The value of information... yours!

- by Greg Kaufman -

It's funny how comfortable Japan is and how easy it is to be lulled into a sense of security. After a few years here, things that grabbed you as absurd when you first arrived begin to seem quite normal. Maybe you've even adopted a few "foreign" mannerisms yourself, like bowing while talking on the phone or chopping the air with your hand as you squeeze through crowds. One of the easiest habits to acquire is, of course, the assumption of personal safety that is taken for granted by all. Japan is a safe country, you hear over and over; Japan has low crime. Despite the sensational but aberrant subway gas attack or poison curry cases, most people - with good reason - generally assume that they are safe.

At the end of November, a large conference room at Nippon Unisys' headquarters in central Tokyo was filled with engineers and procurement specialists who had come to learn more about the recent developments in Internet Electronic Data Interchange (EDI). All of the lecturers at the "Internet EDI Seminar," organized by CommerceNet Japan (CNJ), are frontline engineers from companies which are actively using Internet EDI. The CNJ is a Japanese chapter of Commerce Net, a worldwide organization aimed at promoting e-commerce (EC). Launching the Internet EDI project in May 1997, CNJ has been surveying the present status, studying technological innovations of Internet EDI, and providing education.

In the corporate world of the Japanese salaryman, however, changes are afoot. The prolonged economic slump, the bursting of the speculative bubble, and the revelation that many pension plans are inadequately funded have all started to gnaw on the salaryman's nerves. Though none of these events are themselves sufficient to rattle his famous company loyalty, there are bigger shocks yet to come. For the first time, Japanese companies have moved from merely considering to actually implementing large-scale layoffs, shattering the long-standing, ironclad guarantee of lifetime employment. The salaryman, when he realizes the extent of this breaking of faith, will become very angry indeed.

In this climate of fear and frustration, it is prudent to ask just how prepared is Japan's corporate world to deal with the disillusioned, laid off employee who increasingly might decide to exact revenge. For example, one Japanese executive, no longer anchored by lifetime employment, left his firm to join a competitor. Prior to leaving, he casually sent much of the company's vital information - including valuable R&D data - to an e-mail account at his new employer. In another recent case, a contract employee stole personal registration data on 90,000 Japanese women and sold it on the Internet for ´55,000. As these stories illustrate, the digital age is here and it appears that information systems are the soft, vulnerable underbelly of most enterprises. Yet, many companies in Japan do not consider protection of their valuable data until after it has been damaged or compromised, often by an insider. How can companies protect themselves? How would you deal with litigation from the people whose privacy was compromised? Remember, your lawyer's first question will be: Can you prove you weren't negligent?

1) Ensure that a comprehensive security policy is in place and all staff from new hires to top management agree with and understand the meaning of the policy. Too many Japanese companies believe that security is the responsibility of senior management and IT departments only. All employees need to be briefed on the need to adopt secure working practices and must be vigilant for possible security risks.

2) A thorough security audit and network penetration test should be conducted. This will determine if the security policy is being followed and aid in discovering any serious weak points in the system. Additional security audits should be done regularly and without notice.

3) Obtain and use the latest hardware and software that can provide data and network security. Here in Japan, several leading companies - including ISS and Network Associates - offer security solutions that address the most common intrusion threats and monitor out-of-the ordinary activity on a network.

Greg Kaufman provides corporate security consulting and network assessment and testing for PTS. He can be reached at info@pts-solutions.com.

Back to the table of contents