- Home
- Sustainability
- Sustainability of the OKI Group
- Information Security
- Strengthening of Information Security
Sustainability
Sustainability of the OKI Group Information Security
Strengthening of Information Security
System for Promoting Information Security
The OKI Group is building a robust IT infrastructure to support its business growth. As part of this effort, we are working to strengthen information security from the perspective of minimizing management risks. As our Risk Management Committee has defined "electronic information leakage" and "cyber attack" as common risks, we have made it clear that measures for information security are an important part of management and we are proceeding with them.
Based on the OKI Group Security Basic Policy, the OKI Group has established a system to ensure information security and works to properly manage and protect company and customer information. OKI's Information Planning Division reviews all activities related to information security, and each business unit or group company has a information security promotion team that is responsible for addressing the measures decided by OKI's Information Planning Division.
We have also established relevant rules and regulations for information security. We have examined customer information and data to be processed within the group, defined the types of information to be treated as confidential, and formulated regulations, administrative instructions and guidelines related to the processes of acquiring, generating and discarding such information.
System for Promoting Information Security
Regulations and Rules Related to Information Security
Three Perspectives of Information Security System
In the OKI Group we use the three perspectives shown in the diagram below to broadly promote information security measures for computers, networks and information systems.
Unauthorized Access to File Server
In November 2021, OKI confirmed that a third party gained unauthorized access to our file server in Japan via an overseas subsidiary. The OKI Group takes this incident seriously and has taken measures to strengthen our security measures, including the introduction of suspicious behavior detection mechanisms and the establishment of a monitoring system for all Group computers and servers. To prevent a recurrence, we will adopt more advanced security measures, such as enhanced authentication infrastructure and domestic and overseas security controls.
Information Security Education
As part of its systems for information protection, the OKI group offers information security education to all employees who use the information infrastructures belonging to the group. Each and every individual is asked to thoroughly protect information assets received from customers as well as highly confidential information assets belonging to OKI. For this reason, we widely communicate basic regulations and rules, and company standards regarding the use of our information networks, desktop computers and mobile computers through group training sessions and e-learning programs.
In fiscal year 2021, information security training was provided to all employees by e-learning in August. Closely related to this is personal information protection, for which we also provided training at the same time, and almost 100% of employees received this training.
Sharing and Remedying Issues with Suppliers
Aiming at an improved information security level across the supply chain, we at OKI continuously verify how information security measures are implemented at suppliers to whom we provide critical confidential information. Here, we ask our suppliers to carry out self-evaluations and to score themselves based on check lists prepared by us. In this way, suppliers and OKI are sharing issues and remedying any problem points found.
OKI-CSIRT for Prompt Response to Security Incidents
We have established an organization specializing in security incident response called OKI-CSIRT(*1), which collaborates with external organizations, such as the Nippon CSIRT Association, CSIRT in other companies and ministries/agencies, in order to enhance our preventive measures against threats to computer security in the group and improve our capacity to respond to them.
In fiscal year 2020, we conducted training in accordance with the incident response manual and worked to strengthen our ability to respond to cyber attacks.
- *1 CSIRT:Computer Security Incident Response Team
Enhanced Actions at Overseas Sites
The OKI Group has promoted information security measures at overseas sites, including such actions as laying down information security guidelines in each country and region, appointing security managers at each site, and adopting control tools.
In fiscal year 2021, we introduced EDR(*2) solutions at all our overseas subsidiaries. We are continually working to strengthen security measures, through improving unauthorized access security controls, introducing asset management tools, and updating rules and regulations.
- *2 EDR:Endpoint Detection and Response (technology that continuously monitors and responds to threats at the endpoint (terminal) of a computer system)
Acquisition of ISMS Certification
The OKI Group has acquired the ISMS(*3) certification for divisions involved in building and operating internal information systems, and for divisions engaged in general system design development, in order to improve the reliability of network solution construction and related services. We are continually working to increase the number of Japanese OKI Group subsidiaries with ISMS certification. In fiscal year 2021, one new Japanese subsidiary acquired ISMS certification, so strengthening their information security (as of October 2022).
- *3 ISMS:Information Security Management System
Reports on misuse of public research funds and misconduct related to research
activities can also be filed from the page that opens when you click the above button.