NOTE: this is an archived page and the content is likely to be out of date.
Security to Support Connected Society
Vol. 55, No. 5, 2019
Today, most of our social and economic activities rely on cyberspace. While this brings enormous benefits to our daily lives, we are also confronted by a grave threat, known as cyber attacks. This issue introduces Fujitsu's vision for "Security for Supporting Connected Society" from diverse viewpoints including technologies, services, business infrastructure, and workforce development.
Innovative digital technologies, such as cloud computing, big data, AI, and IoT are now familiar to us, and the digitalization of society is accelerating. A "connected society," formed by connecting all things such as people and things with data, is affecting the structure of social and economic systems and dramatically changing our daily lives. Digital innovation has brought us a "connected society" and is now advancing the digitalization of customers' business environments and businesses in an unstoppable manner. As these changes bring improved convenience, at the same time, we are confronted with emerging new threats, causing cybersecurity to become indispensable in protecting systems and data. Cybersecurity has now become the core foundation of Fujitsu's every business, and we recognize that is our mission to sustain our capability in cybersecurity to keep earning customer's trust. This paper describes Fujitsu's approach on cybersecurity in support of a connected society.
With an increase in security attacks in recent years, methods of attack are becoming increasingly complex and sophisticated, and security monitoring is critical for detecting such attacks quickly. Fujitsu offers FUJITSU Security Solution Global Managed Security Service (GMSS), which provides a one-stop solution for the operation of customers' security management. One feature of this service is that specialized security analysts with advanced skills stay on top of the latest security trends and the characteristics of customers' ICT environments. Based on this information, the analysts provide support ranging from temporary to permanent measures by closely examining alerts and proposing methods for handling any problems encountered. In addition, Fujitsu's proprietary technologies and advanced technologies from security vendors from all over the world are combined to build a platform capable of high-level detection of threats. This paper describes the features and scope of application of GMSS as well as the latest technological trends in cybersecurity monitoring.
Electronic data and people's lives are becoming more closely intertwined, leading to the formation of a digital society where the Internet is being used to process an ever-increasing volume of data exchanges and transactions. This trend is blurring the boundary between the real world and virtual spaces, resulting in a greater impact from cyber attacks. A fundamental requirement for all businesses is security monitoring to detect such attacks. Security monitoring is usually performed under the management of a security operations centre (SOC). However, to cope with the continued rise in cyber attacks, organisations as a whole must continue to innovate. This paper describes an innovative approach to improve incident response in SOC or a response by the Advanced Threat Centre (ATC) which realizes security automation and orchestration as a new model to support effective security monitoring.
In recent years, cyber attacks targeting companies and organizations without sufficient supply chain security measures have increased and security standards across many countries have fragmented. As a result, the burden of security measures on companies and organizations have increased. In response, Fujitsu believes it can contribute to reduce the burden of supply chain security measures by making use of an outcome-based approach that is increasingly being used by some regulators and standardization organizations on security. In this approach, only the results to be accomplished by security measures are specified as requirements, and the selection of the specific security measures is left up to those taking the security measures. Benefits will include a reduction of the burdens on both purchasers and suppliers in supply chains. This paper describes how to deploy this approach and the benefits of such an approach.
In recent years, cyber attacks have been on the rise, and the responsibility of system integrators offering secure systems to customers is becoming all the greater. In order to fulfill this responsibility, security must be incorporated into entire system integration (SI) that covers all processes, from planning and requirements definition to operation and maintenance. That is why Fujitsu is working on Secure SI. Secure SI is ensured security added to conventional SI for the purpose of assuring quality. Fujitsu is discovering and training personnel capable of practicing this Secure SI and certifying them as Security Meisters to contribute to customers' projects. This paper describes specific Secure SI activities.
The training of security engineers with advanced technological capabilities to support future social development is a key issue, both in Japan and overseas. Securing and developing such human resources requires the formation of an ecosystem where organizations can cooperate broadly beyond corporate boundaries with the industrial world, public bodies, and educational institutions. Up until now, Fujitsu has trained security engineers in collaboration with various organizations. Examples include the establishment of the Fujitsu Specialist Training Research Division at Kyushu University, participation in the task of defining security human resources by the Cross-Sector Forum for Cybersecurity Workforce Development, and a hands-on seminar held jointly with Ehime University and Ehime Prefectural Police. This paper describes these three initiatives for training security engineers in collaboration with these organizations, and the results achieved.
Digital co-creation is underway mainly in relation to data, which is being referred to as the new oil of the 21st century. Meanwhile, new challenges are also emerging, such as countermeasures for cyber attacks, which are expected to intensify due to the utilization of the IoT, compliance with regulations relating to personal data, and ensuring the reliability of data to be fed to AI. Security technologies are raising expectations as technologies that support the trust of humans, data, and systems. Fujitsu Laboratories is conducting research and development in the three core areas of authentication/authorization, data security, and cybersecurity for the purpose of supporting safety and security of all customer businesses. This paper first outlines the security technologies that Fujitsu Laboratories is working on. Next, as a topic of the latest research, it describes a technology to ensure the trust of data by making use of blockchain technology.
Blockchains, which are used to manage virtual currency, are expected to be used in many different fields as a distributed ledger technology that enables secure transactions among multiple blockchain participants through a decentralized operation. To increase the value of blockchains, it is necessary to link various blockchains. However, such linking at an application level is insufficient to ensure transparency, as shown by the possibility of unauthorized operations by system operators. There is also a need to deal with errors that may occur when these operations are performed. Fujitsu Laboratories has developed ConnectionChain, a security technology for securely linking and operating different blockchains. This paper presents the features of ConnectionChain and its prototype systems.
Recently, amendments to laws such as the Amended Act on the Protection of Personal Information (implemented in May 2017) in Japan and the General Data Protection Regulation in the EU (GDPR, implemented in May 2018) have been increasing the need for safe management of personal data, with biometric data used for biometric authentication also falling under this scope. In utilizing biometric data, biometric data protection technology that allows for the easy handling of data while strengthening biometric data protections is attracting attention. However, there is a problem with this technology, with it difficult to achieve both security against biometric data leaks and accuracy in the provided biometric authentication. To deal with this issue, Fujitsu Laboratories has taken advantage of its palm vein authentication technology, one of its strength, to develop a biometric data protection technology that is robust against vein pattern deformation. This technology facilitates the protection and management of biometric data and is expected to contribute to the expansion of personal authentication services that make use of hands-free authentication, which requires centralized management of biometric data in the system instead of the need for entering IDs. This paper presents an overview of Fujitsu Laboratories' proprietary biometric data protection technology and examples of use of palm vein authentication technology and hands-free authentication.
Customer systems today are constantly exposed to the threat of cyber attacks. To protect customer businesses in this age, the capability to respond to cyber attacks on customer systems and minimize damage is key. Fujitsu addresses this issue by training Security Meisters, who are human resources capable of responding to cyber attacks. To improve response capabilities against cyber attacks, it is useful to train in a cyber range, a virtual environment that allows trainees to experience simulated cyber attacks. With existing cyber ranges, however, it was difficult to reproduce a wide range of systems and difficult for system engineers in different locations of the country to use them on demand. In response, Fujitsu developed CYBERIUM, a cyber range in which various systems can be reproduced in a virtual environment where trainees can learn online without time or location constraints. This paper describes the usefulness of CYBERIUM.