NEC Cyber Security Solutions NEC Cyber Security Solutions

NEC Cyber Security Solutions

NEC Cyber Security Solutions help achieve the total Futureproof Security security of clients’ cyberspace, and create a brighter and safer future for all society.

ProtectingExtensive experience ICT environments and expert from technology cyber attacks helps protect ICT For further information, please contact: NEC Cyber Security Strategy Division withenvironments a comprehensive against cyber combination attack. of technology, experience, and experts. http://www.nec.com/cybersecurity

• The content of this catalog, including the speciﬁcations and design, is subject to change without notice for improvement purposes. • When exporting this product from Japan (including supplying services to non-residents), it is necessary to follow the procedures required by the Foreign Exchange and Foreign Trade Law and any other applicable laws or export regulations. NEC Cyber Security Solutions If you are unsure which laws and/or regulations are applicable to your case or if you require documents from NEC in order to obtain an export license, please contact the dealer where you purchased your product, or your local NEC sales ofﬁce. • Each of the product names and company names that are indicated in this catalog is a trademark or registered trademark of the company. © 2017 NEC Corporation NEC and the NEC logo are registered trademarks of NEC Corporation.

NEC Corporation 7-1,Shiba 5-chome, Minato-ku, Tokyo 108-8001 Issued February, 2017 Cat.No.J03-17010001E More advanced and sophisticated cyber attacks may strike at the core of your business. Can your company survive with its current measures?

Cyber attacks can cause immeasurable damages to a company. They can cause tangible damages such as stopping services; they can ruin the public’s trust in a company; and they can lead to leaks of Fight to protect the value important information that may affect corporate survival. of your company! In order to prevent a worst case scenario, you must have the proper organization, the proper personnel, and make the proper investments. You must also make business decisions with every aspect of the company in mind. Do you know what you need to do?

NEC Cyber Security Solutions

In a society in which all manner of things are connected to the Internet and the real world and cyber world are become blended, addressing cyber security is a social Cyber security is a problem for society as a whole. requirement and a must. The Japanese government passed the Basic Cyber Security Act in November 2014, and in September 2015 the cabinet NEC helps to achieve an information society that is friendly to humans and the earth by approved the “Cybersecurity Strategy,” a new national strategy for the nation’s cyber security. With the development of providing safe, secure, and comfortable environments in the cyber world. the Internet of Things (IoT) in which everything, including home appliances, automobiles, robots, and whole factories, are connected to networks, there is an increased risk that factories and other manufacturing centers, as well as infrastructure, will become targets of cyber attacks. This makes security measures more important than ever before.

Avoiding cyber attacks requires security measures that combine information, technology, and personnel.

Information Technology Personnel

Stronger international cooperation Multilayer defense Engineer training to respond to new attack methods that assumes infiltration for cyber security measures

Sharing the latest information Emergency response Cooperation between experts and coordinating efforts who have specialized knowledge to understand attack methods and when incidents are detected and technology protect against malware

NEC Cyber Security Solutions provide secure cyber environments Futureproof Security by comprehensively combining information, technology, and personnel.

2 3 More advanced and sophisticated cyber attacks may strike at the core of your business. Can your company survive with its current measures?

NEC Cyber Security Solutions

Avoiding cyber attacks requires security measures that combine information, technology, and personnel.

Information Technology Personnel

Stronger international cooperation Multilayer defense Engineer training to respond to new attack methods that assumes infiltration for cyber security measures

NEC Cyber Security Solutions provide secure cyber environments Futureproof Security by comprehensively combining information, technology, and personnel.

