Information security awareness (情報セキュリティ啓発) is the work of telling every employee about risks such as information leaks and the rules they must follow, so that they learn to stay alert.
Carelessness and rule-breaking are a major cause of incidents, so technical and physical measures alone are not enough. Awareness work is repeated again and again through training sessions, notices posted at work and reminder emails. Whenever a new attack method appears, the information is updated so that staff knowledge does not go out of date.
AnalogyIt is like a station announcement that keeps repeating "Please don't leave your belongings behind." The aim is for listeners to start taking care on their own.
How to rememberThink of awareness as opening people's eyes. The Japanese term uses the character 啓, which means "to open."
Exam points
ExamTraining covers all employees, not just certain departments or the staff in charge. New hires receive it from their induction training onward, and the content is adjusted to each person's job and role.
ExamEducating staff and alerting them to attack methods are classed as human security measures (人的セキュリティ対策). Measures tied to buildings and equipment, such as locks, entry control and keeping backup equipment at a distant site in case of disaster, are physical measures and belong in a separate category.
ExamSecurity training for users is one effective way to prevent virus infection, alongside applying patches.
An information security drill (情報セキュリティ訓練) simulates an incident so that staff practice until they can actually respond correctly.
Awareness leaves people knowing what to do, while a drill leaves them able to act on the spot. For example, staff try out for themselves how to report a suspicious email and whom to contact when their PC behaves oddly. One session is not enough to make it stick, so drills are repeated regularly and the results reviewed.
AnalogyIt resembles a fire evacuation drill. Knowing the escape route on paper is not enough; only after walking it can you move without hesitation.
How to rememberA drill is something you repeat until it becomes automatic, just as the Japanese 訓練 combines "teach" and "train by repetition."
Exam points
ExamTraining of every kind, drills included, is held regularly and also after an accident or incident. Retraining for people who broke the rules also covers how to stop the same mistake from happening again.
Mix-upA session where people only listen to a lecture counts as awareness. Actually trying out reporting and contacting, or handling a practice email that mimics an attack, in a simulated situation makes it a drill.
A targeted-email drill (標的型メール訓練) sends staff simulated emails modeled on attacks aimed at a specific organization, to check whether they can see through them and report them.
Send simulated emails
Record opens and reports
Tally the results
Give follow-up training
Teach the people who opened the email, and the weaker departments, how to spot such emails and how to report them.
4 / 4
A targeted attack (標的型攻撃) aims at a specific organization with emails posing as messages from business partners or work contacts, and gets in by luring people into opening attachments or links. The drill swaps the real attack for harmless simulated emails and records whether each person opened them and whether they reported them. Tallying the results shows where in the organization training should be focused.
AnalogyIt is like a mystery-shopper check, where someone from head office poses as a customer to see whether staff follow the rules.
How to remember"Targeted" means aiming at a bullseye: rather than blasting the same email at anyone, the attacker narrows down to one organization. The Japanese 標的 literally means an archery target.
Exam points
Mix-upThe emails sent in a drill are harmless simulations planned by the organization, not a real attack from outside.
Mix-upNot opening the simulated email is not enough on its own. Whether a person noticed it was suspicious and reported it to the designated contact is also assessed.
Monitoring (監視) means recording and observing system activity and user actions to spot early signs of anomalies or misconduct.
Log operations and traffic
Review the logs regularly
Spot unusual activity
Respond before the damage spreads
Investigate the cause of what was found and deal with it before the damage spreads.
4 / 4
Observation draws on logs that record operations and traffic, as well as entry and exit records. A mechanism that watches how programs run and stops them when they act unusually, such as rewriting file after file, is called behavior detection (振る舞い検知). Because knowing they are watched makes people think twice, monitoring deters misconduct as well as detecting it.
AnalogyIt is like a security camera in a shop. Its mere presence makes would-be shoplifters hesitate, and if something happens you can go back through the footage.
How to rememberThe word monitor comes from the Latin for "one who warns." Letting people know they are being watched is itself a warning.
Exam points
ExamLogs help catch misconduct early only when they are not just collected but also reviewed (audited) regularly.
ExamIn important rooms such as a server room, the basic rule for preventing misconduct is to allow work only while someone is watching. Entry and exit records are kept as well.
ExamBehavior detection finds and stops suspicious actions based on how a program behaves, so it also works against attacks that are not yet known.
The Insider Misconduct Prevention Guidelines (内部不正防止ガイドライン) set out the principles and measures for preventing insider misconduct by employees, former employees and other people inside an organization, and were compiled by the IPA (Information-technology Promotion Agency, Japan).
Principle (example)
Measure (example)
Make misconduct hard to commit
Limit privileges to what the job needs and don't concentrate them in one person
Make misconduct easy to detect
Keep records of operations and review them regularly
Leave no room for excuses
Put policies and rules in writing and tell everyone
Insider misconduct means acts such as someone inside the organization taking information out or abusing their privileges to alter data. Rather than focusing only on punishing offenders, the guidelines put weight on creating an environment where misconduct does not arise in the first place. They lay out measures for the whole organization, from how top management should be involved to privilege management, record reviews and training.
AnalogyIt resembles the house rules of an apartment building. Deciding in advance how keys are managed, how comings and goings are logged and how shared areas are used keeps trouble from arising.
How to rememberThe publisher, the IPA, is also the body that runs the IT Passport exam.
Exam points
ExamSetting the basic policy and announcing it inside and outside the company is top management's job, and responsibility for countering insider misconduct lies with top management.
ExamAdministrator privileges should not be concentrated in one person but arranged so that people can check each other. When misconduct occurs, consider disciplinary action and also take steps to stop it from happening again.
Information security awareness aims to inform people of risks and rules, while an information security drill aims to make them able to act in a simulated situation.
A targeted-email drill is one kind of drill: it uses harmless simulated emails to check whether staff can spot them and have the habit of reporting.
Training covers all employees, is held regularly and after incidents, and is tailored to each role.
Monitoring detects misconduct by reviewing logs and other records, and also deters it because people know they are being watched.
The Insider Misconduct Prevention Guidelines are an IPA publication calling for an environment where misconduct does not arise, with top management held responsible.