RMBI Newsletter = 風險薈訊, Issue 18 (July 2020)

Abstract

香港科技大學 The Hong Kong University of Science and Technology

RMBI BSc in Risk Management and Business Intelligence 風險管理及商業智能學

RMBI Newsletter 風險薈訊 Embrace Connectivity and Prepare for the New Cyberspace 網絡聯繫，迎接網絡新空間 Issue 18 | July 2020

July 1 2 Embrace Connectivity and Prepare for the New Cyberspace 網絡聯繫，迎接網絡新空間 WONG, Enoch 王珞心 (Year 4 四年級學生) LI, Peter Ka-Chung 李嘉聰 (Year 2 二年級學生)

• What are the current developments and benefits of digital transformation? 數碼化轉型的現狀如何，它能帶來什麼好處？ What are the risks in communication and commercialization within cyberspace? 網絡空間內的通訊和商業化有何風險？ How are we managing risks in cybersecurity and what can we do about them? 我們如何管理及應對網絡安全風險？

The Future Is Now 現在便是未來 Digitalization is transforming how we communicate and do business as individuals, firms, and societies. Wireless telecommunication is empowering the world of academia and corporations to operate amidst disease outbreaks. Serverless computing* makes the fast development of startups feasible. Process automation** is accelerating logistics and administrative functions through robotics. In the upcoming decade, commercialization of 5G*** networks, cloud computing, and machine learning algorithms will blur the boundaries between physical space and cyberspace. Smart cities are now a reality with networks of sensors which provides data for algorithms delivering better services in public security, transportation, and health.

無論在個人、企業或是社會層面，數碼化都在改變着我們進行通訊和營商的方式。在疫症爆發時期， 學術界和企業界借助無線通訊維持其正常運作。無伺服器運算*則讓初創企業的快速發展變得可行。 流程自動化**則通過人工智能來加速物流和行政方面的運作。 在未來十年，5G網絡***、雲運算和機器學習算法的商業化將會令實體和網絡空間的界限變得模糊。 在今天，智慧城市已成為現實：龐大的感應器網絡為算法提供數據，從而在公共安全、交通和健康領 域提供更好的服務。

* Serverless computing is a cloud computing execution model in which the cloud provider runs the server, and dynamically manages the allocation of machine resources. 無伺服器運算是一種雲運算執行模型，它由雲端供應商提供伺服器，並動態管理機器資源的分配。 ** Business process automation, also known as business automation or digital transformation, is the technology-enabled automation of complex business processes. It can streamline a business for simplicity, achieve digital transformation, increase service quality, improve service delivery and contain costs. 業務流程自動化，也稱為業務自動化或數碼轉型，是以科技支援的複雜業務流程自動化。 它透過系統化業務運作，達到簡化業務流程、實現數碼轉型、提升服務質素、加強服務提供和控制成本的目的。 *** 5G will enable a new kind of network that is designed to connect virtually everyone and everything together, including machines, objects, and devices. 5G透過支援全新類型的網絡，將幾乎每個人和所有事物（包括機器、物件和設備）連結在一起。 By 2026, the market for Internet of things is estimated to be worth over US $619 billion. [1] 至2026年，物聯網的市價估計將超過6,190億美元。 [1]

Source: Cover banner, from Robynne Hu on Unsplash, Bayfront Avenue, FUTURE WORLD @ ArtScience Museum, Singapore [24]