2 3 NEC Cyber Security Solutions NEC supports e ective and continuous security measures, NEC channels intensive internal and external security intelligence into its one-stop cyber security solution: The Cyber Security Factory including emergency response that assumes incidents will occur. When an incident actually occurs, information, technology, and personnel are all needed to implement a quick response. To that end, in Security 2014 NEC launched the Cyber Security Factory as a center for cyber monitoring security measures. This specialized organization coordinates with all • Incident response • Forensics We will plan measures that reduce your risks from companies within the NEC Group and our external security partners, and brings together specialists who are experts in cyber security. This Information, knowledge cyber attacks, and continuously strengthen your Cyber organization collects and shares advanced technologies, the latest Security range entire organization’s security. Observe attack methods and malware trends, and measure know-how. At the intelligence • Test environment Orient Cyber • Analysis environment Surveillance and same time, it provides one-stop support that includes introduction and • Training environment Simply introducing cyber security measures is not enough. In order to detection of warning signs Situational assessment Security cope with ever more sophisticated cyber attacks, it is important to and anomalies through visibility and construction of security systems, 24/7 operations monitoring, and Factory continuously strengthen your security measures in a planned fashion. other means emergency response when incidents occur. It also provides realistic In addition to strengthening the security of your entire organization cyber training to improve the cyber security response capabilities of Personnel Technology through an effective combination of various security measures, NEC OODA corporate security managers. also provides support for continuous measures that reduce loop A new center was opened in Singapore in 2016 to reinforce our global Human asset Technology vulnerabilities by using the PDCA cycle to plan policies, take development development measures, verify their effectiveness, and make improvements. that assumes monitoring infrastructure. Act incidents will occur Strengthening Quick implementation Decide of of measures Cyber security factory: major functions Decision-making Plan security in measures on measures and ・ Monitor customers’ networks and websites 24/7 Do other related issues ・ Analyze/evaluate system resilience using cyber attack simulations Formulation of policies and operations with high consistency Implementation and ・ Analyze cyber attack trends, share information and knowledge and feasibility operation of security ・ Use advanced techniques to develop sophisticated security technology measures ・ Improve technological understanding of security managers, staff training PDCA ・ Preserve and inspect evidence through advanced digital analysis cycle NEC supports appropriate situational assessment and prompt response in the event of an incident Continuous strengthening of measures to In addition to managing security risks with PDCA cycles, what is NEC Group Collaborative partners (random order) Act reduce risk especially important in preparing for cyber attacks is implementing Revision and measures that assume incidents such as illegal intrusions and improvement Check malware infections will occur. Damage can be minimized by quick Cyber Defense Institute, Inc. Infosec Corporation LAC Co., Ltd. of measures Inspection and detection of abnormal conditions, and timely decision-making and FFRI, Inc. evaluation of response during emergencies. NEC supports appropriate and measures speedy handling of incidents through the concept of an OODA loop Trend Micro Inc. that includes surveillance and detection, situational awareness, World-class engineers use penetration testing Expand the range of security services on offer S&J Corp. decision-making, and execution of measures. (proactive, authorized exploitation of systems to include security management and consulting NRI Secure Technologies, Ltd. to help evaluate their vulnerabilities) and for public sector institutions and private forensic analysis (analysis of evidence of illegal corporations, system design, round-the-clock actions) to devise high-quality security security monitoring, etc. Example of incident response technology services. Observe Orient Decide Act Decide Act NEC promotes a strong security lifecycle with comprehensive one-stop support services. Determining Analysis of scope Monitoring Situational Confirmation of impact the type of Initial response and detection awareness of an incident Analysis of damage attack Analysis of cause NEC’s Security Operation Center (SOC) Cyber security Total Support Service provided by NEC provides advanced security operations Comprehensive one-stop support centered on the NEC Cyber Security Factory monitoring solutions and forensics (analysis of Communications history NEC was one of the first companies to implement systematic measures to handle incidents. Construction of security measure monitoring evidence of illegal actions) by world class systems Companies today are focusing more strongly on Computer Security knowledge with global external organizations, and used our cyber security specialists. When incidents Malware detection Introduction Incident Response Team (CSIRT), which is a system of response that accumulated technologies and experience to configure detection and occur, we also provide emergency incident assumes incidents that threaten important information assets will warning systems, thereby reducing damage. In order to counter ever response solutions implemented by veteran Security consulting occur. NEC started its CSIRT activities in July 2000. We implemented more advanced and sophisticated cyber attacks, we are promoting Introduction Operations specialists. service monitoring service Operations systematic measures at an early stage by cooperating and sharing advanced responses, such as analysis of detected malware. We can also link the SOC of our customers (private SOC) with an NEC SOC. This allows Overview of CSIRT operations Risk Comprehensive us to use both the knowledge accumulated by Improvement analysis Periodic CSIRT : Computer Security Incident response Team service our customers and our own advanced support Cyber Security diagnosis service Detection Detection Sharing cyber specialized knowledge for more advanced Situation Support Services by detection systems CSIRT attack information External monitoring and to reinforce the human control • Collecting information organizations • Analyzing logs Investigation resource capabilities of our customers. Report Detailed Emergency • Recovery operations and feedback User report analysis service response service (confirming safety) • Analysis of targeted attack Directing in-house responses, reports, etc. Discovery of infected Discovery • Malware analysis NEC Immediate response PCs and servers • Forensic analysis, etc. Cyber attack forensic analysis From incident to recovery after an incident occurs (log monitoring, etc.)

