> ### III. Guidelines for IT Security Policy

> ### 1. Positioning and Basic Structure of the Security Policy

> The system of the IT Security Policy has a hierarchical structure as shown in Fig.2.

> At the apex is "the Government's basic concepts of IT security," which illustrates how the Government, as a whole, feels about the measures for IT security.

> The basic concepts are followed by the "basic guidelines (of each ministry and agency)," "standard of measures (of each ministry and agency), " and "implementation procedure (of each ministry and agency)" in this order. The "IT Security Policy," or the Policy, in these Guidelines refers to the "basic guidelines (of each ministry and agency)" and "standard of measures (of each ministry and agency)", and does not include the "implementation procedure (of each ministry and agency)." The "implementation procedure" covers those procedures provided in documents, and usage regulations - some earlier documents and regulations may include items about the standard of measures - concerning information systems published thus far, as well as those newly required according to the policy establishment this time (for example, emergency organization and operation of the monitoring system). For establishing the Policy from the high-order basic guidelines, the existing regulations should be reviewed.

> ### 2. Procedure for Setting up the Policy

> This section describes the procedure for setting up the Policy and the matters to be decided for the Policy.

> (1) Outline of the procedure

> As shown in Fig. 3, the Policy shall be set up according to the steps of: 1 establishing the organization and system for setting up the Policy, 2 mapping the basic guidelines under such an organization and system, 3 analyzing the risks, 4 formulating the standard of measures, and 5 adopting the Policy formally in each ministry and agency.

> Each ministry and agency shall 6 formulate an implementation procedure to rationalize the matters set forth in the standard for countermeasures based on its specific Policy.

> (2) Organization and system for setting up the Policy

> For setting up the Policy, an organization needs to be established that is formed by chiefs of concerned departments and bureaus, administrators of information systems, persons who have technical knowledge and expertise about IT security and other people. By establishing this organization (hereafter called the "IT Security Committee" in these Guidelines), the commitment of the organization executives to policy making and the responsibility of each member are made clear. To attain this object, the purposes, authorities, name, operation, members, etc. of the IT Security Committee shall be defined in the Policy. Although it is considered that the concerned persons in all departments and bureaus will take part in the Policy, because it deals with various issues about information, the key members of the Committee should include the following persons concerned.

> - Persons in information system related sections (such as LAN management sections)
> - Technical experts (experts with technical knowledge inside and outside the Government)
> - Persons in audit related sections (such as sections conducting policy evaluation, internal audit and general affairs section of secretariat
> - Persons in document related sections
> - Persons in personnel related sections
> - Persons in accounting related sections
> - Persons in public relations related sections
> - Persons in government building management sections

> In the course of setting up the Policy, candidates for IT security personnel in each department and section should be incorporated into the organization. In addition, it is important that an environment should be created which enables the Policy to be understood by the staff, by hearing their opinions and explaining problems to them appropriately.

> Some of the Policy formulating work can be consigned to a subordinate group (Policy formulating group) with the approval of the IT Security Committee. In the case of need, outside people can join the group. For easy operation of the Policy formulating group, the executives should organize the group formally, using official appointments, so that the people of the ministries and agencies can recognize that the work of the group is based on an order of the executives.

> (Example)

> Information Security Committee This Committee is formed by representatives of the following organizations: Chairman Chief secretary Information System Section General Affairs Section of Secretariat Documentation Section of Secretariat Secretary Section Accounting Section Public Relations Section Miscellaneous duties of the Committee are assumed by the Information System Section. In addition, as the persons who represent the interests of each department and bureau, staff of the section of each bureau, and the section in charge of the A system (A Section), shall participate in formulating the tasks of the Policy. Staff of the Policy Formulating Work Group (Work Group on IT security policy) shall coordinate with the various departments and bureaus in the ministries and agencies, and promote an understanding of the Policy among those departments and bureaus.

> (3) Mapping the basic guidelines

> It is required as the basic guidelines that the formulation of the basic policies should take countermeasures to guarantee the IT security of the information system of the ministry and agency.

> These basic guidelines shall indicate each ministry and agency's basic concepts for IT security, including the purpose, target, etc. of the IT security measures.

> It also includes the definitions of terminology required to understand the Policy.

> Note that the basic guidelines should not be updated frequently because they determine the basic direction concerning IT security.

> (4) Analyzing the risk

> > 1) General

> > Identifying the information assets to be protected, and evaluating the risk to those assets, is called risk analysis. Although there are various methods for risk analysis, we would like to outline the following procedure for specific risk analysis that is our concern.

> > (a) Look over the information assets held by each ministry and agency, classify them by importance and determine the level of required security for each asset.

> > (b) Investigate the threats surrounding the information assets of each ministry and agency, determine the scale of the risk, based on the frequency of threat occurrence, and the amount of damage caused by the threat. Note that the scale of risk generally refers to the product of frequency of threat occurrence, and the amount of damage caused by the threat.

> > (c) Formulate the standard countermeasures so that the scale of risk falls below the level of required security, and implement risk management as appropriate.

> > When changes are made to the information assets, or if the risk to the information assets is varied, risk analysis is made again for the relevant information assets, and the Policy is reviewed as required. Also in respect to regular review of the Policy, the work should begin with risk analysis. In addition, if vulnerability is found in any information assets, action should be promptly taken if necessary.

