{
  "schemaVersion": "1.0.0",
  "kind": "editorial-inspection-pack",
  "provenance": "editorial-guidance",
  "guideId": "contain-and-restore",
  "updatedAt": "2026-11-12",
  "catalogVersion": "0.11.0",
  "sourceRepository": "https://github.com/sakimyto/security-knowledge",
  "sourceLicense": "MIT",
  "catalogHash": "e99906d58134e7e0d33d994548277ae7814000d92c088aa5894c49b62ae60cca",
  "catalogReviewedAt": "2026-11-09",
  "execution": "read-only-by-default",
  "selectedRuleIds": ["SEC-008", "SEC-013"],
  "deferredRuleIds": [
    "SEC-001",
    "SEC-002",
    "SEC-003",
    "SEC-004",
    "SEC-005",
    "SEC-006",
    "SEC-007",
    "SEC-009",
    "SEC-010",
    "SEC-011",
    "SEC-012",
    "SEC-014",
    "SEC-015",
    "SEC-016"
  ],
  "outsideSelectionStatus": "unverified",
  "resultStatuses": ["finding", "no-finding", "not-applicable", "unverified"],
  "reportSchemaUrl": "https://sakimyto.com/security-data/report.schema.json",
  "reportExampleUrl": "https://sakimyto.com/security-data/report.example.json",
  "catalogDiscoveryUrl": "https://sakimyto.com/security-data/discovery.json",
  "distributionIndexUrl": "https://sakimyto.com/security-learning-data/index.json",
  "requiredRuleIndex": [
    {
      "id": "SEC-001",
      "hash": "efec3489e1663249a2aff75cdb7c25e82d9765acb2bdcfa31e8ee934f12ef626"
    },
    {
      "id": "SEC-002",
      "hash": "1398f1a8c28e4441472ef3a0952fde97c4ff19b5010178989f4ddd05b6a193dd"
    },
    {
      "id": "SEC-003",
      "hash": "00aa6c368be21452c79e662728102938d7d3896073e53de74ea5fc913250b808"
    },
    {
      "id": "SEC-004",
      "hash": "4c8742376f6fe13cb33908f282d1a6af6fd73ae0a13007f8013ca7042fd629b4"
    },
    {
      "id": "SEC-005",
      "hash": "695e2e119a1364887732e6ee90c1250d22063f1e6e0ec71746e80b7231ace15f"
    },
    {
      "id": "SEC-006",
      "hash": "a3cc524b847c5ec9223ea64ed01920283062fe3fcd0eaf2595bde44f951eed71"
    },
    {
      "id": "SEC-007",
      "hash": "154186523c183ea0ec0059b951eb9b35f0ac41557c28df13c071663be3aef6ee"
    },
    {
      "id": "SEC-008",
      "hash": "ab2bd7e87128a2ce571578558337ab8577fcda20f841171dba5b45d732ad2f03"
    },
    {
      "id": "SEC-009",
      "hash": "8b9d4f314306ca656f73c115c195d84dd803e8a58a53355ed03516b330b26cb2"
    },
    {
      "id": "SEC-010",
      "hash": "66b39f4eb8a0f334e98e9388e3f9dab27415e726c0862f0b6a4a4dd10e5e81df"
    },
    {
      "id": "SEC-011",
      "hash": "3ae198ddd5fa82a53bcbca648d3a9070b03e3cd5665387e69e50c6bb6d365cb3"
    },
    {
      "id": "SEC-012",
      "hash": "2da99baf28980f61385469445d6c000edb5434471a4a3500f1775ca78467824a"
    },
    {
      "id": "SEC-013",
      "hash": "630183526a6d030807db345f6214176c12ca911fb261bde3abebc1c355a21d98"
    },
    {
      "id": "SEC-014",
      "hash": "d9142da38fbe305f72d506a6d6c3c97f658fa446587dc9b27657622c880c1163"
    },
    {
      "id": "SEC-015",
      "hash": "1dfd83077658a79d47897d199f646eb9f69aa4d92c7646c57f2b82a715fde44c"
    },
    {
      "id": "SEC-016",
      "hash": "cce435bbacb6fef88c9e9d661222b081d8463e4f025448a7796cdcddd7548488"
    }
  ],
  "boundary": {
    "ja": "選択した2ルールだけを、許可された対象で読み取り点検します。残る14ルールは実行せず、既存の結果形式へunverifiedと範囲外の理由を残します。資料を読むだけで合格にせず、秘密の実値・変更・外部送信の権限は増やしません。",
    "en": "Inspect only the two selected rules in authorized scope, read-only. Leave the other fourteen unperformed and report them as unverified with an out-of-scope reason under the existing contract. Reading guidance is not a pass and grants no authority to expose secrets, modify systems, or send data."
