A new phase for IoT cybersecurity in Japan

As cybersecurity supervision of IoT products tightens worldwide, Japan is accelerating work on its own assessment system for connected products: JC-STAR (Japan Cyber-Security Technical Assessment Requirements).

Background

The scheme is promoted by the Information-technology Promotion Agency (IPA) and aims to raise the overall cybersecurity level of IoT products on the Japanese market by establishing a unified labelling and assessment mechanism.

From the EU CRA and the UK PSTI to the US Cyber Trust Mark and Japan's JC-STAR, a new global trend is taking shape:

"Cybersecurity capability is becoming a competitive differentiator and a market requirement for connected products."

What is JC-STAR?

JC-STAR is Japan's cybersecurity labelling and assessment system for IoT products.

Its core objectives are to:

· Raise baseline cybersecurity capability in IoT products;

· Reduce the security risk of connected devices;

· Encourage companies to establish vulnerability management mechanisms;

· Strengthen software updates and lifecycle security management;

· Help consumers identify secure products.

The launch of JC-STAR signals that the Japanese market is paying increasing attention to:

· Cybersecurity;

· Data protection;

· Vulnerability response;

· Software updates;

· Lifecycle security.

Global IoT security regulation is moving fast

Security incidents involving connected products have continued to rise in recent years:

· Cameras taken over remotely;

· Routers implanted with malicious code;

· Data leaks from smart home devices;

· Mass attacks enabled by default passwords;

· Long-unpatched devices becoming attack entry points.

Countries are therefore gradually establishing cybersecurity management systems for connected products.

The main frameworks worldwide now include:

· The EU CRA;

· The UK PSTI;

· ETSI EN 303 645;

· The US Cyber Trust Mark;

· Singapore's CLS;

· Japan's JC-STAR.

In future, IoT cybersecurity capability will increasingly become:

· An integral part of product development capability;

· An important indicator in international competition;

· A key reference for overseas customers when purchasing.

Which products need attention?

JC-STAR focuses on IoT products with connectivity, for example:

Smart home

· Smart door locks;

· Smart plugs;

· Smart lighting;

· Smart gateways.

Video surveillance

· Network cameras;

· NVR and DVR systems;

· Home monitoring equipment.

Network communications

· Routers;

· Mesh Wi-Fi systems;

· Wireless terminals;

· IoT hubs.

Consumer electronics

· Smart home appliances;

· Wearable devices;

· Smart speakers;

· Smart terminals.

Other IoT devices

· IoT controllers;

· Wireless modules;

· Cloud-connected products.

Which security capabilities does JC-STAR focus on?

The core idea of JC-STAR is to establish a baseline cybersecurity capability system for IoT products.

It covers the following areas.

1. Authentication and account security

Particular attention is paid to:

· Default password security;

· Unique initial passwords;

· Password complexity;

· Login protection mechanisms;

· Identity verification capability.

2. Vulnerability management mechanism

This includes:

· A vulnerability intake process;

· A vulnerability response mechanism;

· Software update capability;

· Security patch management;

· PSIRT development.

3. Software and communication security

This includes:

· TLS encrypted communication;

· Protection against man-in-the-middle attacks;

· Firmware integrity protection;

· Secure boot;

· Firmware signing;

· Secure update mechanisms.

4. Data and privacy protection

This includes:

· User data protection;

· Secure storage of sensitive information;

· Log protection;

· Data access control;

· Handling of personal data.

5. Lifecycle security management

This includes:

· A secure development lifecycle (SDL);

· Risk analysis;

· Threat modelling;

· Security testing;

· Third-party component management;

· SBOM management.

How JC-STAR relates to international rules

JC-STAR is highly consistent with mainstream global IoT security frameworks:

Capability  |  EN 303 645  |  JC-STAR

Default password security  |  Required  |  Required

Vulnerability management  |  Required  |  Required

Software updates  |  Required  |  Required

Encrypted communication  |  Required  |  Required

Data protection  |  Required  |  Required

Lifecycle security  |  Required  |  Required

Companies that have already worked on:

· ETSI EN 303 645;

· RED cybersecurity;

· The CRA;

· The PSTI;

can therefore expand into the Japanese market more efficiently.

Why should companies prepare early?

1. Overseas customers increasingly value cybersecurity capability

More and more brand customers are looking at:

· Vulnerability management mechanisms;

· Security update capability;

· Penetration testing capability;

· Lifecycle security management.

Cybersecurity is moving from an added capability to a baseline one.

2. Global regulation is converging

The direction of IoT cybersecurity worldwide is becoming unified:

· Establish baseline security capability;

· Establish a vulnerability management system;

· Establish lifecycle security mechanisms;

· Establish continuous update capability.

The earlier a company prepares, the lower the cost of later global expansion.

3. Security capability now affects competitiveness

Competition in international markets will no longer rest only on:

· Features;

· Cost;

· Performance.

It will also depend on:

· Security capability;

· Update capability;

· Data protection capability;

· Vulnerability response capability.

Which capabilities should companies build in advance?

Technical capability

· Secure boot;

· Firmware signing;

· TLS secure communication;

· Secure update mechanisms;

· Key protection;

· Secure storage.

Management capability

· PSIRT;

· Vulnerability response mechanisms;

· SBOM management;

· Secure development lifecycle;

· Third-party component management.

Documentation capability

· Risk assessment reports;

· Data flow analysis;

· Network architecture diagrams;

· Security design documentation;

· Vulnerability management procedures.

How we can help

As a specialist information security laboratory, we can support companies with the following.

Testing and assessment

· JC-STAR pre-assessment;

· ETSI EN 303 645 testing;

· RED cybersecurity testing;

· Vulnerability scanning;

· Penetration testing;

· Firmware security analysis.

Compliance support

· Gap analysis;

· Security remediation advice;

· CRA compliance support;

· PSTI compliance support;

· SBOM development.

Security system development

· PSIRT development;

· Secure development lifecycle;

· Lifecycle security management;

· Threat modelling;

· Risk analysis.

Cybersecurity is becoming a key competitive factor for IoT products worldwide

From the EU CRA to Japan's JC-STAR, connected products worldwide are entering an era of security compliance combined with lifecycle security management.

In future, products with genuine cybersecurity capability will more easily gain:

· Recognition from international customers;

· A competitive advantage in overseas markets;

· Stronger brand trust;

· The ability to expand globally.

The progress of JC-STAR also shows that Japan's IoT cybersecurity system is being further refined.

For companies, building cybersecurity capability in advance is not merely a compliance exercise; it is an important foundation for competing in global markets in the years ahead.