4 5 NEC Cyber Security Solutions NEC supports e ective and continuous security measures, NEC channels intensive internal and external security intelligence into its one-stop cyber security solution: The Cyber Security Factory including emergency response that assumes incidents will occur. When an incident actually occurs, information, technology, and personnel are all needed to implement a quick response. To that end, in Security 2014 NEC launched the Cyber Security Factory as a center for cyber monitoring security measures. This specialized organization coordinates with all • Incident response • Forensics We will plan measures that reduce your risks from companies within the NEC Group and our external security partners, and brings together specialists who are experts in cyber security. This Information, knowledge cyber attacks, and continuously strengthen your Cyber organization collects and shares advanced technologies, the latest Security range entire organization’s security. Observe attack methods and malware trends, and measure know-how. At the intelligence • Test environment Orient Cyber • Analysis environment Surveillance and same time, it provides one-stop support that includes introduction and • Training environment Simply introducing cyber security measures is not enough. In order to detection of warning signs Situational assessment Security cope with ever more sophisticated cyber attacks, it is important to and anomalies through visibility and construction of security systems, 24/7 operations monitoring, and Factory continuously strengthen your security measures in a planned fashion. other means emergency response when incidents occur. It also provides realistic In addition to strengthening the security of your entire organization cyber training to improve the cyber security response capabilities of Personnel Technology through an effective combination of various security measures, NEC OODA corporate security managers. also provides support for continuous measures that reduce loop A new center was opened in Singapore in 2016 to reinforce our global Human asset Technology vulnerabilities by using the PDCA cycle to plan policies, take development development measures, verify their effectiveness, and make improvements. that assumes monitoring infrastructure. Act incidents will occur Strengthening Quick implementation Decide of of measures Cyber security factory: major functions Decision-making Plan security in measures on measures and ・ Monitor customers’ networks and websites 24/7 Do other related issues ・ Analyze/evaluate system resilience using cyber attack simulations Formulation of policies and operations with high consistency Implementation and ・ Analyze cyber attack trends, share information and knowledge and feasibility operation of security ・ Use advanced techniques to develop sophisticated security technology measures ・ Improve technological understanding of security managers, staff training PDCA ・ Preserve and inspect evidence through advanced digital analysis cycle NEC supports appropriate situational assessment and prompt response in the event of an incident Continuous strengthening of measures to In addition to managing security risks with PDCA cycles, what is NEC Group Collaborative partners (random order) Act reduce risk especially important in preparing for cyber attacks is implementing Revision and measures that assume incidents such as illegal intrusions and improvement Check malware infections will occur. Damage can be minimized by quick Cyber Defense Institute, Inc. Infosec Corporation LAC Co., Ltd. of measures Inspection and detection of abnormal conditions, and timely decision-making and FFRI, Inc. evaluation of response during emergencies. NEC supports appropriate and measures speedy handling of incidents through the concept of an OODA loop Trend Micro Inc. that includes surveillance and detection, situational awareness, World-class engineers use penetration testing Expand the range of security services on offer S&J Corp. decision-making, and execution of measures. (proactive, authorized exploitation of systems to include security management and consulting NRI Secure Technologies, Ltd. to help evaluate their vulnerabilities) and for public sector institutions and private forensic analysis (analysis of evidence of illegal corporations, system design, round-the-clock actions) to devise high-quality security security monitoring, etc. Example of incident response technology services. Observe Orient Decide Act Decide Act NEC promotes a strong security lifecycle with comprehensive one-stop support services. Determining Analysis of scope Monitoring Situational Confirmation of impact the type of Initial response and detection awareness of an incident Analysis of damage attack Analysis of cause NEC’s Security Operation Center (SOC) Cyber security Total Support Service provided by NEC provides advanced security operations Comprehensive one-stop support centered on the NEC Cyber Security Factory monitoring solutions and forensics (analysis of Communications history NEC was one of the first companies to implement systematic measures to handle incidents. Construction of security measure monitoring evidence of illegal actions) by world class systems Companies today are focusing more strongly on Computer Security knowledge with global external organizations, and used our cyber security specialists. When incidents Malware detection Introduction Incident Response Team (CSIRT), which is a system of response that accumulated technologies and experience to configure detection and occur, we also provide emergency incident assumes incidents that threaten important information assets will warning systems, thereby reducing damage. In order to counter ever response solutions implemented by veteran Security consulting occur. NEC started its CSIRT activities in July 2000. We implemented more advanced and sophisticated cyber attacks, we are promoting Introduction Operations specialists. service monitoring service Operations systematic measures at an early stage by cooperating and sharing advanced responses, such as analysis of detected malware. We can also link the SOC of our customers (private SOC) with an NEC SOC. This allows Overview of CSIRT operations Risk Comprehensive us to use both the knowledge accumulated by Improvement analysis Periodic CSIRT : Computer Security Incident response Team service our customers and our own advanced support Cyber Security diagnosis service Detection Detection Sharing cyber specialized knowledge for more advanced Situation Support Services by detection systems CSIRT attack information External monitoring and to reinforce the human control • Collecting information organizations • Analyzing logs Investigation resource capabilities of our customers. Report Detailed Emergency • Recovery operations and feedback User report analysis service response service (confirming safety) • Analysis of targeted attack Directing in-house responses, reports, etc. Discovery of infected Discovery • Malware analysis NEC Immediate response PCs and servers • Forensic analysis, etc. Cyber attack forensic analysis From incident to recovery after an incident occurs (log monitoring, etc.)

