Cybersecurity incidents are ever-increasing, but there are ways to prevent your company from becoming the next victim
- Ways to prevent your organisation from becoming the next cyber threat victim
[The content of this article has been produced by our advertising partner.]
Cybersecurity specialists believe that nurturing IT talents with high awareness and rich cybersecurity knowledge is key to building a sound defence system.
Repeated data leaks in the city’s significant organisations raise concerns about the ability of enterprises to handle data security. Just as cyberattacks are causing huge economic and reputational losses for the organisations involved, there is a huge demand for increased cybersecurity training to protect an organisation’s critical assets.
In alignment with international practices on the regulation of data security, the Hong Kong authorities have proposed the Protection of Critical Infrastructure (Computer System) Bill, which addresses critical infrastructures, or the facilities that are necessary for the maintenance of normal functioning of the Hong Kong society. Under this proposed legislative framework, operators must implement measures to protect their computer systems, or they could face huge fines for security lapses.
Cybersecurity specialists are of the view that one of the easiest ways to gain unauthorised access to an organisation’s systems is through the employees. This often occurs due to an individual’s careless mistakes, such as falling victim to phishing attacks, poor password practices, and the unintentional sharing of confidential data. Staying vigilant to cyber-related threats is therefore important for everyone in an organisation with access to critical information and data systems.
The cost of being attacked includes operational, material, and reputation costs: system downtime that disrupts business operations; losing customer data can cause regulatory fines, such as those under the EU’s General Data Protection Regulation (GDPR), which specifies substantial penalties for non-compliance by organisations; reputation loss requires long-term efforts to rebuild customer trust; data recovery is not always possible after a ransomware attack, and the company may face the permanent loss of data.
According to SC Media, a firm providing market information and insights to cybersecurity professionals, the average cost of recovering from a ransomware attack in 2023 was US$1.82 million, excluding the ransom payment. The firm puts the number of the average ransom payout to be US$1.5 million. The amount never guarantees recovery of all stolen data, however.
In recent years, there have been several high-profile cybersecurity incidents in Hong Kong. In particular, data breaches have compromised sensitive personal and financial information belonging to numerous companies, their clients, and partners. Cybercriminals often demand a ransom for stolen data. These cases help to underscore the growing concern over data security and the need for robust protective measures and skilled talents.
In light of the urgent need for skilled cybersecurity professionals capable of analysing, managing, and responding to the risks in the digital landscape, the Cybersecurity Centre at IVE (Chai Wan) has been dedicated to offering comprehensive cybersecurity training to cultivate cybersecurity talent over the years. With the recent establishment of the Hong Kong Institute of Information Technology (HKIIT), the 14th member institution of the Vocational Training Council (VTC) and the first dedicated IT tertiary institution in Hong Kong, the Cybersecurity Centre has expanded its reach to one more location at VTC Tsing Yi Complex.
One of the most common cyberattacks is phishing. “Phishing attacks work in a way whereby users of an organisation are psychologically manipulated into performing actions desirable to an attacker and revealing sensitive information," explains cybersecurity specialist Kinsey Ng, lecturer of the HKIIT.
Phishing has been the most commonly reported incident to the Hong Kong Computer Emergency Response Team (HKCERT), followed by malware-infected robot networks, or botnets. Several reasons account for the frequency of phishing. “Phishing is difficult to trace, and it is a low-cost operation for attackers who potentially reap high rewards,” says Kinsey. “The fact that it exploits human mistakes makes it hard to neutralise from a technical perspective.” He advises employees to regularly attend training courses to spot phishing attacks.
The cybersecurity specialist says a person with adequate training can identify phishing emails with ease by analysing email headers to verify the sender's authenticity and checking for mismatched or unusual domains. It is also important to check the actual address of the resources, also known as URL, before clicking one. Computer system users must also be cautious with unexpected attachments, especially those with executable files. They can also make use of advanced email filtering tools to detect and block phishing attempts based on known patterns while staying alert for red flags, such as urgent requests, poor grammar, and unfamiliar language, which often signal phishing attempts.
In response to the increasing prevalence of phishing attacks, the Cybersecurity Centre offers comprehensive awareness training designed to prepare employees with the skills needed to recognise and respond to such threats effectively. The state-of-the-art Centre also boasts advanced facilities, including simulation-based cyber ranges that replicate real-world attack scenarios. In addition, it collaborates with major international cybersecurity brands to provide the latest technologies, thus offering aspiring professionals hands-on training that prepares them for various positions related to cybersecurity in the market.
_0.jpeg?itok=0GpgUlQG "The seminar designed exclusively for the non-profit organisation takes into consideration the specific needs of the industry.")
Given the needs, the team at the Cybersecurity Centre has come up with truly comprehensive recommendations for the management and technical support teams alike, across industries. Cybersecurity awareness training is a critical element when implementing a defence-in-depth strategy, the Cybersecurity Centre offers training for non-technical employees and technical training for staff responsible for monitoring system health and addressing ever-increasing cyber-related threats. The content includes cybersecurity best practices, phishing awareness training, and data protection strategies to engage all members in a cybersecurity culture. These are all practices designed to reduce cyber incidents, and ultimately enhance company branding.