> > Although the materials describing the results of risk analysis shall be saved as the basic materials for setting up the Policy, their saving should be placed under strict management because they contain analysis of system vulnerability.

> > 2) Inquiry to information assets

> > To identify the information assets to be protected, inquiries should be made as to where the assets are located, by whom they are managed, and how they are dealt with.

> > The following is an example of a questionnaire showing specific inquiry items. Besides such a questionnaire, materials that describe the results of risk analysis should also be prepared.

> > (Example)

> > Questionnaire concerning information assets (Inventory concerning information assets)
> > Name of information asset |
> > Use |
> > Administrator |
> > User (access right) |
> > Place of saved (installation) |
> > Term of saved (installation) |
> > Importance | I, II, III, IV Confidentiality [I, II, III, IV] Integrity [I, II, III, IV] Availability [I, II, III, IV]

> > 3) Classification by importance

> > The inquired information assets are examined for classification in terms of three aspects of importance, or confidentiality, integrity and availability.]

> > This classification provides the standard for deciding how each information asset is handled and protected. The level of required security for each information asset is determined by this standard.

> > (Three aspects of importance)

> > (a) Confidentiality: | Importance based on the secret contained in the information asset
> > (b) Integrity: | Importance concerning the integrity and accuracy of the information asset
> > (c) Availability: | Importance concerning the availability and continuity of the information asset

> > (Example)

> > Degree of importance Violation of security exerts a serious influence on the life, property, and privacy of the nation. Violation of security exerts a serious influence as to the execution of administrative affairs. Violation of security exerts a slight influence on the execution of administrative affairs. Violation of security exerts little influence.

> > (Example)

> > The level of required security based on the importance of information assets (The level is set considering the three aspects of the importance mentioned above.) Importance I Level 1 of required security Importance II Level 2 of required security Importance III Level 3 of required security Importance IV Level 4 of required security

> > 4) Risk assessment

> > Risk assessment shall be performed for all inquiries as to information assets.

> > (a) Investigations shall be made into threats in the surrounding physical, technical, and human environments.

> > (Examples of threats)
> > Physical threats: | intrusion, destruction, failure, power stoppage, disaster, etc.
> > Technical threats: | unauthorized access, tapping, computer virus, tampering, deletion, DoS attack, disguise, etc.
> > Human threats: | abusing extraction, misconduct, inappropriate management of passwords, etc.

> > (b) Magnitude of risks to the threats that each information asset is facing shall be assessed from (a) frequency of the threats and (b) scale of damage when a threat occurs.

> > Instead of directly examining the frequency of the threats and the scale of damage, the vulnerability of information assets (taken for frequency) and the importance of information assets (taken for scale of damage) can be examined for convenience.

> > The magnitude of risk shall be examined with all threats to each information asset.

> > (Example)

> > (Assessment levels set in phase of frequency and scale of damage) (a) Frequency of the threat A: The threat occurs at a considerable frequency. (The vulnerability is very serious.) B: The threat occurs at times. (The vulnerability is serious.) C: The threat occurs incidentally. (The vulnerability is slight.) D: The threat occurs scarcely. (There is little vulnerability.) (b) Scale of damage when the threat is realized. There is a method that approximates the scale of damage to the ranking of importance. (This method assumes that the higher the importance is, the greater the damage becomes.) To determine the scale of damage strictly by this method, the three aspects of importance shall be taken into consideration. <Scale of damage> a: The same as importance I. b: The same as importance II. c: The same as importance III. d: The same as importance IV.

> > 5) Countermeasures against risks

> > The scale of the risk for each threat to an information asset evaluated by the risk assessment is compared with the level of required security for the standard of IT security measures.

> > When the standard of IT security measures is determined, it should aim at satisfying the level of required security by reducing the frequency of threat and the scale of damage. The measures to reduce the frequency of threat and the scale of damage should include those that prevent threats. The measures should also include procedures that guard the information, keep the information from tampering, and enable the information to be used continuously, when damage actually occurred. In addition, prompt recovery in the case of a fault should be taken into consideration.

> > In formulating measures to attain the level of required security considering the importance of information assets, it is noted that the frequency of threats should become lower, and the damage (or the risk) should become smaller, as the level of required security becomes higher.

> > For example, the methods of reducing the scale of the risk to the level of required security are divided into the following three types.

> > (a) Method to reduce the scale of the risk by reducing the scale of the damage, for example, by granting access rights only to those who need to access the information.

> > (b) Method to reduce the scale of the risk by reducing the scale of the damage, for example, by granting access rights only to those who need to access the information.

> > (c) Method to reduce the scale of the risk by reducing both the scale of damage and the frequency of threats, for example, by detecting tampering of information systems.

> > The measures to be determined specifically should be effective and efficient, paying due consideration to the convenience of users, according to information assets and their threats.

> > (Example) Examining the standard of measures (unauthorized access)

> > Results of risk assessment (Frequency of occurrence = B, scale of damage = a) The standard of measures are examined to reduce the risk of unauthorized access
> > Granting access rights only to those who need to access the information Permitting logins from the console only Introducing correction programs (patches) Monitoring and recording access logs Detecting tampering of information systems Protecting information assets by emergency action
> > Reduce of risk (Frequency of occurrence = C, scale of damage = c)

> (5) Formulating the standard of measures

> Individual measures for each information asset, which are obtained as the result of risk assessment, should be organized to formulate the standard of measures.

