Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

thalesesecuritycom

Executive Summary2019 Thales Data Threat Report Japan Edition

2019DataThreat

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

Digital transformation is pervasive at Japanese enterprises ndash and is putting sensitive data at riskDigital transformation (DX) is increasing efficiency enabling new services and making possible new economies of scale for existing enterprises while also opening the door for new competitors IT security professionals at Japanese enterprises report that their organizations are moving quickly to adopt and deploy the fundamental technology building blocks used for digital transformation (Cloud SaaS applications big data IoT digital payments containers and blockchain) This change introduces new risks to sensitive data of all types ndash information protected by industry standards such as PCI DSS personally identifiable information protected by privacy regulations such as APPI financial data intellectual property and secrets

This yearrsquos Japan Edition of the Thales Data Threat Report found that 92 of respondents reported that their organizations are implementing DX technologies with sensitive data and that 42 are either aggressively disruptive in their usage of these technologies or are embedding digital capabilities that enable greater organizational agility

To a great extent many organizations seem to be indulging in a false sense of security when it comes to their data Respondents overwhelmingly believe that their DX implementations are safely deployed with 58 responding that they are either very or extremely secure But this belief does not seem to be well supported by their use of encryption for data-at-rest Data-at-rest encryption one of the fundamental controls needed to ensure that sensitive data is securely deployed is in use with less than 33 of implementations

One result is that organizations feel vulnerable to threats against their data with 80 reporting that their organizations are somewhat very or extremely vulnerable to data threats Reflecting the reality of higher levels of external attacks threat vectors have also changed with cybercriminals now identified as the greatest threat to data (70 of respondents)

2

Figure 1 ndash Sensitive data is pervasive in digital transformation environmentsSource 2019 Thales Data Threat Report Survey IDC November 2018

of respondents will use sensitive data with digital transformation technologies

of respondents are using encryption within these environments

33

92

or less

70

Cybercriminals

51

Cyberterrorists

49

Privileged users

41

Service provideraccounts

52

Partners withinternal access

Figure 2 ndash Top five accounts or threat actors that pose the greatest risk to dataSource 2019 Thales Data Threat Report Survey IDC November 2018

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

The reality of the multi-cloud agency creates new risks for sensitive dataData now constitutes the ldquocrown jewelsrdquo of most organizations as they transition into todayrsquos information economy making the protection of sensitive information a critical priority However digital transformation fundamentally changes where data needs to be protected and how it needs to be secured And the cloud is both the most complex of these environments and the most widely deployed

This yearrsquos data shows that cloud usage continues to proliferate rapidly 83 of all respondents said they plan to use all three of the common cloud environment types ndash Infrastructure as a Service (IaaS) Software as a Service (SaaS) and Platform as a Service (PaaS) ndash within 12 months Moreover these deployments wonrsquot be to just one vendor or one platform 45 report that they will use three or more IaaS environments 43 three or more PaaS environments and more than 62 that they will use eleven or more SaaS environments Overall 67 report that they will also use sensitive data within at least one of these cloud environments This level of multi-cloud usage greatly compounds the difficulties Japanese enterprises face in protecting their sensitive data as each environment and often each implementation within the environment can require a unique data security approach

Tools that reduce multi-cloud data security complexity are criticalWith multi-cloud use the complexity of managing controlling and monitoring data security across all of these environments becomes a critical problem As a result itrsquos not surprising that complexity was identified by 39 of respondents as a barrier to data security deployment Lack of staff at 47 was the top barrier Meanwhile organizations need to stretch their IT security budgets to cover not only internal security but multiple outside and edge environments So budget is a critical concern Analysis of this yearrsquos results showed that the percentage of enterprises in Japan increasing IT security held steady with measurements from last year 2019 ndash 53 2018 ndash 54 With increased complexity in data environments and funding increases holding steady enterprises will need to get the highest possible return from their IT resources and spending Data security platforms and service offerings that can help organizations manage the complexity of spanning cloud on-premises and other environments are critical to meeting these needs

Encryption technologies are the top tools neededEncryption and tokenization solutions provide some of the strongest protection in todayrsquos data threat environment and respondents seem to understand this Respondents chose data encryption at 34 as the second most important item needed to alleviate data security concerns for cloud environments behind SLAs and liability terms in case of a data breach at 36

3

Figure 3 ndash Top concerns and mitigationsSource 2019 Thales Data Threat Report Survey

IDC November 2018

44are worried about security breaches and attacks at the cloud provider

45recognize SaaS encryption with enterprise encryption key management as a top solution to SaaS data security problems

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

Nearly half of Japanese enterprises encounter a data breachNot only are data breach rates high but heavy investments in IT and data security have not provided immunity

Therersquos a distressing pattern to the rates of data breaches identified Nearly half of all breached enterprises were breached in the last year and more than half of those breached in the last year have been breached previously The raw numbers show that 45 have been breached at some time in the past 21 were breached in the last year and 12 were breached both in the last year and previously

For many preventing data breaches is not an IT security spending priorityOne explanation for this may be the emphasis that enterprises are placing on their IT security spending priorities The results showed that avoiding data breaches and having previously encountered a data breach were two of the bottom three factors impacting IT security spending decisions What were the top IT security spending priorities Compliance and privacy requirements (47) followed by requirements from partners and customers (43) and increased use of cloud computing (39) If preventing data breaches isnrsquot a priority and threat levels continue to escalate it is no wonder breach rates continue to increase and that we find many serial data breach victims among enterprises in Japan (12)

A multi-layered approach to data security is requiredAs digital transformation expands the location number and type of threat vectors security solutions also need to be expanded and refocused to combat the problem Japanese respondents are at the back of the pack when it comes to expanding their focus from network security as a primary focus to adding equal focus to application and data security Today network security receives the largest share of security focus at 40 with application and data security at lower levels ndash 26 and 34 of focus respectively Making this shift wonrsquot be easy solutions in areas such as encryption and key management will need to shift to consolidated platforms that address multiple environments and use cases

