Doing business in Asia: five etiquette tips

I contributed a piece in Australian BRW late last month that had nothing to do with IT Security, but I thought this may be of interest to those of you out there new to doing business with Asia and would like somewhere to start.

It's quite general, but large mainstream publications want content that will appeal to the masses, not niche pieces that few people will care about. So, if you're an expert on Asia, none of what I've written will be new.

Here's a teaser:

"Business etiquette in western countries is similar enough that we get away with most things. The little quirks are normally overlooked or forgiven, using the “not from around here” explanation. Asia however, is a slightly different animal."

Check out the full article on BRW. 

The business of IT security in APAC - Overview

This post, part 1 of my two-part series on the IT security market in Asia Pacific (APAC), is a subjective high-level overview of the region. I travel throughout the region frequently in my current role and if nothing else, this serves as a way to capture my thoughts at this point in time.

Airports

Photo credit: h8laib8ng

You can learn a surprising amount walking through airports. There are the superficial observations like how modern Singapore, Hong Kong and Shanghai's are compared to the run down airports of Mumbai, Taipei and Sydney. I should point out that Taipei and Mumbai are undergoing renovations so they are actively addressing the issue. Sydney however, is not.

Dig a little deeper and you may notice other things like how the most common language one hears when walking through Hong Kong's airport is Mandarin, not Cantonese or English. For those not aware, Hong Kong locals speak Cantonese. Also, the Mandarin accent of the Chinese is distinct when compared to a Mandarin speaker from Singapore or Taiwan (much like we have different accents in English based on where we are from). What that says to me is that there are more cashed up Chinese nationals that can afford to travel today than there has ever been.

Also, if you get a chance to walk by the premium boutique shops in Hong Kong (e.g. Louis Vuitton), there's usually a queue. Listen to the conversations in the queue, and they are predominantly in Mandarin (with a mainland Chinese accent). That's not to say there's not still a large gap between the upper class and those living below the poverty line, but the Chinese that have money are VERY rich and the number of wealthy Chinese nationals is increasing on a daily basis.

Photo credit: Pondspider

More on this later.

Method

My approach in writing this blog post is hardly scientific. Most of it is based on personal observations, interactions and anecdotal evidence. To be scientific, I'd need a budget of more than $0. Also, I'd be charging you $5000 for this "report" instead of writing it as a blog post. Sorry analyst friends, I couldn't resist :)

I should also point out that my views may be skewed towards the Identity, Access and Security Management markets as I spend a lot more time here than other functional areas within IT security.

Some of what I write may surprise. From the outside looking in, that's a good thing. If you're reading this from one of the countries I'm commenting on, it could potentially offend. For that, I apologise. This is not my intention. I'm simply trying to give my personal views on where we're at right now. Nothing I say is set in stone. Markets evolve, usually for the better. I'm also not always right. Please feel free to discuss in the comments or on Twitter.

IT security market

Analyst firm IDC expects the IT security software market within Asia Pacific (excluding Japan) to have a 13.1% compound annual growth rate through 2015, with India, China and Australia/New Zealand having the highest growth expectations. The report was co-authored by one of my co-presenters at NetIQ's recent Rethinking Security events in India, Naveen Hegde.

These numbers are more or less in line with what most educated people with any sense of what's happening around the world would assume based on their own anecdotal observations. Perhaps some will be surprised that the Australia/New Zealand market is expected to continue to grow (and on a path similar to China and India) given the relative maturity of the market.

Back to the airports. If you look at the airports in the region, there are parallels to the IT security journey of each country. There are countries:

1. Running antiquated infrastructure but are finding it difficult to move forward at the risk of everything coming to a grinding halt (mature, developed countries).
2. Without acceptable infrastructure and have been forced to modernise in a hurry to deal with the speed of change and the influx of traffic (developing, fast-growing countries).
3. That have been on an iterative journey of modernisation to ensure they don't fall behind (modern, developed countries that want to remain ahead of the curve).
4. That don't care if their airport can support capacity (developing countries without anything more than basic technology infrastructure).

The analogy does have exceptions (e.g. Bangkok, Thailand has an ultra-modern airport), but if we look at things generally, it holds true.