  },
  "guide": {
    "id": "contain-and-restore",
    "title": {
      "ja": "広がる範囲と、戻せる範囲を分ける",
      "en": "Separate the blast radius from recovery"
    },
    "lead": {
      "ja": "権限を通じて届く範囲と、隔離・復元の記録をつなげて考えます。",
      "en": "Connect reachable resources with containment and restoration records."
    },
    "situation": {
      "ja": "管理者・CI・委託先の接続が広く、共有システムの復旧も必要なとき。",
      "en": "Use this when broad administrative, pipeline, or contractor access coexists with shared recovery dependencies."
    },
    "goal": {
      "ja": "一つの起点から届く範囲と、実際に復元を確認した範囲を説明できるようにします。",
      "en": "Describe both what is reachable from a starting identity and what has demonstrably been restored."
    },
    "ruleIds": ["SEC-008", "SEC-013"],
    "incidentIds": ["cloudflare-thanksgiving-2023", "askul-2025"],
    "termIds": ["authorization", "restore", "asset"],
    "sourceIds": ["authorization", "recovery"],
    "steps": [
      {
        "title": {
          "ja": "起点と接続関係を読む",
          "en": "Map starting privileges"
        },
        "action": {
          "ja": "管理権限と信頼関係をたどり、本番・別環境・バックアップへ届く経路を分けます。",
          "en": "Trace administrative permissions and trust relationships into production, other environments, and backups."
        },
        "evidence": {
          "ja": "起点の権限と、到達先の資産・管理者。",
          "en": "Starting privileges, reachable assets, and their owners."
        }
      },
      {
        "title": {
          "ja": "隔離と復旧の前提を見る",
          "en": "Review containment and recovery prerequisites"
        },
        "action": {
          "ja": "止める対象、復元に必要なデータ・設定・接続を、既存の手順から読みます。",
          "en": "Read the existing procedures for identifying containment targets and recovery data, settings, and connections."
        },
        "evidence": {
          "ja": "復旧対象と、必要な依存関係・実行権限。",
          "en": "Recovery targets, dependencies, and required permissions."
        }
      },
      {
        "title": {
          "ja": "保存と復元を分けて記録する",
          "en": "Separate backup from restoration evidence"
        },
        "action": {
          "ja": "承認済みの復元試験を読み、使える状態まで戻した対象と未検証の対象を分けます。",
          "en": "Review authorized restoration exercises and distinguish usable restored scope from unverified scope."
        },
        "evidence": {
          "ja": "復元した時点・対象・利用確認と、残る制約。",
          "en": "Restore point, target, usability confirmation, and remaining constraints."
        }
      }
    ],
    "limits": [
      {
        "ja": "権限の経路があるだけで、侵害が成立したとは断定しません。",
        "en": "A permission path alone does not establish that a compromise occurred."
      },
      {
        "ja": "実際の隔離・権限停止・本番復元は、読み取り点検から勝手に実行しません。",
        "en": "Do not turn read-only review into containment, privilege removal, or production restoration."
      }
    ],
    "takeaway": {
      "ja": "備えの有無を一つの数にまとめず、到達範囲と復旧の証拠を分けて残します。",
      "en": "Keep reachability and recovery evidence distinct rather than reducing readiness to one score."
    }
  },
  "rules": [
    {
      "rule": {
        "id": "SEC-008",
        "version": "1.1.2",
        "updatedAt": "2026-10-26",
        "title": {
          "ja": "侵害後に広がる管理権限を確認する",
          "en": "Inspect privileges enabling lateral access"
        },
        "summary": {
          "ja": "管理者・サービスアカウント・CIが本番や別のデータ基盤へアクセスする環境。",
          "en": "Environments where administrators, services, or CI can access production or separate data stores."
        },
        "category": "credentials",
        "surfaces": ["identity", "cloud", "data-store", "ci"],
        "applicability": {
          "ja": "管理者・サービスアカウント・CIが本番や別のデータ基盤へアクセスする環境。",
          "en": "Environments where administrators, services, or CI can access production or separate data stores."