4

Figure 4 ndash Number of cloud environmentsSource 2019 Thales Data Threat Report Survey IDC November 2018

Multi-cloud environments make the task of protecting sensitive data more complex

Number of cloud environments

IaaS PaaS SaaS

4 or more

2 or 3

1

4 or more

2 or 3

1

More than 100

26 - 100

1 - 25

Figure 5 ndash IT security spending increases declineSource 2019 Thales Data Threat Report SurveyIDC November 2018

With IT security spending increases remaining the same as in previous years the complexity of protecting data across multi-cloud environments leads to the need for data security platform and service solutions that can keep costs in line while reducing complexity

5354

2018 2019

Nearly half of Japanese enterprises encounter a data breach

Figure 6 ndash Data breach resistanceFew agencies are successfulSource 2019 Thales Data Threat Report SurveyIDC November 2018

45of Japanese enterprises encountered a data breach in the past with

breached in the last year

21

(ever) (in the last year)

(ever) (in the last year)

60 30

65 36

Global

US

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

Regulatory and compliance changes introduce new challengesEnterprises in Japan must cope with not only industry specific guidelines for financial institutions and credit card processing that apply worldwide (such as PCI DSS) and Japanrsquos national data privacy law (APPI) but multinationals must also cope with global regulations such as GDPR in the European Union and over 100 other national privacy laws around the world In our survey 84 reported that they would be affected by these regulations

Respondents also identified compliance requirements as an area of concern for digital transformation environments especially for cloud big data and containers

bullCloud 34 are very or extremely concerned about meeting compliance requirements in public cloud environments

bullBig Data 38 are concerned about data privacy violations

bullContainers 37 are concerned about privacy violations from shared container resource use

As the complexity and number of compliance and regulatory requirements have increased so have Japanese organizationsrsquo failure rates when audited for implementation of these standards Results from our survey showed that while only 9 of respondents reported their enterprise had failed a data security compliance audit more than twelve months previously 18 ndash twice that number ndash failed a data security audit within the last year

For global enterprises that also operate outside of Japan the potential for substantial penalties and the requirements for detailed audits of data usage continue to increase around the world For instance the European Unionrsquos General Data Protection Regulation (GDPR) outlines potential fines of up to 4 of global sales As a result enterprises in Japan are taking steps to address these regulations Plans center around encryption and tokenization (an encryption technology) with the top selection being encryption at 31 with tokenization the second highest selection at 23

Encryption is a critical solution to data security problemsAs digital transformation results in a migration of data away from enterprisesrsquo traditional perimeters the solutions relied on in the past to protect data are no longer sufficient Fundamentally implementing digital transformation and especially cloud-based solutions and tools changes what needs to be protected and how it needs to be protected

Yet the data security stances of Japanese enterprises often seem stuck in the past As breach rates have increased across the board wersquove seen a consistent pattern in previous years of this report that IT security spending clusters around the areas that have protected networks and systems during many IT security professionalsrsquo careers

5

Preventing data breaches is not an IT security spending priority

Figure 7 ndash IT security spending prioritiesSource 2019 Thales Data Threat Report SurveyIDC November 2018

Complianceprivacy requirements

Requirements from partnerscustomers

Increased use ofcloud computing

Implementingbest practices

Competitivestrategic concerns

Reputation andbrand protection

Avoiding databreach penalties

Previous data breach

Executive directive

47

43

39

33

31

30

30

26

21

Figure 8 ndash Meeting compliance requirementsSource 2019 Thales Data Threat Report SurveyIDC November 2018

2019 2018 2017 2016

1st priority 4th priority

Meeting compliance requirements as anIT security spending priority has been atop priority for the last three years

will be affected by data privacy or sovereigntyregulations such as APPI and GDPR

How will they comply

84

Encryption technologies

Encryptingpersonal data

Tokenizing personal data (an encryption

technology)

Use local hostingand cloud providers

Move to compliance locations

54

31

23

18

12

47 59 66 30

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

For the most part these are network and end-point protections rather than the security tools that are best for protecting sensitive data-at-rest and data-in-motion Essentially organizations continue to protect against todayrsquos threats in the newest technology environments with yesterdayrsquos tools Change is required to protect sensitive data in todayrsquos IT landscape and encryption is the critical foundation technology required

Another key finding this year is that although organizations have strong plans for adopting data security technologies actual implementation rates are low When asked where encryption technologies are deployed today to protect not only cloud environments but also big data IoT containers mobile payments social media and blockchain results in every category were 33 or less At the same time 67 of respondents indicate using sensitive data in cloud environments and 30 or more using sensitive data with other digital transformation technologies (with blockchain a bit lower at 29) These results suggest that in spite of good intentions sensitive data within these environments may be at risk

Nevertheless enterprise IT security professionals we polled in Japan clearly understood whatrsquos needed to solve the problem When selecting the information security technologies that they most needed to expand their secure usage of these critical environments encryption was a top choice

bullFor Cloud Encryption was the second ranked top tool needed to enable more cloud use (34)

bullFor Containers 55 identified encryption as the top IT security tool needed to expand use

bullFor Big Data 40 selected system level encryption and access controls as a critical tool needed to alleviate security concerns

bullFor IoT Encryption was required to increase IoT use (38)

Data Security doesnrsquot have to be hard and is vitally importantOrganizations need to take a fresh look at how they provide data security Against this backdrop analysts recommend that security professionals consider the following

bullFocus on all threat vectors

bullInvest in modern hybrid and multi-cloud-based data security tools and measures that scale to modern architecture

bullLook for solutions that let you do more with less

bullPrioritize compliance and sovereignty issues

bullEncryption is an important part of the mix

6

Encryption technologies (Encryption and Tokenization) were identified as the primary strategy to address data privacy and regulatory concerns

