CON.7 Information Security on Trips Abroad

All aspects which are relevant to information security in connection with working abroad MUST be considered and regulated. The security safeguards taken in this regard MUST be documented in an information security policy for trips abroad. The security policy or an instruction leaflet detailing the security safeguards to be observed MUST be handed out to employees who work in different countries.

In addition, a security concept for handling portable IT systems on trips abroad MUST be established that describes all the security requirements and safeguards in sufficient detail. The implementation of the security concept MUST be checked at regular intervals.

Users MUST be made aware of and receive training in the responsible handling of information technology and portable IT systems on trips abroad. Users MUST be aware of the threats that can arise from inappropriate handling of information, improper destruction of data and storage media, or malware and insecure data exchanges. The limits of the security safeguards in use MUST also be demonstrated. Users MUST be empowered and encouraged to prevent loss or theft or to seek professional advice in case of inconsistencies. In addition, the legal requirements for individual destinations in relation to travel security SHOULD be emphasised to employees. The Chief Information Security Officer MUST keep abreast of legal requirements in the context of information security (e.g. data protection, IT security law) and raise employee awareness in this regard.

Prior to travel, the applicable regulations of each country MUST be reviewed by the respective organisation's information security managers or Human Resources Department and communicated to the relevant staff.

The organisation MUST establish, implement, and communicate appropriate policies and safeguards that enable the adequate protection of internal data. Individual travel- and environmental conditions MUST be taken into account.

Before the beginning of a trip, employees MUST also familiarise themselves with the climatic conditions in the destination country and determine the protective safeguards they require for themselves (e.g. vaccinations) and the information technology they plan to take.

Particularly when abroad, users MUST ensure that no sensitive information can be spied on when they are working on mobile devices. To this end, appropriate privacy screens which cover the entire screen of each device and thwart information espionage MUST be used.

A screen or code lock that prevents third parties from accessing mobile device data MUST be used. The user MUST employ an appropriate code or a secure device password for this purpose. Screen locking MUST automatically activate after a short period of inactivity.

Employees MUST report any loss or theft of information, IT systems, or storage media to their organisation immediately. To this end, there MUST be clear reporting channels and contact persons within the organisation. The organisation MUST evaluate the possible impacts of the loss and take appropriate countermeasures.

In order to allow secure remote access to an organisation’s network for employees on trips abroad, the IT Operation Department MUST set up secure remote access (e.g. via a virtual private network, VPN) in advance. VPN access MUST be cryptographically secured. In addition, users MUST have sufficiently secure access data to successfully authenticate themselves on their end devices and their organisation's network. Employees MUST use secure remote access for all communications which are possible in this context. Care MUST be taken to ensure that only authorised persons can access IT systems which have remote access. To the greatest extent possible, mobile IT systems MUST be protected against direct access to the Internet by a restrictively configured personal firewall.

Whether or not mobile IT systems are allowed direct access to the Internet MUST always be specified.

To access an organisation's network via publicly accessible WLANs, the user MUST use a VPN or comparable security mechanisms (see CON.7.A7 Secure Remote Access and NET.2.2 WLAN Usage). Security safeguards MUST also be taken when using WLAN hotspots (see also INF.9 Mobile Workplace).

If mobile storage media are used, users MUST ensure in advance that they are not infected with malware. Before passing on mobile storage media, users MUST also ensure that they do not contain any sensitive information. If a storage medium is no longer used, it MUST be securely deleted, especially if it is to be passed on to other persons. To this end, the storage medium MUST be overwritten using a sufficiently secure method specified by the organisation in question.

To ensure that sensitive information cannot be accessed by unauthorised third parties, employees MUST ensure that all sensitive information is secured in accordance with the applicable internal policies before travelling. Mobile storage media and clients SHOULD be encrypted by the user or the IT Operation Department prior to travel. The cryptographic keys MUST be stored separately from encrypted devices. When encrypting data, the legal regulations of the destination country SHOULD be observed. In particular, country-specific laws on the issuance of passwords and the decryption of data SHOULD be considered.

Organisations MUST present employees with options for appropriately and securely destroying sensitive documents. Users MUST comply with these regulations. They MUST NOT dispose of their organisation's internal records until they have been securely destroyed. If this is not possible locally or it involves dealing with documents or storage media containing particularly sensitive information, these items MUST be kept until the employee’s return from business travel and then appropriately destroyed.

To protect mobile IT systems outside their organisation, users SHOULD use anti-theft devices, particularly in places where there is increased public traffic or high user fluctuation. The procurement and usage criteria for anti-theft devices SHOULD be adapted to each organisation’s processes and documented accordingly.

Before beginning a trip, employees SHOULD check what data is not absolutely required on the IT systems they are taking with them (notebook, tablet, smartphone, etc). Any data that does not need to be left on a device SHOULD be securely deleted. However, if it is necessary to take sensitive data on trips, this SHOULD only be done in encrypted form. In addition, the mobile storage media that may be taken on trips abroad and the corresponding security measures that should be taken into account (e.g. protection against malware, encryption of business-critical data, storage of mobile storage media) SHOULD be established in writing. Employees SHOULD know and follow these regulations before beginning a trip.

These security-related requirements SHOULD vary depending on the protection needs of the data to be handled abroad and the data to be accessed.

Employees SHOULD secure e-mail-based communications cryptographically in accordance with their organisation’s internal provisions. E-mails SHOULD also be suitably encrypted or digitally signed. Public IT systems, such as those in hotels or Internet cafés, SHOULD not be used for accessing e-mails.

For communication via e-mail services (e.g. webmail), organisations SHOULD clarify in advance what security mechanisms are implemented by the respective providers and whether they satisfy its internal security requirements. These include, for example, secure server operation, the establishment of an encrypted connection, and the duration of data storage.

Before the beginning of a trip, the protection needs of the particular information to be handled on the employee’s mobile storage media or client while abroad SHOULD be determined. The corresponding organisation SHOULD check whether the information to be taken has a special need for protection and use low-radiation or radiation-proof storage media and clients accordingly.

Users SHOULD use checksums to verify the integrity of data during transmission and backups. To achieve an even better level of protection in safeguarding the integrity of sensitive information, digital signatures SHOULD be used.

To ensure that an organisation's sensitive information cannot be accessed by third parties while travelling abroad, the IT Operation Department SHOULD provide employees with pre-configured travel hardware. On the basis of the minimum principle, this travel hardware SHOULD only provide the functions and information which are absolutely necessary to conduct business activities.

Before the beginning of a trip, the authorisations the employee in question truly needs in order to conduct their day-to-day business while abroad SHOULD be checked. To this end, the option to have the IT Operation Department withdraw the employee's access rights for the duration of the trip in order to prevent unauthorised access to information within the organisation SHOULD be considered.