        },
        "targets": [
          {
            "ja": "IAM・ロール・サービスアカウント",
            "en": "IAM, roles, service identities"
          },
          {
            "ja": "本番トークン発行経路・環境間の接続",
            "en": "Production token issuance, cross-environment access"
          }
        ],
        "checks": [
          {
            "ja": "通常業務に必要な権限と、鍵の発行・データ一括取得・権限追加が可能な範囲を比較する。",
            "en": "Compare job needs with credential issuance, bulk-export, and privilege-grant capabilities."
          },
          {
            "ja": "一つのセッションや鍵の侵害で他の環境へ到達できる経路を記録する。",
            "en": "Document cross-environment paths available to a single compromised identity."
          }
        ],
        "remediation": [
          {
            "ja": "権限の縮小と環境の分離を提案し、必要な業務への影響を検証する。",
            "en": "Propose narrower roles and environment boundaries; test impact on required workflows."
          }
        ],
        "completionEvidence": [
          {
            "ja": "許可した操作が成功し、許可していない操作が拒否されるテストを残す。",
            "en": "Record positive tests for allowed operations and negative tests for denied operations."
          }
        ],
        "limitations": [
          {
            "ja": "権限の広さだけで侵害を断定しません。本番ロールの変更は所有者の承認範囲に従います。",
            "en": "Broad privileges do not establish compromise. Production role changes follow owner authorization."
          }
        ],
        "incidentIds": [
          "2rinkan-api-2026",
          "aflac-japan-2026",
          "ainokaze-reservations-2026",
          "anthropic-claude-code-abuse-2025",
          "anthropic-cyber-evals-2026",
          "applynow-bi-2026",
          "arcadia-raiden-2026",
          "asahi-pharma-digital-2026",
          "askul-2025",
          "campfire-2026",
          "charm-2026",
          "chiba-biodiversity-2026",
          "chibagin-shoten-2026",
          "chubu-business-credentials-2026",
          "circleci-2023",
          "cloudflare-thanksgiving-2023",
          "cmic-ra-connect-2026",
          "commune-2026",
          "conoha-wing-2026",
          "coop-yamaguchi-2026",
          "corona-cloud-2026",
          "cota-2026",
          "daiichi-life-hr-2026",
          "daiki-suisan-2026",
          "dandm-vpn-ransomware-2026",
          "denmark-cpr-2026",
          "digital-agency-gss-2026",
          "discord-support-vendor-2025",
          "epark-peakmanager-2026",
          "eplus-refund-2026",
          "estore-shopserve-2026",
          "expo-subcontractor-mail-2026",
          "fines-reservations-2026",
          "five-foxes-2026",
          "forticloud-sso-2026",
          "france-refrigeration-2026",
          "fujita-personal-pc-scam-2026",
          "fukuoka-editable-application-2026",
          "fuso-cloud-storage-2026",
          "gainsight-oauth-2025",
          "gex-ransomware-2026",
          "gmo-infoq-2026",
          "gpoint-2026",
          "gyazo-2026",
          "hana-bank-2026",
          "his-thailand-2025",
          "idcf-ransomware-2026",
          "inkrevolution-payment-2025",
          "innovation-github-2026",
          "jaea-jrr3-files-2026",
          "jogmec-directory-2026",
          "k9natural-2026",
          "kaga-solnet-2026",
          "kamogawa-form-exposure-2026",
          "kb-kookmin-2026",
          "kddi-isp-2026",
          "kindal-phishing-2026",
          "komatsu-user-directory-exposure-2026",
          "kwansei-external-sns-2026",
          "leanbody-metabase-2026",
          "legoland-amadeus-2026",
          "logicvein-2025",
          "media4u-account-list-2026",
          "mediaplex-2026",
          "medley-atlink-2026",
          "metabase-2026",
          "mie-school-form-exposure-2026",
          "mitsui-fudosan-directory-2026",
          "miyamoto-munashi-orders-2026",
          "mrmax-2026",
          "murauchi-2026",
          "nichirei-2026",
          "nihontelenet-ransomware-2026",
          "nostrum-smartspi-2026",
          "omic-support-scam-2026",
          "omu-ransomware-2026",
          "openai-huggingface-eval-2026",
          "openai-mixpanel-2025",
