Improved Security in Cloud-Based Accounting Services

Yayoi Co., Ltd. (“Yayoi”) provides tools and services like Yayoi Accounting and Yayoi Aoiro Tax Returns that help streamline accounting and related operations for small businesses, such as SMEs and sole proprietors that have limited human resources at their disposal. Since the release of its cloud-based tax return software in 2014, Yayoi has provided both desktop software and cloud services. In 2023, the company announced a new brand, Yayoi Next, and it is working to further expand its cloud services.

“Yayoi has a long history, throughout which we have drawn on the feedback of our many customers and applied it to our products and services. It is due to this that we achieved over 3.1 million registered users in September 2023, and survey results show that we have the top market share for accounting software for sole proprietors. While still serving the deeply rooted demand for our desktop software, we also hope to strengthen our services in preparation for further cloud usage in the future, in light of recent years’ trend of preference for the cloud,” said Tomoyuki Ishii, Manager of the Personnel & General Affairs Dept., Administrative Division, at Yayoi.

Bolstering security is a key priority for Yayoi, which has been actively working to move its services to the cloud. “The data handled by the Yayoi Series is primarily very sensitive accounting information. The API integration features provided by financial institutions are important to cloud-based accounting tools, but financial institutions require that we implement strict security measures in the use of those features. As a result, we have worked to ensure safety at the development stages through vulnerability diagnostics and library scans, while also building and administering systems like web application firewalls (WAFs) that protect data by bearing the brunt of attacks head-on,” said Taisuke Ito, Technical Leader in the Information Systems Dept. of the Development Division.

However, as the number of Yayoi Series users has increased and the types of usage have become more diverse, there has been an increasing concern that it is not possible to sufficiently bolster services to the required level. Sole proprietors, who account for the bulk of Yayoi’s users, work at many different times of the day, so they often do their bookkeeping outside of standard business hours, making it essential to have the system up and running 24 hours a day, 365 days a year. However, the WAF that Yayoi used previously had difficulties in maximizing uptime and providing support service, and the company wanted to move to a service that could provide higher-quality security.

When reassessing its WAF situation, Yayoi had already been using Akamai’s CDN to deliver software updates and similar functions, and this led them to take a closer look at Kona Site Defender (now App & API Protector), Akamai’s WAF/DDoS protection tool.

“We had a level of trust in Akamai because it had closely supported us for some time already. When we were considering their WAF, they explained the features of the service in detail so that we could determine if it was suitable for Yayoi’s service or not. They were already providing us with excellent availability on the operational front, and we felt that Akamai’s WAF could provide us with an environment that all of our customers could use with peace of mind,” said Takafumi Nakajima, Project Manager, Information Systems Dept., Development Division.

After introducing Kona Site Defender, Yayoi felt it needed additional measures to bolster security in response to changes in security conditions. Yayoi’s gradual next steps were to introduce Bot Manager to prevent unauthorized login attempts in bot attacks against Yayoi IDs in an integrated login environment, and Client-Side Protection & Compliance to prevent web skimming attacks that exploit client-side scripts to steal end-user data.

“There are a lot of vendors out there offering a variety of security tools, but implementing tools from different vendors has the drawback of making them difficult to operate on a day-to-day basis and hence difficult to maintain a level of security. We believe that by unifying to Akamai’s web application security portfolio, which provides solid technical and support coverage for all web security matters, we can increase operability and security while reducing administrative overhead. Yayoi operates a variety of applications, and we want to standardize the level of security we offer by applying Akamai’s advanced web security services wherever possible. That is where Akamai’s comprehensive services are a real help,” said Kentaro Tsujino, Engineer in the Information Systems Dept. of the Development Division.

At present, Yayoi has completed upgrades from Kona Site Defender to App & API Protector, which offers a web application as well as improved API protection and attack detection. It is now transitioning from deploying and operating a WAF for each application to more integrated operations in the Information Systems Dept. The integrated login environment across applications and anti-bot measures to prevent unauthorized logins to Yayoi IDs have also seen tangible results.

“Bot Manager requires continuous tuning to improve its detection accuracy. So when we first deployed the service, we experimented a lot in our attempts to optimize it for our system environment. However, Akamai offers tremendous customer support and was very helpful in quickly and accurately answering both big issues and small questions as well. One of the features of Akamai’s service is that they provide you with a solid visualization of potential security risks and attacks that you had not noticed before. The fact that we can clearly demonstrate the effectiveness of security measures is also a major benefit when briefing upper management and business departments,” said Ito.

Ito and colleagues hope to raise security levels across the entire company, including the applications they provide themselves and the APIs they use for linked smartphone apps. In addition, they intend to develop robust security mechanisms that flexibly adapt to the unique characteristics and requirements of each service.

Yayoi has long been known as a developer of accounting tools, but now it has shifted gears toward becoming a cloud service/SaaS provider. Yayoi’s goal is to provide a variety of services related to back-office operations and business support, as well as to develop a comprehensive range of services to meet the diverse needs of small business operators. Reflecting on this future, Ishii emphasized that “in order to provide a SaaS service, we not only need to enhance our services themselves — we cannot neglect to invest in security, either.” Ishii expressed great hope for Akamai’s help in a support role.

“The Yayoi Series has a very large number of users, and we have to protect a large amount of data with our relatively small organization. In addition, threats are changing and evolving at an extremely rapid rate, so countermeasures are needed to ensure that problems can be addressed quickly and reliably. We hope that Akamai will continue to be able to address new problems with high-quality service and great customer support, in addition to adding value through delegation, automated management, and other ways to reduce the operational burden.”

Yayoi is a company with a vision to serve as a “business concierge” that meets the challenges that arise in small businesses’ start-up and development phases. The Yayoi Series (cloud services/desktop software) supports back-office operations such as accounting, commercial transactions, and payroll management, as well as business support services for launching companies and fundraising. As the company’s leading product and service line, the Yayoi Series is popular and boasts more than 3.1 million registered users.