54

Encryption is a key driver for increased adoption and usages of digitally transformative technologies

34

Cloud

Containers

40

Big data

38

IoT

55

Figure 9 ndash Encryption for Cloud Big Data IoTand Containers adoptionSource 2019 Thales Data Threat Report Survey IDCNovember 2018

Figure 10 ndash Encryption usage ratesSource 2019 Thales Data Threat Report Survey

IDC November 2018

Encryption usage rates in Japan are low

IoT

DC filevolume

Public cloud

DB ndash fieldcolumn

Big data

FDE in datacenters

ContainersDocker

Nativestorage (SAN)

Cloud native

33

32

32

26

25

24

22

18

17

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

To download the full 2019 Thales Data Threat Report Japan Edition visit ThalesesecuritycomDTR-Japan

2019DataThreat

Our Sponsors

Todayrsquos enterprises depend on the cloud data and software in order to make decisive decisions Thatrsquos why the most respected brands and largest organizations in the world rely on Thales to help them protect and secure access to their most sensitive information and software wherever it is created shared or stored ndash from the cloud and data centers to devices and across networks Our solutions enable organizations to move to the cloud securely achieve compliance with confidence and create more value from their software in devices and services used by millions of consumers every day

About Thales Cloud Protection amp Licensing

About the 2019 Thales Data Threat Report ndash Japan Edition

7

This report is based on a global survey of 1200 executives with responsibility for or influence over IT and data security from nine countries and a range of industries with a primary emphasis on healthcare financial services retail and federal government organizations Job titles range from C-level executives including CEO CFO Chief Data Officer CISO Chief Data Scientist and Chief Risk Officer to SVPVP IT Administrator Security Analyst Security Engineer and Systems Administrator Respondents represent a broad range of organizational sizes with the majority ranging from 500 to 10000 employees The survey was conducted in November 2018

The report focuses on the findings from 100 Japanese respondents providing comparisons and contrast to respondents from other regional markets For global roll-up findings and analysis please see wwwthalesesecuritycomdtr

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

The reality of the multi-cloud agency creates new risks for sensitive dataData now constitutes the ldquocrown jewelsrdquo of most organizations as they transition into todayrsquos information economy making the protection of sensitive information a critical priority However digital transformation fundamentally changes where data needs to be protected and how it needs to be secured And the cloud is both the most complex of these environments and the most widely deployed

This yearrsquos data shows that cloud usage continues to proliferate rapidly 83 of all respondents said they plan to use all three of the common cloud environment types ndash Infrastructure as a Service (IaaS) Software as a Service (SaaS) and Platform as a Service (PaaS) ndash within 12 months Moreover these deployments wonrsquot be to just one vendor or one platform 45 report that they will use three or more IaaS environments 43 three or more PaaS environments and more than 62 that they will use eleven or more SaaS environments Overall 67 report that they will also use sensitive data within at least one of these cloud environments This level of multi-cloud usage greatly compounds the difficulties Japanese enterprises face in protecting their sensitive data as each environment and often each implementation within the environment can require a unique data security approach

Tools that reduce multi-cloud data security complexity are criticalWith multi-cloud use the complexity of managing controlling and monitoring data security across all of these environments becomes a critical problem As a result itrsquos not surprising that complexity was identified by 39 of respondents as a barrier to data security deployment Lack of staff at 47 was the top barrier Meanwhile organizations need to stretch their IT security budgets to cover not only internal security but multiple outside and edge environments So budget is a critical concern Analysis of this yearrsquos results showed that the percentage of enterprises in Japan increasing IT security held steady with measurements from last year 2019 ndash 53 2018 ndash 54 With increased complexity in data environments and funding increases holding steady enterprises will need to get the highest possible return from their IT resources and spending Data security platforms and service offerings that can help organizations manage the complexity of spanning cloud on-premises and other environments are critical to meeting these needs

Encryption technologies are the top tools neededEncryption and tokenization solutions provide some of the strongest protection in todayrsquos data threat environment and respondents seem to understand this Respondents chose data encryption at 34 as the second most important item needed to alleviate data security concerns for cloud environments behind SLAs and liability terms in case of a data breach at 36

3

Figure 3 ndash Top concerns and mitigationsSource 2019 Thales Data Threat Report Survey

IDC November 2018

44are worried about security breaches and attacks at the cloud provider

45recognize SaaS encryption with enterprise encryption key management as a top solution to SaaS data security problems

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

Nearly half of Japanese enterprises encounter a data breachNot only are data breach rates high but heavy investments in IT and data security have not provided immunity

Therersquos a distressing pattern to the rates of data breaches identified Nearly half of all breached enterprises were breached in the last year and more than half of those breached in the last year have been breached previously The raw numbers show that 45 have been breached at some time in the past 21 were breached in the last year and 12 were breached both in the last year and previously

For many preventing data breaches is not an IT security spending priorityOne explanation for this may be the emphasis that enterprises are placing on their IT security spending priorities The results showed that avoiding data breaches and having previously encountered a data breach were two of the bottom three factors impacting IT security spending decisions What were the top IT security spending priorities Compliance and privacy requirements (47) followed by requirements from partners and customers (43) and increased use of cloud computing (39) If preventing data breaches isnrsquot a priority and threat levels continue to escalate it is no wonder breach rates continue to increase and that we find many serial data breach victims among enterprises in Japan (12)

A multi-layered approach to data security is requiredAs digital transformation expands the location number and type of threat vectors security solutions also need to be expanded and refocused to combat the problem Japanese respondents are at the back of the pack when it comes to expanding their focus from network security as a primary focus to adding equal focus to application and data security Today network security receives the largest share of security focus at 40 with application and data security at lower levels ndash 26 and 34 of focus respectively Making this shift wonrsquot be easy solutions in areas such as encryption and key management will need to shift to consolidated platforms that address multiple environments and use cases

