In order to prevent damage from ransomware and other threats, it is important not only to introduce security products, but also to take into consideration operational aspects such as alerts and incident response, and guidelines can be used to achieve this. We focused on the Japan Automobile Manufacturers Association/Japan Automobile Parts Manufacturers Association Cybersecurity Guidelines, which were created for the automotive industry. These guidelines specifically describe necessary measures not only for the automotive industry but also for general IT environments, and can be used by companies outside the automotive industry as well. In this session, we will use these guidelines as a basis to explain what security monitoring operations should be like today, while also discussing recent threat trends.

Nowadays, as cyber attacks become more diverse and sophisticated, it is becoming more difficult to prevent intrusions 100%, and "incident response" is becoming more important than ever. In particular, in order to keep up with the speed at which attackers invade and expand, which is getting faster every year, it is necessary to implement incident response "fast" and "accurately". In this session, we will introduce the threat hunting and incident response service that supports "fast" and "accurate" incident response, and the technology of Team T5, Inc., a threat intelligence vendor from Taiwan that realizes this, with examples from domestic companies.

Cyber-attacks such as ransomware have recently penetrated deep into corporate networks through a variety of entry points and intrusion routes. In order to respond to these attacks with limited resources, many companies tend to use services that outsource product monitoring and operation along with the introduction of countermeasure products. However, outsourcing each product to a different service provider has resulted in more complicated alert responses and delays, causing headaches for corporate security staff. In this session, we will introduce "Macnica Integrated SOC Service," which provides support for finding, identifying the scope of impact, and responding to threats that affect companies, based on cross-sectional monitoring and analysis of effective products against recent threats.