More Companies Adopt Firewall or Advanced Security Measures Against Computer Attacks

Local companies adopting firewall or advanced security measures against computer attacks are on the increase, according to the latest survey jointly conducted by the Office of the Government Chief Information Officer (OGCIO), HKSAR Government, the Hong Kong Computer Emergency Response Team Co-ordination Centre (HKCERT) and the Technology Crime Division of the Commercial Crime Bureau of the Hong Kong Police Force.

Initiated by the Hong Kong Productivity Council (HKPC) in 2000, the Information Security Survey is conducted annually to evaluate local companies' awareness of information security.

In the latest survey, which took place in November and December 2004, telephone interviews were conducted with 3,000 locally registered companies which were selected by proportional sampling from 10 major industrial sectors. The scope of the survey covered the types of computer attacks and their impacts in the past 12 months, actions undertaken, the latest security technologies adopted, as well as security management and manpower policies implemented.

Presenting the finding of the survey at a press conference today (30 March 2005), Mr K T Yung, General Manager (Information Technology Industry Development) of HKPC, said, “The awareness of information security among local companies has generally improved over the past year. In particular, companies (at the basic security level) using ‘firewall’ to protect their computer systems have significantly increased by 20 percentage points (from 45% in 2003 to 65% in 2004). Companies deploying advanced security measures have also increased from 17% to 21% as compared to the last survey in 2003. Majority of these companies came from the banking and finance (37%), manufacturing (33%), and transport and communication (27%) sectors.”

“A point to note is that companies not using any security technologies have dropped from 10% in 2003 to 4% in 2004,” Mr Yung added.

“Regarding security technologies deployed by local companies, the most common measures were ‘anti-virus software’ (91%), ‘physical security’ (66%), ‘firewall’ (65%) and ‘password’ (61%),” he said.

The survey found that ‘computer virus’ (95%) was still the prevailing type of computer attack, followed by ‘denial of service’ (21%) and ‘hacking’ (6%). “While almost half of the respondents (47%) did not know the origin of attacks, 43% conceded that the attacks originated from overseas,” Mr Yung said.

According to Mr Yung, 18% of respondents with servers and/or websites have suffered from computer attacks in the past 12 months. Among them, 52% reported 2 to 4 incidents during the year. A total of 3,464 computers were involved in the victimized companies during the same period, a further drop of 16 percentage points compared to last year, while a decrease of 30 percentage points in financial loss, totalling HK$853,150, was recorded. Among companies that suffered from computer attacks in 2004, the average financial loss per company also decreased by 16 percentage points compared to the previous year. “This is an indication that companies have reaped the benefits of their preventive measures and have minimized the impact of the attacks,” Mr Yung added.

In terms of actions against computer attacks, 96% of respondents patched their security holes while 17% reported to senior management.

The survey also showed that the percentage of companies that had implemented information security policy have increased slightly from 17% in 2003 to 18% in 2004. 37% of the surveyed companies employed full-time and part-time staff to handle information security issues.

The survey also looked into the information security expenses of companies and found that 55% of the respondents had incurred such expenses in the past 12 months. Among them, 40% said that these took up about 1-5% of their annual IT expenses, an increase of 9%.

Other speakers at the press conference included Mr John Wong, Assistant Government Chief Information Officer (Infrastructure and Security), HKSAR Government; Mr Lam Cheuk Ping, Patrick, Senior Superintendent (Acting), Technology Crime Division, Commercial Crime Bureau, Hong Kong Police Force and Mr Roy Ko, Centre Manager, HKCERT.

The HKCERT was set up by HKPC in February 2001 to provide a centralized contact for computer and security incident reporting and response for local enterprises and Internet users. As of the end of February 2005, the Centre has received 8,556 incident-related calls, of which 1,912 were security incidents and 6,642 were virus incidents.

For further information on the HKCERT, please call 8105 6060. For a copy of the survey, please visit HKPC’s website at www.hkpc.org. or HKCERT’s website at www.hkcert.org.

For media enquiries, please contact:
Ms Betty Lee
General Manager
Corporate Communications & Events
Tel: 2788-5036
Fax: 2788-5056
E-mail: emilyc@hkpc.org

31 March 2005