JPCERT/CC Conference Highlights Ransomware Risks and Resilience for Industrial Control Systems
Summary
JPCERT/CC’s 2026 ICS Security Conference covered ransomware and OT disruption, digital-twin risks, integrated safety and security design, incident preparedness, and changing vulnerability disclosure and SBOM requirements.
Key points
- Speakers said ransomware continues to seriously affect manufacturing, while disruption to IT systems can halt OT-dependent operations even when control systems remain intact.
- The conference discussed attacks on critical infrastructure and renewable energy facilities, with cyber incidents increasingly capable of causing physical consequences.
- Presentations recommended planning for degraded operations and recovery, including manual processes, backup systems, and external support.
- Digital twins’ links between physical and virtual environments can expose automotive operations to risks such as data injection, delay attacks, and model tampering.
- One proposed ICS design approach links safety and security analyses, system data flows, SBOMs, and vulnerability information for traceability across development and operations.
- Speakers reviewed CVD, CVE, and SBOM practices, including European requirements for vulnerability disclosure policies and reporting exploited vulnerabilities within 24 hours.
Article Details
- Event Type
- JPCERT/CC's 18th annual ICS Security Conference, featuring presentations and discussions on industrial control system security.
- Impact
- The conference shared perspectives on ICS security threats, incident preparedness, digital-twin security, integrated safety and security design, and vulnerability coordination. It reported no specific new cyber incident or direct impact resulting from the event.
People
Chizuru ToyamaSenior Threat Researcher at TXOne Networks Inc.; presented on digital-twin security in the automotive industry.Katsukuni HashimotoDirector in the Cybersecurity Division of Japan's Ministry of Economy, Trade and Industry; delivered opening remarks.Shunsuke KatoSenior Solution Engineer at Claroty Ltd. APJ Sales; presented on ICS incident response preparedness.Taito SasakiRepresentative Member of Forehacks LLC and Visiting Researcher at the Institute for Manufacturing and Innovation DX Laboratory, Nagoya Institute of Technology; presented on integrated safety and security design.Takayoshi ShiigiJPCERT/CC board member; delivered closing remarks.Tomotaka ItoGlobal CVD Project Lead in JPCERT/CC's Global Coordination Division; presented on vulnerability information and CVD.Toshio MiyachiExpert Adviser at JPCERT/CC; presented a review of ICS security trends.Yumi OritoJPCERT/CC Domestic Coordination Group member and article author.
Malware
Vendors
Products
EPSSHe also encouraged users to improve asset visibility, make use of SBOMs, and adopt prioritization methods such as SSVC and EPSS.JC-STARchain; the formulation of OT security guidelines for semiconductor device factories; the launch of JC-STAR (labeling scheme based on Japan Cyber-Security Technical Assessment Requirements) and moves toNVDCVE Numbering Authorities (CNA) and Roots and confusion surrounding the National Vulnerability Database (NVD), pointing out the need for data quality, enrichment, and proper handling.SSVCHe also encouraged users to improve asset visibility, make use of SBOMs, and adopt prioritization methods such as SSVC and EPSS.
Countries
JapanThis conference aims to share the current threat landscape surrounding Industrial Control System (ICS) in Japan and abroad, as well as initiatives undertaken by stakeholders in ICS security.UkraineAt the outset, he noted that 2025 marked 15 years since the discovery of Stuxnet and 10 years since the Ukraine power outage incidents.United KingdomUnited StatesHe further reviewed developments in regulations and standards, including the EU’s NIS2 Directive, revisions to the IEC 62443 series, and progress related to CIRCIA in the United States.
Industries
AutomotiveUsing cases involving a UK automotive manufacturer and major Japanese companies, he highlighted the structural risk whereby compromises in IT environments can ultimately have major consequences for OT and productionEnergyactors and hacktivists targeting critical infrastructure, as well as incidents involving renewable energy facilities, dams, and hydroelectric power plants, showing that cyber attacks with physical consequencesManufacturingHashimoto noted that ransomware remains a major threat and that its impact continues to expand, particularly in the manufacturing sector.