Keynote Speech by Mr. Jason Pun, Assistant Government Chief Information Officer (Cyber Security & Digital Identity), at the “CISC IoT Security Forum 2018”

Dr CHOW (Dr KP CHOW, Director of the CISC), Simon (Mr Simon WONG, CEO of the Logistics and Supply Chain MultiTech R&D Centre), distinguished guests, ladies and gentlemen,

Good afternoon. It gives me great pleasure to join you today at the IoT Security Forum. I would like to express my gratitude to the HKU Center for Information Security and Cryptography (CISC) for organising this forum.

The Internet of Things (IoT) is showing great potential in transforming business activities into new digital processes, facilitating the formation of new business models, improving operational performance and enriching client experience. In fact, IoT has been widely adopted in various business sectors today, and it plays an important role in strengthening our city management and improving the quality of living of our citizens. This is the reason why IoT is one of the major technology enablers to build Hong Kong into a smarter city as stated in our Smart City Blueprint for Hong Kong.

New technologies have the potential to transform the world and make our lives better.  However, these changes bring forth not only huge benefits, but also challenges and risks. Without proper security protection, IoT devices with their inter-connected nature can become easy targets of attackers as entry points for launching cyber attacks and compromising data assets. Hence, IoT security is no doubt one of the prime considerations when implementing relevant applications. Here, I would like to share with you some challenges and experience from a technology adopter’s perspective.

Firstly, IoT security comes with a much wider range of information security considerations when compared with traditional systems. For example, some IoT systems by nature might not have proper physical protection as their devices may be installed outside a building without patrol. And traditional network security appliances such as internet gateways or firewalls may not be sufficient to secure each and every IoT device. This is especially the case when IoT devices are movable or attached to humans, like wearables or healthcare devices.  Hence, it is a big challenge to secure these devices, as traditional layers of defences are not enough. In addition, when factoring in cost and effectiveness in designing IoT devices, further constraints such as power consumption, computational power and memory size may be imposed when designing well-protected security features within the devices.

Besides technical considerations, we should also note the growing prevalence of Internet-connected devices. The increasing popularity in the use of IoT devices nowadays has become an integral part of our daily life. It is important to raise awareness and knowledge of IoT security in the community. As mentioned above, attacks on end-point devices such as sensors and cameras can have significant impact on the backend systems. They can potentially put the infrastructure at risk, or in a worst-case scenario even causing human casualties. Therefore, businesses and the general public must be fully aware of the importance of IoT security.

A concerted effort is the key to success in the hyper-connected world nowadays. To promote closer collaboration among local information security stakeholders of different sectors, the Government will launch the “Cybersec Infohub” on 24 September, which is a community-driven collaborative programme to facilitate effective exchange of cyber security threat information, mitigation strategies, best practices and knowledge. Here, I would like to encourage all participants of today’s forum to represent your companies or organisations to join the programme. You can then actively share your knowledge and information on IoT security or other security-related matters so as to enhance the overall cyber resilience of Hong Kong.

IoT is playing a significant role in our lives by building an ecosystem where physical objects and IT systems are interconnected to perform tasks smartly. To harness the opportunities whilst keeping risks under control, collaborated efforts and contribution from the industry and the academia are crucial. Before closing, I would like to appeal to all participants here today, including the academia and the field experts, to make the best use of innovation and technology to address the challenges to IoT security.

Lastly, may I wish the event a great success, and every one of you ample and fruitful takeaways. Thank you.

- ENDS -