As Asia's leading logistics, transportation and financial hub, Hong Kong widely uses information and communication technology infrastructures in private and public sectors. In view of the growth of cyber threat that might endanger the safety of Hong Kong's cyber environment and critical infrastructures, the Cyber Security Centre (CSC) under the Technology Crime Division of Commercial Crime Bureau has organised the first Cyber Drill Exercise for local critical infrastructures on different days since March this year for achieving the following objectives:
- To test the capabilities and measures of the participating critical infrastructures to respond to cyber security incidents;
- To increase their understanding of the role of the CSC in enhancing their readiness in the event of cyber attacks; and
- To elevate cyber security awareness in the industry.
During the exercise, the CSC worked in collaboration with three overseas law enforcement agencies, and a total of 14 participating organisations from five critical infrastructure sectors (i.e. Banking & Finance, Transportation, Communications, Public Utilities and Government Services) in Hong Kong took part in a series of scenario-based exercises simulating various types of cyber attack that caused an impact on major information systems. In addition to coordinating the exercise, the CSC was also responsible for gathering global intelligence that might help identify the type and scope of the attack, assisting in mitigating the impact of the attack, and conducting investigation to trace the source of the attack.
The exercise provided a valuable opportunity for the CSC and the participating organisations to experience the happening and respond to cyber security incidents involving critical information systems in a safe venue. Immediately after the exercise, a review session was held on the same day, allowing the participants to discuss and identify areas that will require improvement, such as sharing of information, coordination mechanisms with internal and external stakeholders, and making critical decisions on management level during a cyber attack incident.
Consolidating all the valuable experience acquired from the exercise, CSC is currently organising meetings with the operators of different critical infrastructures for sharing the good practices and areas of improvement identified from the drill, providing them with recommendations that will be useful for further strengthening the cyber security measures of their critical information systems, and enhancing their preparedness to meet the emerging threat of cyber attack.
