Into The Dragon's Den

Into The Dragon's Den: Security Lessons from Taking a SaaS Company into China

Speakers: Jacob Salassi, Michele Freschi

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: https://www.youtube.com/watch?v=hrkeNbuA2hg

Reading time: ~9 minutes

TL;DR

After years leading product security at a major SaaS database company during its China expansion, Jacob Salassi and Michele Freschi share the hard-won mental models they developed for operating in a strategically hostile environment. The core insight: entering China means accepting that certain threats — operating partner coercion, constant surveillance, legally mandated insider risk — cannot be eliminated, only understood. Security success lies in building cryptographically and physically isolated deployments, fully automated operations, and a structured insider risk program before the first line of code lands in a Chinese data center.

Introduction

Going into China with a SaaS product is not a conventional market expansion — it is entry into a jurisdiction where the legal system, the competitive landscape, and the intelligence apparatus are organized around goals that may be directly opposed to your company's interests. Jacob Salassi and Michele Freschi learned this firsthand after spending years at a major SaaS database company navigating the technical and organizational challenges of operating behind the Great Firewall. Their BSidesSF 2025 talk was not a policy debate about whether to enter China, but a practitioner's guide to what happens when the business decision is already made and the security team has to figure out how to survive it.

The talk arrived at a pointed moment: with US-China trade tensions reshaping global technology supply chains, the dynamics they describe — regulatory ambiguity as coercion, state-mandated knowledge transfer, operating partners with intelligence ties — are becoming relevant to an expanding circle of companies. The mental models Salassi and Freschi offer are deliberately generalizable: entering any sufficiently hostile operating environment demands the same kind of thinking.

The Strategic Context: Made in China 2025 and the Long Game

▶ Watch: Made in China 2025 and the operating environment (04:00)

The speakers open by framing the threat not as individual espionage campaigns but as a comprehensive national program. Made in China 2025 lists ten domestic industries in which China seeks to dramatically reduce reliance on foreign technology — with a target of 70% domestic sourcing of key components. Information technology is explicitly on the list, alongside medicine, transportation, and several others. The implication for SaaS companies: what looks like market access is also technology acquisition.

The mechanism is a required joint venture with a Chinese operating partner — a domestic company that will have elevated access to your systems by regulatory design. These partners, the speakers note, are often tied to defense and security services. They are not optional, and no choice of partner is particularly better than another. The operating partner is a structural feature of doing business in China, not a risk that can be engineered away.

Salassi and Freschi also highlight the fundamental legal trap: the US Cloud Act and China's Data Security Law both require data disclosure to law enforcement on request — but Article 36 of Chinese law prohibits providing data to foreign law enforcement without Chinese government approval. A US company operating in China is simultaneously required to comply with both, and the conflict is, as the speakers put it, "by design. The ambiguity is the point."

What You Cannot Change: Accepting the Threat Landscape

▶ Watch: The unavoidable risks — operating partners, surveillance, and insider threats (14:01)

Rather than pretending every risk is manageable, Salassi and Freschi spend explicit time on what cannot be changed — a framework they argue is essential for clear thinking. The list is sobering:

Operating partners will have elevated access. Whatever the contractual arrangements, the partner will see more of your operations than any third party typically would, and they will be subject to coercion by the state. This is not a selection problem.

Regulatory compliance is coercion, not compliance. Requirements like Multi-Level Protection Scheme (MLPS) certification for security tools are real but interpreted flexibly. The flexibility is not permissiveness — it is a mechanism for creating exposure. The speakers observe: "In the US, you can pay money and move on. In other countries, it's a window for coercion."

You will be probed constantly. Every aspect of your operations — architecture, personnel, decision-making — is subject to ongoing intelligence collection. Chinese law requires every citizen to support state security agencies when requested, which means any employee with ties to mainland China may be placed in an impossible position. Critically, the speakers emphasize this is not a reason to discriminate by nationality: US citizens have also conducted espionage for China. The correct framing is to focus on behavior and motivation, not background.

Even giants are not immune. Microsoft was compelled to share source code with Chinese authorities. Tesla learned, precisely as its Full Self-Driving technology launched, that regulations suddenly became restrictive in ways that looked punitive. The speakers are direct: if you are not Amazon, Microsoft, or Apple, you have none of their regulatory influence, no lobbyists, and no geopolitical leverage — and even those companies were not immune.

Architecture: Sovereign Deployments and Cryptographic Isolation

▶ Watch: Architecture principles for China deployment (16:01)

The architectural philosophy Salassi and Freschi propose treats the China deployment like a mission to a hostile planet: bring everything you need for survival, establish safe communication channels, but design the system to contain damage if those channels are compromised.

The core principle is physical and cryptographic isolation between China and global operations. Chinese data stays in China; global data stays out of China. Physical separation (separate AWS accounts, separate organizational structures) is necessary but insufficient — it needs to be coupled with regional encryption using separate key management, so that even if physical controls fail, cryptographic controls prevent cross-border data access.

