新たに発生するサイバーセキュリティの脅威 : 今後の展望. Leonard Ong, CISA, CISM, CRISC, CGEIT, CoBIT 5 Implementer & Assessor 19 June 2016

Size: px

Start display at page:

Download "新たに発生するサイバーセキュリティの脅威 : 今後の展望. Leonard Ong, CISA, CISM, CRISC, CGEIT, CoBIT 5 Implementer & Assessor 19 June 2016"

Ferdinand Chapman
5 years ago
Views:

1 新たに発生するサイバーセキュリティの脅威 : 今後の展望 Leonard Ong, CISA, CISM, CRISC, CGEIT, CoBIT 5 Implementer & Assessor 19 June 2016

2 AGENDA: 1. サイバーセキュリティの現在年の脅威の展望 3. その後の展開 4. 重要なポイント

3 サイバーセキュリティの現在

4 重大な経済的損失を引き起こすサイバーインシデント IP Theft in United States >$ 300 Billion Ponemon Institute Singapore $ 1 Billion Symantec IP Commission Report Losses from Cybercrime $ 575 Billion McAfee

5 2015 GLOBAL CYBERSEC URITY STATUS REPORT 世界中で 3,400 以上の被害 83% の人がサイバー攻撃はビジネスに与える脅威のトップ 3 であると認識しているにもかかわらず 38% の人しか洗練された攻撃への準備ができていないと回答 VISIT :

7 2015 GLOBAL CYBERSEC URITY STATUS REPORT 世界中で 3,400 以上の被害 86% の人がサイバーセキュリティのスキル不足を感じている VISIT

8 経営者の視点から見るサイバーセキュリティ > 経営者の 65% がサイバーリスクが高いレベルに到達したもしくは上昇したと証言しました 58% が以前からもっと策を講じておくべきだったとする中で実際に行動を起こしたのは 14% に過ぎません