> > 1) Configuration

> > The standard of measures should be configured as follows:

> > (i) | Organization and system
> > (ii) | Classification and management of information
> > | (a) Management responsibilities for information
> > | (b) Classification and management of information
> > (iii) | Physical security
> > (iv) | Human security
> > | (a) Role, responsibility, and exemption
> > | (b) Education and training
> > | (c) Reporting of incidents and defects
> > | (d) Management of authentication information, etc. for access
> > | (e) Employment of part-time and temporary staff, and their employment agreement
> > (v) | Technical security
> > | (a) Management of computers and networks
> > | (b) Access control
> > | (c) Development, implementation and maintenance of systems
> > | (d) Countermeasures against computer viruses
> > | (e) Collection of security information
> > (vi) | Operation
> > | (a) Monitoring of information systems and making sure of policy observation (operation management)
> > | (b) Considerations in operation management
> > | (c) Contingency plan
> > | (d) Operation agreement for consignment to outside contractors
> > (vii) | Compliance of laws
> > (viii) | Action against violation of IT security policy
> > (ix) | Evaluation and review

> > 2) Organization and system

> > For the organization and system to maintain IT security, it is important that executives should take initiative in promoting the protection of IT security. To realize this purpose, it is required that the person who takes the final responsibility for IT security (Chief IT Security Officer: CISO 7(5)) is selected and his / her responsibility and authority are made clear. Specifically, the IT Security Committee, headed by the CISO, should assume the responsibilities for establishing a system that ensures the observation of Policy on a daily basis, investigating and reviewing the improvements (gaps from the real world) at the time of implementation and carrying out of education activities.

> > The Policy defines the purposes, duties, authorities, etc. of the CISO and the IT Security Committee as well as the establishment of members, the secretariat and the Audit Group, etc. The Policy also provides for the systems and authority that the secretariat and the Audit Group should have so that the duties of the Committee are surely performed. In particular, regarding the system for making sure of policy observation, the Policy provides the duties of the Audit Group and establishes a system in which the Audit Group makes sure of the implementation status of measures such as auditing, budget and organization and reports the results to the Committee.

> > > 7(5) Chief IT Security Officer

> > 3) Classification and management of information

> > Methods of information management are decided according to the classification of information management used in the risk analysis.

> > (i) Management responsibility of information

> > Persons who bear management responsibility are determined for each information item. The responsibilities for both those who manage it and those who use it should be studied, and the responsibilities and roles should be defined for each.

> > The information administrator, who will take the management responsibility for the documents prepared in that section, should be formally selected for each section. Documents and e-mail messages that are being prepared should be managed properly by individual persons.

> > (Example)

> > Each department, bureau, or section should assume managerial responsibility, as the information administrator, for any information it prepares. Information prepared by Bureau A General affairs section of Bureau A Information prepared by Section X, Bureau A Section X, Bureau A Information prepared by a ministry General affairs section of the minister's secretariat (or the section decided as the information administrator)

> > (ii) Classification and management of information

> > For the information held by the ministries and agencies, the classification and management are decided, based on the results of the classification of information assets, provided in the risk analysis.

> > Specifically, provisions should be made, not only for classification of information and indication about the classification of information, but also for the granting of access rights, encryption, management of media, changing or discarding of information, effective period of classification, etc., as methods of information management.

> > If information that has been classified is copied or transmitted, the reproduced information should also be managed in accordance with its original classification.

> > (Example)

> > A Principle Whether the information held in this ministry should be made public or not is determined by the Information Disclosure Law (Law Concerning Access to Information held by Administrative Organizations). (For information that is considered improper to make public, such as information concerning the privacy of individuals or information that may create a problem of IT security, provisions should be made as required.) B Indication about the classification of information For printed matter, displays on monitors, storage media (labels for FD, etc.), and file names, necessary indications of their classification should be made, paying due consideration to measures that prevent third parties from recognizing the importance of information. C Management of information (determined by the classification) (a) Granting of access rights and encryption Access rights should be determined by the classification of the information. Information that was classified as 'secret' should always be encrypted and saved strictly, separate from its encryption key. (b) Management of media Secret information storage media (FD, MO, CD-R, DAT, MT, DVD-RAM, etc.) should be saved in places that can be locked. (c) Management of information change or discard Changing or discarding of information should be made with the approval of the information administrator. The history data, including the date of when changed or discarded, the name of the person in charge, the contents of the processing should be held. Deletion of secret information should be performed by a method that disables the recovery of deleted information (reformatting of the medium, for example).

> > 4) Physical security

> > To protect information systems and places where they are installed from unauthorized entry, damage, and disturbance, physical measures such as installation of proper facilities, entry/exit management, and anti-theft measures for PCs in office rooms, should be decided.

> > To prevent information leakage using mobile communication devices, necessary measures should be studied, paying consideration to the future proliferation of such devices.

> > With respect to wireless LAN, the standards for determining the propriety of installation should be established in the section on physical security, and the standards for code and authentication in the case of allowing installation should be established in the section on technical security.