Embrace Connectivity and Prepare for the New Cyberspace

3 4 The Current Situation 現狀 The finance industry is one of the beneficiaries of advancements in information communication technology. SWIFT is a network that enables financial institutions worldwide to send and receive information about financial transactions in a secure, standardized and reliable environment. It is responsible for nearly half of all high-value cross-border payments worldwide. Such systems are often criticized for their inefficiency. The Financial Times commented in 2018 that transfers on the SWIFT network“often pass through multiple banks before reaching their final destination, making them time-consuming, costly and lacking transparency on how much money will arrive at the other end.” [2] This lack of transparency took a toll 2 years back. In 2016, fraudulent instructions were issued by criminals via SWIFT to illegally transfer close to US $1 billion from a Bangladesh Bank via their account with the Federal Reserve Bank of New York. Using social engineering techniques, a malware was implanted in the bank , s system after a staff mishandled a malicious email attachment [3]. With the execution of the malware at the right time, the heist was done. No mask, no guns, but with commands entered on the console miles away from the scene. There is much to gain when we base communication and commercialization within the cyberspace, both citizens and criminals alike. 金融業是資訊通訊科技的受益者之 一。SWIFT是一個服務全球金融機構的網 絡，它可讓金融機構在安全、標準化和可 靠的環境下發送和接收有關金融交易的資 訊。這個網絡承擔着全球近半高額跨境支 付。 但此類系統因效率低下而經常被詬病。英 國《金融時報》在2018年對SWIFT作出如 是評論： 「SWIFT要經過多家銀行才能到達最終目 的地，成本高昂又費時，而且收款人能收 到多少金額亦缺乏透明度。」 [2] 透明度不足令SWIFT在兩年前付出了代 價。2016年，犯罪分子通過SWIFT發布欺 詐性指示，要求通過其在紐約聯邦儲備銀行的帳戶從孟加拉國銀行非法轉移近10億美元。事件中，犯罪分子 利用社交工程技術，藉著員工處理惡意電子郵件附件時出錯，將惡意軟件植入銀行系統[3]，然後適時執行 惡意軟件實行搶劫行為。整個搶劫過程沒有使用面具，也沒有槍支，只不過是在距離現場數英里的控制台上 執行程式指令便大功告成。 在網絡空間進行通訊及商業運作，無論對於普通民眾或是犯罪分子，都能帶來很多便利。

網絡聯繫， 迎接網絡新空間

Examples of Cyber Security Threats or Vulnerabilities 網絡安全威脅或漏洞例子 Year 年份 Target 目標 Service 服務 Assets 資產 Aftermath 後果 2013-16 Yahoo 雅虎 [4] Web services 網絡服務 3 billion user credentials and private information 30億用戶憑證和個人資料 Class-action Lawsuits, Discounted Merger Deal (US $350 million) 集體訴訟，合併交易打折 （3億5,000萬美元） 2017 Windows OS Windows 操作系統* [5] Healthcare, government, education, and more 醫療保健、政府、教育 及其他 300,000 computers 30萬台電腦 Suspended medical services and manufacturing 醫療服務和製造停頓 2018 Google+ [6] Social network 社交網絡 52.5 million user data 5,250萬用戶資料 Shutdown of Google+ Google+ 停機 2018 Facebook [7] Social network 社交網絡 50 million user login information 5,000萬用戶登錄資料 Massive IT restructuring 大規模IT重組 2018 Cathy Pacific [8] Airline 航空公司 9.4 million passenger data 940萬乘 Massive IT restructuring 大規模IT重組 2019 Capital One [9] Credit cards, bank, and loans 信用卡、銀行和貸款 106 million credit card application data 1.06億張信用卡申請資料 Class-action Lawsuits, C-suite replacement 集體訴訟，高級管理層人員 撤換 2019-20 Universities in Hong Kong 香港的大學** [10] Education and research 教育和研究 Unknown 未知 Unknown 未知 * The WannaCry ransomware attack was a May 2017 worldwide cyberattack by the WannaCry ransomware cryptoworm, which targeted computers running on the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency. WannaCry勒索軟件攻擊是指WannaCry勒索軟件加密蠕蟲(cryptoworm)在2017年5月進行的全球網絡攻擊，它針對運行Microsoft Windows操作系 統的電腦，將其數據加密，然後要求受害人以比特幣支付贖金，從而達到勒索目的。 ** Computer systems at two Hong Kong universities were compromised in a Winnti Group campaign. 在Winnti Group的一次攻擊行動中，香港兩所大學的電腦系統受到破壞。