9 2018 年の脅威の展望

10 L L economic using the PESTLE model (see Figure 1). ISF Persistent deflation approaches. and austerity This could will result continue social to impact unrest, many with countries. highly fluid set out in this report. Members are encouraged to consider these L S 6 For and some, THE NEXT TWO could well be set to further fuel a move from free market capitalism towards alternative far-reaching this will create consequences YEARS increased mobility for organisations to seek work, around but at the what world. social 8 economic approaches. cost? The conditions 7 This could result in social unrest, with highly fluid and factors and add others from their own far-reaching could well be consequences set to further for fuel organisations a move from around free market the world. capitalism towards alternative experience when considering the threats T 8 economic approaches. Significant acts of terrorism will continue, with varying responses from 7 This could result in social unrest, with highly fluid and leading far-reaching consequences for organisations around the world. set out in this report. countries. 1 As a result, politically motivated changes Technology may will introduce remain restrictions an area of rapid change and thus features 8 in many of the threats on the movement of people and goods across in borders this report. making During international the next two years, it is feasible that the first cyber-related deaths Technology will remain an area of rapid change and thus features in many of the threats business more difficult and expensive. An increasingly fraught political situation in will this occur, report. especially During the as new next health two years, or transport it is feasible systems that the are first hacked. cyber-related 9 A severe deaths and This section Significant could offers worsen acts between non-information of terrorism world will powers continue, particularly security with Technology varying NATO responses will (North remain Atlantic from area leading Treaty of rapid change and thus features in many of the threats will widely occur, publicised especially insider as new attack health will or become transport inevitable, systems are either hacked. due 9 to A severe ignorance, and worker countries. Organisation) 1 As and a result, Russia politically with a motivated return to the changes Cold War, may possibly introduce Figure hastened restrictions 1: The in this report. During the next two by years, it is feasible that the first cyber-related deaths widely disenchantment publicised or insider coercion attack by will a third become party. inevitable, 10 Organisations either due should to ignorance, therefore worker already be context against on a change the movement of which administration of the people threats in and the goods USA in which across this P will may borders occur, wish especially to making redress international as the new balance health of or transport systems are hacked. 9 A severe and 政治動向 disenchantment asking 技術動向 themselves; or coercion If PESTLE Edward by Snowden model a third party. can 10 severely Organisations disrupt should the workings therefore of already governments, be business world power. more 2 Other difficult events, and expensive. such as an An unravelling increasingly widely of publicised fraught Iranian insider political nuclear attack situation deal will become inevitable, either due to ignorance, worker report may be viewed. asking what could themselves; a commercial If Edward counterpart Snowden do can to severely us? disrupt the workings of governments, could or aggressive worsen actions between by world North powers Korea, could particularly add disenchantment to the NATO instability. (North coercion 3 Atlantic by Treaty a third party. 10 Organisations should therefore already be what could a commercial counterpart do to us? Organisation) and Russia with a return to the asking Cold themselves; War, possibly If Edward hastened Snowden by can severely disrupt the workings of governments, It describes a change a world of administration where uncertainty E EE the USA which what may wish could to a commercial redress the counterpart balance of do to us? The pipeline of legislation and regulation will continue to grow. While much of this change is pervasive world Economic and power. growth change 2 Other will events, continue is likely such to as be to an unevenly be unravelling spread of the across Iranian the major nuclear economic deal The may pipeline be viewed of legislation by organisations and regulation as burdensome, will continue it will to grow. still require While compliance: much of this change so, when or powers, aggressive resulting actions in unpredictable by North Korea, outcomes could add as many to the try instability. may will the be viewed first hefty to by keep organisations fines 3 pace be imposed with as a burdensome, for non-compliance it will still in require the face compliance: of these changing so, when accompanied by significant and swift impact. growing US economy and rising interest rates. The 4 Of pipeline equal concern of legislation are the and potential regulation will continue to grow. While much of this change 経済動向 will demands? 法律制 the first 11 hefty At the fines same be time, imposed the for reaction non-compliance of the public in the and face media of these may changing be unpredictable. effects of sustained low commodity prices, which may be may viewed in turn by lead organisations to the failure as burdensome, it will still require compliance: so, when These potential changes are set out as demands? Will ideas they become 11 At the apathetic same time, to the information reaction of security the public incidents, and media or will may they be unpredictable. bring legal action Economic of one or more growth political will continue administrations to be unevenly that Will will rely spread the heavily first across hefty on high fines oil major be prices, imposed economic thus for non-compliance in the face of these changing against 度動向 they organisations become apathetic that fail to information to protect their security data? incidents, or will they bring legal action to challenge powers, jeopardising the resulting reader, future in supplies. unpredictable and are 5 demands? The next outcomes described two years against as many may organisations see try 11 At the same time, the reaction of the public and media may be unpredictable. to the keep first that pace failure with to of protect a large their data? Will they become apathetic to information security incidents, or will they bring legal action using the growing organisation PESTLE US economy model due to a major and (see rising information Figure interest 1). rates. security 4 Of incident. equal concern Loss of are trust, the customer potential against ISF L S organisations that fail to protect their data? effects and media of sustained backlash, low and commodity a substantial prices, reduction which in may share in price turn lead will combine to the failure to Members Persistent of place are one that encouraged or more deflation organisation political and austerity administrations to an unrecoverable consider will continue that these Despite the seemingly positive outcome from the 2015 United Nations Climate Change position. Despite rely to heavily impact many on high countries. oil prices, 6 For thus some, Conference the seemingly (COP21), global positive warming outcome will from continue the 2015 to United wreak havoc Nations on Climate weather Change systems, factors and this jeopardising will create future increased supplies. mobility 5 The to next seek two work, years Conference but may at what see (COP21), the social first global cost? failure warming The of conditions a large will continue to wreak havoc on weather systems, 社会動向 add others from their own could organisation well be due set to further a major fuel information a move from security 環境影響 people people Despite and free incident. market and the economies. economies. seemingly capitalism Loss of trust, positive 12 Unwanted towards customer outcome side alternative from effects the may 2015 include United T Nations major outages Climate in Change power and 12 Unwanted side effects may include major outages in power and experience economic and when media approaches. backlash, considering and 7 This a substantial could the result threats shortages reduction in social shortages Conference of in unrest, share of (COP21), other key other with price highly key will global resources resources combine fluid warming such and such to will as as clean continue clean water. water. to Businesses wreak Businesses havoc with on with plans weather plans and systems, and initiatives initiatives in far-reaching place that organisation consequences in an for unrecoverable organisations position. in around people regions regions and susceptible the susceptible economies. to world. 8 to 12 severe Unwanted severe weather weather side will effects will suffer. suffer. may The include The future future major of of alternative outages alternative in energy power energy and set out in this report. sources sources shortages such such of other as wind as wind key farms, farms, resources tidal tidal lagoons such lagoons as clean and and solar water. solar arrays arrays Businesses are expected are expected with plans to to face and face continued initiatives continued opposition, opposition, in regions susceptible possibly jeopardising possibly jeopardising to severe weather their future. their future. will suffer. 13 The future of alternative energy 13 1 P. Wintour, G20 to discuss threat of Isis infiltrators among EU migrants after Paris attacks, The Guardian, 15 November sources 2015, such as wind farms, tidal lagoons and solar arrays are expected to face continued 2 N. MacFarquhar and S. Erlanger, NATO-Russia Technology Tensions will Rise After remain Turkey Downs an area Jet, The of New rapid York Times, change 24 opposition, November and thus 2015, possibly features jeopardising in many of their threats future in this report. During the next two years, it is feasible that the first cyber-related deaths 3 R. Gladstone and T. Erdbrink, Tensions in Iran After Nuclear Deal Grow in Hostility, The New York Times, 15 November 2015, will occur, especially new health or transport systems are hacked. 9 A severe and PESTLE MODEL 4 L. Phillips, Forex focus: Fed s first rate rise in 10 years will have a global impact, The Telegraph, 1 December 2015, L E G A L CT H N O T E C H N O I C L O G I C A L O G S O C L I A E N V I R O N M E N TA L PI C A L Significant acts of terrorism will continue, with varying responses from leading countries. 1 As a result, politically motivated changes may introduce restrictions L L E G A P O L P O L I T T E C H N O I T L I C A I C A L O G I C C O N O M S O C L I A

