Japan has declared a national cyber emergency – what could this mean for enterprise security leaders? - IT Pro

The declaration by Japan's NCHS cyber agency is unusual, as few countries have declared a cyber emergency despite warnings of heightened threats. The move followed significant breaches, including rail operator JR East reporting the loss of 1.67 million email addresses and car rental company Times Car losing numerous customer driving license scans.

Cloud services operator IDC Frontier also reported a ransomware attack, which investigators linked to the JR East breach and other public sector compromises. The attacks were severe enough to prompt Japan's financial services regulator to instruct banks not to accept driving licenses as proof of identity for new account openings.

Supply chain impact

The interconnected nature of these attacks has highlighted vulnerabilities in supply chain security. "Incidents like this highlight why supply chain attacks can be so disruptive," said Alexandra Rose, head of global affairs and policy at cybersecurity company Sophos. "An attacker doesn't need to compromise a bunch of organizations individually in order to have a widespread impact."

Experts note that while Japan isn't necessarily more exposed to cyber attacks than other advanced economies, the country is experiencing an increase in attack severity. "I think it's a response to the increasing severity of attacks they are seeing," observed Rob Demain, founder of security firm e2e-assure.

Government response

Japan is implementing active cyber defense (ACD) measures, allowing police and other organizations to pursue attackers directly by taking down servers. The government is also considering wider changes to its cybersecurity strategy, including enhanced use of AI for defense following calls from lawmakers.

Effectiveness questioned

Not all experts are convinced of the emergency declaration's value. "A cyber emergency declaration has value if it changes the response, not just the rhetoric," cautioned Nazir Esmail, chief autonomous enterprise officer at Sapiens. "CISOs are well versed in threat vectors and don't need additional warnings that threats are on the rise."

Charl van der Walt, head of security research at Orange Cyberdefense, compared Japan's response to Costa Rica's 2022 national emergency declaration following ransomware attacks. While noting that Japan's emergency stops short of a full state of emergency, he suggested it might be a "knee jerk response" to recent incidents.

Van der Walt also observed that Japan may experience fewer public data leaks than its economic size would suggest, possibly because businesses pay ransoms before leaks occur. He emphasized that governments must balance signaling to adversaries while maintaining public confidence in cybersecurity measures.