Information security key to successful e-business
17 - 02 - 2004

Safeguarding against security breaches was the key to successful e-business, the Director of Information Technology Services, Mr Alan Wong Chi-kong, said today (February 17).

Opening the Integrated Security Conference and Expo 2004, at the Hong Kong Convention and Exhibition Centre, Mr Wong said computer users should be ready to deal with unexpected cyber attacks while enjoying the convenience of e-business.

To safeguard their information systems and assets, computer users should ensure that their software is up-to-date by applying the latest patches or upgrading to the latest version.

Mr Wong warned that a single virus attack could trigger bulk email spamming, causing widespread network congestion, or could embed Trojan codes in "victim computers" that would allow backdoor cyber attacks in the future. New attacks would be equipped with even more sophisticated tools to disguise themselves and spread it even faster, he said.

Mr Wong noted that email spamming was a serious concern. In a number of reported cases, fictitious emails were sent to lure bank customers to visit fake websites and disclose their details.

He added that for the prevention of cyber crimes to be effective, users should be more vigilant and verify the authenticity of websites before performing e-transactions.

Enterprises should regularly conduct risk assessments on their IT assets and implement measures to ensure they complied with their security policies and requirements. IT security cannot be left to IT professionals alone. Users also play a significant part.

Special attention should be given to systems directly connected to the Internet or wireless networks as wireless networks were insecure for transmission of confidential information unless specific hardware or software security enhancements were installed, Mr Wong said.

The Government, in collaboration with various information security associations and industry players, has posted on the Internet information and advice on wireless network security strategies as well as related research findings and best practices for public reference.

Mr Wong said a security management framework had been established in the Government to ensure and enhance its internal IT security.

To promote public awareness on the subject, the "Infosec" website (www.infosec.gov.hk) was set up in 2002 to provide information on IT security. The importance of IT security is also publicised through radio broadcasts and TV programmes.

Hong Kong Police and the Information Technology Services Department work closely with the Hong Kong Computer Emergency Response Team/Coordination Centre to help the public handle cyber attacks.

The Government also encourages the development of industry-specific information security standards and is consulting various professional organisations and business associations on the feasibility of introducing audit mechanisms to certify information security standards for different industries.

The Integrated Security Conference and Expo ends tomorrow.

- END -