At this point, I should reiterate that my views may be skewed towards the Identity, Access and Security Management markets so the comparisons between countries may not be completely in line with the IDC report I referenced earlier.

I created the following infographic to save me having to type it all out in words, but you could draw a grid based on the 4 points above and have the relevant countries sitting in the correct quadrant (this has been left as an exercise for your visualisation skills), albeit with 1 or 2 minor outliers.

Click on the image for a larger version

I used the term "growth appetite" to describe countries that have near-term, rapid economic growth aspirations and have a good chance of fulfilling their goals. My observation earlier about the increasing number of cashed-up Chinese nationals is one such tangible example.

The point is that countries with the most growth appetite have some way to go in getting to a mature, secure IT environment to support their growth aspirations. This basically means there are more potential opportunities (not revenue, mind you) in these countries.

IT security trends

Unfortunately, I'm going to have to pull out the dreaded buzzwords. I can't avoid them because that's all anyone seems to be talking about this year. I am of course, referring to:

• Cloud
• Consumerisation of IT (CoIT)
• Bring Your Own Device (BYOD)

If you've spoken to people about these, you'll find that CoIT and BYOD end up being very similar conversations. Not exactly the same, but one always links to the other. The Cloud of course, is the omnipresent entity in IT today.

So, what does APAC think about all this? Which countries care and which don't? Well, they all do. But I'm going to focus on these trends from an IT security perspective and add Governance, Risk and Compliance (GRC) into the picture. And I'm going to use a Venn diagram.

Click on the image for a larger version

I deliberately used the term "mindshare" because that's what starts conversations. But it doesn't always translate to budgets being directly allocated to the perceived issue. Often, it's the conversation starter that helps an organisation think about IT security more strategically and address the core issues instead of the tactical ones. If you're in a client facing role, understanding the mindset of your audience is half the battle.

Business etiquette

This isn't specific to the IT security market, but business etiquette is often the thing many struggle with when doing business in APAC so I'll briefly discuss it in here.

Doing business in Australia and New Zealand is very similar to the US and Western Europe, so I won't say anything about it. Just behave as you normally do. Even if there are a few differences, we're used to playing nice with others (in business anyway) and won't be surprised by most of the things you say :)

I will however, make a few observations about Asia in general. There are differences between countries, but if you keep these in mind, you should be fine:

• Many people in Asia are introverted by nature in business scenarios, even if they may not be in social situations. They don't like standing out. In public forums, it's very difficult to get audiences to participate or ask questions. In one-on-one situations however, they are more open. This is really about not wanting to "lose face". When we speak up in public, we run the risk of sounding uneducated or stupid. In western society, this is generally acceptable. It's why we always say: "there are no stupid questions". I don't necessarily agree with this statement, but the point is that it's perfectly OK to ask them. In Asia however, they would rather not risk the public humiliation.
• Exchange business cards by presenting yours with both hands to the other person. Reciprocate by accepting someone else's business card with both hands. Look at the business card for a couple of seconds before putting it away. I didn't do this at first, but realised very quickly I was being rude, albeit unintentionally. This is essentially about showing respect.
• Never try to tell a customer what is best for them, even if you think what they are doing is completely nonsensical or illogical. Try to understand why something is done that way. Only when you have a trusted working relationship with someone can you start to voice your opinion about why something may not be the best idea. When you do this, ensure it's collaborative, not one way communication. Even if the customer doesn't know anything about the subject matter, they like to feel that they do. Do everything you can to reinforce that feeling. Above all else, never make someone feel inadequate in front of their peers or their bosses.
• Never assume anyone in the room is unimportant. The quietest person in the room might be the most influential. This is rarely the case in the western business world. Not so in Asia.
• Asian audiences like listening to product features and functions. Many will say they want you to talk about a "solution", but more often than not, they actually want you to talk about the products they are interested in. There are a few reasons why this is so. I'll highlight two:
• The first is cultural. Just look at the way Asian consumer technology companies (e.g. Samsung) market their wares. They like to tout that they have better hardware and faster processors. In reality, the average person can't observe the differences. But Asians like thinking that they have something that is better than everyone else in terms of technical specifications. We in the western work generally prefer the experience. That's why the iPhone doesn't need the fastest hardware on the market. It just needs to have specifications that are good enough to support the best consumer experience.
• The second has to do with the Asian IT market's maturity level (or lack thereof), particularly in IT security. When one meets a software vendor or consultant, they want to gain something from the meeting. Essentially, it's about being educated and coming away with something that can be used to do our jobs better. But western views on being educated differ with the east. Asian organisations view listening to product features as being educated. It's a technology-centric view of things instead of a business-centric one. Western organisations don't want to know about everything a product can do unless they've specifically said: "give me a product pitch". Organisations in the west only want to know about how the product solves their business problems and would prefer if the irrelevant features were omitted. Many parts of Asia just aren't at this point yet. They'll get there eventually though.

