Japan’s government cited inadequate basic security measures, including neglected vulnerabilities, as a cause of a recent string of personal data leak incidents and urged companies operating websites and mobile apps to strengthen their response. It also raised the possibility that hackers abused AI to search vulnerable systems on a large scale.
According to Japanese media outlet ITmedia, the Cabinet Secretariat’s National Cybersecurity Office issued a security advisory on Nov. 5, local time, for businesses that handle personal data. The probe confirmed multiple cases of weak security during app development, website configuration errors, use of software no longer supported and failure to fix already known vulnerabilities.
Authorities said attackers broadly examined systems exposed on the internet to find targets for intrusion and steal personal data. They said vulnerabilities deemed low risk could be used for intrusion when combined, and that AI likely increased the scale of searching and attacks. AI use has not been proven in individual cases, however.
The measures authorities proposed cover three areas: operations and management, design and development, and the supply chain. At the operations stage, operators should continuously identify software configurations and vulnerabilities and set priorities and deadlines for fixes. They were told to block unnecessary management screens exposed to the internet and prepare for brute-force attacks that target weak passwords. Authorities also recommended monitoring for anomalies through AI-based diagnostics and log analysis.
At the development stage, authorities stressed the principle of “Security by Design” that incorporates security from the outset. With tactics confirmed in which publicly available mobile apps are analysed to extract informationcation information and access controls, and vulnerability checks before release
Attacks routed through outsourced and maintenance firms are also a concern. Authorities said companies should inspect virtual private networks and remote desktop access paths used by partners and apply multi-factor authentication. They also called for initial response procedures for cases in which serious vulnerabilities are found in open-
The National Cybersecurity Office last month called for rapid security patches and the adoption of multi-factor authentication, and this time detailed its response scope to include web and app development and supply-chain management.
About the Author
Choi Jae-wonittt_0801@d-today.co.kr
Keyword
#Japan#ITmedia#National Cybersecurity Office#Security by Design#VPNCopyright © DigitalToday. All rights reserved. Unauthorized reproduction and redistribution are prohibited.
