International Travel Guidelines

International travelers should limit the amount of sensitive information that is stored on or accessible to any mobile device taken on the trip, and travelers should avoid contact with the NCCU network in general, specifically when traveling to high risk countries (see U.S. State Department's Alerts and Warnings).

Traveling internationally can pose significant risks to information stored on or accessible through computers, tablets and smartphones.  Access to social media sites, email, and other websites may be blocked or limited. Also, some countries ban bringing in encrypted devices, although many recognize the Wassenaar Arrangement and grant exceptions for “personal use”.


Preparing for your trip

Identify "high risk" countries you plan to visit

Visit the U.S. State Department's Alerts and Warnings web page to identify "high risk" countries you plan to visit.

Understand the sensitivity of any data you bring or access

Seek ways to limit the amount of sensitive information that you take on your trip.  Examples of data that should be left on campus or afforded exceptional protection include information that might be considered sensitive by the host government, and information defined as confidential or highly confidential by the University’s Information Security Policy.  Removing unnecessary confidential data from any device reduces the risk of exposure to anyone gaining access to the information.

Visit the University's NCCU Laptop Loaner page to view additional information.  If you would like to obtain a loaner laptop, contact a member of your department's technology support team at 919.530.7676 or  helpdesk@NCCU.edu

* Please note that the NCCU Laptop Loaner is available to faculty and staff.  The program is also available to students who are traveling internationally in support of University research.

Travel Service Email Accounts

Request a temporary email account to use while traveling and your emails will be forwarded to the temporary account for the duration of the trip. This account helps protect your information and NCCU's systems because you will not directly be accessing NCCU with your ID and password. At the end of your travels, the temporary email account will be deleted.  To request a temporary email account, contact a member of your department's technology support team at 919.530.7676 or  helpdesk@NCCU.edu

Follow guidelines for protecting your devices and data

Review and follow the best practices listed in our IT Security Tips & Guides.  Understanding and following these practices will help you reduce the risk to the data and devices you are carrying or have access to in your travels. 

Learn about hardware and software travel restrictions

In the hardware and software realm, export and import controls may apply to the hardware and software you may bring along. The United States restricts the transporting of certain types of hardware and software products to specific countries (referred to as "export controls").  Many other nations restrict the transporting of certain types of hardware or software into their country (referred to as "import controls").

Please note that there are countries into which we cannot bring an encrypted device either due to United States export restrictions or import restrictions imposed by the destination country (Cuba, Iran, North Korea, Sudan, and Syria).


Things to remember while traveling

Avoid accessing the University directly with your NCCU ID and password

By not logging into NCCU applications while you travel, you eliminate the risk of your ID and password to NCCU being captured and used to compromise NCCU systems.  You also reduce the amount of data that is retrievable if your mobile device is lost, stolen or otherwise compromised.

Therefore, keep your direct access to NCCU systems and information to an absolute minimum, preferably zero. Access the data you need for your trip from the external storage service (e.g., NCCU Google Drive).  Allow a colleague to add files to your external network drive in case a file was forgotten during preparations.

Please note that using Remote Desktop or equivalent software to access your University desktop or other device from a high risk country should also be avoided as these transmissions may also expose valuable information.

Enable multi-factor authentication wherever available

Enable multi-factor authentication wherever it is available, especially when it comes to sensitive data. Multi-factor authentication (MFA), also referred to as two-factor authentication or two-step verification, is a security method in which a user is granted access after successfully presenting two or more pieces of evidence to authenticate or login to a system or application. MFA is a very effective method for protecting your accounts from cyber criminals by making it impossible for them to use your accounts even if your password is stolen. The University uses Duo for multi-factor authentication, and it can be used on many personal accounts as well. 

Visit https://twofactorauth.org/ to view a list of websites that offer MFA.

Avoid using public workstations

The security of public workstations, especially in high risk countries, cannot be trusted.  When you use a public workstation, anything that you enter into the system - IDs, passwords, data - may be captured and used, so limit your activity to the devices that you bring.

Be aware of your surroundings when logging in or inputting data into your devices

There have been many cases where an ID, password or a piece of confidential information had been compromised simply by watching the person input the information. Be discrete when entering your ID and passwords.

Notify NCCU if a theft or loss occurs

Traveling can be fraught with a variety of distractions - going through airport security, finding your way around town, getting used to cultural norms, etc.  Unfortunately, most instances when mobile computing devices are lost or stolen occur in the areas where the distractions are the greatest.  Recognizing distracting situations and, when they occur, taking extra care to maintain your focus can prevent you from having to take the steps necessary to disable those devices and obtain replacements.

In case a laptop or mobile device is lost or stolen, contact a member of your department's technology support team at 919.530.7676


When you return

Change any passwords you may have used during your travels

When you return from your trip, change any passwords you may have used during your travels from a trusted device. When traveling, especially in high risk countries, the likelihood that your username and password will be captured is high. Quickly changing a compromised password helps prevent future attacks on that account.  Click here to change your University password.

Restore the software on the systems with which you traveled to trusted versions

According to National Security Services, when our devices connect to a network in a high risk country, there is an increased likelihood that the device will be compromised and have malicious software installed. This software then can compromise information and other devices on the NCCU network when the device is reconnected to the University's network.

Upon your return before reconnecting to the NCCU network, the hard drive will be reimaged. This is standard practice for loaner devices and should also be for your NCCU-owned or personally-owned devices.


Assumptions when traveling

  • No device can be protected against all possible forms of system and information compromise, especially when its members travel to countries that are deemed as high risk.  So, we must assume that any device taken to a high risk country will be compromised in some, potentially undetectable way.  The only truly secure option is to refrain from using digital devices when traveling.
  • Information of particular interest to someone intent on compromising your devices not only includes business data but also the traveler’s ID and password that could be used to directly access NCCU’s systems and information resources.
  • When a device is compromised, the attacker may install software on the device that could compromise other systems and data on the NCCU network when the traveler reconnects his or her device to our network upon return, unless measures are taken to completely restore the device to its pristine state before the network connection is established.

Additional resources

  • The U.S. Department of State's Country Specific Information website: Allows a user to specify his or her destination country for which it provides information such as, the location of the U.S. embassy and any consular offices; whether you need a visa; crime and security information; health and medical conditions; and local laws.
  • The FBI's Travel Tips brochure: Measures that the FBI recommends taking before, during and after traveling internationally in a compact, printable document.
  • US CERT's Holiday Traveling with Personal Internet-Enabled Devices website: Tips from the US Computer Emergency Readiness Team for protecting your mobile devices when traveling.
  • EduCause’s Security Tips for Traveling Abroad website: A collection of institutional, governmental and other resources that provide guidelines for secure, international travel.
Was this helpful?
0 reviews

Details

Article ID: 85188
Created
Tue 8/20/19 10:17 AM
Modified
Tue 8/20/19 10:18 AM