網絡聯繫，迎接網絡新空間

Embrace Connectivity and Prepare for the New Cyberspace 5 6 What do criminals do with digital assets? What are the implications for individuals and corporations when their digital assets were compromised? Other than conducting identity theft using stolen personal data, criminals could auction their loot on the black market via the dark web. Through the use of crypto-currencies and coupons, criminals could anonymously launder their illicit gain for profit. The data sold on the platform could be then used for spear-phishing*, crypto-jacking**, and botnets***. [11] Having your digital credentials or infrastructure accessed by malicious actors could yield dire consequences ranging from financial loss, to irrevocable loss of confidence and reputation from privacy leaks. These implications may not be materialized by the hackers immediately. Immediate and thorough actions are required upon suspicion of data compromise. 犯罪分子如何處理數碼資產？對個人和公司而言，若其數碼資產遭到盜用，將會受到什麼影響？ 犯罪分子除了使用所盜取的個人資料進行身份盜竊外，犯罪分子還可以通過黑網在黑市上拍賣贓物。犯罪 分子可利用加密貨幣和優惠券，以匿名方式洗錢並牟取暴利。平台上出售的數據可用於魚叉式釣魚攻擊* 、加密挖礦劫持(cryptojacking)**和殭屍網絡(botnet)*** [11] 。 讓網絡罪犯存取你的數碼憑證或基礎設施可能會導致可怕的後果，包括財務損失，以及因洩露私隱而造成 不可挽回的信心和聲譽損失。 網絡犯罪的後果未必即時浮現。如果懷疑數據被盜用，則需要立即採取徹底的措施作出補救。 * Spear-phishing is an attempt, targeting specific individuals and companies, to fraudulently trick them into revealing sensitive information. In contrast to bulk phishing, spear phishing attackers often gather and use personal information about their target to increase their probability of success. 魚叉式釣魚攻擊透過欺詐手段，引誘其針對的目標個人或公司透露敏感資訊。 與大規模的網絡釣魚不同的是，魚叉式釣魚攻擊者通常會收集 並使用有關目標的個人資料來提升成功的機率。 ** Crypto-jacking is an emerging online threat that hides on a computer or mobile device and uses the machine , s resources to “mine” forms of online money known as cryptocurrencies. 加密挖礦劫持是一種新型的網絡威脅，它將挖礦程式隱藏在別人電腦或移動裝置上、並利用這些電腦資源來「挖掘」加密貨幣（to mine cryptocurrency)。 *** Botnet is a number of Internet-connected devices, each of which is running one or more bots. Botnets can be used to perform a distributed denial-of-service attack, steal data, send spam, allowing the attacker to access the device and its connections. 殭屍網絡是指許多與互聯網連接的設備，當中每個設備都運行着一個或多個殭屍程式。 殭屍網絡可用於執行分佈式拒絕服務攻擊、竊取數 據、發送垃圾郵件，並允許攻擊者存取相關設備及其網絡。 Cybersecurity Ventures predicted the global annual losses due to cybercrime from 2021 to be US $6 trillion, surpassing the illegal drug market. [12] Cybersecurity Ventures預測，到2021年，全球每年因網絡犯罪帶來的損失將超越非法藥物市場，金額高達6萬億美元。 [12]

An Uphill Battle 一場艱苦的戰鬥 We are under constant threat of malicious cyber attacks. The sophistication and novelty of cyberattacks would increase with the adoption of new technologies. 我們受惡意的網絡攻擊所威脅。新技術的應用令網絡攻擊愈見複雜，更不斷「推陳出新」。 Technology 技術 Example of Point of Attack 攻擊案例 Example of Attack Method 攻擊方法例子 5G Vulnerable smart devices 易受攻擊的智能設備 Remote buffer overflow 遠程緩衝區溢出 Cloud 雲服務 Unsanitized access controls 未經審查的存取控制 Credential stuffing 憑證填充 Deep Learning 深度學習 System operators 系統操作員 Dynamic spoofing 動態欺騙 With the advent of new technologies, new vulnerabilities would arise awaiting zero-day attacks from threat actors. Smart devices, while offering convenience to users, also allow threat actors to control the network of victims through remote code execution from over 100 meters. In 2019, a flaw in Philips smart light bulb allowed remote access to a targeted WiFi network via buffer overflow without breaking WiFi passwords [13]. Cloud services operate on the shared responsibility model, which allow companies to rent secured computing resources so they can devote more time to developing applications for their customers. In most cases, the security of the server-side is robust enough to prevent intrusion but poor access and identity management on the client-side still pose a security threat. The celebrity breach on the iCloud platform in 2014 was the result of vulnerabilities of weak passwords and security questions which allows threat actors to perform credential stuffing, or educated guesses of the passwords of victims [14]. Machine learning algorithms are useful for computer graphics, which include rendering believable versions of digital media. FaceSwap is a tool that utilizes deep learning to recognize and swap faces in pictures and videos [15]. In 2019, criminals used similar tools to impersonate the voice of a German chief executive of the parent company and successfully carried out a fraudulent transfer of US $243,000 from its subsidiary. Considering the myriad of unpatched vulnerabilities from new technologies and security misconduct from system operators, it is an uphill situation which means it would be difficult to eliminate cybersecurity risk. Despite this, there are effective measures that we could adopt to combat these adversaries.

