Information Security Sustainability

The information assets of any company are a constant security risk, with exposure potentially impacting many stakeholders. Recognizing that ensuring information security is an important social responsibility of companies, GOLDWIN formulated and implemented its Basic Policy on Information Security in March 2008. In view of current trends such as accelerating globalization of business and expansion of e-commerce channels, we revised this policy in October 2021 and developed a management framework that is more in tune with these changes. Our aim is to increase awareness of these diverse risks among all officers and employees, to maintain and improve information security, and to become a more trusted company in society.

Training for Targeted Email Attacks

In FY 2022, we conducted two drills for targeted email attacks to raise employee perception of cyberattacks as being a risk that can affect them.

In recent years, there has been a spate of cases in which important information has been stolen or ransom money demanded from specific companies and organizations through targeted email attacks, as well as cases in which money has been extracted through scam business emails. We have also received similar emails. As a measure to combat this, the Information Security Committee Administrative Office sent a mock email attack to employees as a training exercise. By actually exposing employees to targeted email attacks, they will learn not to open suspicious emails, not to click on URLs in the body of suspicious emails, and not to open attachments, thereby reducing the risk of virus infection, information leaks, and other problems. Employees who opened the attached files during both drills are required to retake the e-learning course and undertake other education.

To strengthen companywide management of information assets under this new framework, it is important that we restructure our management rules. In FY 2021, we began working to understand the situation with internal management of information assets as the first step toward achieving this goal. After asking each division about which information assets they hold and how they are currently managing them, we have been analyzing the status of operations.

Under the GOLDWIN document handling rules, we have defined three standards: Strictly Confidential, Confidential, and For Internal Use Only. In FY 2021, we conducted a survey of personal information and other information classified as Strictly Confidential, which requires the highest level of control, and in FY 2022, we conducted an inventory of information assets by expanding the scope to include Group companies. Going forward, we will clearly identify our information assets to ensure documentation, companywide uniformity, and compliance with the management rules.

Furthermore, in addition to our commitment to information asset management, we are also working to strengthen restrictions on the use of USB memory devices. We clarified the criteria for approved use, and we reexamined devices that have already been approved. In FY 2023 onward, restrictions on USB use will be further strengthened, including limiting PCs to which USB memory devices can be connected.

When information security incidents occur, it is extremely important to receive a prompt report from the relevant person, and to respond as an organization. In August 2021, we established and began operating a new Information Security Incident Support Center in preparation for such a situation. In FY 2022, there were 25 inquiries, of which 21 were about spam emails. We are also explaining to all employees that if they find an incident potentially leading to an information leak, they must report it to their division superior and contact the support center immediately.

With the importance of information security continuing to increase, we will improve the level of management in terms of technologies, operations, systems, and education going forward. We will also establish appropriate management indicators as we steadily advance our objectives.

From next fiscal year, we plan to assess risks related to the essential computers, networks, and other devices we use for business, and to investigate priority measures. In addition, we plan to further strengthen our systems by securing specialists in information security management and establishing a dedicated organization.