Modern software development paradigms, particularly Agile and DevOps methodologies, have compressed development timelines while simultaneously increasing the complexity of security threat landscapes. Traditional threat modeling approaches, notably attack scenario analysis, demand substantial security expertise and extensive time investments that are incompatible with accelerated development cycles. Furthermore, the expanding demand for secure systems has necessitated threat analysis implementation by practitioners lacking comprehensive security backgrounds. This research presents COTTAGE, an automated tool that generates Attack Defense Trees (ADTrees) by leveraging CAPEC and CWE security knowledge repositories, specifically designed to enable effective threat modeling by security non-specialists. Experimental validation involving six participants with limited security expertise revealed that COTTAGE facilitated threat analysis outcomes comparable to expert-level assessment within 30-minute sessions, contrasting with the approximately two-day timeframe typically required by security professionals. Additional validation through DevOps environment case studies confirmed COTTAGE’s capability to support continuous security assessment via automatically generated reference tree structures.

Software-Defined Vehicle（SDV）は，ソフトウェアによって機能が定義される次世代自動車であり，そのアーキテクチャはゾーン型へと移行しつつある．本稿では，まず従来型車両との構造的な違いと，SDVを支える仮想化，マイクロサービス，OTAといった技術基盤を解説する．次に，コネクティビティの増大やサプライチェーンの複雑化に伴い拡大するサイバー攻撃の脅威を分類し，具体的な攻撃シナリオを論じる．その上で，SBOMによる構成の透明化，Uptaneやin-totoを用いたサプライチェーン全体の信頼性確保，HSM/TEEといったハードウェアセキュリティに至る多層的な対策技術を詳述する．最後に，UN-R155などの国際標準への対応や

Proposal for Digital Talent Development to Promote Digital Transformation in Pharmaceutical Manufacturing. Japan’s digital transformation (DX) is considered to be lagging behind Western countries, particularly in pharmaceutical manufacturing, where conservative corporate culture and regulatory complexity hinder progress. This proposal emphasizes human resource development as the key to successful DX implementation. We define seven essential roles—Business Architect, Designer, Data Scientist, Software Engineer, Cybersecurity Specialist, Data Steward, and CSQA (Computer System Quality Assurance)—and outline their responsibilities, tasks, and required skills. By fostering these roles, pharmaceutical companies can enhance DX quality, strengthen global competitiveness, and establish sustainable organizational frameworks. This proposal presents a conceptual framework aimed at providing practical guidance and recommendations for accelerating DX in the pharmaceutical industry.

While websites are becoming more and more complex daily, the difficulty of managing them is also increasing. It is important to conduct regular maintenance against these complex websites to strengthen their security and improve their cyber resilience. However, misconfigurations and vulnerabilities are still being discovered on some pages of websites and cyberattacks against them are never-ending. In this paper, we take the novel approach of applying the concept of security governance to websites; and, as part of this, measuring the consistency of software settings and versions used on these websites. More precisely, we analyze multiple web pages with the same domain name and identify differences in the security settings of HTTP headers and versions of software among them. After analyzing over 8,000 websites of popular global organizations, our measurement results show that over half of the tested websites exhibit differences. For example, we found websites running on a web server whose version changes depending on access and using a JavaScript library with different versions across over half of the tested pages. We identify the cause of such governance failures and propose improvement plans.