■WannaCry肆虐全球多個國家及地區。 網上圖片【原文】勒索軟件（ransomware）「WannaCry」肆虐全球，並蔓延至香港，大部分受害者為家庭用戶。此次席捲全球的網絡攻擊對香港敲響警號，香港資訊發達，流通自由（free flow of information），這是優勢之一，卻亦成為容易受到網絡攻擊的「軟肋」（Achilles' heel）。
已出現變種 警方籲勿鬆懈
「WannaCry」爆發短短數日，已經影響超過全球150個國家及地區，超過20萬用戶受到攻擊。所幸的是，目前本港除了個人用戶受到攻擊、個別企業「中招」外，尚未有政府和公營部門（public institutions）受到影響。
不過，「WannaCry」已出現變種（mutated variants），更加危險，警方提醒所有電腦使用者嚴陣以待，切勿鬆懈防範，並盡快更新電腦軟件，修補漏洞。
事件反映，網絡科技日新月異，網絡犯罪層出不窮，攻擊不分國界，來去迅速，影響廣闊，防不勝防（vulnerable）。政府部門掌握大量敏感資料（sensitive data）和民眾私隱，是網絡攻擊的頭號目標。美國、英國、澳洲等先進國家的政府網站及資訊系統屢遭黑客（hackers）攻擊，2015年本港政府資訊科技總監辦公室亦曾向各政策局發出68次嚴重保安警報（security alerts ），提醒各部門（bureaux）採取必要防控措施，保護政府網站及數據。
港電腦犯罪6年失18億
香港是國際金融、貿易中心，商業機構的資訊安全不容忽視。德勤與特許公認會計師公會去年發表報告指出，2009年至2015年，香港的電腦犯罪案件增長驚人，複合年增長率（compound annual growth rate）高達28.8%，累計損失達18億港元。
報告反映（indicates），受訪公司在資訊安全（information security）方面的投入卻頗低，四成受訪者甚至不清楚公司是否有資訊安全開支預算，而網絡攻擊成功，企業平均每次損失100萬美元。
本港商業機構（enterprises）未充分認識網絡攻擊的嚴重性，對資訊安全建設投入不足，隨時可能因小失大。
「WannaCry」襲港，正正發出警告，香港雖未受重大損失，企業無大規模淪陷，並不說明本港網絡安全固若金湯，只是較為幸運而已。政府、企業及市民對防範網絡攻擊、網絡犯罪絕不能掉以輕心，要以此次事件為契機，不斷審視、彌補網絡安全的不足（loopholes），完善風險防範體系。 （標題及小標題為編輯所加） （摘錄自香港文匯報社評16-5-2017）
WannaCry exposes need to review cybersecurity
【譯文】"WannaCry" has hit Hong Kong in the midst of the global ransomware outbreak, with most of the new victims being home users. Hong Kong should treat this worldwide cyber attack as a wake-up call, at a time in this digital age when free flow of information might become the Achilles' heel of the city.
Variants have emerged
More than 200,000 computers from over 150 countries and regions have been infected just within days of the ransomware outbreak. Fortunately, public institutions in Hong Kong have not been affected yet; victims are mostly home users along with a few corporations. However, the police have urged users to step up preventive measures and keep systems updated, after mutated variants of the ransomware have been reported.
The attacks have shown how vulnerable the modern world has become, as nations and individuals alike are prone to swift and omnipresent cybercrimes that benefit from rapidly advancing information technologies. Government bodies, which hold vast amounts of sensitive data and private information of the citizens, are at the top of the cyberattack list. Government websites and networks of technologically advanced countries such as the US, Britain and Australia are frequently targeted by hackers. The Office of the Government Chief Information Officer in Hong Kong issued 68 security alerts to policy bureaux in 2015, urging all government bodies to take preventive measures to protect their websites and data.
HK lost 1.8 billion in 6 years from cyber attacks
Hong Kong is a world leading financial and trading centre, so cybersecurity should be among the top priorities of corporations. Yet according to a 2016 report jointly released by Deloitte and the Association of Chartered Certified Accountants, the compound annual growth rate of computer crimes from 2009 to 2015 is a staggering 28.8%, while resultant financial losses reached HK$1.8 billion.
The report also indicates that companies' commitment to information security is only lukewarm, with 40 per cent of respondents not knowing whether their organisations have earmarked a budget for information security. With every successful cyberattack, companies would have to sustain losses averaging US$1 million. Failing to understand the threats and consequences of cyber attacks, enterprises in Hong Kong may end up paying a much higher price than they would have to, if risk prevention is not properly addressed.
The "WannaCry" attacks in Hong Kong are an alarm signal for all - it is only pure luck that enterprises are not crippled and paralysed, and that we did not suffer huge losses. Government bodies, companies and individuals alike must remain vigilant against cybercrimes, and take this opportunity to close any loopholes in their cybersecurity mechanisms.■Jeffrey Tse [ywc_jeffrey@hotmail.com]
Learning Point: Common Cybercrimes
Phishing: the attempt to obtain personal information such as usernames and passwords for malicious reason, by disguising as entities or institutions that are apparently trustworthy.
Ransomware: a malicious software that denies access to the victim's data or threatens to delete it until a ransom is paid. "WannaCry" is an example of ransomware.
Trojan horse: a malicious program that misleads users of its true intent. The program could allow the hacker to access sensitive personal information.
DoS attack / DDoS attack: denial-of-service attacks intend to make network resources unavailable to users by disrupting, overloading and flooding the services of the host.
