Isolated from Danger: Protecting Branch Offices in Risky Regions

The Realities of Globalization: Addressing Security Risks in Branch Offices

The increasing interconnection and interdependence among the world’s countries, cultures, and economies have made globalization a thriving concept. At its core, globalization promises to build bridges and promote unity among nations. However, as companies expand their markets to a boundless list of potential buyers, they need to splash a bit of cold water on their faces and acknowledge the potential security risks.

The Security Risks of Globalization

From a security viewpoint, interconnecting networks, data, and systems with some regions is just more dangerous than with others. Wars are fought among countries, and threat actors tend to concentrate and target specific regions. For instance, Russian threat actors primarily target US companies and have geopolitical reasons for targeting Ukrainian enterprises. Moreover, some countries consider company property as state property, leaving it vulnerable to seizure, invasion, or inspection, and at times, digital inspection without detection. Other countries, such as China, have a history of capturing the intellectual property of private companies.

It’s important that companies with offices in foreign lands, no matter how small, understand the risk exposure that their satellite office could pose to the home office should they openly share the same networks, applications, and data without restriction. As such, IT teams must consider specific controls when it comes to regions that have:

• An established history of hacking/ransomware
• Laws against personal and commercial privacy
• Advocate/practice nation-state spying
• Require nation-state filters (Internet inspection and proxies)
• A history of raiding commercial offices
• A largely oppressed population or economy
• A significant history of stealing intellectual property

These groups are prioritized by risk, with each group having recommended levels of security protections and controls.

Securing Offices within the Risk Groups

While it’s ideal to segment and isolate each office that resides in a separate country, it is not pragmatic considering usability, cost, and timely response. Therefore, below are some general security guidelines per country group:

Risk Group 1:

Offices in these countries pose the highest level of risk and should be completely isolated from the corporate network. These offices should maintain separate systems, databases, backups, applications and share no software-as-a-service (SaaS) solutions with the corporate primary operations. While this may incur cost and inconvenience, the risk from these countries is too great to ignore. Offices should adhere to security best practices, including zero-trust principles, layered security across people, process, and technology, and stringent lateral movement defenses.

Risk Group 2:

Offices in politically neutral countries which are economically depressed and show higher rates of digital crime pose moderate risks. These offices should adhere to security best practices, and users in these locations should not be given blanket access to global systems. Instead, leverage strictly enforced role-based access control, enable this access via a US-based virtual desktop infrastructure (VDI) machine and log user access granted to individuals in the risk register.

Risk Group 3:

The risks in this group are not sufficient to warrant special protections, and global organizations should employ security best practices and fully understand and implement identity, endpoint, and lateral movement defenses.

Intentional Strategy in an Uncertain Landscape

Leadership must establish their risk tolerance and intentionally decide the controls they wish to make within those tolerance levels to demonstrate that they have taken reasonable care to protect the business. While there is no such thing as “zero risk,” companies need to be realistic about how they interact with their various counterparties within a global landscape to ensure safe operations in at-times adversarial settings.

Editorial and Advice

In the current ever-changing world where businesses are increasingly embracing globalization, it is critical that companies prioritize their cybersecurity concerns. A business’s failure to implement proper security measures can lead to loss of company data and finances, lawsuits, and reputational damage.

Therefore, when expanding to foreign lands, companies must be aware of the potential security risks and put in place strict data security policies, controls, and procedures focused on mitigating the identified risks. This should include establishing cybersecurity guidelines for employees in foreign offices and regularly updating these guidelines to stay ahead of emerging threats.

While globalization may present significant opportunities and benefits, it is crucial that businesses take necessary steps to protect themselves against the associated security risks. By doing so, they can safely expand their operations and relationships with foreign entities.