4 5 NEC Cyber Security Solutions NEC is strengthening its information, technology, and personnel NEC is developing security professionals with excellent practical skills.

by working together with society to provide secure cyber space. Because cyber attacks become more sophisticated every day, NEC is system by cooperating with our customers to define the security strengthening its efforts to develop security personnel who can improve personnel that they need. Moreover, we are working together with NEC the security measures of products, systems, and services, and who can Group companies, such as the Cyber Defense Institute, and partner We share the latest information with specialized cybercrime measure organizations help customers in many different areas. companies to prepare training courses for each personnel category, and to reinforce security at an international level. The NEC Group has defined the security personnel that it requires, and is making these courses available to our customers. training professionals in each category. We are continuing to improve this

NEC is working with INTERPOL to reinforce international security against cybercrimes. We have established a certification system of our own Development of professionals and encourage our staff to acquire official qualifications. In a bid to strengthen the global fight against cybercrime, NEC signed a partnership NCP Professional (security) certified staff Holders of CISSP Execution capability/skill level agreement with INTERPOL in 2012 to fight cybercrime in the INTERPOL Global Complex NEC has established the NEC Certified Professional System to certify and other advanced security technology qualifications for Innovation (IGCI) in Singapore. NEC delivered a digital forensic platform and various personnel who have advanced security expertise. NEC also strongly other technical resources for IGCI, which began full operations in 2015. IGCI offers recommends the acquisition of official qualifications for security, and is essential assistance for national authorities in terms of investigating and identifying cyber expanding the number of staff with CISSP*, which is an international Development of the next generation by the community crimes and criminals, research and development in the area of digital crime, and digital certification, Information-Technology Engineers Examination for security. NEC is keen to participate in further collaborations between law enforcement Information Security Specialist, and the Registered Information Security Creation and execution of a staff development framework and the internet security industry to contribute to the stability of security for businesses Specialist qualification. Employees who have advanced skills, work and communities throughout the world. experience and/or certification in the information security field take the Definition of types of security staff lead in providing customers with optimal solutions.

* CISSP Certified Information Systems Security Professional Expanding the breadth of security staff “NEC Security Skill Challenge” ©INTERPOL Image of the Cyber Fusion Centre Developing a community of next-generation experts and implementing a companywide CTF Japan Cybercrime Control Center collaboration ( JC3*) links industrial, academic and public sectors. Security personnel categories

The NEC Group already has a security community made up of over 300 NEC is a full member of the Japan Cybercrime Control Center (JC3), institutes and law enforcement agencies, and the police’s stronger Industry SI-related Professional services-related Advanced cyber security security staff, and follows up on professional development of the next a non-profit organization seeking to reduce cyber space threats by investigative rights. Level 3 generation through means that include holding regular workshops on coordinator Security architect Security planner Security coordinator Security architect Security consultant Security handler Incident analyst Security creating cooperative frameworks between the industrial, academic and JC3’s ultimate aim is to encourage cooperation and information sharing topics such as sharing of intelligence and investigation of technology.

public sectors. among relevant institutions worldwide, so they can pinpoint the source of Level 2 We also hold the NEC Security Skill Challenge, an internal Capture The JC3 promotes a pre-emptive, comprehensive response to cyber threats any threat, and localize or minimize any resulting damage. Flag (CTF) competition open to all employees in the NEC Group. In fiscal by capitalizing on the individual strengths of industry, academic research * NEC’s Executive Vice President and Chief Marketing Officer, Takaaki Shimizu, was appointed JC3’s first Representative Director.

