← All talks

Tokyo Takedown Reviewed: A International Tour To Japan by Ben Ellis

BSides London · 202213:13167 viewsPublished 2022-01Watch on YouTube ↗
Speakers
Tags
StyleTalk
Show transcript [en]

oh god hi my name is ben and today i'll be talking about japan and its cyber security scene so as i'm going to be talking about japan i might as well start by putting down some foundations of what japan is to most people it's the land of anime we're tv game shows amazing food and wacky futuristic technology and because of that japan has been handed a title of one of the kings of technology but that's a view of japan outside of japan so what is it really like on the streets well what what a better way to do it than to have a look at but look behind the curtain of the world's busiest metropolis tokyo

but how do we do that well by following a story of what makes tokyo and arguably the whole world tick salaryman so please everyone introdu let me uh let me introduce to everyone our main character hanlu hanu is a office worker for multi-cloud company in tokyo he's in his mid-30s so hands rushing to work he arrives at the metro station shoots down the stairs flashes his icy car just goes from ticket gates but as he launches himself down the escalator quick glances at his watch 30 seconds until the train arrives oh god i've had a rush so he hits hit hits platform and he shoots over to the yellow line looks like he's down his watch again 10

seconds few i've made it but as han looks around the platform as he's catching his breath he notices there's quite a lot of people on the platform more than they should be but oh well that's a really matters rush hour but as he looks back at his watch again it's now been a minute and a half since the train should have arrived that's a bit concerning but hey you know that can happen so he looks around again and sees a train conductor on the platform so he walks over and goes excuse me where's the train looking back to bowels and apologizes he says i'm really sorry i don't know where the train is it's delayed

but as soon as he says that he handsomely hears the rattling of the train coming along so han gets on the train and as he enters it an announcement comes over over the thing my deepest apologies for our delay um with having technical issues and we're five minutes late we'll be issuing out delay certificates to our passengers to give to their bosses now where's the problem in this but it's a good example of losing face which is one of the biggest problems that japan faces in general in my opinion issue with losing face is it sometimes brings out bad solutions of getting around it for example in cyber security a really good example of it is companies not

announcing breaches months after they occurred now everyone should know what the problem with that is now one of the main reasons for this is c-suite x-er executives will get fired or will be asked to resign when they announce it now hans not really thinking about that as he's actually considering what's the technical issues but han's late so he doesn't have to you know he's not gonna think about that right now so now hands on his lunch break after working a couple of hours in the office and as he walks into his family mart he sees hey newspaper stand next to the cashier so he picks up a newspaper as he grabs his lunch and he goes and sits down after paying

he starts reading the front page and a headline of an article catches his eye billions of yen lost every year to cyber crime the article details how over the past few years the percentage of cyber crime being reported has increased at a steady rate now arguably is the same around the world but why are people concerned about this well it's well in june this year the japanese let me receive myself a bit the japanese national police agency announced they were just about to set up their cyber unit next year to establish a countermeasure to the increasing rate of 34 over the decade of cybercrime now to be clear this is the first time in the agency's history of

setting up anything on a specific area of crime as all investigations in japan are conducted by the local police departments except for incidents regarding the imperial family which is dealt with by the imperial guards now can finish his work and he's heading he's heading back to back home and following the rush hour crowd as they go into the metro but before he goes to the ticket gates the cap the crowd gets stopped by the conductor from this morning who's looking very concerned and han walks up and going goes what's going on and the conductor bows against i'm really sorry we're still experiencing technical issues which are disrupting all our trains now the conductor leans forward a little

closer to hand and says we don't have enough i.t staff to restore our systems around tokyo and we've had to request support out from other companies and bows and because okay thank you very much and leaves to go to the next metro line 20 minutes away now han eventually does get home an hour later and he's so exhausted he flops onto his futon and turns on the tv as he lays there he hears a familiar voice from the tv so he turns over and looks and is the ceo of the metro company in a press conference bowing with press cameras illuminating him the ceo announces i'm really really sorry for the disruptions which we've had we've caused our