4

Figure 4 ndash Number of cloud environmentsSource 2019 Thales Data Threat Report Survey IDC November 2018

Multi-cloud environments make the task of protecting sensitive data more complex

Number of cloud environments

IaaS PaaS SaaS

4 or more

2 or 3

1

4 or more

2 or 3

1

More than 100

26 - 100

1 - 25

Figure 5 ndash IT security spending increases declineSource 2019 Thales Data Threat Report SurveyIDC November 2018

With IT security spending increases remaining the same as in previous years the complexity of protecting data across multi-cloud environments leads to the need for data security platform and service solutions that can keep costs in line while reducing complexity

5354

2018 2019

Nearly half of Japanese enterprises encounter a data breach

Figure 6 ndash Data breach resistanceFew agencies are successfulSource 2019 Thales Data Threat Report SurveyIDC November 2018

45of Japanese enterprises encountered a data breach in the past with

breached in the last year

21

(ever) (in the last year)

(ever) (in the last year)

60 30

65 36

Global

US

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

Regulatory and compliance changes introduce new challengesEnterprises in Japan must cope with not only industry specific guidelines for financial institutions and credit card processing that apply worldwide (such as PCI DSS) and Japanrsquos national data privacy law (APPI) but multinationals must also cope with global regulations such as GDPR in the European Union and over 100 other national privacy laws around the world In our survey 84 reported that they would be affected by these regulations

Respondents also identified compliance requirements as an area of concern for digital transformation environments especially for cloud big data and containers

bullCloud 34 are very or extremely concerned about meeting compliance requirements in public cloud environments

bullBig Data 38 are concerned about data privacy violations

bullContainers 37 are concerned about privacy violations from shared container resource use

As the complexity and number of compliance and regulatory requirements have increased so have Japanese organizationsrsquo failure rates when audited for implementation of these standards Results from our survey showed that while only 9 of respondents reported their enterprise had failed a data security compliance audit more than twelve months previously 18 ndash twice that number ndash failed a data security audit within the last year

For global enterprises that also operate outside of Japan the potential for substantial penalties and the requirements for detailed audits of data usage continue to increase around the world For instance the European Unionrsquos General Data Protection Regulation (GDPR) outlines potential fines of up to 4 of global sales As a result enterprises in Japan are taking steps to address these regulations Plans center around encryption and tokenization (an encryption technology) with the top selection being encryption at 31 with tokenization the second highest selection at 23

Encryption is a critical solution to data security problemsAs digital transformation results in a migration of data away from enterprisesrsquo traditional perimeters the solutions relied on in the past to protect data are no longer sufficient Fundamentally implementing digital transformation and especially cloud-based solutions and tools changes what needs to be protected and how it needs to be protected

Yet the data security stances of Japanese enterprises often seem stuck in the past As breach rates have increased across the board wersquove seen a consistent pattern in previous years of this report that IT security spending clusters around the areas that have protected networks and systems during many IT security professionalsrsquo careers

5

Preventing data breaches is not an IT security spending priority

Figure 7 ndash IT security spending prioritiesSource 2019 Thales Data Threat Report SurveyIDC November 2018

Complianceprivacy requirements

Requirements from partnerscustomers

Increased use ofcloud computing

Implementingbest practices

Competitivestrategic concerns

Reputation andbrand protection

Avoiding databreach penalties

Previous data breach

Executive directive

47

43

39

33

31

30

30

26

21

Figure 8 ndash Meeting compliance requirementsSource 2019 Thales Data Threat Report SurveyIDC November 2018

2019 2018 2017 2016

1st priority 4th priority

Meeting compliance requirements as anIT security spending priority has been atop priority for the last three years

will be affected by data privacy or sovereigntyregulations such as APPI and GDPR

How will they comply

84

Encryption technologies

Encryptingpersonal data

Tokenizing personal data (an encryption

technology)

Use local hostingand cloud providers

Move to compliance locations

54

31

23

18

12

47 59 66 30

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

For the most part these are network and end-point protections rather than the security tools that are best for protecting sensitive data-at-rest and data-in-motion Essentially organizations continue to protect against todayrsquos threats in the newest technology environments with yesterdayrsquos tools Change is required to protect sensitive data in todayrsquos IT landscape and encryption is the critical foundation technology required

Another key finding this year is that although organizations have strong plans for adopting data security technologies actual implementation rates are low When asked where encryption technologies are deployed today to protect not only cloud environments but also big data IoT containers mobile payments social media and blockchain results in every category were 33 or less At the same time 67 of respondents indicate using sensitive data in cloud environments and 30 or more using sensitive data with other digital transformation technologies (with blockchain a bit lower at 29) These results suggest that in spite of good intentions sensitive data within these environments may be at risk

Nevertheless enterprise IT security professionals we polled in Japan clearly understood whatrsquos needed to solve the problem When selecting the information security technologies that they most needed to expand their secure usage of these critical environments encryption was a top choice

bullFor Cloud Encryption was the second ranked top tool needed to enable more cloud use (34)

bullFor Containers 55 identified encryption as the top IT security tool needed to expand use

bullFor Big Data 40 selected system level encryption and access controls as a critical tool needed to alleviate security concerns

bullFor IoT Encryption was required to increase IoT use (38)

Data Security doesnrsquot have to be hard and is vitally importantOrganizations need to take a fresh look at how they provide data security Against this backdrop analysts recommend that security professionals consider the following

bullFocus on all threat vectors

bullInvest in modern hybrid and multi-cloud-based data security tools and measures that scale to modern architecture

bullLook for solutions that let you do more with less

bullPrioritize compliance and sovereignty issues

bullEncryption is an important part of the mix

6

Encryption technologies (Encryption and Tokenization) were identified as the primary strategy to address data privacy and regulatory concerns

