Webinar Held on the Theme: "What are Ransomware Countermeasures for Large Corporations and Group Companies Under the SCS Evaluation System?"

Details and registration here.

The level of implementation of ID management, network segmentation, and detection systems in large corporations and group companies, as questioned by the SCS evaluation system. Ransomware damage remains at a high level, with no signs of a slowdown in reports of damage from domestic companies throughout the year. The majority of infection routes are through VPN devices and remote desktops, with attackers exploiting vulnerabilities at these network perimeters to infiltrate and spread laterally within the organization by stealing IDs and authentication information. Particularly in large corporations, the greater the number of branches and group companies, the more VPN devices and authentication infrastructure there are, leading to complex ID and privilege management. In reality, it is not uncommon for even large corporations to be unable to accurately grasp the versions of their VPN devices or to quickly identify the equipment to be addressed when vulnerabilities are discovered. In environments where security policies and operational levels differ by location, achieving Zero Trust is not easy and is perceived by attackers as a "structural weakness."

Inability to detect and block lateral movement after intrusion leads to damage spreading throughout the organization. In ransomware attacks, it is not the initial intrusion itself, but the "lateral movement" within the network after the intrusion that determines the scale of the damage. After gaining a foothold via VPN or remote desktop, attackers repeatedly steal privileged IDs and escalate privileges to reach critical servers and databases. If this lateral spread cannot be detected and blocked, an intrusion into one location can lead to system-wide shutdowns and information leaks throughout the organization. However, many companies have introduced point solutions like EDR, but lack a mechanism to comprehensively monitor internal movement after an intrusion. In environments where ID management, network monitoring, and endpoint protection are fragmented, threat information detected in one area is not immediately reflected in other defense layers, risking the allowance of attacker lateral movement. To stop lateral movement, a "mechanism to localize damage" that links ID, network, and detection layers is essential.

Specific measures to localize damage and countermeasures that lead to the SCS evaluation system. This seminar will introduce a three-layered defense approach to localize damage from ransomware attacks: "ID management and authentication enhancement," "network segmentation," and "post-intrusion detection and response (XDR)." The first layer, authentication enhancement, utilizes Cisco's cloud-based authentication platform, "Cisco Duo." Cisco Duo provides multi-factor authentication (MFA), device health assessment, and adaptive access policies to block ID theft and unauthorized access at the entry point. The second layer, network segmentation, logically divides the network to contain the attacker's movement within a specific segment, even if an intrusion is allowed. The third layer, post-intrusion detection and response, utilizes "Cisco XDR." Cisco XDR is an integrated platform that detects threats across network, endpoint, email, cloud, and identity domains, and automatically contains lateral movement. Furthermore, the SCS (Security measures for strengthening the supply chain) evaluation system, which the Ministry of Economy, Trade and Industry plans to implement, includes countermeasures to prevent the spread of damage as important evaluation items, and the measures introduced in this seminar will also contribute to preparation for it. We encourage those considering building a mechanism to localize damage to participate.

Organizer/Co-organizer DIES Service & Solutions Co., Ltd. Cisco Systems, LLC

Cooperation Majisemi Inc.

Details and registration here.

Majisemi will continue to hold webinars that are "useful for participants."

Past seminar materials and other upcoming seminars can be viewed here.

Majisemi Inc.

3-12 Kioicho, Chiyoda-ku, Tokyo 102-0094 Inquiries: https://majisemi.com/service/contact/