          "osaka-high-court-teams-2026",
          "osaka-recruitment-vendor-2026",
          "ozmall-2026",
          "pickleballone-plugin-2026",
          "postman-shai-hulud-2025",
          "quick-2025",
          "rakuten-books-pc-2026",
          "rakuten-drive-2026",
          "react2shell-2025",
          "ryomo-systems-2026",
          "saga-hirakawaya-payment-2026",
          "sakura-billing-2026",
          "sakura-hosting-2026",
          "scala-iask-2026",
          "seicomart-app-2026",
          "shueisha-hapicomi-2026",
          "skyticket-business-system-2026",
          "skyticket-server-2026",
          "snowflake-unc5537-2024",
          "temairazu-2026",
          "times-car-2026",
          "tokyometro-metpo-mail-2026",
          "trivy-supply-chain-2026",
          "unit42-ai-assisted-2026",
          "visualarts-cloud-credentials-2026",
          "voising-bi-2026",
          "weverse-payment-api-2026",
          "white-essence-2026",
          "yakiniku-king-2026",
          "yamato-pay-later-2026",
          "yellowhat-booking-2026"
        ],
        "references": [],
        "execution": "read-only-by-default",
        "provenance": "editorial-guidance"
      },
      "example": {
        "ruleId": "SEC-008",
        "scenario": {
          "ja": "一つの管理者やCIアカウントから、複数環境へ接続できる構成。",
          "en": "One administrative or CI identity can reach several environments."
        },
        "firstCheck": {
          "ja": "ロール、接続関係、引き受け可能な権限を設定資料からたどります。",
          "en": "Trace roles, connections, and assumable permissions through configuration records."
        },
        "lookAt": [
          {
            "ja": "誰がどの資産を管理できるかの一覧。",
            "en": "The mapping of identities to administrable assets."
          },
          {
            "ja": "別環境・委託先へ進む信頼関係。",
            "en": "Trust relationships reaching other environments or contractors."
          },
          {
            "ja": "権限変更を承認し記録する経路。",
            "en": "The approval and recording path for privilege changes."
          }
        ],
        "evidence": {
          "ja": "起点にした権限と、そこから届く範囲を区別して残します。",
          "en": "Separate the starting privilege from the resources reachable through it."
        },
        "limit": {
          "ja": "経路の一覧だけで侵害の成立を断定しません。実際の権限昇格や停止は行いません。",
          "en": "A relationship map does not establish exploitability. Do not escalate privileges or disable access."
        },
        "sourceIds": ["authorization"]
      }
    },
    {
      "rule": {
        "id": "SEC-013",
        "version": "1.1.2",
        "updatedAt": "2026-11-09",
        "title": {
          "ja": "隔離手順とバックアップの復元を確認する",
          "en": "Inspect containment and backup restoration"
        },
        "summary": {
          "ja": "共有システム、クラウド、データ保存先がある場合に、侵害時の被害拡大と復旧を点検します。",
          "en": "Applies to shared systems, cloud, and data stores for containment and recovery inspection."
        },
        "category": "configuration",
        "surfaces": ["cloud", "data-store"],
        "applicability": {
          "ja": "共有システム、クラウド、データ保存先がある場合に、侵害時の被害拡大と復旧を点検します。",
          "en": "Applies to shared systems, cloud, and data stores for containment and recovery inspection."
        },
        "targets": [
          {
            "ja": "システム間の依存関係、ネットワーク隔離と実行の責任者、バックアップの保存先と削除権限。",
            "en": "System dependencies, isolation procedures and owners, backup locations, and deletion privileges."
          }
        ],
        "checks": [
          {
            "ja": "侵害された本番権限からバックアップを変更・削除できるかを権限情報で確認する。",
            "en": "Use privilege metadata to check whether compromised production authority can alter or delete backups."
          },
          {
            "ja": "復元試験の日時・対象リビジョン・成功結果を確認し、目標復旧時間とデータ損失の要件と照合する。",
            "en": "Inspect restoration-test dates, revisions, and outcomes against recovery-time and data-loss requirements."
          },
          {
            "ja": "共有システムの隔離手順、業務影響、連絡・判断の担当を記録と照合する。",
            "en": "Compare shared-system containment procedures, operational impact, and decision ownership with records."
