Japan's National Cyber Office Urges Firms to Fix Basic Security Gaps

Operations: know your assets, shrink your exposure

Companies should track the software, versions and locations they use, collect known vulnerability information and act on it, with servers and network devices first. The NCO also asks firms to keep inventorying and minimizing their attack surface. Examples include publicly reachable admin screens, development and test environments, and badly configured cloud storage sharing.

The third operational measure is continuous vulnerability scanning and monitoring of suspicious behavior, including with AI. Uses listed include probing attack paths, assessing the impact and priority of flaws, analyzing logs and alerts, and suggesting responses. Humans should still check the basis and validity of AI results and make the final call.

Design and supply chain

For design and development, the NCO recommends security by design, stronger API protection and pre-release vulnerability testing. It names threat modeling, tools such as SAST, SCA, DAST and IAST, and checks of API permissions, credentials and rate limits. It warns of app-to-backend (A2B) attacks that exploit API flaws. Listed vulnerability types include SQL injection, OS command injection, remote code execution, SSRF and directory traversal.

On the supply chain, companies can be hit through a contractor's weaknesses even when their own defenses are sound. The NCO suggests multi-factor authentication, IP restrictions, connections only during work, reviews of admin rights, written security requirements in contracts and zero-trust access control. It also advises preparing first-response procedures for zero-day flaws, tracking versions and support status, and requiring an SBOM in contracts.

The NCO notes that the measures target current attack methods, and that firms should plan for more sophisticated misuse of AI. It has asked businesses that run web or app services and handle personal data to review their basic defenses.