12 脅威 1.1 IoT(Internet of Things) による機密情報漏洩影響 : 被害の発生に伴う罰金や法的費用の高まり法的責任の増加信用リスク推奨 : IoT 導入に先立つ同意の獲得とデータ保護策の導入ポリシー利用規約の透明性と準拠性を確認 IoT を単なるデバイスの一分類と判断しないポリシー基準指針プロセスをアップデート

13 Source: PerfectCloud.io

14 脅威 1.2 不透明なアルゴリズムが安全性の欠如につながる影響 : 維持メンテナンスされないアルゴリズムが収益の損失や遅延につながる専門能力の欠如から基幹システムの不具合が増加インシデント発生により信用に傷がつく推奨 : 脆弱性なアルゴリズムを利用するシステムの識別法的責任の理解コード管理ポリシーをアップデートアルゴリズム関連インシデントに起因するリスク対処方法の代替手段を識別堅牢な事業継続復旧計画を指揮

15 Source: The Hacker News

16 脅威 1.3 ならず者政府がテロリストグループをサイバー攻撃に使用影響 : ブランドのダメージ収益の減退や破産も SIEM (Security Information and Event Management) システムが度重なる攻撃にさらされることによる事業の中断推奨 : リスク管理プロセスを採用し新たな能力にて脅威に対処既存のコントロールを評価上昇しているレジリエンシーに集中同様の脅威に直面する政府や組織との協力による脅威情報の共有を模索

17 Source: Security Intelligence

18 脅威 2.1 主要インシデントにより露見する経営陣の期待への相反影響 : 不完全なリスクアセスメントに起因する費用のかかるインシデント意思決定の妨げとなる脅威とインシデントに対する能力欠如推奨 : 経営幹部と連動し信頼性の高いサイバーリスクを定期的に提供 CISO と情報セキュリティ部門の現在と未来の能力に基づきセキュリティ向上について経営陣の期待と歩調を合わせる CISO および情報セキュリティ部門を専門家から信頼できるビジネスパートナーへと移管するタレントプログラムの開始他者から学習

