[ITmedia News] Government warns business operators due to series of information leaks Confirms multiple cases where "basic measures are insufficient"

On November 5, the Cabinet Secretariat's National Cyber ​​Control Office issued a warning to businesses operating websites and mobile apps in response to a series of leaks of personal information in Japan. Regarding recent information leaks, he explained, ``We have confirmed multiple cases where the cause appears to be that basic measures were not sufficient,'' and called on business operators to take thorough security measures.

According to the Control Office, it is believed that the attacker conducted a large-scale investigation of websites on the Internet, looking for systems that could be penetrated and stealing personal information. It is analyzed that AI is likely to be used to investigate and infiltrate these targets, and that a wide range of businesses are being targeted because multiple issues that were assessed as relatively low risk by conventional vulnerability diagnosis can be combined to infiltrate systems, making it easier to scale up attacks.

Additionally, operators have pointed out that there are multiple cases in which basic measures were not sufficient, such as insufficient security measures when developing mobile apps, incorrect website settings, and continued use of software that is no longer supported or that has unfixed known vulnerabilities.

Three measures required by the National Cyber Control Office

This alert primarily targets businesses that operate websites and mobile apps and handle personal information, and provides countermeasures in three areas.

The first is countermeasures at the system operation and management stage. The Office is asking companies to understand the configuration and vulnerabilities of the software they are using, and to determine priorities and deadlines for countermeasures. They also called on companies to refrain from publishing unnecessary management screens and functions, citing cases where management screens published on the Internet were accessed illegally through easy-to-guess passwords or brute-force attacks.

In addition, there are concerns about the increasing sophistication of attacks by exploiting AI to search for vulnerabilities. He urged them to conduct continuous vulnerability diagnosis using AI and other tools, and monitor suspicious behavior through log analysis.

The second is countermeasures at the design and development stage. We call for thorough "security by design," which considers security from the beginning of development. Analysis of public apps also confirmed a method of illegally obtaining information via API, and called for access restrictions and appropriate management of authentication information. For systems that handle personal information, it also recommended vulnerability assessment before disclosure.

The third is countermeasures against intrusions via the supply chain such as subcontractors. It is said that there are cases in which the attacker uses the environment of a subcontractor or maintenance company as a foothold to infiltrate the ordering company. For this reason, we are asking contractors to identify the connection routes they use, such as VPNs and remote desktops, and to introduce multi-factor authentication.

They are also calling on people to decide on initial response procedures in the event a serious vulnerability is made public regarding OSS (open source software that anyone can use and improve) and external libraries.

On October 9th, the National Cyber ​​Control Office issued an alert calling for basic measures for the entire organization, such as the prompt application of patches and the introduction of multi-factor authentication. This time, we expanded our measures to include the operation and development of websites and mobile apps.