2015 about 600 employees took part, and they tried to solve 100 Level 1 Security problems in two weeks. About half of the participants were not involved Security engineer operator NEC uses its technological expertise and know-how in both ICT in security work. It is through measures like this competition that we are succeeding to increase our base of security experts. and its customers’ businesses to develop robust security measures.

As a comprehensive information and communications technology (ICT) standards to prevent the leakage and falsification of information for NEC is working with government agencies, local governments, and academic institutions vendor, NEC has developed a broad portfolio of hardware and software systems, products, and services, including social infrastructure. NEC to develop security personnel and implement training courses. products. We also have an extensive lineup of solution offerings for many assures security quality by constantly updating its measures for new different businesses that are based on our experience and know-how in cyber attacks that occur daily, while also considering international constructing systems, networks, and providing operations support. It is security standards, standards set by the government, and industry Working with the Singapore government to train cyber security professionals. because we understand the work styles of our customers and have been guidelines. constructing ICT environments for many years that we can succeed in For the era of IoT, NEC will provide a safe and secure ICT environment NEC has contracted with the Singapore Economic Development security of Singapore and surrounding countries, develop personnel reducing security risks. In the various development and operations phases, based on our long-established “Security by Design” concept whereby we Board to accept trainees for the Strategic Attachment and Training with practical skills, and conduct joint research. NEC has established development and operations implementation introduce security measures from the design phase. (STRAT) Programme. This program aims to help improve the cyber

NEC is working on reinforcing social infrastructure by conducting proofs of concept (PoCs) NEC has established a JAIST endowed lecture series to train cyber security engineers. for targeted attack measures in Shinagawa Ward. In 2015, NEC provided an endowment to the Japan Advanced Institute develop cyber ranges (cyberspace training areas), and use them to NEC was an early proponent and is a proactive user of SDN Automatic Cyber Attack Control Solution of Science and Technology for a course entitled “Cyber Range design and develop education programs. The education programs that (Software-Defined Networking). When malware infections, website Organization and Design” to enable advanced research into cyber are developed are made available to other universities and institutions of falsification or other problems are detected, the SDN network control Threat detecting product SDN controller Infected equipment security, and to develop personnel. Course participants research and higher learning. functions automatically implement an initial response, such as isolating the communications of infected client PCs and servers, and moving Incident Cooperating with the MIC’s practical exercise to defend against cyber attacks them to a quarantine network. NEC conducted a joint PoC with Shinagawa Ward to construct new security Since 2013 NEC has been cooperating with the “Experimental exercise to against targeted attacks in a large-scale simulated ICT environment. functions that use SDN, and launched the production system in April 2016. analyze and prevent cyber attacks” conducted by the Ministry of Internal From September 2016, NEC has also been cooperating with CYDER NEC is aiming to strengthen security measures for social infrastructure Detects illegal The infected equipment is Network control cut off from the internal Affairs and Communications (MIC). The purpose of these tests is to have programs for public organizations in 11 areas around Japan, and is through automatic cyber attack control solutions that use SDN. communications network, isolated, system administrators of government and important infrastructure systems helping to improve the incident handling skills of information system and quarantined. conduct Cyber Defense Exercises with Recurrence (CYDER) to protect managers.

6 7 NEC Cyber Security Solutions NEC is strengthening its information, technology, and personnel NEC is developing security professionals with excellent practical skills.

NEC is working with INTERPOL to reinforce international security against cybercrimes. We have established a certification system of our own Development of professionals and encourage our staff to acquire official qualifications. In 2012, NEC signed a partnership agreement with INTERPOL (The NCP Professional (security) certified staff Holders of CISSP Execution capability/skill level International Criminal Police Organization) on global cyber security measures. NEC has established the NEC Certified Professional System to certify and other advanced security technology qualifications The purpose of this cooperation was to investigate and analyze increasingly personnel who have advanced security expertise. NEC also strongly more complex and sophisticated cyber crimes through INTERPOL’s recommends the acquisition of official qualifications for security, and is international network and NEC’s cutting-edge cyber security solutions, to expanding the number of staff with CISSP*, which is an international Development of the next generation by the community strengthen cyber security at the international level. Also in 2015, NEC provided certification, Information-Technology Engineers Examination for core systems for the Digital Crime Centre established in the INTERPOL Global Information Security Specialist, and the Registered Information Security Creation and execution of a staff development framework Complex for Innovation opened in Singapore. Specialist qualification. Employees who have advanced skills, work

experience and/or certification in the information security field take the Definition of types of security staff lead in providing customers with optimal solutions.