54

Encryption is a key driver for increased adoption and usages of digitally transformative technologies

34

Cloud

Containers

40

Big data

38

IoT

55

Figure 9 ndash Encryption for Cloud Big Data IoTand Containers adoptionSource 2019 Thales Data Threat Report Survey IDCNovember 2018

Figure 10 ndash Encryption usage ratesSource 2019 Thales Data Threat Report Survey

IDC November 2018

Encryption usage rates in Japan are low

IoT

DC filevolume

Public cloud

DB ndash fieldcolumn

Big data

FDE in datacenters

ContainersDocker

Nativestorage (SAN)

Cloud native

33

32

32

26

25

24

22

18

17

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

To download the full 2019 Thales Data Threat Report Japan Edition visit ThalesesecuritycomDTR-Japan

2019DataThreat

Our Sponsors

Todayrsquos enterprises depend on the cloud data and software in order to make decisive decisions Thatrsquos why the most respected brands and largest organizations in the world rely on Thales to help them protect and secure access to their most sensitive information and software wherever it is created shared or stored ndash from the cloud and data centers to devices and across networks Our solutions enable organizations to move to the cloud securely achieve compliance with confidence and create more value from their software in devices and services used by millions of consumers every day

About Thales Cloud Protection amp Licensing

About the 2019 Thales Data Threat Report ndash Japan Edition

7

This report is based on a global survey of 1200 executives with responsibility for or influence over IT and data security from nine countries and a range of industries with a primary emphasis on healthcare financial services retail and federal government organizations Job titles range from C-level executives including CEO CFO Chief Data Officer CISO Chief Data Scientist and Chief Risk Officer to SVPVP IT Administrator Security Analyst Security Engineer and Systems Administrator Respondents represent a broad range of organizational sizes with the majority ranging from 500 to 10000 employees The survey was conducted in November 2018

The report focuses on the findings from 100 Japanese respondents providing comparisons and contrast to respondents from other regional markets For global roll-up findings and analysis please see wwwthalesesecuritycomdtr

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

Nearly half of Japanese enterprises encounter a data breachNot only are data breach rates high but heavy investments in IT and data security have not provided immunity

Therersquos a distressing pattern to the rates of data breaches identified Nearly half of all breached enterprises were breached in the last year and more than half of those breached in the last year have been breached previously The raw numbers show that 45 have been breached at some time in the past 21 were breached in the last year and 12 were breached both in the last year and previously

For many preventing data breaches is not an IT security spending priorityOne explanation for this may be the emphasis that enterprises are placing on their IT security spending priorities The results showed that avoiding data breaches and having previously encountered a data breach were two of the bottom three factors impacting IT security spending decisions What were the top IT security spending priorities Compliance and privacy requirements (47) followed by requirements from partners and customers (43) and increased use of cloud computing (39) If preventing data breaches isnrsquot a priority and threat levels continue to escalate it is no wonder breach rates continue to increase and that we find many serial data breach victims among enterprises in Japan (12)

A multi-layered approach to data security is requiredAs digital transformation expands the location number and type of threat vectors security solutions also need to be expanded and refocused to combat the problem Japanese respondents are at the back of the pack when it comes to expanding their focus from network security as a primary focus to adding equal focus to application and data security Today network security receives the largest share of security focus at 40 with application and data security at lower levels ndash 26 and 34 of focus respectively Making this shift wonrsquot be easy solutions in areas such as encryption and key management will need to shift to consolidated platforms that address multiple environments and use cases

4

Figure 4 ndash Number of cloud environmentsSource 2019 Thales Data Threat Report Survey IDC November 2018

Multi-cloud environments make the task of protecting sensitive data more complex

Number of cloud environments

IaaS PaaS SaaS

4 or more

2 or 3

1

4 or more

2 or 3

1

More than 100

26 - 100

1 - 25

Figure 5 ndash IT security spending increases declineSource 2019 Thales Data Threat Report SurveyIDC November 2018

With IT security spending increases remaining the same as in previous years the complexity of protecting data across multi-cloud environments leads to the need for data security platform and service solutions that can keep costs in line while reducing complexity

5354

2018 2019

Nearly half of Japanese enterprises encounter a data breach

Figure 6 ndash Data breach resistanceFew agencies are successfulSource 2019 Thales Data Threat Report SurveyIDC November 2018

45of Japanese enterprises encountered a data breach in the past with

breached in the last year

21

(ever) (in the last year)

(ever) (in the last year)

60 30

65 36

Global

US

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

Regulatory and compliance changes introduce new challengesEnterprises in Japan must cope with not only industry specific guidelines for financial institutions and credit card processing that apply worldwide (such as PCI DSS) and Japanrsquos national data privacy law (APPI) but multinationals must also cope with global regulations such as GDPR in the European Union and over 100 other national privacy laws around the world In our survey 84 reported that they would be affected by these regulations

Respondents also identified compliance requirements as an area of concern for digital transformation environments especially for cloud big data and containers

bullCloud 34 are very or extremely concerned about meeting compliance requirements in public cloud environments

bullBig Data 38 are concerned about data privacy violations

bullContainers 37 are concerned about privacy violations from shared container resource use

As the complexity and number of compliance and regulatory requirements have increased so have Japanese organizationsrsquo failure rates when audited for implementation of these standards Results from our survey showed that while only 9 of respondents reported their enterprise had failed a data security compliance audit more than twelve months previously 18 ndash twice that number ndash failed a data security audit within the last year

For global enterprises that also operate outside of Japan the potential for substantial penalties and the requirements for detailed audits of data usage continue to increase around the world For instance the European Unionrsquos General Data Protection Regulation (GDPR) outlines potential fines of up to 4 of global sales As a result enterprises in Japan are taking steps to address these regulations Plans center around encryption and tokenization (an encryption technology) with the top selection being encryption at 31 with tokenization the second highest selection at 23

