Hello everyone. This is Bot Temori. Why is the leakage of personal information continuing? Today we'll be hearing from Takashi Yonai, an expert in cybersecurity. thank you. thank you . Well, this month in particular, there have been so many cases of unauthorized access and the theft of personal information at major companies that it feels like there isn't a day that goes by without seeing it on the news. No, there isn't . About 23 or 23 of those cases occur every day . Yes, that happens. But since the beginning of this month, there have been securities firms, restaurants, universities, and so on, so it's really more than just a few things, and well, I can't just ignore it, so I'll mention it. There was an incident with the company I belong to, GMO Internet Group, although it's a different company within the group. So, what I want to ask today isn't so much about the cause of the incineration in that particular company, but rather the structural background of why it's stuck there. In a nutshell, what would that be? Hmm. First and foremost, I think we'll see the emergence of AI. The biggest factor is the emergence of AI. As a result, things that humans previously didn't need to bother with or even bother attacking can now be targeted with a single, decisive blow. We sometimes call this "bugnomics," but the number of targets that attackers can profit from has increased. Well, I suppose that's the result. yes. Yeah. So, with the evolution of AI, it was said for a while that the use of AI for malicious purposes would increase. Has the saltiness changed in any particular way recently? Oh, yes. It seems like the number of news stories we can see has really increased. So, while we can sense the changes in the tide, I think no expert has been able to definitively say whether this is truly a bad thing or not. To be honest, we're in a situation where we really don't understand why we're in this predicament. That's right . So, it really feels like the number of sudden closures has increased especially over the past month or two, but I wonder if this situation will continue for a while. that's right . I think so . Well, more than anything, I think there are quite a lot of legacy systems out there in the world. It's not like everything is being developed while spending an enormous amount of money. And when that happens, I think that's definitely going to be the target. Is that what you call a legacy system? Oh, it's a somewhat old system. I think there are companies out there with systems that have been running for 10 years straight, but nobody knows how to maintain them. It's that kind of system. Legacy system. Ah, yes. debt. Ah, so the systems that are being targeted are those so-called legacy systems? That's right. Those aspects are included, plus new things are being implemented, so if you go down that road, it's pretty much anything, but legacy systems in particular haven't been patched, and as a result, there are still vulnerable areas, so they are more likely to be targeted. I see. It's hard to say for sure how long this situation will continue, given that incidents like this are happening with this much frequency. Hmm. Well, I think they'll probably continue selling it for about one to two years. Why is that ? Well, I think that updating or changing the legacy software system, or replacing it with a different new system, takes time. In particular, the systems that company has are the kind that require a budget of one or two years to implement, and that's the kind of speed at which it feels. It's not like it's going to suddenly disappear tomorrow; I think the system will gradually be replaced and it'll only be around for a while before it's gone. Well, the company's cycle is roughly 12 years, so in that sense, I think it will probably last for a year. I see. So, what's happening now is that AI has made it easier to find vulnerabilities. So, if we update and strengthen the legacy systems to a certain extent, then this kind of thing will decrease, right? Well, obviously, if there isn't a weak point like that, an attacker can't launch an attack. The question is why, once that disappears, these kinds of incense will disappear, and at what pace will they decrease? Well, the answer is that it will probably take about 12 years. I see. Ah, so it's like the chase between the attacker and the defender has just caught up. Oh, right. Well, right now the attackers have a huge advantage, so the question is whether organizations that realize this is dangerous and take action can create a situation where the attackers' advantage diminishes. So, I guess that means there are still some options available, right? Well, if all the places were properly locked, I don't think there would be much to steal. Well, if you go there now, it's in a really old state, with only doors that are so old the locks are falling apart, but it would be great if that gradually disappeared through various investments. Yeah. I see. Could you please explain, in a concrete way, the measures that companies and other victims should take, in a way that even a complete novice like me, who has absolutely no knowledge of engineering or anything like that, can understand? I agree. Well, especially with corporate systems, the most important thing is