* CISSP Certified Information Systems Security Professional ©INTERPOL Image of the Cyber Fusion Centre Expanding the breadth of security staff “NEC Security Skill Challenge” Developing a community of next-generation experts and implementing a companywide CTF Japan Cybercrime Control Center collaboration ( JC3*) links industrial, academic and public sectors. Security personnel categories

6 7 NEC Cyber Security Solutions NEC provides total solutions that include cyber security Integrated control and governance: Systematically managing ICT environments from an administrative point of view. consulting, measures, operations, and incident response.

Fields that require governance are spreading to cloud-based systems and smart devices. NEC uses its system-reinforcing and technology development expertise to create standard solutions to counter Development of ICT in areas such as the cloud and smart devices higher level of regulation, such as access controls that cross increasingly sophisticated cyber attacks, and security measures tailored for entire organizations and systems. has expanded the range of areas that must be covered by company boundaries. In this complicated situation, understanding the security management. Because the boundary between internal and vulnerabilities of client PCs and servers is more important than ever, NEC provides total solutions to suit entire organizations and systems protecting against cyber attacks such as targeted attacks and DDoS external systems has become more ambiguous, there is a need for a and quick response is vital. by focusing on five areas. 1. Consulting to visualize risks by attacks on web systems, as well as incident response; and 5. Internal diagnosing vulnerabilities, propose improvements, and help customers fraud measures to prevent the leakage of information, whether NEC’s “Count management” helps visualize risks. create security policies tailored to their needs; 2. Integrated control deliberate or unintentional. By enumerating and visualizing people, ID numbers, client PCs, To handle the growing number of threats, including vulnerabilities, and governance through which companywide control is implemented NEC also provides security for its customers by reducing the risks servers, and even logs, it is possible to understand what kinds of targeted attacks, and internal information leaks, NEC provides the and security levels are maintained and improved; 3. Platforms that are unique to various businesses through its “Business-specific Solutions” vulnerabilities exist in which locations. Quantification also makes it know-how that it has acquired through the NEC Group and through the base for realizing the created security policies; 4. External attack that include everything from consulting to operations based on our rich easy to quickly determine the degree of risk a company faces, and to its business partners in the form of Proactive Cyber Security measures which cover the operations and monitoring of systems for experience and system construction know-how. prioritize measures. Solutions, which provide pre-emptive measures.

Protecting PCs from viruses and malware Count management Business-specific solutions Countering the risks unique to the government and public, finance, communications, medicine, manufacturing, and educational fields Any deviation in security measure levels becomes a point of In addition, if a client PC without the latest security patches installed vulnerability for cyber attacks. NEC has been using “Count is connected to the internal network or if malware is detected on a management” to visualize security environments. Count client PC, that client PC is isolated and cut off from the internal management enables thorough understanding of which equipment is network by a quarantine network. These and other such measures Integrated control Reinforcement and measure solutions connected to internal networks, making it possible to ensure that all provide valuable peace of mind. and governance client PCs have security software installed.

Security operation Incident response solutions Security-integrated monitoring solutions management Administrative ID and response solutions management External Internal reinforcement solutions Targeted attack measure DDoS attack measure attack solutions solutions fraud Threat and vulnerability measures measures information management Data center access control solutions solutions Email security Web system security NEC provides new “proactive" cyber security measures based on our internal reinforcement solutions reinforcement solutions Integrated ID "Count management" know-how. management solutions Every day, new software vulnerabilities suddenly appear, output daily, and take appropriate and timely action to protect

Integrated log Smart device security Database security Document management security rendering previously secure ICT environments vulnerable and in the company’s networks. Additionally, NEC’s cyber security management solutions need of emergency action. The key to implementing successful experts are continually analyzing the latest threat and Secure PC systems Entrance/Exit control File protection measures is to have the latest information on threats and vulnerability information collected from around the world and Platforms Cyber security vulnerabilities on hand and control risks to your ICT environment. adding it to a “security intelligence” database. NEC uses this personnel development Thin clients Biometric and IC card authorization support solutions NEC has been implementing “Count management” for many “security intelligence” combined with our security platform that Authentication linking Remote access Firewall/IPS years. This technology forms the basis of a platform that allows allows for real time visualization to provide “Proactive Cyber NEC to visualize within one hour which client PCs and servers Security Solutions” that implement proactive and effective among the 180,000 units in the NEC Group are vulnerable or measures before cyber attacks occur. These solution offerings have illegal applications installed according to industry reports are known as the “NEC Cyber Security Platform.”