Third-party SaaS dependencies require specific attention. GitHub, Wiz, Jira — none of these are available through the Great Firewall. The team had to identify Chinese-market equivalents: Gitea instead of GitHub, Prisma Cloud instead of Wiz, Zendao instead of Jira. AWS accounts cannot be shared; even IT systems like HR, sales, and billing (Workday, Salesforce) need separate instances with maximized segmentation. Where interfaces between China and global operations are unavoidable — billing being a common example — they become known concentration points for focused monitoring and detection.

Operations: Automate Like HAL 9000, Build Travel Mode

▶ Watch: Automated operations and travel security protocols (24:02)

On the operations side, the speakers make a pointed argument for full deployment automation. The analogy is HAL 9000 from 2001: A Space Odyssey — a system that executes its mission without requiring human interaction, that doesn't accept override instructions from unauthorized parties, and that takes drastic measures to protect mission integrity. The principle: if deployment is fully automated, any manual access is immediately anomalous and detectable. If operators routinely SSH into production, that signal is lost.

For secrets management, the speakers invoke the XZ supply chain attack as a warning against assuming peer review is sufficient. Their prescription: every secret must be in inventory, every secret in inventory must have automated rotation, and there should be zero exceptions. Scanning for leaked secrets is necessary but insufficient if you don't have the rotation capability to respond in seconds when one is found.

Travel security receives dedicated attention — and with good reason. While the security team is writing architecture documents, someone is already boarding a flight to Shanghai with a corporate laptop full of sensitive data. The mitigation is a structured travel mode protocol: define approved devices (not work laptops, which carry too much sensitive context), revoke all non-essential credentials before departure, create a pre-defined menu of permissible actions the traveler can take on production systems, and treat return from high-risk travel as a potential compromise event with corresponding decontamination steps. Critically, the system's security should not depend on one person refusing to unlock their device when detained at customs.

Insider Risk: Everyone Is a Potential Insider

▶ Watch: Building an insider risk program for China operations (30:02)

Michele Freschi takes on the hardest part of the talk directly: when operating in China, Chinese law mandates that every citizen support state security agencies when requested. This means any team member in China will, at some point, be in a position where they must act as an insider — not out of malice, but because the law requires it. "This does not make them bad people," Freschi emphasizes. "They're just like us. They have to play by a different set of rules."

The practical implication: collaboration interfaces (chat, email, wikis) between China-based and global teams need to be treated as secured perimeters, not open channels. The speakers suggest modeling China-based teams similarly to an external contractor relationship — limiting access to what is functionally necessary for collaboration. Detecting insider activity requires dedicated staffing and tooling separate from existing teams; the speakers warn that the moment you start looking, you will find things, and most will not be malicious — just humans doing careless things that still require investigation.

The program should focus on behavior and motivation, not nationality, and should engage the FBI's dedicated counterintelligence resources. Local FBI offices, the speakers note, actively want to help US businesses and have resources specifically oriented toward the China threat.

Notable Quotes

"China wants to be to data what Saudi Arabia is to oil. And when you think about acquiring oil, governments and businesses are willing to use all the tools, whatever they are, as a weapon or as an enabler."

— Jacob Salassi [[▶ 08:00]](https://www.youtube.com/watch?v=hrkeNbuA2hg&t=480s)

"This ambiguity is the point. You're set up to fail — either comply with the US or comply with China, and the choice is theirs to make for you."

— Jacob Salassi [[▶ 08:00]](https://www.youtube.com/watch?v=hrkeNbuA2hg&t=480s)

"I would encourage everyone here to be more like HAL — fully automated, no direct interactions, drastic measures to protect mission integrity — and less like NASA."

— Jacob Salassi [[▶ 24:02]](https://www.youtube.com/watch?v=hrkeNbuA2hg&t=1442s)

Key Takeaways

• Accept what you cannot change before planning what you can. Operating partners with intelligence ties, mandatory compliance ambiguity, and constant surveillance are structural features of operating in China — not problems to be engineered away. Knowing this prevents wasted effort and incorrect threat models.
• Physical isolation is necessary but not sufficient. Pair separate AWS accounts and organizational structures with regional encryption and separate key management so that cryptographic controls provide a second layer of containment.
• Automate everything that touches production. Full deployment automation makes unauthorized access immediately detectable. Build a pre-defined runbook menu for emergency access rather than allowing free-form SSH sessions.
• Treat every secret as already compromised. Maintain a complete inventory of all secrets with automated rotation for each one. The question is not whether a secret will be stolen, but whether you can rotate it before damage occurs.
• Travel security is a systemic design problem, not an individual policy. Build a formal travel mode protocol with dedicated clean devices, pre-travel credential revocation, and post-travel decontamination procedures. Company security should never depend on an individual's willingness to resist customs pressure.