Encryption is a critical solution to data security problemsAs digital transformation results in a migration of data away from enterprisesrsquo traditional perimeters the solutions relied on in the past to protect data are no longer sufficient Fundamentally implementing digital transformation and especially cloud-based solutions and tools changes what needs to be protected and how it needs to be protected

Yet the data security stances of Japanese enterprises often seem stuck in the past As breach rates have increased across the board wersquove seen a consistent pattern in previous years of this report that IT security spending clusters around the areas that have protected networks and systems during many IT security professionalsrsquo careers

5

Preventing data breaches is not an IT security spending priority

Figure 7 ndash IT security spending prioritiesSource 2019 Thales Data Threat Report SurveyIDC November 2018

Complianceprivacy requirements

Requirements from partnerscustomers

Increased use ofcloud computing

Implementingbest practices

Competitivestrategic concerns

Reputation andbrand protection

Avoiding databreach penalties

Previous data breach

Executive directive

47

43

39

33

31

30

30

26

21

Figure 8 ndash Meeting compliance requirementsSource 2019 Thales Data Threat Report SurveyIDC November 2018

2019 2018 2017 2016

1st priority 4th priority

Meeting compliance requirements as anIT security spending priority has been atop priority for the last three years

will be affected by data privacy or sovereigntyregulations such as APPI and GDPR

How will they comply

84

Encryption technologies

Encryptingpersonal data

Tokenizing personal data (an encryption

technology)

Use local hostingand cloud providers

Move to compliance locations

54

31

23

18

12

47 59 66 30

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

For the most part these are network and end-point protections rather than the security tools that are best for protecting sensitive data-at-rest and data-in-motion Essentially organizations continue to protect against todayrsquos threats in the newest technology environments with yesterdayrsquos tools Change is required to protect sensitive data in todayrsquos IT landscape and encryption is the critical foundation technology required

Another key finding this year is that although organizations have strong plans for adopting data security technologies actual implementation rates are low When asked where encryption technologies are deployed today to protect not only cloud environments but also big data IoT containers mobile payments social media and blockchain results in every category were 33 or less At the same time 67 of respondents indicate using sensitive data in cloud environments and 30 or more using sensitive data with other digital transformation technologies (with blockchain a bit lower at 29) These results suggest that in spite of good intentions sensitive data within these environments may be at risk

Nevertheless enterprise IT security professionals we polled in Japan clearly understood whatrsquos needed to solve the problem When selecting the information security technologies that they most needed to expand their secure usage of these critical environments encryption was a top choice

bullFor Cloud Encryption was the second ranked top tool needed to enable more cloud use (34)

bullFor Containers 55 identified encryption as the top IT security tool needed to expand use

bullFor Big Data 40 selected system level encryption and access controls as a critical tool needed to alleviate security concerns

bullFor IoT Encryption was required to increase IoT use (38)

Data Security doesnrsquot have to be hard and is vitally importantOrganizations need to take a fresh look at how they provide data security Against this backdrop analysts recommend that security professionals consider the following

bullFocus on all threat vectors

bullInvest in modern hybrid and multi-cloud-based data security tools and measures that scale to modern architecture

bullLook for solutions that let you do more with less

bullPrioritize compliance and sovereignty issues

bullEncryption is an important part of the mix

6

Encryption technologies (Encryption and Tokenization) were identified as the primary strategy to address data privacy and regulatory concerns

54

Encryption is a key driver for increased adoption and usages of digitally transformative technologies

34

Cloud

Containers

40

Big data

38

IoT

55

Figure 9 ndash Encryption for Cloud Big Data IoTand Containers adoptionSource 2019 Thales Data Threat Report Survey IDCNovember 2018

Figure 10 ndash Encryption usage ratesSource 2019 Thales Data Threat Report Survey

IDC November 2018

Encryption usage rates in Japan are low

IoT

DC filevolume

Public cloud

DB ndash fieldcolumn

Big data

FDE in datacenters

ContainersDocker

Nativestorage (SAN)

Cloud native

33

32

32

26

25

24

22

18

17

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

To download the full 2019 Thales Data Threat Report Japan Edition visit ThalesesecuritycomDTR-Japan

2019DataThreat

Our Sponsors

Todayrsquos enterprises depend on the cloud data and software in order to make decisive decisions Thatrsquos why the most respected brands and largest organizations in the world rely on Thales to help them protect and secure access to their most sensitive information and software wherever it is created shared or stored ndash from the cloud and data centers to devices and across networks Our solutions enable organizations to move to the cloud securely achieve compliance with confidence and create more value from their software in devices and services used by millions of consumers every day

About Thales Cloud Protection amp Licensing

About the 2019 Thales Data Threat Report ndash Japan Edition

7

This report is based on a global survey of 1200 executives with responsibility for or influence over IT and data security from nine countries and a range of industries with a primary emphasis on healthcare financial services retail and federal government organizations Job titles range from C-level executives including CEO CFO Chief Data Officer CISO Chief Data Scientist and Chief Risk Officer to SVPVP IT Administrator Security Analyst Security Engineer and Systems Administrator Respondents represent a broad range of organizational sizes with the majority ranging from 500 to 10000 employees The survey was conducted in November 2018

The report focuses on the findings from 100 Japanese respondents providing comparisons and contrast to respondents from other regional markets For global roll-up findings and analysis please see wwwthalesesecuritycomdtr

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

Regulatory and compliance changes introduce new challengesEnterprises in Japan must cope with not only industry specific guidelines for financial institutions and credit card processing that apply worldwide (such as PCI DSS) and Japanrsquos national data privacy law (APPI) but multinationals must also cope with global regulations such as GDPR in the European Union and over 100 other national privacy laws around the world In our survey 84 reported that they would be affected by these regulations

