Microsoft 365 E5 and Microsoft Security Copilot: Forging a security environment to protect SHUEISHA creativity

New cybersecurity approaches enable vigorous protection of creativity and intellectual property

Both physical security and cybersecurity represent key challenges for SHUEISHA Inc., whose intellectual property (IP) includes innumerable global successes in manga, novels, and other areas.

Since 2020, several triggers progressively stimulated SHUEISHA’s consideration of cybersecurity, as Information System Department Manager Kenji Okamoto recalls. “We used to rely heavily on Virtual Desktop Infrastructure (VDI) for cybersecurity countermeasures. However, once remote work took off with the COVID-19 State of Emergency declaration in April 2020, we discovered that many employees had no computer at home and relied solely on the office VDI, so we hastily procured and distributed notebook computers. Then in 2022, we learned that support was ending for existing VDI and IP-PBX. This chain of events caused us to rethink the fundamentals of our cybersecurity.”

In June 2022, the company underwent structural reorganization, and the Information System Office which was previously in the General Affairs Division became the independent Information System Department. Establishing an Information Management Office within the Information System Department allowed the cybersecurity enhancement project to proceed swiftly. SHUEISHA was able to select a unified plan from Microsoft solutions to integrate the environment, transitioning away from the previous use of differing products for authentication infrastructure, endpoint security, and VDI. Okamoto describes what happened in greater detail.

“Just before COVID-19 hit, we had signed up with Office 365 E1 and switched over to Exchange Online and Outlook on March 1, 2020. Enabling mail usage both within and outside the company allowed us to transition to remote work without any major disruption to business. During this period, we grappled with what to do next. When it was announced in October 2023 that support would end for Office 2016 and 2019 cloud connections, we considered transitioning to Microsoft 365 E5. A great benefit gained by unifying with Microsoft products is the switch from VDI to Azure Virtual Desktop (AVD) and IP-PBX to Microsoft Teams Phone, which enabled a more convenient environment and closed security gaps.”

In December 2022, SHUEISHA decided to introduce Microsoft 365 E5. A major system renovation began the following month once the company had procured its license. About a year was required to realize zero-trust security utilizing Microsoft 365 E5.

“Password-less authentication”—random generation of extra-long passwords

SHUEISHA fully utilizes the Microsoft 365 E5 features. This of course includes endpoint security such as anti-virus measures, as well as sustained secured connections to SaaS apps and automated management of the total network. (See the conceptual diagram.)

SHUEISHA relies particularly heavily on Microsoft Entra ID P2 (previously, Azure AD)—the authentication platform—with Privileged Identity Management (PIM) minimizing information leakage by restricting access to key resources based on time and approval. The restrictive structure requires password-less access authentication not only from employees, but from collaborating external staff as well.

SHUEISHA utilizes password-less employee authentication through Windows Hello, which relies on biometric authentication, and Microsoft Authenticator, a smartphone authentication app. Akihiro Sutou, Information Management Section Chief in the Information System Department, explained that in March 2024, management revised Active Directory passwords, making them longer and completely random, “so that no employee is aware of his or her password.”

“Employees joining the company in April 2024 did not immediately receive a password. Device authentication alone controlled safe access to the company system. This basically eliminated the risk of unauthorized access through password leakage. So today, I would address any information leak by initially investigating internal fraud.”

Mobile devices such as (corporate-issued) iPhones equipped with Microsoft Authenticator are also centrally managed using Microsoft Intune. Compliance with corporate policies is routinely monitored.

Kensuke Watanabe, manager of the Information Management Section in the Information System Department, comments on one success resulting from the initiative: “We are now seeing a change in security awareness within the company. The other day, an editing department requested a new tool. As it could not be incorporated into our single sign-on environment, we responded that ‘at present, you will need to issue and manage your own password.’ ‘Ah, we need a password,’ came the disappointed reaction. This delighted us, as it indicated that people were now aware of the safety and convenience of our password-less, single sign-on. The editing department staff were pleased to learn that we plan to incorporate the desired tool into the single sign-on environment. This marks a significant difference from the past, when the editing department expected to manage their own IDs and passwords every time they used a tool.”

High-level security without special effort and wide range of cost reductions

Sutou explains that, “the major reason SHUEISHA incorporated Microsoft 365 E5 was that we saw the merits of the ‘high-level security without special effort,’ which our IT partner was advocating at the time.”