隨著新技術的誕生，新的漏洞亦會相應出現，並可能受到網絡罪犯的零日攻擊（Zero day attack)。 智能設備在帶來便利的同時，還為威脅者提供了機會，以在100米外以遠端方式執行代碼、控制受害 者的網絡。在2019年，Philips智能燈泡的一個缺陷便讓攻擊者毋需破解WiFi密碼[13]，便可透過緩衝 區溢出，對目標WiFi網絡進行遠端存取。 雲服務以共享責任模型運行，它可讓公司租用安全運算能力，從而騰出更多時間為客戶開發應用程 式。在大多數情況下，伺服器端的保安措施足以抵禦入侵，但若客戶端的存取和身份管理不當，仍可 能構成安全威脅。iCloud平台在2014年發生的名人失竊事件是由於密碼和安全問題脆弱，致使網絡罪 犯可以執行憑證填充或對受害者密碼進行有根據的猜測[14]。 機器學習算法對電腦繪圖非常有用，其中包括呈現數碼媒體的一個可信版本。FaceSwap是一種利用 深度學習來識別和交換圖片和視像中的面孔的工具[15]。在2019年，犯罪分子使用類似的工具來模 仿母公司德國首席執行官的聲音，並成功欺詐其子公司轉移24.3萬美元資金。 由於新技術帶來的大量未修補漏洞以及系統運營商的不當行為，網絡安全風險很難消除。這是一個艱難的局面。儘管如此，我們仍可採取和維持有效的措施以對抗這些對手。

網絡聯繫，迎接網絡新空間 Embrace Connectivity and Prepare for the New Cyberspace

7 8 Down The Road 展望將來 As individuals and corporations, we need to understand the best practices in cybersecurity and adopt cybersecurity risk management measures to protect ourselves in the Cyberspace of the future. Cybersecurity risk could be defined as:

無論作為個人或公司，我們都需要了解網絡安全的最佳做法，並採取網絡安全風險管理措施以適應新的網 絡空間。網絡安全風險可以定義為： The possibility that something could happen to damage, destroy, or disclose data 某些事件可能會損壞、破壞或披露數據的可能性 [16] The primary goal of cybersecurity risk management is to reduce cybersecurity risk to an acceptable level by protecting assets from attackers in a controlled and secure environment with minimal vulnerability. The relations between systems, assets, vulnerabilities and attackers are as follows: 網絡安全風險管理的主要目標是把資產放在受控的安全環境中，以保護資產免受攻擊，並把網絡風險降至 可接受的水平。系統、資產、漏洞和攻擊者之間的關係如下： Source: Relations in Cybersecurity from Slide 25, COMP3632, Principles of Cybersecurity, Spring 2020, Prof Tao WANG [25] For secure systems to be easily managed and maintained, secure design is needed to protect assets and to patch vulnerabilities effectively. Saltzer and Schroeder , s Principles of Secure Design [17] could be used as a guide to how we can design secure systems. 要使安全系統易於管理和維護，就要進行安全系統設計，以保護資產並有效地修補漏洞。Saltzer和Schroeder的安全設計原理[17] 可作為我們如何設計安全系統的指南。 Some of the notable principles are: 一些值得注意的原則包括： Principle 原理 Description 說明 Possible Reason 可能的原因 Open design 開放設計 The design of the system should be open to all 系統的設計應向所有人開放 Vulnerabilities could be patched with crowdsourcing 漏洞會可透過大眾智慧作出修補 Separation of privileges 特權分離 Permission to enter a system should be granted based on multiple conditions 系統應基於多個條件授予權限 Minimize the risk of misconduct by only offering needed permission 透過只給予所需的權限而減少不當行為所造 成的危機 Least privilege 最低特權 Every program and every user of the system should operate using the least set of privileges necessary to complete the job 每個程式和系統的每個用戶都應使用完成工作所 需的最少權限來進行操作 Limiting the damage that can result from personal misconduct 限制由於個人不當行為而造成的損害 Fail-safe defaults 故障安全默認值 Upon failure, the system should revert to a secure default mode 發生故障時，系統應恢復為安全默認值 Minimizing damage to system upon breach 最大限度地減少對系統的破壞 Psychological Acceptability 心理可接受性 Security should be intuitive to the human psyche 易於被接受 Allowing ease-of-use for users to follow secure protocols 讓用戶易於跟從安全協定 Source: Saltzer and Schroeder’s Principles of Secure Design [17] The main challenge of implementing and maintaining secure designs in applications is balancing usability and security. Recent technologies and platforms have enabled accessibility and acceptability in secure designs. For companies, there is an increasing number of vendors providing security-as-a-service that offers round-the-clock monitoring, management and response to advanced threats, risks and compliance requirements [18]. These services are becoming more accessible with the adoption of cloud services and microservices; companies could set identity and access policies for assets through a graphical interface. On the other hand, detection of vulnerabilities is frequently issued by the open security community [19], allowing companies to patch their systems in a timely manner. With the increase in the number of advanced automatic attacks, there are also security intelligence services using machine learning and behavioral analytics [20] which enable companies to rapidly detect and respond to threats. For individuals, secure designs are becoming easier to implement and maintain through adopting security applications. Individuals could improve application security by setting multi-authentication mode in essential applications and setting policies to block suspicious incoming emails and attachments. Moving forward, individuals could consider operating on trusted systems and networks when handling private information. An example of this could be using a frequently maintained operating system [22] and routing network traffic using a virtual private network.