          }
        ],
        "remediation": [
          {
            "ja": "バックアップの権限と管理経路を本番から分け、保護・保持の方針を設定する。",
            "en": "Separate backup privileges and administration from production and define protection and retention policies."
          },
          {
            "ja": "承認された環境で復元・隔離の試験を行い、結果に基づき手順を更新する。",
            "en": "Conduct authorized restoration and containment tests and update procedures from outcomes."
          }
        ],
        "completionEvidence": [
          {
            "ja": "バックアップの権限・保護設定と、対象リビジョンを明記した復元試験の記録。",
            "en": "Backup privilege and protection settings, plus restoration-test records with scoped revisions."
          },
          {
            "ja": "隔離の判断者、手順、業務依存を確認した記録。",
            "en": "Records verifying containment decision ownership, procedures, and operational dependencies."
          }
        ],
        "limitations": [
          {
            "ja": "バックアップが存在することだけでは復元成功を証明できません。復元試験の証拠がなければ未確認です。",
            "en": "Backup existence does not prove successful restoration; missing restoration evidence remains unverified."
          },
          {
            "ja": "本番通信の遮断や破壊的な復旧操作は、この点検ルールだけでは許可されません。",
            "en": "This inspection rule does not authorize production isolation or destructive recovery."
          }
        ],
        "incidentIds": [
          "arcadia-raiden-2026",
          "askul-2025",
          "conoha-wing-2026",
          "coop-yamaguchi-2026",
          "cota-2026",
          "dandm-vpn-ransomware-2026",
          "education-software-dormant-2026",
          "epark-peakmanager-2026",
          "five-foxes-2026",
          "france-refrigeration-2026",
          "gex-ransomware-2026",
          "idcf-ransomware-2026",
          "keio-ransomware-2026",
          "logicvein-2025",
          "medley-atlink-2026",
          "nichirei-2026",
          "nihontelenet-ransomware-2026",
          "nishiyama-2026",
          "nostrum-smartspi-2026",
          "omu-ransomware-2026",
          "ryomo-systems-2026",
          "sakura-hosting-2026",
          "nec-contractor-breach-2026"
        ],
        "references": [
          {
            "title": "アスクル調査結果",
            "url": "https://www.askullogist.co.jp/pdf/20251212.pdf"
          },
          {
            "title": "京王電鉄の障害公表",
            "url": "https://www.keio.co.jp/news/update/announce/nr260926v13404/"
          }
        ],
        "execution": "read-only-by-default",
        "provenance": "editorial-guidance"
      },
      "example": {
        "ruleId": "SEC-013",
        "scenario": {
          "ja": "バックアップは保存しているが、必要なサービスを戻せるかを確認したい環境。",
          "en": "Backups exist, but restoration of the required service needs verification."
        },
        "firstCheck": {
          "ja": "復旧対象と、直近の承認済み復元試験の記録を照合します。",
          "en": "Compare the recovery scope with records of the latest authorized restoration exercise."
        },
        "lookAt": [
          {
            "ja": "戻すデータ・設定・依存サービスの一覧。",
            "en": "The data, settings, and dependencies required for recovery."
          },
          {
            "ja": "隔離する手順と復元先の権限。",
            "en": "Containment procedures and restoration-target permissions."
          },
          {
            "ja": "復元結果と業務上の利用確認。",
            "en": "Restoration results and confirmation of usable service."
          }
        ],
        "evidence": {
          "ja": "どの時点の何を、どの状態まで戻せたかを記録します。",
          "en": "Record what was restored, from which point, and to what usable state."
        },
        "limit": {
          "ja": "保存成功や手順書の存在だけでは復元成功にしません。本番への復元や隔離は実行しません。",
          "en": "A successful backup or written procedure is not a successful restoration. Do not restore or isolate production during review."
        },
        "sourceIds": ["recovery"]
      }
    }
  ],
  "referenceIncidents": [
    {
      "id": "cloudflare-thanksgiving-2023",
      "title": {
        "ja": "Cloudflare：失効漏れのトークンとアカウントから侵入",
        "en": "Cloudflare: credentials missed during rotation"
      },
      "organization": "Cloudflare",
      "summary": {
        "ja": "以前のOkta事故で漏洩した資格情報のうち、更新されなかったトークンとアカウントが悪用されました。自己管理のAtlassian環境に侵入され、ソースコード等にアクセスされました。",
        "en": "Credentials stolen in the earlier Okta incident were missed during rotation. They enabled access to self-hosted Atlassian systems and source code."