to thoroughly search for vulnerabilities ourselves beforehand . For example, I have a system. Well , if it's a system supplied by another company, or open source, something that's free to use, then there's version information, and if you know the version, you can find out if vulnerabilities have been reported or made public . I looked it up. that's right. Well, you can also use AI to look it up, or something like that, and it will come up if you search that way too, but if you look it up and find anything even slightly suspicious, and it says that there is a security patch update available , then just updating it will be enough to take some precautions. And on top of that, I think there are also systems that corporations have created themselves, but honestly, for those kinds of systems, you should either use AI or ask a specialized company to check if there are any flaws in the system, and if you ask them to do that, they can often identify them, and then you can systematically eliminate them one by one . The difficult part is that, frankly, vulnerabilities already exist in systems all over the place. Fixing it inevitably costs money . Even if you say you're updating the system, if you have to do it without shutting it down, it sounds like it would be a hassle, and if you tell them to rewrite and fix it, well, if foreign and domestic lawyers do it, it can be a hassle, so, well, I'm really sorry to say this, but the difficult point is that it also depends on whether the managers will spend the money properly, and whether they will think, "We've had so many incidents already" There was talk of foreign and domestic vendors, and from what I've heard, even though I'm not an expert, it seems that in Japan, it's quite common to outsource such systems and such to external companies. I've heard things like that, so I wonder if that kind of structure, which is unique to Japan, is related to it? Yes, that's right . Well, that's exactly where I feel a strong sense of concern. For example, when the US and other countries were facing the issue of AI being a serious threat to cybersecurity, the reason they were able to respond so quickly was because they had been developing software internally. Well, in the end, when using AI to review security, flaws emerge, and weaknesses are found, the only thing to do is fix them. And fixing this is essentially equivalent to creating software, so in the cases where there was a team creating the software, the improvements were really completed very quickly. And, as you just mentioned, in Japan, when it comes to software, you often hear about relationships where you ask an outside company, like a systems integrator, to create it for you, and then you bring it in . That's why, even if we want to fix it ourselves, we ca n't. And when you try to fix it, it can cost millions or tens of millions of yen, which I think is one of the structural reasons why it's difficult for Japanese companies to implement security measures now . This is a point where I, as a business owner, really feel the difficulty. Oh really? Ah, the US has quite a few countermeasures in place for this kind of thing . Well, in the US, most enterprise companies, like those that build networks or provide SaaS services, tend to have their own teams. I think the idea was to speed up business, and that increased speed would lead to increased competitiveness . On the other hand, in Japan, while some SaaS companies do have teams for civil wars, it's not a very widespread thing . When you look at the financial sector, for example, there are very few companies that have their own development departments. In fact, many companies have systems subsidiaries that handle development there. It seems that there is a significant structural difference in this area. Yeah. I see. Well, even though there are structural difficulties, technically, reducing the frequency of these occurrences is possible if you explore the possibilities. I agree. Technically, if we had an unlimited budget and could immediately pay to fix any vulnerabilities, then technically, it's relatively easy to find and fix vulnerabilities using AI , so technically, I think it's possible to do it quickly. So, the real focus right now is on whether we can make good investment decisions, or rather, whether things will work out well in that regard. Yeah. Yeah. As you mentioned earlier, while it's technically possible for this to continue for another year or so, there are also unique circumstances in Japan that make it roughly that long. Yeah. I agree. That's when the system department and others might say, "Okay, this is a serious vulnerability and we have to fix it," and well, right now, at this time of year, when we're recording in October, there's the budget for the equipment we want, right? So, I think whether or not we can incorporate this will be the key to whether or not things will change even within this one year. I see. Well, if you just look at the arrangement like this, there seems to be a lot to consider. That's right . Well, in the past, security investments were kind of like insurance, you know, even though no accidents had happened yet, you'd do it just in case something did happen. But nowadays, you're seeing a lot of real damage, aren't you? For