�and�know-how�and�create�communities� to�promote�collaboration�with�security� leaders�and�experts� in�other� industries�and�overseas.

◦�Accumulate� global� knowledge� and� create� opportunities� to� exchange�knowledge�with�overseas�experts� through�active�collaboration�with� foreign�countries.

◦�Disseminate� information�and�provide�training�to�corporate�executives�on�the�actual�situation�of�cyberattacks�and�the�necessity�for�industrial�cyber�security�measures.

Investigation�and�analysis�of�cyberattacks

◦�Collect� the� latest� cyberattack�information.� (observation�of�decoy�systems,�collection�of�cyberattack�information� from� professional�organizations� in�the�private�sector,�etc.)

◦�Investigate�and�analyze�new�attack�methods� to� ut i l ize� for� human�resources�development�and�system�verification�activities.

Understanding�of�ethics,�norms,�and�

lawsProfessional�

network�formation

Page 3: In recent years, the risk of cyberattacks that inflict ... · < Efforts of Final project > ... Provide the one-year full-time program targeting “core human resources” who

<Composition�of�the�FY2019�(3rd-term)�trainees>

<�Efforts�of�Final�project�>

By�industry By�age�group

Results�of�Core�Human�Resource�Development�Program Program�for�managers�and�practitioners

<Supply chain security study>

The�team�prepared�a procurement specification�specific�to�the supply chain security�by�trainees�mainly� from�power� industry� together�with�important�infrastructure�operators�and�vendors,�which�deals�with�the�risk�of�possible�contamination�of�malicious�codes�and�malware�in�the�supply�chain� from�ordering�to�delivery.�Both�top-down� (systematical�and�comprehensive�reflection�of�procurement�specifications�based�on�national�and� international�security�standards)�approach�and�bottom-up� (enhancement�of� the�effectiveness�of�procurement�specifications�through� interviews�with� ICSCoE�trainees�and�organizations� in�Japan)�approach�are�combined.

Power�industry�team

< Activities to improve security levels in the Building Automation industry >The�team�prepared�an explanation book� for�"Guidelines�for�Cyber-Physical�Security�Measures� for�Building�Systems"*,� the�security�guideline�published�by�METI�(Ministry�of�Economy,�Trade�and�Industry)� in�June.�This�book�was�intended� for�various�stakeholders�across� the� industry�so� that�security� is�considered�as�a�common�language�and�their�own�issue.�It�would�encourage�them�to�take�the�“FIRST STEP” by accelerating the understanding of�security�risks,�impact�by�cyberattacks,�and�more�practical�countermeasures.The explanation book�offers�the�following�original�contents:① �Proposals�on�how�to�proceed�with�the�measures�using�the�guideline,

② �Measure�map�which�visualizes�the�control �points�of � the�whole�building�automation�system�and�around�it ,

③ �Measure�catalog�which�il lustrates�security �risks,� incidents,�measures,�and�mapping�to�the�guideline�with�easy-to-understand�diagrams,

④ �Case�studies�of �r isk�analysis� to�determine�the�priority �of �measures.

※�Guidel ines� for �Cyber -Phys ica l �Secur i ty �Measures� for �Bu i ld ing�Systems�https ://www.met i .go . jp/engl ish/press/2019/0617_005.html

Building�industry�team

◦ �"The content of the lectures is�practical,�and�it�is�easy�to�imagine�how�to�use�learned�knowledge�in�the�real�world."◦ �"The� lecturers�are�very�enthusiastic�and�give�us�many�assignments,�making�us�realize�that�the

level of training is high in quantity and quality."◦ �"We�use�internationally�acclaimed�good�books�as�textbooks.�Although�it�was�tough�to�read�them�in�English,�we�can�tap�into�a globally high-level knowledge."◦ �"By working closely with peers from other sectors, we can exchange information concerning

issues and situations in unfamiliar industries, and it broadens our perspective."

Comments�from�trainees

This�exercise�aims�to�enhance�response�and�resilience�on�the�cyber�security�of�divisions�and�departments�and�to�strengthen�the�entire�corporates�with�an�awareness�of�industry�characteristics.This�exercise� is�distinctive�by� training� focused�on� the�hands-on�activities�using�scenarios,�assuming�a�virtual�company�by�industry.�Also,�intensive�lectures�will�explain�cybersecurity�regulations�and�guidelines,�which�overseas�subsidiaries,�affiliates,�and�business�partners� such�as�supply�chains�may�face.t

Cyber�Resilience�Enhancement�eXercise�by�industry�(CyberREX)…�2�days

Digital� transformation� in� business� is� proceeding.�Companies� increasingly�need� to� recognize� that�cyber�security�is�a�management�issue�correctly.This�seminar�targets�those�who�take�security�measures,�including�policy�planning�and� risk�management,�and�gives�lectures�on�the�organization�and�function�required�for� security�measures� from� the�viewpoint�of�business�continuity.

Strategic�Management�Seminar

This� exercise� uses� a� simulated� process� control�network.�Trainees�experience�cyberattacks�used� for�malicious�equipment�controls�as�well�as�defenses�by�countermeasures.�The�content� is�practical�and�gives�a�deeper�understanding�of�the�control�systems�security.Trainees� can� learn� the� security�of� industrial� control�systems�(such�as�the�IT�and�control�systems�architecture,�security�vulnerability,�and�measures�specific� to�control�systems.)

Cybersecurity�Exercise�for�Control�Systems�…2�days

Program�for�managers

Program�for�practitioners

<Contact>�Business�Promotion�Department,�Industrial�Cyber�Security�Center�of���������������Excellence,�Information-technology�Promotion�Agency

Tel:03-5978-7554��Mail:[email protected]��Web:https://www.ipa.go.jp/icscoe/activities/

The�advanced�cyber� threat� is� increasing.�This�exercise�gives� lectures� and� table� top�exercises�on� the�best�way� to�protect�companies�with�control� systems,� risk�analysis�providing�the�basis�for�cyber�security�investment�applicable�to�own�organization�and�execution�framework�of�incident�management.�Former�United�States�Cyber�Command�experts�conduct�table� top�exercises� in� the�war�game� format.�Trainees�learn�skills�and�methods� to�protect�corporates�while�experiencing�the�roles�such�as�CISO,�plant�manager,�and�public�relations�representative.

Cyber�Crisis�Response�Table�Top�Exercise�(formerly�Global�Training)…�2�days

Example�of�the�explanation�book�(measure�catalog)

The�Points�of�Procurement�Specification

Power 19%

Others 4%

Insurance vendor 4%

Broadcasting and communications 7%

Railway 6%

Iron and Steel 4%Gas 1%

Oil 3%

Chemicals 9%

Automobile and car parts 10%

Industry vendor 28%

Construction and building 1%

20s 24

50s 1

30s 34

40s 10

n = 69

A core hub achieving world-class cyber security measures assembling OT and IT

産業サイバーセキュリティセンター(ICSCoE)Industrial Cyber Security Center of Excellence

For radical strength

ening cyber securit

y for social and ind

ustrial infrastructur

e

gathering human re

sources, technolog

ies, and know-how

Bunkyo Green Court Center Office2-28-8 Honkomagome, Bunkyo-ku Tokyo 113-6591Tel. 03-5978-7554 Fax. 03-5978-7513

2019.11.19