Respondents also identified compliance requirements as an area of concern for digital transformation environments especially for cloud big data and containers

bullCloud 34 are very or extremely concerned about meeting compliance requirements in public cloud environments

bullBig Data 38 are concerned about data privacy violations

bullContainers 37 are concerned about privacy violations from shared container resource use

As the complexity and number of compliance and regulatory requirements have increased so have Japanese organizationsrsquo failure rates when audited for implementation of these standards Results from our survey showed that while only 9 of respondents reported their enterprise had failed a data security compliance audit more than twelve months previously 18 ndash twice that number ndash failed a data security audit within the last year

For global enterprises that also operate outside of Japan the potential for substantial penalties and the requirements for detailed audits of data usage continue to increase around the world For instance the European Unionrsquos General Data Protection Regulation (GDPR) outlines potential fines of up to 4 of global sales As a result enterprises in Japan are taking steps to address these regulations Plans center around encryption and tokenization (an encryption technology) with the top selection being encryption at 31 with tokenization the second highest selection at 23

Encryption is a critical solution to data security problemsAs digital transformation results in a migration of data away from enterprisesrsquo traditional perimeters the solutions relied on in the past to protect data are no longer sufficient Fundamentally implementing digital transformation and especially cloud-based solutions and tools changes what needs to be protected and how it needs to be protected

Yet the data security stances of Japanese enterprises often seem stuck in the past As breach rates have increased across the board wersquove seen a consistent pattern in previous years of this report that IT security spending clusters around the areas that have protected networks and systems during many IT security professionalsrsquo careers

5

Preventing data breaches is not an IT security spending priority

Figure 7 ndash IT security spending prioritiesSource 2019 Thales Data Threat Report SurveyIDC November 2018

Complianceprivacy requirements

Requirements from partnerscustomers

Increased use ofcloud computing

Implementingbest practices

Competitivestrategic concerns

Reputation andbrand protection

Avoiding databreach penalties

Previous data breach

Executive directive

47

43

39

33

31

30

30

26

21

Figure 8 ndash Meeting compliance requirementsSource 2019 Thales Data Threat Report SurveyIDC November 2018

2019 2018 2017 2016

1st priority 4th priority

Meeting compliance requirements as anIT security spending priority has been atop priority for the last three years

will be affected by data privacy or sovereigntyregulations such as APPI and GDPR

How will they comply

84

Encryption technologies

Encryptingpersonal data

Tokenizing personal data (an encryption

technology)

Use local hostingand cloud providers

Move to compliance locations

54

31

23

18

12

47 59 66 30

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

For the most part these are network and end-point protections rather than the security tools that are best for protecting sensitive data-at-rest and data-in-motion Essentially organizations continue to protect against todayrsquos threats in the newest technology environments with yesterdayrsquos tools Change is required to protect sensitive data in todayrsquos IT landscape and encryption is the critical foundation technology required

Another key finding this year is that although organizations have strong plans for adopting data security technologies actual implementation rates are low When asked where encryption technologies are deployed today to protect not only cloud environments but also big data IoT containers mobile payments social media and blockchain results in every category were 33 or less At the same time 67 of respondents indicate using sensitive data in cloud environments and 30 or more using sensitive data with other digital transformation technologies (with blockchain a bit lower at 29) These results suggest that in spite of good intentions sensitive data within these environments may be at risk

Nevertheless enterprise IT security professionals we polled in Japan clearly understood whatrsquos needed to solve the problem When selecting the information security technologies that they most needed to expand their secure usage of these critical environments encryption was a top choice

bullFor Cloud Encryption was the second ranked top tool needed to enable more cloud use (34)

bullFor Containers 55 identified encryption as the top IT security tool needed to expand use

bullFor Big Data 40 selected system level encryption and access controls as a critical tool needed to alleviate security concerns

bullFor IoT Encryption was required to increase IoT use (38)

Data Security doesnrsquot have to be hard and is vitally importantOrganizations need to take a fresh look at how they provide data security Against this backdrop analysts recommend that security professionals consider the following

bullFocus on all threat vectors

bullInvest in modern hybrid and multi-cloud-based data security tools and measures that scale to modern architecture

bullLook for solutions that let you do more with less

bullPrioritize compliance and sovereignty issues

bullEncryption is an important part of the mix

6

Encryption technologies (Encryption and Tokenization) were identified as the primary strategy to address data privacy and regulatory concerns

54

Encryption is a key driver for increased adoption and usages of digitally transformative technologies

34

Cloud

Containers

40

Big data

38

IoT

55

Figure 9 ndash Encryption for Cloud Big Data IoTand Containers adoptionSource 2019 Thales Data Threat Report Survey IDCNovember 2018

Figure 10 ndash Encryption usage ratesSource 2019 Thales Data Threat Report Survey

IDC November 2018

Encryption usage rates in Japan are low

IoT

DC filevolume

Public cloud

DB ndash fieldcolumn

Big data

FDE in datacenters

ContainersDocker

Nativestorage (SAN)

Cloud native

33

32

32

26

25

24

22

18

17

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

To download the full 2019 Thales Data Threat Report Japan Edition visit ThalesesecuritycomDTR-Japan

2019DataThreat

Our Sponsors

Todayrsquos enterprises depend on the cloud data and software in order to make decisive decisions Thatrsquos why the most respected brands and largest organizations in the world rely on Thales to help them protect and secure access to their most sensitive information and software wherever it is created shared or stored ndash from the cloud and data centers to devices and across networks Our solutions enable organizations to move to the cloud securely achieve compliance with confidence and create more value from their software in devices and services used by millions of consumers every day

