See webinar recording of this presentation at https://resource.alibabacloud.com/webinar/detail.htm?webinarId=43

 Global companies have to deal with various legal risks while doing business in China, and cybersecurity regulation is definitely one of them. In this presentation, we directly address your top concern and topics regarding cybersecurity compliance and provide a roadmap to help global companies understand regulatory risks related to network security, content security, personal information protection and data cross-border transfer. As the biggest cloud service provider in China, Alibaba Cloud has extensive know-how on cybersecurity compliance and provides solutions that can help global companies minimize regulatory risks and succeed in China.

1. 1 / 25
Cyber Security
Compliance Solutions
for Foreign Companies
in China

2. 2 / 25
Content
Key Regulatory Risks for Foreign Companies in China
Alibaba Cloud’s Compliance Solutions
01
02

3. 3 / 25
When We Think of Cybersecurity Compliance
• A Grey Rhino: Increasingly Heavy Pressure on
legal, GR, and PR.
• A Disastrous Outcome: Serious fines and
penalties for cybersecurity regulation violation.
• A Must-do: Increasingly large investments in
compliance.
• A Rewarding Investment: Investment on
compliance is necessary and rewarding.
No Local Entity
No ICP License
Data Cross-border
Cybersecurity
Compliance

4. 4 / 25
Increasingly Heavy Pressure for Foreign Enterprises
Legal: Leading tech companies have been investigated
GR: Focus point of both the central
and local authorities
PR: Medias are keen to cover cybersecurity
related cases.

5. 5 / 25
Real case for Fines and Penalties
A fine between RMB
50,000 - 500,000. A
temporary suspension of
operations, closing of
website, and cancellation
of business licenses.
A fine between RMB
50,000 - 500,000.
A fine between RMB
10,000 to 50,000.
A fine between one and
ten times the amount of
the unlawful gains
A fine between RMB
50,000 - 500,000. A
temporary suspension of
operations, closing of
website, and cancellation
of business licenses.
Suspension of operations usually starts from 6 months.
Act. 59 Act. 60 Act. 61 Act. 64 Act. 68
Fail to perform
network
security protection
duties
Fail to immediately take
remedial measures for
Security flaws and
vulnerabilities
Fail to require users to
provide truthful identity
information
Infringe on personal
information
Fail to stop the
transmission of
prohibited
information

6. 6 / 25
Trend - Global companies are stepping up investment in compliance
Public Policy Stay updated with policies and regulations, and consult with local experts
Content Security Strengthen ability to recognize prohibited information
Business Licensing Establish data center in China or work with local cloud service providers
PI Protection Higher data protection standards
Data Cross-border Transfer Store data in China and transfer overseas after proper risk assessment
Increase investment in training, management and facilitiesNetwork Security

7. 7 / 25
Compliance is the most rewarding investment in global markets
Alibaba
Cloud
Solution
Lower
TCO
Reduce
Risk
Effective
Business
Growth
Reduce
Legal Risk
More
Competitive

8. 8 / 25
You Need One-Stop-Shop for Go-China Compliance
Public Policy Expert Team
Alibaba Cloud CSL ready
One-Stop Compliance
Solution
Security Product and
Compliance Consulting
Services

9. 9 / 25
Local Business Consulting
Local entity registration
ICP filing/licensing
Overview of Alibaba Cloud Cyber Security Law Compliance Solutions
Network Security Risk Management
• Vulnerability management and repair
• Virus and cyber attack prevention
• Personnel training
• Network logs storage
• Emergency Response
Data Cross-border Transfer Risk Management
• Data cross-border transfer consulting service
• Data cross-border transfer self-assessment consulting
• Data cross-border transfer authority assessment
consulting
Personal Information Protection
• Real identity verification
• Data encryption
• Data leakage prevention
Information Compliance
• Prohibited image recognition
• Prohibited text recognition
• Video and live streaming solutions
• Social media and e-commerce solutions

10. 10 / 25
Network Security Risk Management

11. 11 / 25
Management System, Technology & Tools, Security Awareness are 3 key factors of Cybersecurity Law
compliance framework.
Cybersecurity Law
Network Security - Alibaba Cloud Service
Chapter 1 Overview
Chapter 2 Network Security
Chapter 6 Legal liabilities
Chapter 7 Appendix
Chapter 5 Monitoring and Contingency plan
C3 Network Operation Security
2.1
General
2.2
Infra Security
A 21
Overall security requirements
A. 31,32 and 39
Infra Requirement
A 37
Data Retention
A.22~23
Network and Security
Product Supply Chain
A 43,44 and 46
Responsibility of Personnel
and Org
A45, 50
Network Security
A 40~42
Personal information
protection
C4 Network Information
Security
Mgt
Parties
Threat Alert
Growth Operation Risk Mgt Regulation
Alibaba CSL Compliance Service
Network ResilienceNetwork Security
Employee Client3rdProcess Data Attacker
Network Security Strategy & Management
……
-Infra
-ID Mgt
-App Security
-HR Security
-Privacy
-Vulnerability
-Cloud
-3rd Party
-Physical
- TI
-SOC
- APT
- Ransomware
-Drill Testing
- Incident Response
- BCP
LawAsset
Process
Tech Skill