      },
      "occurredAt": "2023-11-14",
      "disclosedAt": "2024-02-01",
      "reviewedAt": "2026-10-02",
      "outcome": "confirmed-breach",
      "categories": ["credentials"],
      "cves": [],
      "claims": [
        {
          "topic": "entry",
          "text": {
            "ja": "未使用と誤認したサービス用トークン1つとアカウント3つが、更新されずに残っていました。",
            "en": "One service token and three accounts were not rotated because they were mistakenly thought unused."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "Credentials not rotated"
        },
        {
          "topic": "scope",
          "text": {
            "ja": "侵入は自己管理のAtlassian環境に及びました。顧客データやグローバルネットワークへの影響はなかったと公表しました。",
            "en": "The self-hosted Atlassian environment was accessed; Cloudflare reported no impact on customer data or its global network."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "Executive summary"
        }
      ],
      "timeline": [
        {
          "date": "2023-11-14",
          "text": {
            "ja": "公表された偵察・アクセスの開始。",
            "en": "Beginning of disclosed reconnaissance and access."
          },
          "sourceIds": ["s1"]
        },
        {
          "date": "2023-11-23",
          "text": {
            "ja": "侵入を検知。",
            "en": "Intrusion detected."
          },
          "sourceIds": ["s1"]
        },
        {
          "date": "2023-11-24",
          "text": {
            "ja": "攻撃者のアクセスを停止。",
            "en": "Attacker access terminated."
          },
          "sourceIds": ["s1"]
        },
        {
          "date": "2024-02-01",
          "text": {
            "ja": "調査結果を公表。",
            "en": "Investigation published."
          },
          "sourceIds": ["s1"]
        }
      ],
      "reportedActions": [
        {
          "topic": "response",
          "text": {
            "ja": "資格情報の広範な更新と、侵入範囲の調査を実施しました。",
            "en": "Credentials were rotated broadly and access scope investigated."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "Remediation"
        }
      ],
      "prevention": {
        "classification": "operational-control",
        "assessment": {
          "ja": "更新した鍵の一覧だけでなく、対象の全資格情報と旧鍵の失効証拠を照合する点検が必要です。",
          "en": "Reconcile all affected credentials against rotation records and evidence that old credentials are revoked."
        },
        "sourceIds": ["s1"]
      },
      "ai": {
        "status": "unknown",
        "assessment": {
          "ja": "参照した一次情報に、攻撃でAIを利用したことを裏付ける記述はありません。AI不使用を意味しません。",
          "en": "The cited primary sources do not establish AI involvement. This does not establish that AI was absent."
        }
      },
      "unknowns": [
        {
          "ja": "対象資格情報の実値や内部の完全な権限構成は、公表資料から確認できません。",
          "en": "Public sources do not expose credential values or the complete internal authorization model."
        }
      ],
      "sources": [
        {
          "id": "s1",
          "title": "Thanksgiving 2023 security incident",
          "url": "https://blog.cloudflare.com/thanksgiving-2023-security-incident/",
          "publisher": "Cloudflare",
          "kind": "organization",
          "publishedAt": "2024-02-01",
          "reviewedAt": "2026-10-02"
        }
      ],
      "ruleIds": ["SEC-005", "SEC-008", "SEC-009"]
    },
    {
      "id": "askul-2025",
      "organization": "ASKUL",
      "title": {
        "ja": "アスクル：MFAの例外アカウントから侵入",
        "en": "ASKUL: access through an MFA exception"
      },
      "summary": {
        "ja": "委託先用の管理者アカウントの認証情報が悪用され、ランサムウェア被害が発生しました。このアカウントにはMFAが適用されていませんでした。",
        "en": "Stolen credentials for a contractor administrator account without MFA enabled a ransomware intrusion."
