Closing Keynote: Future Cybersecurity Strategy - Active Cyber ​​Defense, Human Resource Development, and More

Closing Keynote: Future Cybersecurity Strategy - Active Cyber ​​Defense, Human Resource Development, and More

Speakers: Kazutaka Nakamizo, Deputy Director-General, National Cybersecurity Office (NCO), Cabinet Secretariat, Government of Japan

Conference: CODE BLUE

YouTube: https://www.youtube.com/watch?v=uWw6lOUq9ns

Overview

In a compelling closing keynote at CODE BLUE, Kazutaka Nakamizo, Deputy Director-General of Japan's newly established National Cybersecurity Office (NCO), unveiled Japan's forward-looking cybersecurity strategy. The talk, titled "Future Cybersecurity Strategy - Active Cyber ​​Defense, Human Resource Development, and More," provided a comprehensive overview of the nation's ambitious plans to counter escalating cyber threats. Nakamizo-san detailed a multi-faceted approach encompassing new legislative frameworks, significant institutional reforms, and a strong emphasis on public-private collaboration to enhance national cyber resilience.

The presentation underscored Japan's recognition of cyberattacks as not merely technical incidents but as critical challenges impacting national security, economic stability, and the daily lives of its citizens. By introducing concepts like Active Cyber Defense, a modernized cybersecurity strategy, and a robust Human Resource Framework, Japan is positioning itself to proactively address the qualitative and quantitative increase in cyber threats. This strategic pivot reflects a global trend towards more assertive national cybersecurity postures, while also emphasizing a commitment to a free, fair, and secure cyberspace rooted in democratic principles.

Background

▶ Watch: Introduction of speaker and talk topics (0:00)

The impetus for Japan's updated cybersecurity strategy stems from a stark recognition of the evolving threat landscape. Nakamizo-san highlighted a significant escalation in both the sophistication and volume of cyberattacks. Historically, cyber threats primarily targeted publicly exposed internet servers, with website defacement being a common form of attack. However, the landscape has dramatically shifted, witnessing a surge in IT system intrusions leading to severe consequences such as system failures and ransomware demands. More concerning is the increasing penetration of critical infrastructure systems, often interpreted as preparatory actions to disrupt essential services during emergencies. These advanced attacks are notoriously difficult to detect and mitigate.

Quantitative data from Japan's National Institute of Information and Communications Technology (NICT) further supports this alarming trend, showing a consistent year-on-year increase in attack-related network traffic. Nakamizo-san cited two high-profile incidents that underscored the urgency of the situation: the July 2023 ransomware attack on Nagoya Port, which halted cargo handling for three days and significantly impacted logistics for major corporations including Toyota, and DDoS attacks in late 2023 and early 2024 that temporarily disrupted airline reservation systems and financial online services. These incidents not only caused substantial economic damage but also raised profound concerns about the resilience of Japan's critical infrastructure. The speaker emphasized that individual enterprises are increasingly unable to cope with these advanced threats alone, necessitating a collaborative, whole-of-society approach involving robust public-private partnerships. This collective vulnerability forms the bedrock of Japan's new, proactive cybersecurity stance.

Key Findings

▶ Watch: New government structure for cyber defense implementation (15:30)

The talk presented several critical findings and outlined Japan's strategic responses to the evolving cyber threat landscape:

• Introduction of Active Cyber Defense (ACD): Japan is enacting new legislation to establish an ACD framework. This framework is built upon three pillars: public-private partnership, utilization of communication information, and remote access and neutralization capabilities. This represents a significant shift towards a more proactive and assertive national cyber defense posture.
• Strengthened Institutional Framework: The establishment of the National Cybersecurity Office (NCO) in July and the enhanced authority of the Cybersecurity Strategy Headquarters signal a more centralized and powerful government role in coordinating national cyber defense efforts, with the Prime Minister now at its helm.
• Enhanced Critical Infrastructure Resilience: New national standards for critical infrastructure security are being developed, aiming to elevate the baseline security posture across 15 vital sectors and promote higher-level defenses for high-risk areas.
• Preparation for Post-Quantum Cryptography (PQC): Recognizing the future threat of quantum computing to current cryptographic standards, Japan is developing a roadmap for the transition of government information systems to PQC, with a goal to publish this roadmap by the end of the year.
• Comprehensive Human Resource Development: A new Human Resource Framework is under development to categorize cybersecurity roles, define required skills, and visualize career paths, addressing the persistent talent gap and fostering a more robust cybersecurity workforce.
• New National Cybersecurity Strategy: A long-term strategy outlining Japan's vision for a free, fair, and secure cyberspace, underpinned by five core principles and three strategic pillars, is being finalized to guide future policy.
• Emphasis on Public-Private Collaboration: A recurring theme throughout the presentation was the critical importance of a robust ecosystem of public-private cooperation to effectively counter sophisticated cyber threats, acknowledging that neither government nor private entities can manage these challenges in isolation.