Consulting Vulnerability diagnosis analysis consulting Information security consulting ICT environment that leverages the cyber security policy

* These total solutions are available only in Japan. proven on NEC’s 180,000-device platform

Consulting: Providing solutions through multifaceted diagnoses Practical knowledge that promotes "visualization" Platform that enables real-time "visualization" NEC Customer's ICT environment

NEC provides support for improving work and creating Calculate number Calculate number of units by version Calculate patch Security Analyze of units by OS of Microsoft Office application ratio organizations through multifaceted diagnoses. Take measures NEC “Cyber Security Management Guidelines” assessment intelligence target before an attack occurs equipment NEC analyzes the entire ICT environments of its customers from The “Cyber Security Management Guidelines” were formulated in NEC’s various angles, confirms the implementation status of existing knowledge December 2015 by METI (Ministry of Economy, Trade and Industry), and Risk Risk security measures, and proposes solutions, including those the independent Information-technology Promotion Agency in Japan. External intelligence related to work improvements and systems operations. These guidelines position cyber security as an important management We also utilize our long experience in operating a CSIRT within task, and summarize the requirements necessary for promotion of the NEC Group, and support our customers by providing measures under the leadership of management. NEC uses these guidelines to assess and clarify the problems of our customers, create emergency responses that assume incidents will occur and policy, and provide appropriate solutions and services. building disciplined organizations.

8 9 NEC Cyber Security Solutions NEC provides total solutions that include cyber security Integrated control and governance: Systematically managing ICT environments from an administrative point of view. consulting, measures, operations, and incident response.

Consulting Vulnerability diagnosis analysis consulting Information security consulting ICT environment that leverages the cyber security policy

* These total solutions are available only in Japan. proven on NEC’s 180,000-device platform

Consulting: Providing solutions through multifaceted diagnoses Practical knowledge that promotes "visualization" Platform that enables real-time "visualization" NEC Customer's ICT environment

8 9 NEC Cyber Security Solutions Platforms: Security infrastructure must be convenient to use. Futureproof Security. Beyond the frontlines of cyber security.

NEC provides infrastructure that functions when and how required to protect your information assets. See where NEC is going in the future. To maintain an ICT environment that supports your business, you security infrastructure that protects confidential trade secrets and need balanced security infrastructure that includes a document customer information while handling external attacks and internal NEC will continue to boost the security of social infrastructure with advanced cyber security management system to protect information assets, physical security, fraud, and also places importance on maintaining convenience for and quarantine systems for PCs that are brought in from outside. users. measures that combine our experience and record of building systems for many customers NEC leverages the operational know-how of the NEC Group to provide with our extensive information, technology, and personnel.

The NEC Group has a network system that External attack measures: It is important to assume that there will be intrusions, Realizing social infrastructure and combine multiple measures to reduce damage. links 180,000 client PCs and servers. To that does not stop, break, maintain the safety of this enormous ICT or malfunction environment, NEC has combined and utilized its original security technologies Automated Security Intelligence Protecting information assets from targeted attacks by using cyber security and HR policies to mount a multilayer defense. and solutions. Based on the technologies Automatic detection of unknown cyber attacks through machine learning and know-how proven in our own systems, Targeted attacks often use unknown malware that cannot be of unknown malware is “multilayer defense.” NEC provides Global deployment of Security detected and removed by conventional antivirus software. When a “multilayer defense” that combines technological measures that we are developing and providing solutions Operation Centers (SOCs) client PC in a company is infected by unknown malware, the quickly detect malware activities, and human-based services such that will protect companies and our social infected client PC must be identified and immediate action taken. as user education and monitoring services. infrastructure. SDN coordination One measure that is effective against theft of information by this type NEC offered the first commercially viable Quarantine networks that use SDN

