Japan outlines measures to protect infrastructure from cyberattacks

The Japanese government has drafted guidelines outlining 150 measures to bolster cybersecurity for companies managing critical infrastructure. Despite the protection offered by closed networks disconnected from the internet, the draft cautions that these systems are not entirely safe. Following a string of ransomware attacks, the draft advises businesses to secure cybersecurity insurance to mitigate the substantial financial consequences of such incidents.

The government solicits public comments on the guidelines until Wednesday, with plans to revise and release the final version by the end of September. It hopes that industry groups and government agencies will incorporate these guidelines into their safety standards. The draft applies to 15 sectors identified as critical infrastructure, including finance, railways, electricity, and postal services, which are set to join in October.

The draft acknowledges that cybersecurity is a management issue crucial to a company's survival and is difficult to completely safeguard against cyberattacks. It encourages companies to enhance their recovery capabilities, preparing for the potential of system failures. The draft warns against complacency, advising against overconfidence due to reliance on closed networks, dedicated operating systems, or unique technical specifications.

In addition to recommending cybersecurity insurance, the draft advises companies not to pay ransoms during attacks. It specifically addresses threats from advanced AI models like Claude Mythos, urging the swift enhancement of defense measures, including the use of sophisticated AI systems. Furthermore, the draft calls for the adoption of postquantum cryptography (PQC), which is resistant to quantum computer attacks, by as early as 2035.