      },
      "occurredAt": null,
      "disclosedAt": "2025-10-19",
      "reviewedAt": "2026-10-10",
      "outcome": "confirmed-breach",
      "categories": ["credentials"],
      "cves": [],
      "claims": [
        {
          "topic": "entry",
          "text": {
            "ja": "委託先用アカウントのID・パスワードが悪用されました。認証情報が漏れた経路は特定されていません。",
            "en": "A contractor account was misused; the original credential leak remains unresolved."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "p.4 §6(1) 不正アクセス"
        },
        {
          "topic": "impact",
          "text": {
            "ja": "一部のサーバーにはEDRと常時監視がなく、バックアップの暗号化・削除が復旧を妨げました。",
            "en": "Some servers lacked EDR and continuous monitoring; encrypted or deleted backups impeded recovery."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "p.3 §4-2 / p.4 §6(2)・(3)"
        },
        {
          "topic": "investigation-limit",
          "text": {
            "ja": "委託先PCのOS更新で侵入時点のログが失われ、取得経路の調査に限界があると公表しました。",
            "en": "ASKUL reported that an OS update erased relevant contractor-PC logs, limiting the origin investigation."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "p.4 §6(1) 調査により判明した事項"
        }
      ],
      "timeline": [
        {
          "date": "2025-10-19",
          "text": {
            "ja": "この事案を公表。",
            "en": "Incident disclosed."
          },
          "sourceIds": ["s1"]
        }
      ],
      "reportedActions": [
        {
          "topic": "response",
          "text": {
            "ja": "認証情報の更新、MFA適用、環境の再構築を実施したと公表しました。",
            "en": "ASKUL reported credential resets, MFA rollout, and environment rebuilding."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "p.4 §5-2 / p.4–5 §7-1・7-2"
        }
      ],
      "prevention": {
        "classification": "operational-control",
        "assessment": {
          "ja": "MFAの例外と委託先の管理権限を確認します。侵害された権限から削除できないバックアップと復元試験も必要です。",
          "en": "Inspect MFA exceptions and contractor privileges, plus protected backups and restoration tests."
        },
        "sourceIds": ["s1"]
      },
      "ai": {
        "status": "unknown",
        "assessment": {
          "ja": "参照した情報では、攻撃者によるAI利用は確認できません。AI不使用を意味しません。",
          "en": "The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence."
        }
      },
      "unknowns": [
        {
          "ja": "認証情報の流出元は不明です。VPNの脆弱性を悪用した痕跡は確認されていません。",
          "en": "Credential theft origin is unresolved; the report found no evidence that the VPN vulnerability was exploited."
        }
      ],
      "sources": [
        {
          "id": "s1",
          "reviewedAt": "2026-10-10",
          "title": "ランサムウェア攻撃の影響調査結果および安全性強化に向けた取り組みのご報告（第13報）",
          "url": "https://www.askullogist.co.jp/pdf/20251212.pdf",
          "publisher": "ASKUL",
          "publishedAt": "2025-12-12",
          "kind": "organization"
        }
      ],
      "ruleIds": ["SEC-002", "SEC-003", "SEC-005", "SEC-008", "SEC-009", "SEC-013"],
      "hypotheses": [
        {
          "id": "contractor-endpoint-origin",
          "kind": "cause",
          "status": "hypothesis",
          "provenance": "editorial-analysis",
          "statement": {
            "ja": "委託先端末から管理者の資格情報が取得された可能性を、調査候補として残します。",
            "en": "Acquisition of administrator credentials from the contractor endpoint remains a candidate origin."
          },
          "basis": {
            "ja": "委託先アカウントの悪用は確認されていますが、同PCの侵入時ログは失われています。",
            "en": "Account misuse was confirmed, but relevant contractor-PC logs are unavailable."
          },
          "sourceIds": ["s1"],
          "locator": "p.4 §6(1)",
          "assumptions": [
            {
              "ja": "該当する資格情報が、侵入前に委託先端末で使用・保存されていた場合。",
              "en": "The credentials were used or stored on the contractor endpoint before entry."
            }
          ],
          "supportingObservations": [
            {
              "ja": "保全済みの端末・EDR記録で、初回ログイン前の資格情報読み取りや持ち出しを確認できる。",
              "en": "Preserved endpoint or EDR records show credential access or transfer before the first login."
            }
          ],
          "contradictingObservations": [
            {
              "ja": "別の保管先から同じ資格情報が流出した記録があり、端末由来という説明と時系列が合わない。",
              "en": "A documented leak elsewhere and its timing contradict the endpoint-origin explanation."
            }
          ],
          "limitations": [
            {
              "ja": "ログ欠落は侵害の証拠ではありません。フィッシングや別の保管先からの流出も排除できません。",
              "en": "Missing logs are not proof of compromise; phishing and other storage origins remain possible."
