• About
  • Archive
  • Contact
  • Home 1
  • Submit a Story
  • Submit a Story
  • USCBC Podcasts
China Business Review
  • Operations
    Multinational Supply Chains in a Post-Pandemic China

    Multinational Supply Chains in a Post-Pandemic China

    Managing Risk in the “New Era”

    Managing Risk in the “New Era”

    Design Patents vs. Trade Dress: Protecting IP in China

    Design Patents vs. Trade Dress: Protecting IP in China

    As China Emerges from COVID-19, US Companies Invest to Compete

    As China Emerges from COVID-19, US Companies Invest to Compete

    Inside the Mad Rush for Masks – Anatomy of a 10 Million Mask Order

    Inside the Mad Rush for Masks – Anatomy of a 10 Million Mask Order

    Addressing Risk in the Era of US-China “Great Power” Competition

    Addressing Risk in the Era of US-China “Great Power” Competition

  • Politics
    Hong Kong’s National Security Law, Five Months In

    Hong Kong’s National Security Law, Five Months In

    China Implements its Long-Awaited Unreliable Entities List Mechanism

    China Implements its Long-Awaited Unreliable Entities List Mechanism

    Competing WTO Reform Agendas and the Contest for the Next Director-General

    Competing WTO Reform Agendas and the Contest for the Next Director-General

    China Eyes Further Northeast Asian Economic Integration in RCEP

    China Eyes Further Northeast Asian Economic Integration in RCEP

    COVID-19 Could Doom or Deliver US-China Commercial Relations

    COVID-19 Could Doom or Deliver US-China Commercial Relations

    A Game of Chicken

    A Game of Chicken

  • Tech
    The Growing Intersection of Digital Health and Data Processing in China

    The Growing Intersection of Digital Health and Data Processing in China

    Export Controls on Emerging and Foundational Technologies: A Null Set?

    Export Controls on Emerging and Foundational Technologies: A Null Set?

    How Companies Are Reacting to China’s New Data Security Scheme

    How Companies Are Reacting to China’s New Data Security Scheme

    China’s Participation in International Standards Setting: Benefits and Concerns for US Industry

    China’s Participation in International Standards Setting: Benefits and Concerns for US Industry

    The Hidden Challenges of China’s Booming Medical AI Market

    The Brave New Business Models Making Waves in China’s Ecommerce Market

    Trending Tags

    • Intellectual Property
    • innovation
    • cybersecurity
    • ecommerce
    • tech
  • Society
    COVID-19 Could Doom or Deliver US-China Commercial Relations

    COVID-19 Could Doom or Deliver US-China Commercial Relations

    The Year in Social Credit: Where is Corporate Social Credit Going in 2020 and Beyond?

    The Year in Social Credit: Where is Corporate Social Credit Going in 2020 and Beyond?

    Open Government Developments in China: Implications for US Businesses

    The Hidden Challenges of China’s Booming Medical AI Market

    The Handshake that Changed the World

    President Carter and Vice Premier Deng at the Performance of American Arts

    January 29, 1979 Performance of American Arts for Deng Xiaoping

  • Media

    Gallery: Craig Allen’s Trip to China

    USCBC 45th Annual Membership Meeting

    USCBC 45th Anniversary DC Open House

    USCBC President’s China Visit

    USCBC Hosts Business Roundtable with Zhejiang Party Secretary Che Jun

    USCBC hosts Comprehensive Economic Dialogue (CED) Luncheon

  • Podcasts
No Result
View All Result
  • Operations
    Multinational Supply Chains in a Post-Pandemic China

    Multinational Supply Chains in a Post-Pandemic China

    Managing Risk in the “New Era”

    Managing Risk in the “New Era”

