Japan Its Own Enemy in Push to Improve Cybersecurity
By THE ASSOCIATED PRESS

OKINAWA, Japan — Apart from rogue hackers, criminal organizations or even state-backed cyberwarfare units, Japan’s businesses and government agencies are facing a unique cybersecurity foe: themselves.

Even with the frequency and severity of cyberattacks increasing rapidly worldwide, efforts by the world’s third-largest economy to improve its data security are being hobbled by a widespread corporate culture that views security breaches as a loss of face, leading to poor disclosure of incidents or information sharing at critical moments, Japanese experts and government officials say.

Improving cybersecurity practices has emerged as a top national priority for Japan, stung in recent years by embarrassing leaks at Sony Pictures, the national pension fund and its biggest defense contractor, Mitsubishi Heavy Industries, which possibly suffered the theft of submarine and missile designs.

Toshio Nawa, a top Japanese security consultant who is advising the Tokyo 2020 Olympics organizers, said he encountered a telling instance this summer when he was called to investigate a breach at a major Japanese government agency.

Nawa found that five different cybersecurity contractors employed by the agency had discovered the breach, but not one reported or shared their findings.

With evidence from the contractors pooled together, Nawa matched the digital fingerprints to a Mexican group that he believes was responsible for a previous attack on Japanese diplomatic servers. The breach was patched, but Nawa walked away flustered.

“In the U.S., if they find a problem, they have to report,” he said. “The Japanese engineer feels he fails his duty if he escalates a report. They feel ashamed.”

To be sure, the cybersecurity industry around the world, not just in Japan, frequently echoes the call for greater transparency within and among organizations. The U.S. Senate last month passed the Cybersecurity Information Sharing Act to ease data sharing between private companies and the government for security purposes, although civil liberties advocates warned it posed a threat to privacy.

But the problem may be particularly acute for Japan’s private sector behemoths and government ministries. These sprawling bureaucracies are wrapped in a “negative culture that cuts against wanting to communicate quickly,” said William H. Saito, the top cybersecurity adviser to Prime Minister Shinzo Abe.

While rank-and-file workers fear reports of security lapses may get them punished, the problem reflects a broad lack of understanding of cybersecurity among the top ranks of Japanese executives, Saito said in an interview on the sidelines of the Cyber3 conference in Okinawa.

“This is Japanese culture where in some situations the upper management doesn’t know how to use email and IT integration is voodoo magic,” said U.S.-born Saito, also an executive at Palo Alto Networks, a security firm. “The reality is companies either have been hacked or will be hacked. My message is, ‘It’s not your fault.’”

In 2013, the latest year of available data, the Japanese government network faced an eightfold increase in cyberattacks from two years prior, with attacks spreading into civil infrastructure, as well as the telecommunications and energy sectors.

Against that backdrop, the Abe administration has pinpointed the 2020 Tokyo Olympics as a chance to upgrade Japan’s national security capabilities while calling for a more hands-on government role to nudge companies to take cybersecurity seriously.

A Cabinet-level cybersecurity agency in September published a strategy paper that proposed, among other things, extending government-run cybersecurity classes to companies, awarding financial incentives for firms that demonstrate improved security capabilities and requiring companies to fill a chief cybersecurity officer role.

The Cabinet report also highlighted the issue of disclosure, saying “it is essential to relieve (network) operators’ psychological burden of possibly losing credit or ruining reputation of their business if providing information to others.”

Jim Foster, a former U.S. diplomat and Microsoft Japan executive who heads the Keio International Center for the Internet and Society in Tokyo, said the fast-evolving threat of hacking poses a looming challenge for Japanese industry, which never developed a deep pool of cybersecurity expertise with active exchange of ideas and know-how.

“Japanese companies grew up too big too quick and didn’t have to cooperate or rely on outside expertise,” he said. “But now there’s this new threat unlike anything else and things suddenly get difficult.”

But changing habits is hard, said Nawa, the security adviser for the Olympics, who is now holding simulations and educational sessions around the country, where he emphasizes to security engineers — who do not necessarily lack technical chops — the importance of sharing findings and speaking up when they spot a problem.

He said he uses a simple mantra on the training circuit: “What I say is: ‘Please remove your pride.’”

日人臉皮薄 成駭客肥羊

美聯社報導，日本政府單位和企業的資訊安全人員以「被駭客攻擊」為恥，被駭後往往既不對外聲張，也不與同業分享情報，以致成為駭客眼中的肥羊。

近年來，日本索尼影業、國家退休基金與最大國防承包商三菱重工業都遭到駭客攻擊，三菱重工被竊的資料甚至可能包括潛艦與飛彈的設計圖。根據最新資料，2013年日本政府內部網路遭受駭客攻擊的次數，是2011年的8倍，而且攻擊對象擴展到民生基礎設施、電信與能源設備。

日本知名資安顧問名和利男說，今年夏天他受命調查日本政府一個重要單位被駭的案件，發現這個單位的5個資安承包商雖然都察覺被駭，卻沒有一個對外通報，也不互相分享資訊。他感嘆：「美國的資安人員一旦發現問題就必須通報，日本的資安人員卻認為，通報就會暴露自己失職，那樣很丟臉。」

日本首相安倍晉三的首席資安顧問齋藤威廉說，基層資安人員擔心，通報駭客攻擊案可能會被上級處罰，這反映出日本高階主管普遍不了解網路安全的本質，「日本的企業文化就是，有些高階主管甚至不會使用電郵，資訊科技的整合對他們來說就像巫術般難以理解，但事實是，一個公司若不是已經被駭，就是即將被駭，我都跟日本資安人員說，『這不是你的錯』」。

安倍政府決定利用主辦2020年東京奧運的機會，提升日本防範駭客的能力。日本內閣資安單位9月發布的策略報告也建議，政府可在企業裡開設資安課程，對提升資安能力的公司給予財務獎勵，並要求企業增設「資訊安全長」一職。

原文參照：
http://www.nytimes.com/aponline/2015/11/08/world/asia/ap-as-japan-cybersecurity.html

2015-11-09．聯合報．A13．國際．編譯李京倫