Quarantine Network System in Japan to Provided the NEC Cyber Security Platform Example of Measures to protect against malware infections detect and isolate unauthorized client PCs 2015 multilayer defense on a network. In addition, NEC was one of Proactive Cyber Security Lightweight 1. Malware detection 2. PC measures 3. Security education and training the first companies to propose and Systemized preemptive cyber security solutions authenticated encryption Email spoofing implement “Count management,” a by utilizing security intelligence Secure computation technology used to quantify and visualize Full operation of the Cyber Security Factory Employees security threats and vulnerabilities. NEC is Supported MIC*’s “Cyber Defense Exercise Targeted corporate network currently developing cutting-edge with Recurrence” project technologies that leverage SDN and * Ministry of Internal Affairs and Communications Confidential Malware artificial intelligence (AI). As a leading Cooperation with INTERPOL information infected client PC company in delivering innovative cyber 2010 Created a “Secure Development Provided an information leak and Operations” system Malware infected site security solutions that create new value, we measure solution 2005 Reinforced information Hard disk encryption, strong 6. Data encryption 5. Illegal communication detected 4. Log management will never stop providing security and leak measures encryption of files, operation log SecureSociety acquisition, thin clients, etc. safety to our customers. Measures to prevent information theft even if a device is infected by malware Proposed “Count management.” Reinforced email measures Systemized security solutions. Developed quarantine network Quarantining unidentified PCs from internal networks. 2000 CSIRT (Computer Security Incident Response Team) launched NEC protects the public web systems that are the face Protecting against ransomware Developed firewall-related technologies of a company. Ransomware is malware that encrypts the data on an infected client There are many cases in which victims turn into inadvertent PC making it impossible to use. The user is then ordered to pay a perpetrators when attackers alter websites by exploiting their ransom in exchange for making the data useable again. Various vulnerabilities and lead users to illegal sites or infect client PCs with security measures are necessary based on the concept of NEC is conducting R&D on technologies that will use AI to automatically detect malware. NEC visualizes the states of web systems and applications, multilayer defense in order to reduce the risk of infection. It is also and quarantine unknown cyber attacks. and proposes measures that classify priorities for new vulnerabilities. important to have backups just in case a system is infected. NEC is looking to the future. One of the Automated Security Intelligence technologies we are developing is “Automated Security Intelligence,” a Learns the normal The current system operation is The scope of damage is analyzed and compared with identified and the affected Internal fraud measures: Measures are necessary for risks that are a tradeoff technology that automatically detects state 1. of the system 2. the normal state to 3. devices are automatically from its overall operation for using the latest ICT to make work more efficient. unknown cyber attacks by using AI, enabling detect anomalies. quarantined from the network. the scope of damage to be ascertained in less than one-tenth of the time required for Automatic detection and quarantining of the damaged area conventional manual analysis. Continuously updating all measures, including security policy creation, education and risk analysis, is indispensable. This technology learns the normal state of a Light log collection, such as Communication network from the complex operations of the program startup and file access flow Email, CD-Rs, thumb drives, cloud storage, and smartphones have Current Files A system to prevent internal information leaks that utilizes deterrent effects entire system, such as the actions of client operating state allowed us to work much more efficiently. On the other hand, ICT Learning of Threat Processes Target PCs and servers (program startup, file the normal state Scope of developments have led to information leaks caused by fraudulent acts Find the person who accessed damage Threat Find the person who took out the data access, communications, etc.), compares by employees or through human error. It is necessary to analyze the the data (automated) and analyzes the normal state of the system Client PC, risks involved in using new devices and services, and continuously Confidential Normal state Comparison Server information with the current state, and detects when the Normal state reinforce measures, such as updating security policies and educating Recipient of Personal information leaked information system acts abnormally. employees. In addition to measures such as access limits, using thin Trade secrets Internal External (Internet) It can also automatically quarantine only the Even unknown cyber attacks are detected in real time. clients, controlling external media and devices, and encrypting data, affected section from the network by using Identifying the scope of damage takes less than one-tenth of the time required introducing operations monitoring and log analysis devices also have Access log Network log Work content Taking media out of Information Living situation the company confirmation for conventional manual analysis. Email attachments Analysis of system management tools and SDN. a deterrent effect. Proxy logs the receiving party

10 11 NEC Cyber Security Solutions Platforms: Security infrastructure must be convenient to use. Futureproof Security. Beyond the frontlines of cyber security.

10 11 NEC Cyber Security Solutions

NEC Cyber Security Solutions help achieve the total Futureproof Security security of clients’ cyberspace, and create a brighter and safer future for all society.

NEC Corporation 7-1,Shiba 5-chome, Minato-ku, Tokyo 108-8001 Issued May, 2017 Cat.No.J03-17050001E