The panel discussion on the security conditions of the Asian countries (The 4th)

I understood that cultural and security IT literacy and its understanding differs greatly depending on the country. To make the employees aware of the importance and the background of the security rules, how do you explain these things?

The level of security awareness in China differs from the one in Japan. Since our company is a Japan originated company, we tell the employees when they first come to work that they must obey the Japan headquarter security rules which are applicable to China. When educating them about the security rules, I try to also explain the background, the consequence of not obeying, and the disadvantage of having a security incident (i.e. affecting their evaluation).

In Vietnam, we usually communicate verbally instead of having them in writing when educating the employees things like the security rules. If the written documents are made, we must also determine how it should be managed for changes/updates.

In the last panel discussion with other countries, Philippine and Singapore said they do not educate the employees about the usage of IT assets nor the security rules on the first day of work. Instead, awareness raising activities are made on a regular basis by introducing the security incidents which happened and such. How about Vietnam?

Same here. However, we do not have any security educations on a regular basis. The security rules are often told from the senior colleagues on OJT basis.

The current condition of Thailand is similar to the one of Vietnam where the security awareness is not yet so high. However, since the security related regulations are being made as explained earlier, the awareness is expected to raise. Although the people in Thailand may have a harder time putting things into writing, I find it necessary to enforce it. Providing some activities to improve the security level on a regular basis is also important. I hope that kind of system become more common in the society. However, since the security rules will hinder the ease of usage, it is important to explain the background and the purpose of the rules in detail.

If you put the security rules in writing, will the people in Thailand read them?

Yes, I think so.

I heard that in Philippine, people think that they are allowed to do something unless it's clearly specified as the rules. How about other countries?

Since it will be quite difficult to put everything in writing, I believe people will use the norms of Thailand to make their decisions. They may also check with the senior colleagues and/or their bosses if things are unclear.

Vietnam is the same way as in Philippine. Therefore, having awareness raising activities on a regular basis is a must.

Shanghai is also the same as in Philippine. It is a risk to automatically assume people think humans are inherently good in nature.

If an incident happens, we follow the steps specified in the rules. In China, people think that having incidents are inevitable & people evaluate you based on how fast and how you reacted to the incident. People here are not too keen on finding the root cause of the problem nor having a way to prevent the same issue from happening again. I would say Japan is rather unique in that sense. But of course, the Japan side will mandate a very detailed report, so I tell them to keep all records along the way.

In Vietnam, people generally respond to an incident as fast as the Japanese do. But when it comes to finding the root causes or the re-prevention measures, Japan seems to be more detailed.

If the Japan side requires a detailed report, do people become hesitant about that?

People in Vietnam may think that the level of the details Japan requires is a lot, but they will accommodate if they are told that's necessary.

The first thing is to stay calm and consider the possible counter measures. Some security incidents can be very complex involving various parties such as the delivering venders, SIer, IT managers, and the end users. There may be a case where they try to impose the responsibility to a third party. The ties among the people here are strong & they prefer to defend for their positions as a priority. It is rare to have them reply to things in a way which jeopardizes their positions. There is a risk of people making the situation where the causes become hard to find & reply in a way so only the strongest can survive. As a result, we sometimes are forced to close a case without knowing the root causes of the issue. Therefore, it is very important to have a good communication on a routine basis to understand each person's situations.

Chinese market is unique. For example, some Western cloud security solutions used in Japan cannot be used due to the local regulations. Thus, tools developed within China have to be procured.

It will not be any issues if the product is sold globally (in English language). If the product is in Japanese only, it will be difficult to implement.

Thailand is same as Vietnam. If it is a global product (in English language), no issues. We also have various distributors in Thailand, so a thorough support can be promised.

It's important to trust the local country & delegate authorities to the local side. But this will have a side effect of not having the transparency on the local situation. Thus, each company should determine the most appropriate distances for the management.

It is important to understand the diversity in perspectives/environments such as the languages, cultures, and historical backgrounds & not force the standards nor values of the Japanese.

I often see a gap in the communication between the local Thai and the person coming from Japan. But know both are working very hard for the company. Therefore, when a security policy is being implemented for example, it is important to take time and keep on having a continuous communication by understanding each other's positions with a respect.

The most important thing is to understand the local country. For example, if a Japan Originated Company wants to start a business in Thailand, more than 70% of the employees for hire will be the local Thai. In this kind of situation, first thing is to determine will be the overall security policies & then apply the rules in a way to suite the Thai nationality. This will be the key to a successful management.

We Unaidex and Netmarks entities in various countries have long been supporting the client companies in the overseas. We will be happy to make advises based on our experiences and know-how, so please feel free to contact us.