Information Security

Policy

Fujitsu Group appointed dedicated Chief Information Security Officer (CISO) in October 2021. Under the new information security regime, we are striving to secure and improve information security for our customers through our products and services, while also ensuring the information security of the entire Fujitsu Group.

Management Structure

We have established Regional CISOs in Japan and three international regions (Americas, Europe and Asia Pacific) under the CISO to implement globally consistent security policies and measures. They align the headquarters’ policies with security requirements specific to each country to bolster information security through our globally integrated system.
We have also been building a system to strengthen the CISO’s control over relevant departments to achieve the ideal state of information security by assigning security managers in charge of autonomous information security enhancement of each department in Fujitsu Headquarters and its group companies inside and outside Japan.

Specifically, our security manager system ensures that each department has an “Information manager,” who oversees the management and protection of information; an “System Security Manager,” who supervises the maintenance and management of information security system; and a “Product Security Incident Response Team (PSIRT) Manager,” who leads product vulnerability management, so that they can promote various information security measures in cooperation with the CISO.

Information Security Initiatives

With the rapid increase in more skillful and more sophisticated cyber-attacks, enhancing information security has become an urgent issue for national economic security and for corporate economic activities.
We have set up our goals for information security as described below. To achieve them, we respond to cyber-attacks with ever-evolving advanced information security and by continuing to reform the awareness of each employee and our organizational culture as it is the key to success. Together with relevant departments and employees, we are developing processes, rules, and systems to promote cybersecurity and working to strengthen information security for the entire Fujitsu Group as well as a safer business environment for our customers and partners.

<Our Goals for Information Security>

• Proactive information security
  - Continuous evolution of information security to support diverse work styles in the age of digital transformation (DX)
  - Autonomous information security response by employees and organizations
• Defensive information security
  - Cyber-attack prevention by addressing vulnerability
  - Enhanced monitoring to minimize cyber risks in case of emergency

<Cross-departmental Application of Recurrence Prevention Measures and Visualization of Security Risks>

In response to information security incidents involving our project information sharing tool, “Project WEB” and cloud service, “FJcloud-V”, we have been applying recurrence prevention measures across different departments under the dedicated CISOs’ system. By 2022 we had completed the application of one of the principal recurrent prevention measures, “multi-factor authentication of web systems” in Japan. We also continue to promote corrective measures by visualizing security risks through company-wide security inspections.

In 2023, we will continue our efforts to achieve our goals for information security by taking appropriate corrective measures through visualization of security risks and evolving information security based on the following major themes:

<What Visualization of Security Risks Can Achieve>

• Autonomous risk control by internal relevant departments
  Objectively visualized risks related to information management and information system security are reviewed and promptly addressed by relevant department within the company. In case of critical system or information, an organization under the direct control of CISOs conducts direct inspection to objectively confirm the risk content with more accuracy.
  Moreover, the information management literacy of each employee and the organization (internal factors) and the actual status of cyber-risks (external factors) are also visualized and shared (Visual control). Having each employee understand this and take this personally (developing a sense of ownership) fosters an organizational culture of autonomous information security measures (taking initiatives).
• Accurate correction of digitally visualized risks
  Introduction of CMDB (*1) and Information Management Dashboards (*2) allows digital visualization of information system vulnerability and information management deficiencies. Correcting the visualized risks mechanically, not manually, minimizes security risks accurately and speedily.
  • (*1)
    CMDB：Configuration Management Database
    CMBD is a database that automatically collects and centrally manages information systems’ configuration information of hardware, software, network, etc.
    The collected information is utilized for security inspections and audits, handling vulnerability, and responding to security incidents.
  • (*2)
    Information Management Dashboard: digitalized information management register.
    The Fujitsu Group maintains a digitalized information management register, which controls managers, management locations, and scope of sharing of the confidential information.
    Any deficiencies detected through consistency checks between the Dashboard and the actual information management status (such as audit logs of storage services) will be readily and quickly corrected through a trouble ticketing system, or set a workflow for the solution.
• Evolution of information security with technology
  From 2023, we will unify our authentication infrastructure to promote centralized and visualized management of user IDs, authorization information and trail logs.
  With this authentication infrastructure, we will seek to conduct behavior analysis using trail logs and optimize authorization information in conjunction with the analysis results.

<Main Measures>

We will introduce the main measures tied to each theme from the following three perspectives.

• Cyber-security
  Introduction of information system security (or ensuring and maintaining the safety and reliability of information systems and networks), as well as measures related to activities to maintain the security of our products and service
• Information management
  Introduction of measures to maintain and manage the confidentiality, integrity and availability of information itself, including critical information (confidential or personal information)
• Governance enhancement
  Introduction of measures to strengthen governance to instill and establish security measures and enhance the security of the entire organization.

Cyber Security

Based on the IT asset management information of Fujitsu’s systems, we will bolster preventive measures against security compromises by providing perimeter defense and zero-trust security not only to block any unauthorized access by an attacker, but also to detect and take defensive actions in the event of such intrusion.

<Autonomous Correction Through Centralized and Visualized IT Asset Management>

To support our customers’ safe, secure, and sustainable business activities, we have centralized and visualized the IT asset management of the IT systems for our globally operating customers, as well as our internal ones. This helps us promptly identify and correct any security risks throughout the group. We have been strengthening routine risk management, visualizing risk audits conducted by an organization under the direct control of the CISOs and their result, and promoting an appropriate understanding of the actual situation in relevant departments and their autonomous correction.