> > (Example)

> > For network devices including computers, proper physical measures should be taken in accordance with classification of importance (I, II, III, and IV) used in risk analysis. Use of double keys and IC authentication cards, installation of monitor cameras and antimagnetic walls, thorough management of entry/exit, installation of fire-extinguishing facilities and protection of wiring securing devices by chains, and protection of wiring ... These devices should be properly managed by the section in charge.

> > 5) Human security

> > Increase of IT security does not always go together with an increase of convenience, and may not be easily understood by users. This requires that necessary measures should be decided for human security, so that adequate education can be provided.

> > (i) Role, responsibility, and exemption

> > As a part of the "target of application" decided in the basic guidelines, the role and responsibility of each person being targeted, (who assumes the responsibility and role of the executives and staff) should be determined together with their relationship to outside contractors (including the relationship to program developers).

> > For exemption, necessary provisions for smooth application of the Policy should be determined, including the clause, that the responsibility for IT security failure will be discharged, if the person in charge notifies of failure on his or her initiative.

> > > (a) Chief IT Security Officer (CISO)
> > > The CISO should assume authority and responsibility for IT security as a whole. It should also have the decision authority concerning important matters on operation.

> > > (b) Officers in charge of IT security (executives and other leaders)
> > > IT security officers should be selected in each section, department and bureau. Their duties and responsibilities should include formulating a line of command in their organizations, and collecting and processing opinions of their people. For example, personnel in each section should report a violation against or a problem with the Policy to the officer in charge of IT security for advice or direction. The officer in charge should decide whether a violation or problem should be reported to CISO.

> > > (c) System management structure
> > > With respect to the system management structure that plays an important role in IT security measures, the structure, responsibilities and authority thereof should be provided.

> > > (A) System administrator
> > > The allocation of the system administrator, who carries out maintenance, management and operation of an information system, should be determined, and the duties for IT security, such as policy observation, should be clarified with respect to the information system managed by the system administrator. In addition, measures necessary for policy observation should be taken, such as regulating the implementation procedures for the information system managed by the system administrator. It should also be provided that the system administrator may exercise necessary authority within the scope of the Policy, regardless of departments and bureaus.

> > > (B) System administration staff
> > > The allocation of the administration staff sufficient to appropriately implement IT security measures should be determined. The system administration staff shall carry out system management work in line with the system administrator's orders.

> > > (d) Staff and other personnel

> > > - Obligation to observe the IT security measures
> > >   A provision should be set forth that places the staff under an obligation to observe the contents of the Policy and the implementation procedure, (individual manuals will do) in order to have the IT security measures function effectively. The staff is also required to give advice when he/she has questions or opinions about the Policy.
> > > - Management concerning external consignment
> > >   When the ministries and agencies consign development and operation management of information systems to outside contractors (including subcontractors), it is recognized that the obligation to observe the Policy and the implementation procedure is imposed on those contractors according to the target of application. Provisions are thus required to have the contractors observe the Policy and the implementation procedure, to provide education for this purpose, and to include a damage compensation clause to the contracts in cases where the Policy or procedure is not observed.
> > >   Because the contractors may deal with important information in terms of security, they should pay due consideration to the technical abilities and credibility of their personnel who handle such information.
> > >   Incidentally, regarding agreements for consignment to outside contractors, 6)(iii) "Development, implementation and maintenance of systems" and 7)(iv) "Operation agreement for consignment to outside contractors" shall also be taken into consideration
> > > - Part-time and temporary workers
> > >   It is prescribed that part-time and temporary workers should assume responsibility and a role in the manner that is applied to other staff members.
> > > - Miscellaneous
> > >   It should be noted that when staff or part-time and temporary workers who work for IT security leave the work because of personnel changes or retirement, the information known to the staff or other workers poses a security problem.

> > (ii) Education and training

> > Part of implementation of the Policy may be realized automatically by technical actions incorporated in information systems. A greater portion of implementation, however, depends on the decision and activities of the persons in charge and users in the organization. Thus to raise and maintain security consciousness, education and training should be provided, based on a plan so that all people in the organization, including the executives, recognize the importance of IT security, and understand and carry out the Policy.

> > Education and training are important to protect information systems against unauthorized accesses, computer viruses, information leakage by insiders, attacks from the outside, etc.

> > Specifically, research study meetings, seminars, and other educational activities should be provided. Training programs for new employees should also be provided.

> > (iii) Reporting of incidents and defects

> > If a member of the staff becomes aware of an incident concerning IT security or a defect of an information system, s/he should promptly report it to the IT security officer, in order to receive directions, without attempting to solve the incident or defect themselves. A provision should be made, concerning the obligation to report incidents and defects and reporting method, to localize the damage of an incident or defect.

> > In addition, with the implementation of electronic application, notification, etc., there will be more opportunities for the public to exchange important information by using the government's information system. Therefore, the necessary standards should be established to appropriately receive and deal with reports and communications about incidents and defects from the public.

