The Computer Unauthorized Access Reporting System (コンピュータ不正アクセス届出制度) lets organizations and individuals who have suffered unauthorized access, including attempts, report what happened to IPA (the Information-technology Promotion Agency, Japan).
Notice the damage
Report to IPA
IPA collects and analyzes reports
Publish attack trends and measures
The findings are published to the public as alerts and countermeasure information.
4 / 4
IPA is an independent administrative agency that carries out national IT policy, and it is the contact point that receives these reports. Reporting is not a legal obligation. The aim is to compile attack trends and countermeasures from the collected cases and share them widely so that the same damage happens less often.
AnalogyIt is like gathering reports of break-ins across a neighborhood onto one map, which reveals what kinds of houses tend to be targeted.
Exam points
Mix-upReporting to IPA means providing information for trend analysis and prevention of repeat incidents. It is a separate process from going to the police to have the culprit investigated and punished.
The Computer Virus Reporting System (コンピュータウイルス届出制度) lets people who have found a virus or been infected by one report the details to IPA.
Simply finding a virus counts as a reportable case even if no infection occurred. From the reports it receives, IPA tracks which viruses are spreading and how, and uses this to issue alerts and countermeasure information.
AnalogyIt resembles a public health office learning about an outbreak from hospital reports and then warning the local community.
Exam points
ExamWhen a virus (ウイルス) infection is suspected inside an organization, the first response is to disconnect the device from the network and notify the in-house administrator. Do not start recovery work on your own judgment.
Mix-upContacting the in-house administrator is a report within the organization. Reporting to IPA is a separate mechanism for sharing information across society as a whole.
The Vulnerability-Related Information Reporting System (脆弱性関連情報届出制度) lets anyone who discovers a vulnerability (a security weakness) in a software product or website report it to IPA.
Finder reports to IPA
JPCERT/CC (coordinator) contacts the developer
Developer prepares a fix or workaround
Published on JVN (vulnerability information site)
Once coordination on the product is complete, the weakness and how to deal with it are posted on JVN.
4 / 4
JPCERT/CC (JPCERT Coordination Center) handles incident response and the coordination of vulnerability information in Japan, and acts as the go-between with the developer for software product reports. When coordination on a product is finished, the weakness and its fix are published on JVN, a vulnerability countermeasure portal run jointly by JPCERT/CC and IPA. For a weakness in a website, IPA notifies the site operator and urges them to fix it.
AnalogyIt is like someone who spots a defect in a household appliance telling a contact point before spreading rumors, with users informed only once the maker has arranged a fix.
Exam points
ExamJVN is a website that publishes information on software weaknesses and how to deal with them, giving each entry an identifier that starts with "JVN#".
ISMAP (Information system Security Management and Assessment Program) is a scheme that assesses cloud services in advance for use by government bodies and lists those meeting the standards in a register.
Cloud provider applies
Auditor checks how controls are operated
Listed in the register after review
Government bodies choose from the register
When procuring cloud services, government bodies choose from those in the register.
4 / 4
In the assessment, an audit body registered with ISMAP checks that controls matching the government's security requirements are actually in operation. Because ministries in principle choose from services in the register, they spend less effort checking safety separately each time they procure.
AnalogyIt is like a government office buying supplies from a list of vendors that have already passed screening.
How to rememberMAP stands for Management and Assessment Program, so you can read it as a scheme that assesses how things are managed.
Exam points
ExamISMS certification (ISMS認証) is third-party recognition that an organization runs a system for managing and protecting its information assets, and it does not vouch for the security of individual systems or products. Its unit of assessment differs from ISMAP, which assesses each cloud service.
ExamISMS cloud security certification (ISMSクラウドセキュリティ認証) is a third-party certification confirming that an organization already holding ISMS certification also applies cloud-specific controls. It is a different scheme from ISMAP, which serves government procurement.
J-CSIP (Initiative for Cyber Security Information sharing Partnership of Japan) is a public-private scheme, centered on IPA, in which member organizations pool information on cyberattacks and share it with one another.
Member detects an attack
Provides information to IPA
IPA analyzes it with the source hidden
Shared with other members
The analysis reaches the other members, who use it to prepare for the same attack.
4 / 4
Members are industry associations and companies in critical infrastructure and other sectors, and they exchange information under confidentiality agreements. Passing on the method used against one organization quickly lets the other members prepare for the same attack.
AnalogyIt is like a neighborhood association circulating a notice when a suspicious visitor comes around, so other households lock up more carefully.
How to rememberThe IP at the end stands for Information sharing Partnership, so read it as "partners who share".
Exam points
Mix-upJ-CSIP is a scheme for passing attack information among its members. Helping an individual victim organization respond is the job of J-CRAT.
J-CRAT (Cyber Rescue and Advice Team against targeted attack of Japan) is an IPA activity that takes consultations from organizations hit by targeted attacks and helps them limit the spread of damage and break the chain of attacks.
A targeted attack aims at a specific organization and tries to break in through means such as emails disguised as business correspondence. J-CRAT analyzes the situation and gives advice when consulted, and when needed it goes on site to support the investigation.
AnalogyIt is like calling in an expert about a leak at home: the expert finds the cause and advises on repairs, but the homeowner decides how to fix it.
How to rememberCRAT stands for Cyber Rescue and Advice Team, a team for rescue and advice.
Exam points
ExamJ-CRAT gives advice and investigation support to organizations that consult it. The organization that asked for help decides its own course of action.
Cyber Rescue Team (サイバーレスキュー隊) is the Japanese name for IPA's J-CRAT, and both refer to the same activity.
J-CRAT is the abbreviation of the official English name, while the Japanese name describes its role. The official name, Cyber Rescue and Advice Team against targeted attack of Japan, includes the words "against targeted attack", so the name itself shows which kind of attack it helps organizations deal with.
SECURITY ACTION is an IPA self-declaration (自己宣言) scheme in which small businesses and others declare that they will work on their own information security.
Level
What to do before declaring
One star
Work on the "Five Information Security Principles"
Two stars
Assess the current state by self-diagnosis, then set a basic policy and make it public
IPA's Information Security Guidelines for SMEs serve as the benchmark for what to work on. Businesses that declare may use the logo mark, which shows business partners and others their commitment.
AnalogyIt is like a shop putting up its own sign saying "We take hygiene seriously".
How to rememberThe name says ACTION, not CERTIFICATION: the English word itself tells you what it is.
Exam points
ExamSECURITY ACTION is not earned by passing a review. It takes effect when the business itself declares its commitment.
ExamDeclarations are not limited to for-profit companies. Sole proprietors and non-profit corporations can also declare.
IPA is the contact point that receives reports under all three reporting systems: unauthorized access, viruses and vulnerabilities.
Among vulnerability reports, weaknesses in software products are published on JVN together with how to deal with them, after coordination with the developer.
ISMAP assesses cloud services in advance for government use and lists them in a register.
The Cyber Rescue Team is another name for J-CRAT, which supports organizations hit by targeted attacks in their response.
SECURITY ACTION has one-star and two-star levels, and small businesses and others declare according to what they have put in place.