在應用程式中實現和維護安全設計的主要挑戰是平衡可用性和安全性。最新的技術和平台保證了安全設 計的可達致性及可接受性。 對於公司而言，有越來越多的供應商提供「安全即服務」，以全天候監視、管理和應對先進的網絡威脅、風險和合規要求[18]。隨著雲服務和微服務的普及，這些服務變得越來越容易獲得，公司可透過圖 像化界面為資產設置身份和訪問政策。另一方面，開放網絡安全社區經常發布漏洞檢測的資訊[19]，從 而使公司能夠及時修補其系統。隨著先進的自動攻擊的冒升，使用機器學習和行為分析的安全情報服務 [20]應運而生，從而幫助公司快速檢測威脅並作出應對。 對於個人而言，採用安全應用程式令安全設計更易於實行和維護。個人可以通過在基本應用程式上設置 多重身份驗證模式並設置策略來阻止可疑的電子郵件和附件，從而提高應用程式的安全性。進一步而 言，個人可以在處理私人資訊時考慮在可信任的系統和網絡上進行操作，例如使用經常進行維護的操作 系統[22]及虛擬專用網絡。

A Battle Cry 戰鬥呼聲 The implementation and maintenance of security features require a change of attitude towards cybersecurity. Technologies and tools that safeguard our assets would not be useful if we do not implement and maintain them. In response to this, there is a surge in development of cybersecurity and public policy in data privacy such as the GDPR [23] and reporting on the repercussions of data breaches. This has provided the public with some optimism in motivating governments and companies to create and maintain more secure systems. As individuals and shareholders, we need to continue our efforts in monitoring both governments and companies and demanding that they protect our data. We could influence government officials and the management of companies to enhance cybersecurity in their information systems to protect our personal identifiable and transaction data. To boost our secure systems, we would need to amplify our efforts in promoting awareness of the importance of cybersecurity and equip the public with the technology and tools required to implement and maintain secured systems. With this uphill battle, we need to collaborate for better data protection in the new cyberspace.

網絡聯繫，迎接網絡新空間 Embrace Connectivity and Prepare for the New Cyberspace 實施和維護安全功能需要我們改變對網絡安全的態 度。如果我們不實施和維護網絡安全技術和工具，那 麼這些可保護網絡資產的技術和工具將無法發揮效 力。 因應這種情況，網絡安全和數據私隱公共政策（例如 GDPR [23]以及對數據洩露影響的報告等）都發生了 急速發展。這使公眾對推動政府和公司創建並維護更 好的安全系統感到樂觀。 作為個人和股東，我們需要繼續努力監視和要求政府 和公司保護我們的數據。我們可以影響政府和公司的 管理層，去加強資訊系統中個人身份和交易數據的網 絡安全。 為了擴大我們共同創建安全系統的努力，我們需要更加努力去加強人們對網絡安全重要性的意識，並使公眾 擁有實施和維護安系統所需的技術和工具。 在這場艱苦的戰鬥中，我們需要攜手合作，以在新的網絡空間更好地保護數據。