“We recommend Microsoft 365 E5 for the clear reason that it reduces the enormous time required for security operation maintenance.  When using multiple companies’ products and services, we need to monitor the ever-changing cyberthreat landscape and update individual products. As updates accumulate, their coverage changes, and features may conflict with each other. That is not something which can be handled by a small information systems department. Microsoft 365 E5 allows security monitoring and maintenance of a safe environment by activating each feature in turn and then monitoring the overall system through the dashboard. This is a great benefit. Keeping operations simple has brightened the mood in the Information System Department.”

Sutou also points out great cost savings. “For example, with VDI, updating existing products would necessitate an estimated annual cost per user of 100,000-200,000 (690-1,379USD)* yen. The AVD we are switching over to is a pay-as-you-go system which costs only one-tenth the amount. Differing departments in SHUEISHA used differing BI tools, but they are now unified in Power BI Pro, which is included in Microsoft 365 E5. That also helped with cost savings. Discontinuing multiple security products and switching over to Microsoft 365 E5 enabled great cost reductions.”

*Using an exchange rate of 145 yen/USD.

The dual security reports Sutou issued in late 2023 highlight SHUEISHA’s use of Power BI. One overview visualized the number of attacks on the company in total, while a second individualized report tallied the attacks on each employee’s account along with how many spam mails were received. SHUEISHA has 760 employees (including contracted part-time workers). One might expect that creating a report for that number of individuals would take a tremendous amount of time, but Sutou explained that it took “less than 30 minutes.”

“It was just a matter of exporting data accessed from Microsoft Sentinel, so creating the report took no time at all. Employees could visualize the number of attacks on their own accounts, and many voiced their surprise. It was a great opportunity to elevate their security awareness and illuminate the work we do in the Information System Department.”

Dramatically reducing stress with Microsoft Copilot for Security

The cost benefits from incorporating Microsoft 365 E5 led to smooth approval for adding a new feature—Microsoft Copilot for Security—which supports security management tasks with generative AI. Sutou professes that, from the beginning, his sights were set on incorporating this optional product, which officially came onboard in April 2024. 

“We’d had our eye on the improved work efficiency generative AI empowers for some time. When Microsoft Security Copilot was officially released, an analyst suggested that it would improve response speed by 22%. My sense is that it has exceeded that. And it’s not only the response speed, but the peace of mind you enjoy. At any rate, it has reduced stress in our work. When incidents occur, Copilot quickly issues a summary and can formulate queries with simple commands. I was in the Sales Department before moving to the Information Management Section and have very little experience of drafting queries. It was not easy for us to create KQLs to query Microsoft Sentinel logs, but that task can be handled speedily with Microsoft Security Copilot. We now experience far less stress in operations management.”

Security talent shortages reportedly plague Japanese companies, and SHUEISHA is no different. In fact, Section Manager Watanabe shifted over from the Editing Department, while Sutou was previously in Sales, making a similar in-house transfer.

“The constant fostering of security talent is a major issue faced by many companies.  I think we need a dual focus: the progression towards operations management less dependent on skilled security talent and the continual training and acquisition of such talent. I believe Microsoft Security Copilot can be extremely helpful in that regard,” affirms Sutou.

“The less pressure we experience, the easier we can initially respond to incidents. We have only begun to utilize generative AI, but there is no doubt it will effectively support non-specialized and unskilled tasks. The simplicity of incorporating such a beneficial feature is one of the great things about Microsoft security solutions.”

New working styles for security managers

Microsoft 365 E5 and Microsoft Copilot for Security have generated many benefits for SHUEISHA, but Watanabe points out another direct advantage felt in-house regarding new working styles since the advent of COVID-19.

“We were surprised at how smoothly the transition was to Teams Phone. The shift to Teams Phone was about 99% complete as of April 2024, but we had already begun using the product before that. We can directly find and call employees via the Teams app on iPhones, and we can also use it for conferences and daily communication among worksite editing staff.” 

Watanabe describes how the use of other tools has also changed from the past. “Thinking back on my time in the Editing Department, the staff had used a variety of SaaS apps… but not necessarily for any profound reason. Now when I explain the many benefits—the contract with Adobe, the many digital tools available, and the handy functions and features that Teams offers—they are easily convinced to switch over. SHUEISHA has absolutely no intention of limiting the inspiring environment for creators, and we intend to provide a digital workspace in which all kinds of SaaS apps can be used safely. I find it greatly significant that the company is devising this environment in which everybody can work comfortably and with peace of mind.”

Okamoto adds the following comments in conclusion. “It has been about a year since we integrated Microsoft 365 E5, and a month or so since we added Microsoft Security Copilot. Even the working style in the Information System Department has changed, and we are now interacting more with those in other departments. Despite the beneficial results, switching systems can put a burden on users, so we’d like to collaborate with the help desk in strengthening the support system.”