19 Source: Slash Gear

20 脅威 2.2 研究者がセキュリティの脆弱性を隠蔽影響 : 修正が加えられるべき危険なソフトウェアに起因する事業の中断脆弱性をもみ消した行為が公になった時に製造者の販売が減退死亡事例の発生につながる脆弱性をもみ消した製造者へのダメージ推奨 : 責任感のある仕事をする研究者に経済的報酬を検討仲介業者を採用し満足度の高い情報公開への合意を取り付ける調達プロセスにおける高いレベルでの透明性を追求

21 Source: LinkedIn

22 脅威 2.3 サイバー保険セーフーティネットの消失影響 : 組織のリスク移管へのアクセス消失代替策適用に伴う高いコスト信用性評価によるサイバー保険市場の減速推奨 : 事前にリスク管理戦略を再評価サイバー保険を通じて移管されるリスクを把握潜在的に高費用な例外事象へのサイバー保険を精査

23 Source: Business Insider

24 脅威 3.1 破壊的な企業が政府の怒りをかう影響 : 政府と恊働せず反発する組織への莫大な罰金 IT 分野の企業はより厳しい監視の対象に推奨 : 地元での製品およびサービス提供の状況を理解し政治的反発を回避原理に基づく規則システムに特化した政治的影響への明確なる戦略を考案集約した影響についての可能性を検討

25 Source: Euractiv

26 脅威 3.2 規制がクラウドを分断影響 : クラウドサービスが複数の国に分断されることでオペレーションや製造に滞りが発生クラウドのコンプライアンス遵守のために追加のリソースが必要組織自身がデータ保護関連の基準に適合する必要性推奨 : 規制は変容していくことを理解先を見越し後の祭りになる前に戦略を考案

27 Source: Security Intelligence

28 脅威 3.3 犯罪者の能力と国際警察とのギャップ影響 : 組織の技術的能力不足がサイバー犯罪の抑止に失敗しブランドが毀損 e コマースの成長と不十分な国際法執行機関との協力により発生した損失がより一層悪化海外でビジネスを行なう能力の低下推奨 : 脅威情報の充足と障害回復力の向上先を見越して行動政府に働きかけ国際的枠組みを構築

29 その後の展開

30 安全をデザインプライバシーをデザイン 1. テクノロジーは十分なセキュリティ機能を有し顧客の手に渡る前に確実に設定されなければなりません 2. 個人データ保護の原則は製品の機能や動作と一体化したものであることが重要です 3. ほんの少し努力すれば専門的な知識がなくても顧客が製品を安全にできることが求められます 4. 製品の安全性を確保する上での負担は販売側よりも顧客側において軽減されるべきです

32 倫理的テクノロジーの開発 1. 製薬医療法律業界には厳しい検査と認可制度があります不意の事故や質の悪い薬の削減は専門的人材の削減にも繋がります 2. 技術開発は社会安全プライバシーといった項目において適切な検査を経るべきでしょう 3. 安全なデザインとプライバシー保護のデザインはそれぞれ別々に検査することが重要です

33 重要なポイント 1. サイバー攻撃の被害と頻度は今後も増加 2. 知的財産の盗難から生じる損失はサイバー犯罪のコストを圧倒的に上回る 3. サイバー犯罪はビジネスや革新への税金 4. 堅牢なセキュリティとプライバシー保護を持たない崩壊的テクノロジー 5. 技術開発における倫理規定の必要性

34 DISCUSSIONS

Period for Exception to Lack of Novelty for Designs Extended to One Year

T O P I C 1. Period for Exception to Lack of Novelty for Designs Extended to One Year 意匠の新規性喪失の例外期間が 6 か月から 1 年に延長 2. Strengthening of Requirements for Divisionals of Trademarks Applications 商標登録出願の分割要件が強化