> > (iv) Management of authentication information, etc. for access

> > Authentication information for access to an information system (ID, password, information relating to biometric authentication, etc.) and media recording such information (IC card, etc.) (referred to as "authentication information, etc." hereafter) is information liable to be infringed due to human security factors. The standards should be set to minimize the risk of leakage due to human factors in the process from issue of authentication information, etc. by the administrator to the management thereof by users. Specifically, the standards for management of authentication information, etc. by users should be established. In particular, since IDs and passwords are information likely to be leaked, a method of management thereof by users should be defined clearly and IDs and passwords should be effectively coordinated with technical security items that complement them, for example, restriction of passwords by the number of letters, etc. based on the access control function.

> > (Example)

> > 1) Password management The password should be kept secret. Notes on passwords should not be taken unless the notes are saved securely. If an information system or passwords might be exposed to risk, the passwords should be changed. The password should be of a proper length, and the character string should be a one that cannot be easily associated. (Details are decided in the implementation procedure.) Each password should be changed when a predetermined period has elapsed or when the predetermined number of accesses is reached (old password should not be used). The password for the administrator should be changed more frequently. Users should not have their passwords used by other users. Passwords should not be stored in mobile communication devices. 2) IC card management Users must observe the following matters with respect to IC cards for authentication. Users should strictly manage the IC cards for authentication. If users have lost the IC cards, they should immediately notify the system administrator of such. Users should observe other matters prescribed by the system administrator relating to use of the IC cards for authentication.

> > (v) Employment of part-time and temporary staff and their employment agreement

> > It is required to have part-time and temporary staff understand the observance of the Policy clearly in terms of IT security. In particular, when they need to work with PCs, the access management of those PCs and their authority to the information system, should be defined clearly to prevent unauthorized access by the staff.

> > Therefore, provisions should be set forth that, for example, the Policy is made known to the part-time and temporary staff and the staff sign a written consent.

> > 6) Technical security

> > (i) Management of computers and networks

> > Considerations and regulations should be set forth concerning the operation management procedures of information systems, network management, protection of storage media, data exchange with other organizations.

> > Methods of handling and managing devices should also be determined based on the results of risk analysis.

> > (Example)

> > Information should be managed as follows according to the classification of information assets. I All accesses should be logged and the log data should be held for a predetermined period. Log data should be analyzed regularly for monitoring. When an information system is changed, the contents, necessity and schedule of the change, should be reported to the administrator for approval. Before the changed system is installed on the production machine, the operation of the system should be validated on another machine. For updating, the current state should be stored, so that immediate recovery will be possible. These should be done outside business hours. In order to make it possible to take prompt action in an emergency, spare systems should be provided for the systems that are identified as an especially important system by the IT Security Committee. The emergency spare systems should be validated at least once every quarter. Education for managers should be provided regularly. Information systems should be backed up regularly. II For operations that the IT Security Committee identify as those that might seriously effect information systems, all accesses should be logged and the log data should be held for a predetermined period. When an information system is changed, the contents, necessity and schedule of the change should be reported to the administrator. If the administrator considers that the change would seriously effect information systems, the most important procedure should be changed outside business hours after preparing for recovery from the current state If the influence to the information system is considered to be trivial, the change is made under instructions from the administrator. Information systems should be backed up regularly. III When an information system is connected to the network, necessary items should be reported to the administrator according to the Instruction Manual for approval of the connection created by the administrator. The configuration of each information system should be defined in the corresponding implementation procedure manual. IV Handling can be made freely. No network connection should be made without approval.

> > The following are examples of regulations concerning the use of information systems.

> > (Example)

> > Regulations concerning the use of information systems Prohibition of non-business use of information systems Use of an information system or network resource is permitted only when it is made for business purposes. Access to information systems, use of mail addresses, and access to the Internet for non-business purposes, are not allowed. Prohibition of extraction of business data The staff should not bring class I business data out of the ministry or agency. The staff should not take media on which personally owned data is stored to a place where class information assets are installed. This regulation does not apply when the chief of an organization to which the staff member belongs (such as a section chief or room chief) gave permission to that effect. For example, the following activities require permission: bringing the information stored in a mobile terminal or storage medium out of the ministry or agency, taking personal information into an office where the above information is installed, transferring personal data over a network (sending and receiving data to and from the address of a private person by e-mail, and so forth). Prohibition of installation of unauthorized software The staff should not install software that is not authorized by the section of information system management on their PCs given to them from the ministry or agency. Among pieces of information strictly prohibited by that section are monitoring software for eavesdropping the information over the network, security-related software for scanning the network status, and hacking software. Software to increase the efficiency of work can be used by permission of the officer in charge of IT security. Prohibition of change of device configuration The staff should not make any device addition or change to their PCs given to them from the ministry or agency. The addition of a modem or other similar devices to connect to other environments (such as the Internet) over a network or making a mechanism to allow access from outside the ministry or agency should be prohibited

> > (ii) Access control

> > Access to information should be permitted based on the business requirements. Access permission should include provisions about the authority and responsibility of the users. The password management procedure on the system administrator's side, and the authority of the system administrator, should also be defined. For important information systems, specific access control for individual systems (access control using special personal authentication, for example) should be defined. The standard of permitting connection from outside users, (or connection from a mobile terminal) and requirements for accessing information and information systems, should also be defined.

> > In addition, for connection from local bureaus (Regional bureaus and departments) via leased lines, measures such as access control to increase security should be taken depending on the conditions of those lines.