References Research Sources: [1] Capture the value in IoT. (2019, September 18). Retrieved from https://www.ericsson.com/en/internet-of-things/audience-page/ capture-the-value-in-iot [2] Arnold, M. (2018, June 6). Ripple and Swift slug it out over cross-border payments. Retrieved from https://www.ft.com/ content/631af8cc-47cc-11e8-8c77-ff51caedcde6 [3] Al Jazeera. (2018, May 24). Hacked: The Bangladesh Bank Heist. Retrieved from https://www.aljazeera.com/ programmes/101east/2018/05/hacked-bangladesh-bank-heist-180523070038069.html [4] Yahoo! data breaches. (2020, March 4). Retrieved from https://www.bbc.com/news/world-us-canada-37447016 [5] WannaCry ransomware attack. (2020, March 6). Retrieved from https://www.theguardian.com/technology/2017/may/12/nhsransomware- cyber-attack-what-is-wanacrypt0r-20/ [6] Newman, L. H. (2018, December 10). Google Exposed Data of 52.5 Million Users and Will Shut Down in April. Retrieved from https://www.wired.com/story/google-plus-bug-52-million-users-data-exposed/ [7] Statt, N. (2018, September 28). Facebook hacker stole login information for 50 million accounts. Retrieved from https://www. theverge.com/2018/9/28/17914524/facebook-bug-50-million-affected-security-token-access-view-as-feature [8] Horton, W. (2019, June 7). Cathay Pacific Faulted For Data Breach, But Hackers’ Objective Unclear. Retrieved from https://www. forbes.com/sites/willhorton1/2019/06/06/cathay-pacific-faulted-for-data-breach-but-hackers-objective-unclear/#2d692d7b7068 [9] Flitter, E., & Weise, K. (2019, July 30). Capital One Data Breach Compromises Data of Over 100 Million. Retrieved from https:// www.nytimes.com/2019/07/29/business/capital-one-data-breach-hacked.html [10] Gatlan, S. (2020, January 31). Winnti Group Infected Hong Kong Universities With Malware. Retrieved from https://www. bleepingcomputer.com/news/security/winnti-group-infected-hong-kong-universities-with-malware/ [11] The Economy of Hacking: How Does a Hacker Make Money? (n.d.). Retrieved from https://www.bulletproof.co.uk/blog/thehackers- economy [12] Morgan, S. (2018, Decemeber 13). 2019 Official Annual Cybercrime Report. Retrieved from https://www.herjavecgroup.com/wpcontent/ uploads/2018/12/CV-HG-2019-Official-Annual-Cybercrime-Report.pdf [13] Flaw in Philips Smart Light Bulbs Exposes Your WiFi Network to Hackers. (2020, February 5). Retrieved from https:// thehackernews.com/2020/02/philips-smart-light-bulb-hacking.html [14] Assaraf, N. (2019, April 9). 5 Safety Concerns with Cloud Data Storage, Answered. Retrieved from https://blog.cloudhq.net/5- safety-concerns-with-cloud-data-storage-answered/ [15] Deepfakes. (2020, March 16). deepfakes/faceswap. Retrieved from https://github.com/deepfakes/faceswap [16] Tittel, E., Chapple, M., & Stewart, J. M. (2003). Cissp: Certified Information Systems Security Professional: Study Guide. Sybex. [17] Saltzer, J. (1994, September 9). Basic Principles of Information Protection. Retrieved from http://web.mit.edu/Saltzer/www/ publications/protection/Basic.html [18] Security SaaS on the Cloud. (n.d.). Retrieved from https://www.ibm.com/security/saas/ [19] National Vulnerability Database. (n.d.). Retrieved from https://nvd.nist.gov/ [20] Microsoft Security Intelligence Report. (n.d.). Retrieved from https://www.microsoft.com/securityinsights/ [22] Ubuntu security notices. (n.d.). Retrieved from https://usn.ubuntu.com/ [23] General Data Protection Regulation (GDPR) Compliance Guidelines. (n.d.). Retrieved from https://gdpr.eu/ Image Credit: [24] Cover banner, from Robynne Hu on Unsplash, Bayfront Avenue, FUTURE WORLD @ ArtScience Museum, Singapore [25] Relations in Cybersecurity from Slide 25, COMP3632, Principles of Cybersecurity, Spring 2020, Prof Tao WANG

Advisors 顧問 Prof. Kai-Lung HUI (Program Director) 許佳龍教授 Prof. James Tin-Yau KWOK (Program Co-Director) 郭天佑教授 Prof. Kani CHEN (Program Co-Director) 陳卡你教授 Dr. Jean Jiying WANG (Undergraduate Program Coordinator) 王繼英博士 All contents and information are subjected to copyright protection. Republication, redistribution or unauthorized use of any content is expressly prohibited without the prior written consent. Risk Management and Business Intelligence Program The Hong Kong University of Science and Technology 2358 8229 rmbi@ust.hk http://www.rmbi.ust.hk hkustrmbi hkust.rmbi

RMBI Newsletter 風險薈訊