Technical Deep Dive

▶ Watch: Plans for Post-Quantum Cryptography (PQC) migration (28:50)

The core of Japan's future cybersecurity strategy lies in the new legal framework for Active Cyber Defense (ACD), which empowers the government with unprecedented capabilities to protect national interests. This framework is meticulously designed around three integrated pillars:

1. Public-Private Partnership (官民連携): Acknowledging the limitations of isolated defense, this pillar mandates enhanced cooperation.

• Reporting Obligation: Over 250 designated Critical Infrastructure Operators (機関インフラ事業者), primarily large corporations, will be legally obligated to report cybersecurity incidents to the government. This also includes a requirement to register their IT assets, providing the government with a comprehensive overview of critical systems.
• Consultative Councils: Beyond mandatory reporting, Consultative Councils will be established to facilitate two-way information sharing. These councils will extend beyond critical infrastructure operators to include a broader range of companies and organizations, fostering a wider collaborative ecosystem for intelligence exchange and coordinated response. The goal is to leverage collective strength, recognizing that the government alone cannot effectively counter advanced threats.

1. Utilization of Communication Information (通信情報の利用): This pillar grants the government authority to analyze internet traffic to identify and understand malicious cyber activities.

• Scope of Acquisition: The focus is on acquiring and analyzing machine-related information and metadata from internet traffic. Crucially, the speaker explicitly stated that this does not involve viewing the content of individual users' communications, emphasizing privacy protection. The aim is to detect attack sources, understand attack methodologies, and identify malicious servers.
• Privacy Safeguards: To prevent misuse, the acquisition of communication information will require prior approval from an independent body. This independent oversight is a key component of the system design, ensuring that analyses are conducted appropriately and with due consideration for user privacy and communication secrecy. Comprehensive analysis of this collected information, combined with data from public-private partnerships, will then be used to actively share intelligence with the private sector to bolster overall national cyber resilience.

1. Remote Access and Neutralization (アクセス無害化): This is perhaps the most assertive component, allowing the government to directly intervene against attacker infrastructure.

• Authority Granted: In cases where a cyberattack is deemed to pose a significant threat, the Police and Self-Defense Forces will be granted the authority to remotely access and neutralize the attacker's server. This measure is intended as a last resort to prevent widespread damage.
• Strict Governance: Similar to communication information utilization, the exercise of remote access and neutralization powers will require prior approval from an independent body to prevent abuse. In urgent situations where immediate action is required and prior approval is not feasible, ex-post facto reporting and review mechanisms will be in place to ensure accountability and necessity are rigorously checked. This ensures that while proactive measures are taken, they are subject to robust governance.

These three pillars are not intended to function in isolation but as an integrated system, all aimed at the singular objective of protecting national life, economic activities, and the foundations of society from cyber threats.

Beyond the ACD framework, Nakamizo-san detailed significant institutional reforms to support this new strategy:

• Cabinet Cyber Security Officer (内閣サイバー官): A new position established in July within the Cabinet Secretariat, serving as the "commander" for the operation and implementation of the ACD legal framework. This officer also concurrently holds the position of Deputy Director-General of the National Security Secretariat (NSS), ensuring close alignment between cyber and national security policies.
• National Cybersecurity Office (NCO): Also established in July, the NCO (the speaker's own department) is an enhanced successor to the former National center of Incident readiness and Strategy for Cybersecurity (NISC). The NCO acts as the central coordinating body for the Cabinet Cyber Security Officer and the broader government.
• Cybersecurity Strategy Headquarters (サイバーセキュリティ戦略本部): This critical body has seen its authority and functions significantly strengthened. Previously chaired by the Chief Cabinet Secretary with six cabinet ministers and private experts as members, it is now chaired by the Prime Minister himself, with all Cabinet members participating. This structural change emphasizes a whole-of-government approach to cybersecurity.
• Expert Council (専門家会議): To ensure policies are informed by diverse perspectives, an Expert Council has been established to gather input from private sector specialists and academia, feeding directly into the Cybersecurity Strategy Headquarters.
• NCO's Expanded Role: The NCO serves as the secretariat for the Cybersecurity Strategy Headquarters, coordinates policies across various ministries, develops security standards, and acts as a central incident response function for the entire government.

The phased implementation of the ACD legal framework was also outlined: the independent oversight body is expected to be established by Spring next year; the public-private partnership and remote access/neutralization components will become effective by Autumn next year; and the communication information utilization part is slated for Autumn 2025. This gradual rollout allows for careful preparation and establishment of the necessary operational frameworks.

Further initiatives include new Critical Infrastructure Security Standards for 15 sectors, developed by the Cybersecurity Strategy Headquarters and implemented by five key ministries (Financial Services Agency, Ministry of Internal Affairs and Communications, Ministry of Health, Labour and Welfare, Ministry of Land, Infrastructure, Transport and Tourism, Ministry of Economy, Trade and Industry). These standards aim to raise the overall security baseline for thousands of operators and prioritize higher security levels for high-risk areas, focusing on information sharing, drills, HR development, and executive awareness.

Japan is also proactively addressing the threat of Post-Quantum Cryptography (PQC). A roadmap for the migration of government information systems to PQC is set to be published by the end of the year, with a target transition deadline around 2035, aligning with international trends. This involves creating a crypto inventory of where encryption is used, performing risk assessments, and developing detailed migration plans to counter "Harvest Now, Decrypt Later" attacks.

Finally, a Human Resource Framework is being developed to categorize cybersecurity job roles and define the specific knowledge, skills, and tasks required for each. This framework aims to reduce mismatches in hiring, enhance the effectiveness of training programs, and provide clear career paths for cybersecurity professionals, fostering an environment where talent can thrive. The overall New Cybersecurity Strategy reiterates a vision for a free, fair, and secure cyberspace, guided by principles of free information flow, rule of law, openness, autonomy, and multi-stakeholder cooperation, with the government taking a more active, supportive role rather than a controlling one. Its three pillars are: enhanced cyber defense and deterrence (via ACD), strengthened societal cyber resilience (across government, critical infrastructure, and supply chains via secure-by-design principles), and fostering a robust human resource and technology ecosystem (leveraging AI and quantum technologies).

Demo / Proof of Concept

▶ Watch: Developing a cybersecurity human resource framework (31:30)

While the talk primarily focused on strategic and policy initiatives, there was no direct technical demonstration or proof of concept for the Active Cyber Defense capabilities or other government security measures. However, Nakamizo-san did highlight an initiative related to human resource development: the International Cybersecurity Challenge (ICC) Tokyo 2025. Japan, through the NCO, recently hosted a preliminary event for the ICC, a global Capture-the-Flag (CTF) competition aimed at young, talented individuals. The event featured a unique gamified visualization using animated characters to represent teams and their progress, making the competition more engaging. Crucially, the event also invited elementary, junior high, and high school students to observe and participate in security workshops, with the explicit goal of inspiring the next generation of cybersecurity professionals and serving as a catalyst for their interest in the field. This demonstrates a commitment to practical engagement in talent development, even if not a technical PoC of the government's direct defensive capabilities.

Defensive Implications

▶ Watch: Q&A: Specific types of cybersecurity talent needed (42:20)

The detailed strategy outlined by Nakamizo-san carries significant implications for various stakeholders across Japan and potentially serves as a model for other nations.

For Critical Infrastructure Operators (機関インフラ事業者), the new legislation introduces mandatory incident reporting and IT asset registration. This necessitates a proactive approach to cybersecurity, including robust internal incident response plans and comprehensive asset management. Engagement with the newly formed Consultative Councils will be crucial for information sharing and collaborative defense, moving beyond a siloed approach to security.