    Design Patents vs. Trade Dress: Protecting IP in China

    Design Patents vs. Trade Dress: Protecting IP in China

    As China Emerges from COVID-19, US Companies Invest to Compete

    As China Emerges from COVID-19, US Companies Invest to Compete

    Inside the Mad Rush for Masks – Anatomy of a 10 Million Mask Order

    Inside the Mad Rush for Masks – Anatomy of a 10 Million Mask Order

    Addressing Risk in the Era of US-China “Great Power” Competition

    Addressing Risk in the Era of US-China “Great Power” Competition

  • Politics
    Hong Kong’s National Security Law, Five Months In

    Hong Kong’s National Security Law, Five Months In

    China Implements its Long-Awaited Unreliable Entities List Mechanism

    China Implements its Long-Awaited Unreliable Entities List Mechanism

    Competing WTO Reform Agendas and the Contest for the Next Director-General

    Competing WTO Reform Agendas and the Contest for the Next Director-General

    China Eyes Further Northeast Asian Economic Integration in RCEP

    China Eyes Further Northeast Asian Economic Integration in RCEP

    COVID-19 Could Doom or Deliver US-China Commercial Relations

    COVID-19 Could Doom or Deliver US-China Commercial Relations

    A Game of Chicken

    A Game of Chicken

  • Tech
    The Growing Intersection of Digital Health and Data Processing in China

    The Growing Intersection of Digital Health and Data Processing in China

    Export Controls on Emerging and Foundational Technologies: A Null Set?

    Export Controls on Emerging and Foundational Technologies: A Null Set?

    How Companies Are Reacting to China’s New Data Security Scheme

    How Companies Are Reacting to China’s New Data Security Scheme

    China’s Participation in International Standards Setting: Benefits and Concerns for US Industry

    China’s Participation in International Standards Setting: Benefits and Concerns for US Industry

    The Hidden Challenges of China’s Booming Medical AI Market

    The Brave New Business Models Making Waves in China’s Ecommerce Market

    Trending Tags

    • Intellectual Property
    • innovation
    • cybersecurity
    • ecommerce
    • tech
  • Society
    COVID-19 Could Doom or Deliver US-China Commercial Relations

    COVID-19 Could Doom or Deliver US-China Commercial Relations

    The Year in Social Credit: Where is Corporate Social Credit Going in 2020 and Beyond?

    The Year in Social Credit: Where is Corporate Social Credit Going in 2020 and Beyond?

    Open Government Developments in China: Implications for US Businesses

    The Hidden Challenges of China’s Booming Medical AI Market

    The Handshake that Changed the World

    President Carter and Vice Premier Deng at the Performance of American Arts

    January 29, 1979 Performance of American Arts for Deng Xiaoping

  • Media

    Gallery: Craig Allen’s Trip to China

    USCBC 45th Annual Membership Meeting

    USCBC 45th Anniversary DC Open House

    USCBC President’s China Visit

    USCBC Hosts Business Roundtable with Zhejiang Party Secretary Che Jun

    USCBC hosts Comprehensive Economic Dialogue (CED) Luncheon

  • Podcasts
No Result
View All Result
China Business Review
No Result
View All Result
Home Cybersecurity

Cybersecurity best practices for the traveling executive: A Q&A with Crumpton Group’s Rick Doten

USCBC by USCBC
August 29, 2016
Share on FacebookShare on TwitterLinkedin

Q&A Photo

  1. What unique information security challenges does China present to a traveling executive when compared with other countries?

You have to understand that you are not in a free state; you could be constantly monitored, both your physical movements and all communications. Your electronic devices might be accessed, again either physically or electronically, to steal information you have, or inject malware to gain remote access to your devices, and/or infect your organization’s network when you return.

Never leave your phone, tablet, or laptop unattended. If you happen to be targeted (which may depend on who you are, your nationality, your company, your business purpose, etc), you will have people with eyes on you at all times, and they may enter your hotel room, open the safe where you leave your laptop, and copy the hard drive. If you are at lunch, and have your phone on the table, you might be distracted while someone takes your phone and quickly downloads data from it and then returns it when you turn around. Be aware if anyone, particularly pretty women if you are male, show assertive interest in you. They are just a distraction to give someone else time to access your devices.

While this is not the reality for all Western business travelers, it is in the range of possibility if you are visiting for a business purpose that could be considered to put China at a disadvantage.

  1. What unique information security challenges does China present to companies’ corporate networks based in China?

Your network traffic might be monitored, there might be listening devices in your office, and cellular connections might also be eavesdropped on. Don’t store any intellectual property, or sensitive or competitive information on the local network in China, use a remote desktop to access platforms in Western territories, only store critical information outside of China.