> > (Example)

> > Registration of users Formal procedures for registering users or canceling user registration should be used to authorize or cancel access rights to information systems. Considerations for logging in and logging out (The procedure for login and logout should be defined in the implementation procedure.) Limitation of automatic mail transfer Granting access rights to servers

> > (iii) Development, implementation and maintenance of systems

> > When an information system is developed, introduced, or updated, risk analysis should be made according to the Policy to define the necessary items for taking proper IT security measures. Security items for the consignee of system development should also be defined.

> > When new devices, software, storage media, or services are introduced for the information system, they should be checked in advance for any failure or defect that might compromise the security of the system. In addition, their specifications should be dealt with carefully.

> > If a device is discarded, repaired or returned, an appropriate measure should be taken to prevent leakage of the information in the device. For example, if a hard disk drive is to be discarded, the contents should be completely deleted before it is discarded.

> > (Example)

> > Confidentiality obligation Management of reconsignment Management of information system specifications, etc. Requirements under various guidelines for government procurement8(6) (ISO15408, etc.) Work area, work management Handling of incidents relating to IT security in working state dSubmission of a work report Procedure at the time of bringing in and out equipment Vulnerability test at the time of introduction Submission of source code Requirements for observing the Policy in accordance with other information systems

> > Regulations concerning a monitoring system and the correction of information systems should be prescribed to ensure security during maintenance. In doing so, 7)(iv) "Operation agreement for consignment to outside contractors" shall also be taken into consideration

> > (Example)

> > A 24-hour monitoring system for information systems, guidelines for installing correction programs (patch programs), time of installing such programs, etc.

> > (iv) Countermeasures against computer viruses

> > Preparation of the system to cope with computer viruses, regulations to be observed by the staff and others, should be set forth as the countermeasures against viruses. The actions to be taken when a computer virus is found are defined as an action against an intrusion into an information system.

> > > 8(6) Major guidelines for government procurement
> > > The following policies that should be observed in procuring hardware, software and services provide the standards for IT equipment and points of concern in consignment to outside contractors, etc. from the viewpoint of ensuring IT security.

> > > - "Policy of Using Products with a High Level of Security, etc. in Procurement by Each Ministry and Agency" (approved on March 29, 2001 by the Liaison Conference for the Ministries and Agencies Concerning Promotion of Administration Computerization)
> > > - "Promotion of Consignment of Information System-related Operations to Outside Contractors by Governmental Administrative Organizations" (approved on March 31, 2000 by the Liaison Conference for the Ministries and Agencies Concerning Administration Information System).

> > Installation of unauthorized software should be prohibited. (This relates to compliance of laws.) When to receive data files or software files from an external network, anti-virus software should be executed at both the server and terminal. The vaccine program should be updated to the latest version, and the virus information should be updated frequently at both the serverand terminal. The contents of important software, information systems, and information should be checked regularly

> > (v) Collection of security information

> > Because security holes are likely to be found on a daily basis, security information should be corrected regularly. For this purpose, an information collection system, information analysis procedure, and sources of information collection need to be decided. If a serious security hole is found, action should be promptly taken.

> > 7) Operation

> > (i) Monitoring of information systems and making sure of policy observation (operation management)

> > To ensure the effectiveness of the Policy and to prevent the Policy from being abused by attacks to other information systems via the Internet, constant checking is essential. Specifically, it should be checked through network monitoring, that users of information system are observing the Policy, and if unauthorized access is made to an information system via the Internet. Thus self-checking by each person in the target of policy application and network monitoring by self-monitoring devices, etc. of the information management section should be defined. This helps ensure the observance, the evaluation of the problems, and the coordination of the Policy with the actual conditions.

> > To implement operation management properly, it is required to formulate an organization that does not impose too much burden on particular persons. The organization is also required to provide a quick action in the case of a failure, and to monitor the system constantly even during the failure. Therefore, necessary measures shall be prescribed according to the risk, such as installation of an intrusion detection system, etc. and establishment of a monitoring system.

> > Acquisition and analysis of the access log should also be defined clearly. The access log should be maintained safely to prevent deletion or tampering of data or other unauthorized operations.

> > Detailed items (such as retention period of the access log and number of persons in charge of monitoring) should be defined in the implementation procedure.

> > (ii) Considerations in operation management

> > Operations of system and security management software, including the browsing of users' e-mail messages, should not violate the privacy of users. Due consideration should be paid to the fact that the security measures may effect the privacy of the staff. From this standpoint, provisions should be made as to the time, conditions, and organization that allow the use of the security procedure.

> > Desirably, this issue receives the good understanding of users.

> > (Example)

> > The system administrator can only see personal e-mail messages in the presence of the executive in charge or another selected person when the executive has admitted that a problem may occur with IT security.

> > (iii)Contingency plan

> > Specific actions to be taken when the IT security was, or might be violated, should be formulated as a plan of emergency measures.

> > This plan includes a series of operations to take necessary actions, such as liaison when the information asset was violated, perpetuating the evidence, localizing the damage, and recovering quickly and smoothly from the damage and to take measures for preventing recurrence of security violation.

