Bridging Cultures: Collaboration of the US/Global and Japanese Financial Communities

No ratings

Presented at FirstConferenceKualaLumpur 2018 by

Natsuko Inui

As part of FS-ISAC’s global team, Natsuko works with colleagues in the Asia Pacific region to foster the community in sharing, collaboration and engagement in the Asia Pacific region. Previous to FS-ISAC, she was an analyst at Cyber Defense Institute involved in government research projects regarding incident response and cyber exercises. She continues to work with the CSIRT community in Japan and internationally, and is also Vice Chair of the Nippon CSIRT Association, the CSIRT community of Japan.Two very different countries, Japan and the United States, have established their own sharing communities and frameworks, but are also working to share and collaborate. The Financial Services Information Sharing and Analysis Center (FS-ISAC) and Financials ISAC Japan (FIJP) first signed a sharing agreement in 2015, and continue to work together to collaborate to benefit the global community. This presentation will give a brief history and overview on each of the communities, our similarities and differences, and what the sharing agreement enabled to start the collaboration. Screenshots of messages/alerts and files that have been shared daily/weekly and the initial sharing criteria will be presented to the audience. Once the sharing kicked off, the two organizations came to gradually understand the strengths and needs, which lead to a major change in the information that is translated and shared on a daily basis. For example, FS-ISAC at first believed the indicators would be most useful, but turned out to be one of the least useful kinds of information to the Japanese community. The presentation will also talk about the gradual dialogue between the two communities to change the daily/weekly information sharing. Screenshots and examples will also be shown for the new content. Other than daily/weekly sharing, the two are working on working group collaboration. Each ISAC has their own set of committees and working groups that work on various issues and producing papers. The talk will cover efforts on working group collaboration and making each other's documents available in the other language and culture.Finally, some good practices, along with the struggles and difficulties we face will be addressed. Some of the struggles would be TLP definition differences and declassifying, maturity levels and how that connects to needs, how to ask for honest feedback, and language barriers. Some actual examples of what we couldn't share and why will be presented. As ISAC members are often deeply involved with incident response, collaboration between the two ISACs is for the benefit of the incident responders globally, and is a work in progress as the threats, communities and all involved change and evolve. This presentation will give some insight into an actual ongoing collaboration between two different incident responder communities.