example, with the situation this month, if we don't do it now, even suddenly, we'll have a lot of accidents and losses, so I think this is a good time to say, "Let's do it now." That's why, in this situation, I would recommend starting something that you can begin now, rather than focusing too much on the budget. I see. Given the various incidents that have occurred recently, I wonder if there's a possibility that the public's attitude towards AI will become more cautious. Yeah. I don't think there are that many. Well, at this point, it's simply unthinkable not to use AI in cybersecurity. Well, the reason is that if the attacking side is likely to be using it, then in order to keep up with that speed, we have no choice but to use it too. Well, even if we take away one cybersecurity issue, it doesn't mean that everyone should start self-isolating. So, even if we take a step back, that's the situation here. Even though we're doing things like helping the users, we ourselves have become incredibly efficient right now to the point where we think there's no other option but this wave. Well, in that sense, I definitely see this trend continuing with rising bosses. I suppose it means that expectations for AI, or rather, the speed of its development, won't be a brake on it. I agree. In cybersecurity, the attacker is basically always at an advantage. The reason is that they don't have any rules. Well, even if we all say we should regulate it, open weight models are already out there, and there are a lot of movements to turn them into uncensored versions, versions that can be used for bad things. Now that it's out there, there's no stopping it. They already have it in their possession, and no matter how much we all try to refrain from using it, it's impossible now. As long as there are people breaking the rules, this game is basically impossible to stop . So the basic idea is that we should all use AI to protect ourselves, because this is no time for self-restraint, and we must protect ourselves . And today, Anthropic, the company in question, has a program called CVP, which determines which businesses they will provide their cybersecurity models to. They had been restricting access to models for people who are in serious trouble, but they have announced that they will be gradually expanding that restriction. In that sense, I suppose the official side is also taking action. Model providers will likely continue this trend, and I think they'll eventually surpass those who offer cybersecurity models as well. Yeah. I see. Pick and I had a long conversation, and it seems we got along well. I see. We've been hearing about the measures taken at the company level up to this point, but well, even on an individual level, this is quite a complex issue, isn't it? I already have friends who have been directly affected, but what kind of measures can individuals take? Well, the most important thing is protecting personal information, or rather, the kind of data that's currently being leaked. Honestly, the best course of action is to prevent it from being passed on to anyone. Once you hand over your data, I don't think you need to supervise whether that company is managing it properly from that point on. For example, they might ask if you have obtained a P mark from the outside, or there are various other security certifications, right? If you're taking pictures or something, and then you ask if you're using an app, the answer is no, so basically, I think you should input it here. I think the first self-defense measure you can take is to immediately consider whether you really need this just for the sake of eating at a restaurant. And even so, there's no way to take any countermeasures against the data that has already been handed over, since I've registered it too. Me too. I've registered with quite a few different shops, and well, I do think to myself, "If I'm going to be in so many accidents, then maybe I should just do it," but I guess there's nothing I can do about it now. First, I think you should consider where you're going to send the data. Yeah. But in a sense, it's better to assume that anything that's already been redefined and entered has already been leaked. I agree. It really makes you feel like you're living in the current times, doesn't it? Fortunately, most of the news these days is about the leakage of so-called personal data, and it's not like, for example, a massive leak of data uploaded to web storage. Well, we're fortunate right now, but we should anticipate that things other than personal information could be leaked in the future. In that sense, there are various services out there, but it's best to avoid using them as much as possible, or if you absolutely must use them, operate under the assumption that some information might be leaked. I think that's the wisest course of action. Well, if you have any questions about cyber-related matters, I'd appreciate it if you could ask me. thank you. Yes, thank you. I have an announcement for everyone. We are currently accepting votes from our viewers for their favorite pivot content, or "Pivot Vote ." 100 lucky voters will be randomly selected to receive a 3,000 yen Amazon gift certificate. We would be delighted if you would shake your hand and apply. O