> > In particular, measures should be reviewed thoroughly through validation and training, so that the following actions can be conducted easily: deciding measures based on examination of the cause, identifying the offender, perpetuating the evidence to prepare for receiving legal measures and quick recovery.

> > In addition, actions are required to prevent the damage from diffusing to the information asset held by you or to outside information assets. If some persons are damaged by the leakage of their information, notice should be promptly given to them.

> > Close contact should be kept with the police and other agencies concerned if the case in question constitutes an infringement of the Law Concerning Prohibition of Illegal Access to Computer Systems (Unauthorized Computer Access Law).

> > As well, easy-to-understand emergency manuals for administrators and users should be prepared as an implementation procedure.

> > - Items to be included in the plan of emergency measures
> >   (a) Liaison
> >   The place for making contact, person in charge of liaison and communication means

> >   (Example) | Person in charge of information summarization (place for making contact), section or department of information asset management, liaison system in the ministry or agency, Branch for IT Security, Cabinet Office for National Security Affairs and Crisis Management, agencies concerned including the policy, and others

> >   (b) Survey of the case
> >   The survey method and survey items to understand the violation case should be decided.

> >   (Example) | Classifying the symptoms, identifying the cause, determining the scope of damage or influence, and recording

> >   (c) Coping with the case
> >   Criteria of deciding actions, the person who assumes the responsibility, the person in charge of implementation, implementation procedure, etc. are determined.

> >   (Example) | Notification, disconnecting the network, shutting down the information system, obtaining the logs (access log, action log, etc.), recovery, and checking for recurrence

> >   (d) Measure to prevent the recurrence of security violation
> >   The violation case should be surveyed to decide the measure to prevent the recurrence of a security violation.

> >   (Example) | Reporting to the IT Security Committee, risk analysis in relation to the case, and formulating the measure to prevent the recurrence of security violation (including evaluation of the Policy)

> >   (iv) Operation agreement for consignment to outside contractors
> >   When operation is carried out by outside consignees, necessary requirements for policy observation should be prescribed in an agreement, etc. Specifically, the necessary requirements in the following examples should be defined clearly depending on the content of consignment to outside contractors.

> > (Example) Confidentiality obligation Management of reconsignment Submission and management of record on system management and failure Management of information system specifications, etc. Measures concerning monitoring Emergency measures Collection of information on IT security Version control of software Other requirements for continuously maintaining IT security

> > 8) Compliance of laws

> > A provision is made about the observance of the related laws. Laws and administrative guidance to be observed should be enumerated so that they are not violated They include the Copyright Act, the Law Concerning Prohibition of Illegal Access to Computer Systems (Unauthorized Computer Access Law), and the Act for Protection of Computer Processed Personal Data held by Administrative Organizations.

> > 9) Actions taken against violation of IT security policy

> > The Policy stipulates that the persons who made violation of the Policy and their superior officers can be punished under the National Public Service Law, depending on the seriousness of the violation. This stipulation is included in order to suppress the actions of those who intend to make light of the Policy and the implementation procedure and to maintain the required level of IT security.

> > If any actions that may infringe IT security are observed in business, the superior of the officer who made the infringement, should immediately order the person who made the actions to stop using the terminal.

> > 10) Assessment and review

> > It should be provided that assessment and review of the Policy be performed periodically in response to the evaluation of the Policy and IT security measures, and to cope with alteration of the information system and emergence of new threats. The IT Security Committee should decide the implementation of assessment and review of the Policy by right of the committee.

> > (i) Auditing

> > IT security of the information system should be audited, and the results should be reflected in the assessment and review of the Policy.

> > The Committee's duties relating to auditing shall be defined clearly, and systems and authority necessary for fulfilling the duties shall be prescribed.

> > The Audit Group and other auditors should be ensured to be neutral in terms of auditing and report on IT security measures within an organization, and they should be clearly given the authority necessary for auditing such as access to information. In addition, to minimize the risk of leakage of information in auditing work, the standards for storage, management and confidentiality obligation, etc. should be established with respect to information relating to auditing handled by the Audit Group, etc.

> > The auditors should be qualified persons with expertise. For fair auditing, auditors who have no direct connection with the system to be audited are desirable, and the utilization of auditors outside the organization should also be taken into consideration.

> > (ii) Inspection

> > As for the implementation states of IT security measures in accordance with the Policy, questionnaires should be issued to the users, or autonomous inspections should be made. The results should be used when the Policy is updated to a more practical one.

> > (iii) Updating the Policy

> > Updating the Policy, as in the case of setting up the Policy, requires a procedure that justifies updating. The assessments by specialists of IT security should be utilized at that time, and reference to opinions of the related departments and bureaus is required.

> > The Policy should define a procedure that includes opinions about the update draft from the related departments and bureaus reflected in the Policy, and provide that the Policy has to be adopted by the IT Security Committee.

> (6) Decision of the Policy

> The set up Policy draft requires a procedure that justifies the draft. The assessments by specialists of IT security should be used at that time and reference to the opinions of related departments and bureaus is required.

> The Policy should define a procedure to include opinions about the draft from the related departments and bureaus reflected in the Policy, and provide that the Policy has to be adopted by the government ministries and agencies.

> ### 3. Introduction

> (1) Outline of introduction

> The Policy should be thoroughly known to the related persons before its operation is started so that the Policy can be positively implemented.