Next

In part 2, I'll look at key countries in more detail. Do you agree or disagree with me? I'd love to get your opinions either in the comments or on Twitter.

From Russia with DLP Love

Ok so I'm not Sean Connery, but the title jumped out at me.

Those of you that know me will know I travel extensively across Europe in my current job. But not until last week did I make it anywhere near Eastern Europe. I started the week in Prague (beautiful city by the way) and then spent 3 days in Moscow meeting with various organisations...most of whom were banks.

Moscow still has remnants of its Soviet past as you would expect and the social divide is still vast. It feels a lot like China in that respect. In fact, I felt like I was in China...but no one was speaking Mandarin (I understand Mandarin so I should know). The main thing I took away from my visit is that Russia matters again. It seemed fitting that Vladimir Putin was named Time Magazine's Man of the Year for 2007 while I was in Moscow. I found out by watching CNN in my extremely expensive hotel room (not that I was staying in an expensive hotel by world standards - it's just how things are in Moscow...expensive for non-locals).

I'm not a social or political commentator so I'll stay clear of those things. But from a business perspective, it's not an easy place to work in. But it IS a place you can do business and it is growing at a fast pace. Here are a few points I took away from my visit:

• Forget about doing business in Russia if you cannot speak the language or if you do not have a local business partner to visit organisations with you. While most professionals in Western Europe can speak and understand English, this is not the case in Russia.
• Russian organisations don't waste time thinking about things and going through vast amounts of process (something the Western world is often guilty of...especially here in the UK). If they want to get something done, they get it done. Unfortunately, sometimes they can be hasty and go at 1000km/h when they should be going at 10km/h. I had to curb the enthusiasm of one of the organisations (they could speak and understand a little English) to help them plan things through properly rather than jumping straight into the deep end. Another organisation said to me "I want this now and where can I get it in Russian".
  
• Russia has somewhere between 100 and 1000 banks. I don't know the exact figure because different people were telling me different things. Most of these are small local banks and the only way to go seems to be consolidation or acquisitions. They cannot compete with the large international retail banks that are moving into Russia in the longer term and they know it.
• The IT landscape in Russia is still very new. But they have a lot of smart and educated people and are advancing very quickly (take Kaspersky for example). However, this means that many of the people you deal with in the IT departments are VERY young by our standards. Most of the so called "managers" I was talking to were only in university 2 years ago. I felt old (and I'm not...well at least I don't feel like I am).
  
• From an IT security perspective, they do care and there is movement. Fortunately for them, they are thinking about security up front instead of waiting until it is too late (like most Western organisations). But being so new to the IT area, this means there are a lot of "green field" opportunities. This can be a positive or negative depending on what solutions you are trying to sell.
• If you have encryption capabilities or technologies in the solution you are selling, forget about selling to state (government) organisations. They cannot put any encryption technology into their environments without first "ripping the solution apart" and looking at the internals. Then it has to go through a lengthy approval process which is almost always unsuccessful. I hear they are a little more lenient with Russian owned vendors and solution providers.
• Moscow's roads are permanently jammed...even more so than China. You cannot go anywhere during the day without getting stuck in a few traffic jams. Journeys that you expect would take 10 minutes always take somewhere between 30 minutes and an hour.
• Things are VERY expensive if you are not a local. My hotel cost 2-3 times the amount it would have cost me had I been in Western Europe or the USA.

Of course, I only spent 3 days there. So this is all just a first impression. I dare say I'll have to visit again so I reserve the right to change my views.