There is great risk of insider threat, as locals may be under direction of the State to gather information. Keep servers in a secure room, with strong access control, as even cleaning or utility staff might be under direction of the State to collect information.

If you bring in a lot of computing equipment into the country, to build a datacenter or server room for example, be prepared to be harassed by “officials” who will show up unannounced and want to audit that you have specific components and demand to see that they are present. Sometimes they will ask you to show them larger computing or network devices; sometimes it might be really small network adapters or phones. They do this under charter that they want to make sure you didn’t re-sell the equipment; but likely, this could be a distraction technique for someone to visually map the building, enumerate what is in server room, and look for information sitting around the office.  

Finally, have a procedure in case of a “Dawn Raid,” where Law Enforcement or Military will show up unannounced one morning, and need to collect servers or other paperwork and devices as evidence for a claim against your company. They will show up with a team of armed agents who will take computers, file cabinets, and even walk out with your systems. This is a very inconvenient event.

  1. What is a common information security mistake made by travelers to China that could be avoided with better preparation?

You will not have access to the entire Internet, and where you do browse is monitored. So it’s important to setup a VPN before you travel. The Great Firewall of China (GFC) will block IPsec VPNs, and many known SSL VPN services. Setting up an SSL VPN termination point, either through a service, or on your own will help you get unfettered access to the Internet when you are in country. If you try to setup something after you are there, or just pick a popular VPN service, it won’t always work, and when it does you’ll only get access for a few minutes until it shuts down. Which is very frustrating.  

Second, Google and Gmail are natively blocked by GFC. People come to rely on these so much they forget how tough it is to work without them. Getting the VPN setup before you go will make sure you stay connected.

  1. What are some common phishing or exploitation techniques used by Chinese State actors?

They use similar techniques to other actors and there is a wealth of phishing templates to use from very simple to very advanced. They will escalate which malware they use, depending on the sophistication of the target. They will start basic, to see if it’s caught, then use something unique, and only save zero-day exploits for the most advanced, or important targets. They are less concerned with attribution, and they will come from obviously Chinese networks. That is why some people think Chinese hackers aren’t that advanced, because it was the basic attack that compromised the victim.

  1. What are some information security best practices an executive should always consider ahead of travel to China?

Best practices for travel to China aren’t much different from what you should normally be doing anyway: keep systems and applications current and with the latest patches. Use strong passwords, and use different passwords for each application; train users on how to be safe.

Use of encryption could be a challenge, as technically it’s illegal to have encryption on your devices; but they won’t call you on it unless you give them a reason to or they generate a reason to. So it’s best to not encrypt; therefore, don’t store anything that you need protected; rely on paper and physical control for that. Also, remember all cellphone and telephone conversations are monitored.

  1. What would you recommend to do if you suspect your information security has been compromised during your trip?

It depends on if you have the resources (or business need) to learn what happened to compromise the device or not. If you don’t care, or don’t have anyone to do forensics on the device, then turn it off, don’t use it for the rest of the trip, and destroy or replace the hard drive when you return. For mobile devices, you might do the same, and do a factory reset, or just destroy the device if you can.

If you want to collect evidence: put mobile devices in airplane mode, keep them charged until you return, then give it to a forensics team to gather evidence and indicators and determine if the device can be wiped and reused, or if it needs to be destroyed. For laptops, put in sleep mode to save memory, and do a similar forensics process when you return.

If you need to use these devices while you are there, make a risk based decision whether knowing the device is not trusted matters to what you are doing, or purchase a burner phone while there. If it is critical that you need a device for your work, consider bringing backups that you leave off until you need to use them.

  1. In your work with clients, have you observed changes in the threat dynamic presented by Chinese actors over time when compared with non-Chinese actors?