> (2) Preparation of implementation procedure

> The implementation procedure provides how the contents of the Policy should be put into operation for actual work or in the information system. The implementation procedure is equivalent to a manual that defines what each person who should observe the Policy must do to maintain IT security according to the information handled and the work to be done. Therefore, the implementation procedure has to be determined for individual cases when necessary, according to the actual working environment. It should be provided that the existing regulations could be used where applicable.

> In particular, the implementation procedure plays a very important role in ensuring continuity and consistency of measures by making rules for procedure of the Policy-based measures. For example, by the implementation procedure, the level of security can be maintained when a person in charge is relocated, and a uniform level of security can be ensured when departments, local bureaus, etc. connect their information systems with each other.

> It shall be allowed that the implementation procedure be set up, updated, and abolished by the system administrator, etc. without necessarily obtaining approval from the IT Security Committee since it is effective to prepare the implementation procedure based on the standard of measures for individual purposes and flexibly carry out the cycle for implementation, including evaluation and review.

> (3) Conformity to the Policy

> The IT Security Committee has the IT security officer verify that the implementation procedure, and what are actually implemented, conform to the Policy before it is put into operation. The Committee collects and studies information about conformity to the Policy and provides appropriate advice or actions for the operation of the Policy in advance.

> The officer in charge of IT security should verify that the physical, human, and technical IT security measures, as well as the emergency action plan and the implementation procedure introduced for all information assets s/he is responsible for, conform to the Policy.

> (4) Distribution and briefing

> The IT Security Committee distributes prints of the Policy or holds briefing about the Policy to make the Policy known to related personnel. Each department and bureau will be responsible for making the implementation procedure known to related personnel.

> It is desirable that the necessary part of the Policy is made known to outside consignees to have them agree to the conformance to the Policy.

> The implementation procedure is confidential. The related persons, including outside consignees, should handle the procedure under strict control.

> ### 4. Operation

> Establishment of organizations or systems, monitoring, actions taken at the time of intrusion, and other measures, should be provided for positive operation of the Policy.

> (1) Operation management

> Persons in charge of IT security in information management sections and the departments and bureaus, (bureaus and departments) should make sure that physical, human and technical IT security measures are implemented appropriately under the IT Security Committee.

> If a violation of the measures that could cause a serious problem for IT security is found, actions should be taken in accordance with a plan of emergency measures.

> These actions must be managed with tight control ready for use for the assessment or review of the Policy because they can serve, not only as proof of violation, but as materials for measuring the practicability of the Policy.

> (2) Actions taken in case of intrusion

> > 1) Training

> > Training should be performed regularly for smooth implementation of a plan of emergency measures. The results of the training are used for assessment and review of the plan.

> > 2) Notes for liaison

> > The method of liaison should be invulnerable to problems of IT security. (Use of e-mail for forwarding sensitive information should be avoided to protect it from eavesdropping.)

> > It is desirable that more than one communication means be provided around the clock for contacting the persons in charge of IT security.

> > 3) Notes for investigation

> > Investigation must not cause liaison any delay.

> > 4) Notes for taking actions

> > The scope of a person in charge for taking actions without the permission of the responsible person should be defined. Appropriate considerations should be given to a case where the responsible person cannot be reached, and the authority has to be entrusted to his replacement and an ex post facto report is needed.

> > 5) Prevention of repeated intrusions

> > As for prevention of repeated intrusions, the results of discussion of the matters related to the Policy, various actions, a plan of emergency measures, and the assessment and review of the implementation procedure should be indicated, with attention paid to the result of risk analysis about the intrusion that occurred.

> ### 5. Assessment and Review

> Regular assessment and review of the standard of measures are important. It should be done in consideration of the evaluation of the Policy and the IT security measure, changes of the information system and emergence of new threats. The assessment and review should be done under the IT Security Committee to keep the Policy practical and keep the IT security level high.

> (1) Auditing

> When implementing IT security measures, it is important for ministries and agencies to be able to explain that they have been appropriately carrying out the Policy-based measures from an objective viewpoint. For this purpose, auditing should be implemented appropriately.

> Based on this, the Committee shall implement appropriate review on the implementation status of measures. Specifically, the Committee shall audit the status of planned policy observation and make the Audit Group carry out this auditing work.

> In addition, the system administrator shall implement appropriate storage and management of records, etc. that are necessary for auditing, and make sure of policy observation when developing, introducing and operating an information system, by utilizing necessary auditing of the system, including investigation of the vulnerability of the information system.

> If an external auditing organization is used, sufficient consideration should be given to its credit. It should capture weak points of the information system subject to the audit.

> (2) Updating the Policy

> Updating the Policy for the first time after its introduction requires special consideration. Since differences between the Policy and the reality have to be considered, it is desirable to capture the actual states by canvassing opinions from the sections concerned, or by other means. Updating the Policy should begin with risk analysis to make it practical. Information about new methods of attacking systems should be collected for reference purposes for updating the Policy.

> The updated Policy has to be distributed and applied. This requires as much trouble as that required when the Policy was introduced. Efforts should be made to seek efficient methods.

> (3) Reflection to the Guidelines

> The results of assessment and review must be reflected in these guidelines.