passengers today we've discovered our system has been hit by ransomware which led to us not having access to our systems and sits up and listen very carefully sierra continues and goes well we're investigating the tech right now but we've discovered hackers have gained access to our systems for a vulnerability in a fax machine now there are some clear issues here which are hindering japanese cyber security the two main ones found in this part of the story is the shortage of workforce and old technology now these channels actually don't just infect impact cyber security in general for japan it affects the whole of its society and it's not just me saying this the japanese government released their

security cyber security strategy which highlights that there is a shortage of workforce that are caused by the japanese aging population and has led to japan now depending on foreign organizations for cyber security capabilities and solutions plus how many of you know what a fact machine is let alone how to use one so how does japan fix this why is japan even in this situation they're one of the kings of technology so how did they fit and fall in this pit well i've mentioned a couple of the challenges that japan faces from losing face shortage of workforce the capability the lack of capability and the fact that japan is a mix of new and old and many areas of its society

including technology but this is only a glimpse of the scene and there's so many more challenges that haunt japan so what does japan and we the cyber security industry do to solve this issue well one component of the greatest solution was highlighted to me during the free free trade agreement launch event in march by the british embassy this year while listening to the defense sector's specialist i saw a question that caught my interest surely japan wants to keep their cybersecurity in-house my answer that is yes it's very easy any country in the world wants their own security in-house and the japanese government made this clear in their cybersecurity strategy for example they stated they want to

establish no japanese technical verification system for addressing supply chain risks but it's not as simple as that japan is already struggling to do that because of the challenges it faces but it knows a temporary solution in theory i'm foreign that japan should encourage adoption of services products from western and other parts of the world cyber security organizations to help boost its cyber security whilst improving their own cyber security stance through their through their own organizations to catch up with the markets around the world but it's not as simple as that unfortunately there are many problems that limit this now japan is the third biggest company in the world with the uk being fifth so therefore there is a lot of money

that could be invested in cyber security in theory the problem is apart from a different language there's cultural differences and biases this concept of you go into a bar no one speaks your language there's no one there to translate for you and you can't read the menu how do you do anything in that bar well the clear answer is you know do your research learn the language learn the cultural differences but that's not enough for japan when i think about the japanese market i get reminded of something that i see a lot in our industry it's not what you know it's who you know in japan knowing someone who can get your foot in the door with a potential

client makes all that research and prep work tenfold were attempt worth tenfold so with all that's happened in hands day what's the implications for japan nationally each part the story would lead to economic problems for individuals not corporations and on top of that potential job loss for both c-suites and office workers what about the viewpoint of tokyo well it might not seem that major one of the nine major metro lines being disrupted but it still carries a heavy implication on the system especially during rush hour to put this in numbers a good there's a good chance that that line would be connected to shinjuku station which is the busiest train station in the world it's been recorded to have up to 3.5

million people daily going through it so let's say 10 of the metro was affected that's 300 hundred and fifty thousand people that could have been infected compare that to something like wimbledon which is the oldest train uh not trained tennis tournament in the world the number of people possibly affected 1.5 more people that they're more people than people that attended overall wimbledon in 2019 for individuals like han it could lead to many things for example just distribute air disrupted trains equals longer train journeys leading to higher chances of being late which leads to problems like deploy which with employment and could lead to financial issues stress health etc so what can japan do to counter these

challenges it faces and the impacts it experiences while developing its cyber security scene there are many things they could they should do like talking about losing face but what about the cyber security viewpoint well they already have an answer to this the japanese government strategy provides a lot of answers to the couple of the challenges i've talked about whilst providing solutions to matters that the subsequent cyber security industry like ourselves here already look at like key supply chain risks now in the past i've listed these things on the screen which are things that japan should adopt to improve its scene now since i've just started my journey in japan's cyber security scene has japan done any of this

well it already has set up its national center of residence ready instant residence and strategy for cyber security but the other things will hopefully be acted upon through their strategy so where do we the cyber security industry come in well even getting into the into the japanese market can be inter and it can be an interesting experience japan is in need of cyber security measures services products that will help organizations weather the storms known as their neighbors now i've given you a glance of what japan's cyber security scene is like what i want people to take away from this talk though well as a young man with so much to say with an nd on his head as well

and asking for at least someone in this room to have a look at the country that i've become very highly involved with and is a massive contributor to the technology we live and breathe and for them to ask how can we help thank you very much

[ feedback ]