Like most threat actors, the Chinese are only as good as they have to be to accomplish their job. Many organizations that have been compromised by Chinese hackers say that they weren’t that sophisticated. This is more a statement of the victim’s security posture. The more secure you are, the more the actors will escalate to achieve their goal. If you are wide open and not monitoring your network well, they will be sloppy, hurried, and leave a lot of tracks. If you have good controls, and are actively monitoring, then they will be patient, stealthy, and very advanced. Also, they care less about hiding where they are coming from; they have been more blatant about coming from Chinese networks. I’m not sure if they are doing it to let the victim know who they are dealing with, or they know there is little consequence to them if discovered.

  1. What is the worst case of someone’s information security being compromised during a trip, to China or elsewhere, you have observed in your career?

Someone I knew, who was a CTO of a company, told me how he was actively followed throughout his trip within a large city in China. Every day, when he returned to his hotel room, he could tell that more than one person looked through his drawers, bags, and the room safe. He always had someone watching him, and those spies would regularly walk by his table at restaurants, if they couldn’t be sat at a table near him. They were obviously listening to his conversations. At the restaurant, or coffee shops, they attempted to take his phone off the table, or his laptop bag from the floor by his feet, when he was distracted. One day he returned to his hotel early and two pretty Chinese ladies stopped him in the lobby attempting to engage him to “practice their English.” He insisted he was in a hurry to get to his room, and when he looked back at them before the elevator doors closed, they were hurriedly and anxiously on their phones, looking at him– likely notifying whomever was sweeping his room that he was coming up.  

 

Rick Doten is Chief, Cyber and Information Security for Crumpton Group in Arlington, Virginia. Rick provides strategic guidance for large company CISOs, and sometimes acts as surrogate CISO for companies who want to improve the IT security and risk management programs.

USCBC

USCBC

Next Post

USCBC 2016 Membership Survey: The Business Environment in China

Recommended.

The Growing Intersection of Digital Health and Data Processing in China

April 12, 2021

From West to East: The Charged Challenge of Delivering Electricity

April 7, 2021

As US-China Ties Fray, Indiana Firms Seek to Keep Trade Flowing

March 26, 2021

Multinational Supply Chains in a Post-Pandemic China

March 5, 2021

Latest Podcasts.

A quick recap of Forecast Beijing 2021

April 7, 2021

How can the United States compete with China on semiconductors?

April 2, 2021

What companies should know about cybersecurity and data flows in China

March 31, 2021

Takeaways from the Alaska meetings

March 23, 2021
China Business Review

China Business Review is the official magazine of the US-China Business Council, a nonprofit and nonpartisan trade association that represents more than 200 American companies doing business in China.

  • How to contribute to China Business Review

Categories

  • Bilateral Relations
  • Business Etiquette
  • CBR Spotlight
  • China Deals
  • Corruption
  • Cybersecurity
  • Ecommerce
  • Environment
  • Finance
  • Galleries
  • Getting Started
  • HR & Staffing
  • Infographics
  • Innovation
  • Intellectual Property
  • Management
  • Media
  • Operations
  • Opinion
  • Policy & Regulations
  • Politics
  • PR & Marketing
  • Rural Issues
  • Safety
  • Social Policy
  • Society
  • Standards + Licensing
  • Sustainability
  • Tax
  • Tech
  • Top Story
  • Trade
  • Uncategorized
  • US-China Business Council
  • Videos

Tags

Agreements Agriculture Alibaba Best Practices Business Environment China China's Investments Abroad China Market Intelligence Chinese Consumers Chinese Investment Commentary Consumer Trends E-Commerce Economic Trends Energy Environment Events Food Foreign Investment Going Global Healthcare Reform Human Resources Infrastructure Internet Interview Investment Investments into China IPO Joint Venture Labor Legal Analysis M&A Manufacturing Media National People's Congress Q&A Strategic and Economic Dialogue Supply Chains Technology Trade Transparency US-China Relations USCBC US Exports to China Xi Jinping

Join our Mailing List

Sign up for the US-China Business Council's newsletters to stay ahead of the game with roundups, analysis, and commentary.

Sign Up

Follow Us

  • About
  • USCBC
  • Submit a Story
  • Archive

© 2021 China Business Review

No Result
View All Result
  • Operations
  • Politics
  • Tech
  • Society
  • Media
  • Podcasts

© 2021 China Business Review