First published: 18th May 2012
Last month, Hong Kong Computer Emergency Response Team (HKCERT) was celebrating the opening of its new centre, this month centre manager Roy Ko is interviewed by international IT industry news website The Register.
In the interview, Mr. Ko explained how the CERT was responding to the changing nature of incidents and taking a more proactive approach. HKCERT already checks all .hk sites for suspicious activity, notifying owners to clean up malware in their machines, and it plans to expand this to .com and .org addresses based in the region. HKCERT uses third party information sources and it is planning to deploy its own sensors, and to systematise and automate the process. He recognised that the CERT needs to expand the scope of their service, especially in the areas of monitoring, early analysis and preventative work, but HKCERT has a very small team compared to other CERTs.
Nevertheless, HKCERT takes an active role in the wider IT security community, liaising with the police's Technology Crime Division and the government's Office of the Government Chief Information Officer (OGCIO) and further afield, fellow regional CERTs, including the very well funded mainland China CERT, headquartered in Beijing and industry contacts. This type of cooperation was effective in April 2010 when HKCERT was instrumental in the takedown of Koobface servers in Hong Kong. The Koobface gang rapidly moved their hosting to mainland China, but that just highlights the need for better cross-border cooperation.
Not everyone fully recognises the importance of strengthening HKCERT, talking to The Register, IT Subsector Legislative Councillor Samson Tam recently emphasised the importance of increasing resources for the Technology Crime Division, but failed to mention HKCERT.