About Thales Cloud Protection amp Licensing

About the 2019 Thales Data Threat Report ndash Japan Edition

7

This report is based on a global survey of 1200 executives with responsibility for or influence over IT and data security from nine countries and a range of industries with a primary emphasis on healthcare financial services retail and federal government organizations Job titles range from C-level executives including CEO CFO Chief Data Officer CISO Chief Data Scientist and Chief Risk Officer to SVPVP IT Administrator Security Analyst Security Engineer and Systems Administrator Respondents represent a broad range of organizational sizes with the majority ranging from 500 to 10000 employees The survey was conducted in November 2018

The report focuses on the findings from 100 Japanese respondents providing comparisons and contrast to respondents from other regional markets For global roll-up findings and analysis please see wwwthalesesecuritycomdtr

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

For the most part these are network and end-point protections rather than the security tools that are best for protecting sensitive data-at-rest and data-in-motion Essentially organizations continue to protect against todayrsquos threats in the newest technology environments with yesterdayrsquos tools Change is required to protect sensitive data in todayrsquos IT landscape and encryption is the critical foundation technology required

Another key finding this year is that although organizations have strong plans for adopting data security technologies actual implementation rates are low When asked where encryption technologies are deployed today to protect not only cloud environments but also big data IoT containers mobile payments social media and blockchain results in every category were 33 or less At the same time 67 of respondents indicate using sensitive data in cloud environments and 30 or more using sensitive data with other digital transformation technologies (with blockchain a bit lower at 29) These results suggest that in spite of good intentions sensitive data within these environments may be at risk

Nevertheless enterprise IT security professionals we polled in Japan clearly understood whatrsquos needed to solve the problem When selecting the information security technologies that they most needed to expand their secure usage of these critical environments encryption was a top choice

bullFor Cloud Encryption was the second ranked top tool needed to enable more cloud use (34)

bullFor Containers 55 identified encryption as the top IT security tool needed to expand use

bullFor Big Data 40 selected system level encryption and access controls as a critical tool needed to alleviate security concerns

bullFor IoT Encryption was required to increase IoT use (38)

Data Security doesnrsquot have to be hard and is vitally importantOrganizations need to take a fresh look at how they provide data security Against this backdrop analysts recommend that security professionals consider the following

bullFocus on all threat vectors

bullInvest in modern hybrid and multi-cloud-based data security tools and measures that scale to modern architecture

bullLook for solutions that let you do more with less

bullPrioritize compliance and sovereignty issues

bullEncryption is an important part of the mix

6

Encryption technologies (Encryption and Tokenization) were identified as the primary strategy to address data privacy and regulatory concerns

54

Encryption is a key driver for increased adoption and usages of digitally transformative technologies

34

Cloud

Containers

40

Big data

38

IoT

55

Figure 9 ndash Encryption for Cloud Big Data IoTand Containers adoptionSource 2019 Thales Data Threat Report Survey IDCNovember 2018

Figure 10 ndash Encryption usage ratesSource 2019 Thales Data Threat Report Survey

IDC November 2018

Encryption usage rates in Japan are low

IoT

DC filevolume

Public cloud

DB ndash fieldcolumn

Big data

FDE in datacenters

ContainersDocker

Nativestorage (SAN)

Cloud native

33

32

32

26

25

24

22

18

17

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

To download the full 2019 Thales Data Threat Report Japan Edition visit ThalesesecuritycomDTR-Japan

2019DataThreat

Our Sponsors

Todayrsquos enterprises depend on the cloud data and software in order to make decisive decisions Thatrsquos why the most respected brands and largest organizations in the world rely on Thales to help them protect and secure access to their most sensitive information and software wherever it is created shared or stored ndash from the cloud and data centers to devices and across networks Our solutions enable organizations to move to the cloud securely achieve compliance with confidence and create more value from their software in devices and services used by millions of consumers every day

About Thales Cloud Protection amp Licensing

About the 2019 Thales Data Threat Report ndash Japan Edition

7

This report is based on a global survey of 1200 executives with responsibility for or influence over IT and data security from nine countries and a range of industries with a primary emphasis on healthcare financial services retail and federal government organizations Job titles range from C-level executives including CEO CFO Chief Data Officer CISO Chief Data Scientist and Chief Risk Officer to SVPVP IT Administrator Security Analyst Security Engineer and Systems Administrator Respondents represent a broad range of organizational sizes with the majority ranging from 500 to 10000 employees The survey was conducted in November 2018

The report focuses on the findings from 100 Japanese respondents providing comparisons and contrast to respondents from other regional markets For global roll-up findings and analysis please see wwwthalesesecuritycomdtr

Executive Summary ndash 2019 Thales Data Threat Report Japan Edition

To download the full 2019 Thales Data Threat Report Japan Edition visit ThalesesecuritycomDTR-Japan

2019DataThreat

Our Sponsors

Todayrsquos enterprises depend on the cloud data and software in order to make decisive decisions Thatrsquos why the most respected brands and largest organizations in the world rely on Thales to help them protect and secure access to their most sensitive information and software wherever it is created shared or stored ndash from the cloud and data centers to devices and across networks Our solutions enable organizations to move to the cloud securely achieve compliance with confidence and create more value from their software in devices and services used by millions of consumers every day

About Thales Cloud Protection amp Licensing

About the 2019 Thales Data Threat Report ndash Japan Edition

7

This report is based on a global survey of 1200 executives with responsibility for or influence over IT and data security from nine countries and a range of industries with a primary emphasis on healthcare financial services retail and federal government organizations Job titles range from C-level executives including CEO CFO Chief Data Officer CISO Chief Data Scientist and Chief Risk Officer to SVPVP IT Administrator Security Analyst Security Engineer and Systems Administrator Respondents represent a broad range of organizational sizes with the majority ranging from 500 to 10000 employees The survey was conducted in November 2018

The report focuses on the findings from 100 Japanese respondents providing comparisons and contrast to respondents from other regional markets For global roll-up findings and analysis please see wwwthalesesecuritycomdtr

thalesesecuritycomDTR-Japan

2019DataThreat