For the broader ecosystem of important infrastructure (数千、数万の事業者), which extends beyond the 250+ critical operators, the upcoming national security standards will demand a collective elevation of cybersecurity posture. Organizations in these 15 sectors must prepare to adopt new criteria, which will likely involve increased investment in information sharing mechanisms, regular drills and exercises to enhance incident response capabilities, dedicated human resource development programs, and crucially, raising cybersecurity awareness among executive leadership. The government's intent to evaluate each ministry's progress and demand improvements through a PDCA (Plan-Do-Check-Act) cycle suggests a sustained push for higher standards.

The government's new capabilities to utilize communication information (metadata) and conduct remote access and neutralization against attacker servers, while subject to independent oversight, means that malicious actors targeting Japan will face a more proactive and capable adversary. Defenders should understand that the government will possess enhanced threat intelligence, which, through public-private partnerships, can be leveraged to inform defensive strategies.

The emphasis on Post-Quantum Cryptography (PQC) migration is a long-term, but critical, defensive implication. Organizations, especially those handling sensitive or long-term confidential data, should begin their own crypto inventory and risk assessment to prepare for the transition to quantum-safe algorithms. The government's roadmap will provide a crucial starting point for these efforts.

Finally, the focus on Human Resource Development and the creation of a Human Resource Framework offer opportunities for cybersecurity professionals. Clearer career paths and skill definitions will enable more targeted training and recruitment, potentially alleviating the talent shortage. Organizations should leverage this framework to better define roles, develop their workforce, and foster an environment where cybersecurity talent can thrive. The overall message is clear: cybersecurity is a collective responsibility, requiring integrated efforts from government, industry, and individuals to build a resilient and secure digital society.

Key Takeaways

• Proactive National Cyber Defense: Japan is implementing a robust Active Cyber Defense framework, backed by new legislation, which includes public-private partnerships, communication information analysis (metadata only), and remote neutralization capabilities against attacker infrastructure.
• Strengthened Government Leadership and Coordination: Significant institutional reforms, such as the elevation of the Cybersecurity Strategy Headquarters (chaired by the Prime Minister) and the establishment of the National Cybersecurity Office (NCO), aim to centralize and enhance government-wide cybersecurity efforts.
• Comprehensive Resilience for Critical Infrastructure: New national standards are being developed to elevate the cybersecurity posture of thousands of critical infrastructure operators across 15 sectors, emphasizing information sharing, drills, HR development, and executive awareness.
• Strategic Preparation for Future Threats: Japan is proactively addressing emerging threats like quantum computing by developing a roadmap for the transition to Post-Quantum Cryptography (PQC) in government systems, with a target migration by approximately 2035.
• Fostering a Robust Cybersecurity Talent Ecosystem: A new Human Resource Framework is being developed to categorize roles, define skills, and visualize career paths, aiming to reduce the talent mismatch, enhance training effectiveness, and create a supportive environment for cybersecurity professionals.
• Public-Private Collaboration as a Core Principle: The overarching strategy emphasizes that countering sophisticated cyber threats requires an integrated public-private ecosystem where government and industry collaborate closely on information sharing, threat analysis, and coordinated response.

About the Speaker(s)

Kazutaka Nakamizo serves as the Deputy Director-General of the National Cybersecurity Office (NCO) within the Cabinet Secretariat of the Government of Japan. His extensive career in information and communication policy began in 1993 when he joined the former Ministry of Posts and Telecommunications. At the Ministry of Internal Affairs and Communications, he played a pivotal role in shaping key legislation and policies, including the Unfair Access Prohibition Law, privacy protection in the telecommunications sector, and regulations concerning platform services. Since 2020, Nakamizo-san has been dedicated to cybersecurity measures, serving as the Deputy Director-General of the National center of Incident readiness and Strategy for Cybersecurity (NISC). In this capacity, he significantly contributed to the development of cyber security assurance systems, the promotion of national accounts, and the initial efforts towards realizing active cyber defense. In July of the current year, with the establishment of the National Cyber Governance Office, he assumed a central leadership position, overseeing Japan's overarching cyber strategy.