12. 12 / 25
Network Security - Alibaba Cloud Security Product Family
Data Center Alibaba Cloud
Pentest Bug Bounty
After SIEM
Intermediate IDS, IPS Security Awareness
Before Vulnerability Scanner
Host Anti-Virus Software Server Guard
Network DDoS Mitigation Appliance DDoS Mitigation Service
Web Application WAF Appliance Cloud WAF
ACL Firewall Appliance
VPC
Security Group

13. 13 / 25
• Alibaba Cloud
- Host Security: Server Guard
- Network Security: Anti-DDoS, WAF
• Customer Data Center
Network Security - Anti-Virus & Vulnerability Management
Solution
Customer Value
• Easy Management
• Lower Operation Cost

14. 14 / 25
• Deliver emergency response solutions for clients, including
drill testing plan, policy configuration plan, etc.
• Provide incident analysis report and remediation plan.
Network Security - Emergency Response
Solution
Customer Value
• One-stop service.
• Experts with multiple domain knowledge.

15. 15 / 25
Information Compliance & Content Security

16. 16 / 25
Alibaba Cloud Information Compliance - Provide image, text and video recognition based on Alibaba Big Data
technology to protect your brand from association with illicit or otherwise illegal and brand damaging activity.
Information Compliance- Alibaba Cloud Offering
2015 2016 2017
• Pornography Detection
• OCR
• Text Recognition
• Video Recognition
Video Pornography
• CDN Detection
• OSS API Detection
• Frame based image detection
Image Pornography
• OSS Image Pornography
Detection
• Pornography Detection API
• Sensitive Graph
• Sensitive Content
• SPAM
• Branding Logo
• Audio Recognition
• Customized Service

17. 17 / 25
Advertisement
Scenario:
UGC related，Icon/Album/ IM Pictures
Highlighted feature:
1. Multi-Layer Filtering
2. Variety detection
Information Compliance - Text Recognition
OCRQR Code Anti-SPAM
SPAM: Yes
Type: IM Contact

18. 18 / 25
Personal Information Protection Solutions

19. 19 / 25
Base on user-submitted information, Real Identity Verification is a ID authentication solution that leverage on
Alibaba bio and big data risk management model to detect ID fraud activities.
Personal Information Protection - Real Identity Verification
ID Authentication
• Name and ID Pair
Matching
• OCR support
Facial Recognition
• Static Comparison
• Interactive Authentication
Fake ID Auth
• Identify fraud ID, Phone
No and devices.
• High performance check
on known database.

20. 20 / 25
Personal Information Protection - Data Encryption

21. 21 / 25
Personal Information Protection - Anti-Hacking
0day Mitigation
Anti-bot service
Data Leakage Protection
Find vulnerability in your system
by community white hat.
Risk overview of your
network and assets.
Vulnerability Management
Assets Management
Incident response
and 7X24 services.

22. 22 / 25
Data Cross-border Transfer Risk Management

23. 23 / 25
Definition
Typical Scenarios
Data Cross-border Transfer: Personal information or important data collected or generated
domestically by network operator sending to oversea company, organization or individual using
network or other methods.
Data Cross - border Risk Management
• Your local office sends client information collected domestically to oversea HQ.
• Your local office sends Chinese employees’information to oversea HQ for management purpose.
• Your clients send data to oversea regions using your platform.
• Your local office sends client information to overseas third party consulting/ audit firm or contractor.

24. 24 / 25
Data Cross - border Risk Management
Data Cross-Border
Legitimacy and Legality
Risk Management
Allowed
Two-tiered Assessment
• Conditions for self and
authorities assessment
• Definition of legitimacy
and legality
• Risk management
• Responsibility boundaries
• Managing risks after data
is transferred overseas
Pain points our experts
help address
Alibaba Cloud Data Cross-
border Risk Management
Data Cross-Border Authority
Assessment Consulting
Data Cross-Border Self-
Assessment Consulting
Data Cross-Border Overall
Risk Evaluation

25. 25 / 25