<Vulnerability Scanning of Systems Exposed to The Internet>

We provide vulnerability scanning mechanism in systems exposed to the Internet from the outside based on IT asset management information. This enables our relevant departments managing those systems to conduct autonomous periodic scans and take corrective actions triggered by vulnerability detection. By conducting periodic inspections through this mechanism on annual basis, we ensure implementation of countermeasures against vulnerabilities. Moreover, we inspect critical systems with more accuracy through third-party audits conducted by an organization under the direct control of the CISOs. In 2023, we will promote the automation and mechanization of this process.
Furthermore, we have also established a mechanism to ensure that vulnerabilities of systems not exposed on the Internet are thoroughly addressed, by regularly updating IT asset management information, checking it against the vulnerability database, and, in case of any critical vulnerability, issuing tickets (corrective tasks) to responsible department.

<Utilization of Threat Intelligence and Attack Surface Management>

We are proactively utilizing threat intelligence to speed up the detection of, and response to, vulnerabilities in systems exposed to the Internet. Threat intelligence enables us to collect information in the early stage of an actual attack from an attacker’s perspective, such as information on global threat trends and vulnerability as well as vulnerability information in Fujitsu Group’s systems exposed to the Internet. The obtained threat intelligence allows impact analysis and prompt corrective action.
Moreover, in combination with vulnerability scanning of Internet-exposed systems based on IT asset management information, we also implement attack surface management, which monitors system vulnerabilities from an attacker’s perspective.

The cyber security environment is constantly changing, and attack methods are becoming more complex and sophisticated. Under these circumstances, the Fujitsu Group takes a zero-trust approach, based on the concept that 100% prevention of intrusion by cyber-attack is impossible, to reinforce security monitoring. We will improve the internal guidelines for security monitoring and conduct periodic system inspections to grasp and visualize the current situation. We will also work to ensure a sound monitoring system to enhance detection capabilities and earlier response to cyber-attacks. Furthermore, we ensure that critical systems are thoroughly monitored through third-party inspections conducted by an organization under the direct control of the CISOs.

As a company that supports customers’ safe and secure business activities, we must respond immediately to cyber-attacks that are becoming increasingly skillful and sophisticated. To that end, we have created an incident response process on the premise that a contingency is inevitable, so that in such cases our organization can quickly implement the series of processes of escalation to higher levels, response, recovery, and notification.

①Escalation process
We have standardized, and are continuously improving, the process of calculating an impact of each incident risk and escalating accordingly, to bolster the organization’s ability to respond to any incident.

②Incident response and system recovery process
After receiving information on attacks and vulnerabilities, we will take actions for prompt recovery by formulating a system recovery plan that includes appropriate incident handling, patch application plan and business continuity plan (BCP) for the affected product or system.

③Notification process
To ensure accountability to our stakeholders, we strive to properly share and report incident information.

④Activities to have the processes take root in the organization
The Fujitsu Group conducts regular education and training on incident response to raise employees’ awareness and implement activities for the incident response processes to take root.

<Sophistication of Incident Response>

Responding to a security incident requires an accurate understanding of the event from a technical perspective through log analysis, malware analysis, disk forensics, and other methods. A quick and fitting response also requires determining an overall policy and collaborating with parties involved inside and outside the company.
In our company, technical experts and members who take the lead on the path to the solution work together to handle security incidents, following various processes, including the escalation process.
In addition, we have been accumulating information on attacker’s tools, processes, and access methods and improving technical knowledge and skills of our response team members through continuous training. We also review the incidents we, including our global group companies, have handled to continuously improve our response capabilities, including upgrading our structure, rule and processes and accumulating know-how, so that we can speed up our response and minimize the impact.

<PSIRT Manager System>

To protect our customers who use our products and services, we have assigned PSIRT Managers in internal relevant departments to be responsible for centralized management of information on product configuration, IT asset and threat intelligence, including vulnerability information, as well as for vulnerability response. This is a system that enables speedy and proactive response to risks caused by vulnerabilities in our products and services.

<Formulation of Processes>

To accelerate estimation of the risks to products and services, as well as consideration and execution of countermeasures against them, we created standards and processes to handle the risks caused by vulnerabilities. We are continuously improving those processes based on statistical analysis by data scientists and track record of our responses.

Earlier problem resolution through prompt vulnerability response based on these systems and processes will prevent secondary damage to customers and minimize the impact on their business continuity.

Information Management

In Japan, with the objective of protecting personal information, Fujitsu Group obtained certification for the PrivacyMark (*2) by the Japan Information Processing and Development Center (JIPDEC) in August 2007. We are continually working to strengthen our Personal Information Protection System. Our domestic Group companies also obtain the PrivacyMark as necessary and work to thoroughly manage personal information.

• (*2)
  The PrivacyMark
  The PrivacyMark is granted to businesses that handle personal information appropriately under a personal information protection management system that is in compliance with JIS Q 15001:2017.

In FY2022, Fujitsu Customer Service Center Personal Information Protection Desk did not receive any consultations or complaints regarding customers’ privacy. No customer information was provided to government or administrative agencies in accordance with the Act on the Protection of Personal Information.

Fujitsu Group is actively promoting the acquisition of third-party evaluation and certification in our information security efforts.

• Third-party evaluation/certification audit results (link)