            }
          ],
          "ruleIds": ["SEC-003", "SEC-009"]
        },
        {
          "id": "mfa-exception-closure",
          "kind": "mitigation",
          "status": "hypothesis",
          "provenance": "editorial-analysis",
          "statement": {
            "ja": "委託先も含めてリモート管理のMFA例外をなくすと、ID・パスワードだけを使う侵入を減らせる可能性があります。",
            "en": "Removing contractor MFA exceptions could reduce remote entry using passwords alone."
          },
          "basis": {
            "ja": "悪用された委託先用管理者アカウントには、例外としてMFAが適用されていませんでした。",
            "en": "The misused contractor administrator account had an MFA exception."
          },
          "sourceIds": ["s1"],
          "locator": "p.4 §6(1)",
          "assumptions": [
            {
              "ja": "対象の侵入がID・パスワード認証に依存し、セッション窃取や別経路ではない場合。",
              "en": "Entry depends on password authentication rather than stolen sessions or another path."
            }
          ],
          "supportingObservations": [
            {
              "ja": "自分の環境のIdP設定と認証ログで委託先・緊急用の例外がなく、隔離環境の架空アカウントでパスワードのみの接続が拒否される。",
              "en": "IdP policies and logs show no contractor or emergency exception; a synthetic isolated test rejects password-only access."
            }
          ],
          "contradictingObservations": [
            {
              "ja": "旧方式の認証や例外アカウントで追加要素なしに接続できる、または窃取されたセッションで接続できる。",
              "en": "Legacy or exempt access bypasses the extra factor, or a stolen session still grants access."
            }
          ],
          "limitations": [
            {
              "ja": "MFAだけで資格情報の流出、端末侵害、バックアップ破壊を防ぐことはできません。",
              "en": "MFA alone does not prevent credential leaks, endpoint compromise, or backup destruction."
            }
          ],
          "ruleIds": ["SEC-002", "SEC-005"]
        }
      ]
    }
  ],
  "terms": [
    {
      "id": "authorization",
      "name": {
        "ja": "操作できる範囲",
        "en": "Authorization"
      },
      "meaning": {
        "ja": "利用者が、その対象に、その操作をしてよいかを決めること。ログインできることとは別の判断です。",
        "en": "The decision about whether a caller may perform a particular action on a particular resource, separate from establishing their identity."
      },
      "question": {
        "ja": "対象を別の利用者や組織に変えても、同じ判断が働きますか。",
        "en": "Does the decision still hold when the resource belongs to another user or organization?"
      },
      "ruleId": "SEC-014",
      "sourceId": "authorization"
    },
    {
      "id": "restore",
      "name": {
        "ja": "復元",
        "en": "Restoration"
      },
      "meaning": {
        "ja": "保存したデータから、必要なサービスを使える状態へ戻すこと。バックアップの保存成功とは分けて確認します。",
        "en": "Returning data and services to a usable state. Treat this separately from successfully creating a backup."
      },
      "question": {
        "ja": "必要な範囲を、信頼できる状態へ戻せた記録はありますか。",
        "en": "Is there evidence that the required scope was restored to a trusted state?"
      },
      "ruleId": "SEC-013",
      "sourceId": "recovery"
    },
    {
      "id": "asset",
      "name": {
        "ja": "守る対象",
        "en": "Asset"
      },
      "meaning": {
        "ja": "サービス、保存先、管理アカウントなど、点検の対象になるもの。持ち主と用途を一緒に記録します。",
        "en": "A service, store, or administrative identity included in the review. Record its owner and purpose as well as its name."
      },
      "question": {
        "ja": "どの環境の、誰が管理する対象を見ていますか。",
        "en": "Which environment and owner does this asset belong to?"
      },
      "ruleId": "SEC-006",
      "sourceId": "attack-surface"
    }
  ],
  "sources": [
    {
      "id": "authorization",
      "title": "Authorization Cheat Sheet",
      "publisher": "OWASP",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html",
      "locator": "Enforce Least Privileges; Validate the Permissions on Every Request",
      "reviewedAt": "2026-11-12"
    },
    {
      "id": "recovery",
      "title": "CIS Critical Security Control 11: Data Recovery",
      "publisher": "Center for Internet Security",
      "url": "https://www.cisecurity.org/controls/data-recovery",
      "locator": "Overview: restore in-scope assets to a pre-incident and trusted state",
      "reviewedAt": "2026-11-12"
    }
  ]
}