Initiatives for Delivering Safe and Secure Services

As security regulations, KDDI established standards for security measures that business-critical systems should follow and reviews the compliance with these regulations.
These security regulations provide concrete security requirements, along with their interpretations, for systems used by the KDDI Group for planning, development, and operation. These requirements cover physical hardware installation locations, connecting with external networks, software versions, authentication and access control methods, logging, and recordkeeping.
By stringently conducting reviews during the transitional phase from system planning to development, KDDI achieves "security by design" that embodies security measures from the planning and design phase.
Also, in a system's application phase, KDDI runs a network vulnerability diagnosis that detects issues that are present in servers and network.
For network vulnerability diagnosis, KDDI uses a dedicated diagnostic tool with a signature database that accumulates various software vulnerability information to check for possible security issues that may be present in the target server or network device.
The issues identified are classified into different levels based on risks in order to make necessary corrections such as application of security patches and revision of settings.
Such are examples of KDDI's endeavors to ensure system security at each phase of planning, development, and application, in order to deliver safe and secure services.

KDDI comprehensively monitors its networks nationwide centering around the Security Operation Center (SOC).
In the case of a large-scale network failure, control is centralized at the SOC in order to give instructions internally and externally on recovery response and information sharing. At the SOC, security engineers with specialized training are on duty round-the clock for surveillance of unauthorized access, tampering, targeted attacks, and other cyber-attack threats. The security engineers monitor and analyze logs output from security monitoring devices to detect any signs of attack from the massive volume of data. Upon the onset of a destructive incident such as unauthorized access and tampering, security engineers detect such occurrences in real-time, and if necessary, quickly inform CSIRT and other relevant internal organizations and give instructions.

As a dedicated organization that responds to security incidents, KDDI has set up a computer security incident response team (CSIRT).
CSIRT coordinates with the KDDI Digital Security, a KDDI group company, to receive information on incidents and work on incident handling, response support, and review of recurrence prevention. KDDI's CSIRT is also a member of the Nippon CSIRT Association and coordinates with other CSIRTs in Japan and abroad to share information on trends and measures.
Cyber attacks are getting more advanced day by day. KDDI is stepping up the collection of vulnerability and attack information, analysis of information, and further automation and sophistication of cyber attack responses in order to combat new threats.

At KDDI, we define security specialist role models for the purpose of clarifying their career path.
KDDI promotes the acquisition of a wide range of knowledge and deepening of specialization in addition to personnel exchange with external organizations and acquisition of specialized qualifications.

In the past few years, there has been a rapid increase in phishing frauds that guide people to a fake website via e-mail or SMS and steal customers' authentication information. As a dedicated organization that responds to such unauthorized use, KDDI has set up KDDI-SSIRT, a service security incident readiness & response team, to strengthen measures against such acts.
In addition to taking measures to disseminate information on phishing to customers and tackling conventional e-mail scams, KDDI-SSIRT detects fake websites and coordinates with related organizations to eliminate damage caused by malicious websites.
As another security initiative, KDDI-SSIRT also has a round-the-clock surveillance system to identify any unauthorized logins that take over authorized user accounts.
In the review process for new services, KDDI has inserted a new process where specialists audit the service from an anti-unauthorized use perspective as part of the check mechanism to prevent issues in authentication for services.
Phishing tactics are getting shrewder and more sophisticated, to which KDDI will continuously bolster proactive security measures for our services while combating new threats.