Japan's National Cybersecurity Office warned operators of websites and mobile apps on November 5 that basic security measures are falling short, after a run of personal information leaks. The office, part of the Cabinet Secretariat, said it had confirmed multiple recent leak cases that appear to have been caused by inadequate basic defenses.
Attackers are surveying websites at scale to find systems they can break into and steal personal data from, the office said. It assesses that AI is highly likely being used for that scanning and intrusion. Combining several flaws that conventional vulnerability assessments rated as relatively low risk can open a way into a system, and makes it easier to scale up attacks, it said. That has put a wide range of businesses in the crosshairs.
The office also pointed to shortcomings on the operators' side. It cited weak security in mobile app development, misconfigured websites, and continued use of software that has reached end of support or carries unpatched known vulnerabilities.
Three areas of advice
The guidance covers three areas for businesses that run websites or mobile apps and handle personal information. The first is operations and management. The office asks operators to map the software they use and its vulnerabilities, then set priorities and deadlines for fixing them. It cited cases where management screens exposed to the internet were broken into through easily guessed passwords or brute-force attacks, and called for unnecessary admin screens and features to be kept offline.
It also flagged attacks that use AI to hunt for vulnerabilities. Operators should run continuous vulnerability assessments, using AI among other tools, and monitor logs for suspicious behavior.
The second area is design and development. The office calls for security by design — building protection in from the start. It said it has confirmed cases where analyzing a public app let attackers pull data improperly through its API, and asked for access limits and proper management of credentials. Systems handling personal information should be checked for vulnerabilities before release.
The third covers intrusions through the supply chain, including contractors. Attackers sometimes use a contractor's or maintenance provider's environment as a foothold to reach the company that hired them. The office asks operators to identify connection routes such as VPNs and remote desktops used by contractors and to introduce multi-factor authentication.
For open-source software (OSS) and external libraries, it asks operators to decide in advance how they will respond when a serious vulnerability is disclosed.
The office issued separate guidance on October 9 calling for organization-wide basics, including prompt application of patches and multi-factor authentication. The latest notice extends that advice to how websites and mobile apps are built and run.