Resilience

Collection and Utilization of Global Threat Information

NTT has joined the Joint Cyber Defense Collaborative (JCDC), a U.S. government cybersecurity and resilience initiative, as its first Asian member.

Established by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) in 2021, the JCDC is spearheading the collaborative development of cyber defense plans, information sharing on cybersecurity, and the dissemination of cyber defense guidance to reduce risks to critical infrastructure and essential national functions. Private sector members include major telecommunication companies, technology giants, and major security companies, such as AT&T, Verizon, Lumen, Microsoft, Google, Cisco, Mandiant, and Palo Alto Networks. Moreover, U.S. government intelligence agencies and cybersecurity-related departments from countries allied with the U.S. are also participating. By leveraging the global intelligence gained from the JCDC, NTT can offer more effective protection of vital information networks and improved responses to cyber incidents. Additionally, sharing information with other JCDC members enables NTT to further advance its own cybersecurity initiatives.

Building on our existing foundation of trust and collaboration with CISA and the U.S. government, we will contribute a unique Asian perspective to the JCDC while sharing NTT's leadership along with its expansive global experience and specialized expertise in security. In an era of continued global uncertainty surrounding cybersecurity, we firmly believe that a collaborative approach between the public and private sectors in cybersecurity is essential, not just in the United States but also globally, to defend against cyberattacks that threaten the critical social infrastructure upon which our daily lives depend.

Red Team

NTT formed a Red Team in 2019. A Red Team conducts simulated cyberattacks from the perspective of external attackers. In the realm of cybersecurity, it is a never-ending game of cat and mouse, with new types of attacks emerging no matter how much one defends. Moreover, while attackers only need to succeed once with any variety of assaults, defenders must block every single one, creating an imbalance that favors the attackers. To address this challenge, NTT's Red Team was established to formulate countermeasures from the attacker's viewpoint. The ultimate goal is to improve defensive capabilities; the activities are not limited to just conducting simulated attacks. The Red Team's activities also include analyzing and reporting vulnerabilities and organizational challenges in the targeted systems after the simulated attack and even providing actionable advice for improvement. In some cases, the team may assist with implementing these improvements.

Bug Bounty Program

NTT began a Bug Bounty Program on a trial basis in 2022 and fully launched it in 2023. A bug bounty is a reward given to individuals who discover security loopholes in an information system. NTT has implemented this program with two specific aims.

1) To identify and rectify vulnerabilities before they can be exploited by malicious third parties, thereby enhancing the overall security posture of the NTT Group.

2) To offer employees who participate an avenue to refine their security skills from an attacker's viewpoint, thereby nurturing the development of security talent.

The trial phase demonstrated that the program not only contributed to enhancing corporate security, but also helped in discovering undiscovered security talent and further honing their skills. Although fully operational only since 2023, the program will be continually refined, and we aim to broaden the understanding that improving security is a collaborative effort involving all employees.