Cybersecurity and Privacy
FoundationCyber threats include malware such as viruses, Trojans and ransomware, plus phishing; protection relies on anti-virus software, firewalls, encryption, strong passwords and two-factor authentication. Hong Kong's Personal Data (Privacy) Ordinance lays down data protection principles governing how personal data is collected and used.
- Malware types are told apart by spread and disguise: viruses ride files, worms self-spread, Trojans disguise, spyware steals, ransomware extorts.
- Phishing attacks the mind: inspect domains, beware panic wording, and remember no genuine body asks for passwords or codes.
- Anti-virus detects inside, firewalls guard the doorway; updates patch holes, and offline backups are the last insurance.
文體小知識：科技知識說明文——分析惡意軟件與網絡釣魚等常見威脅，講解加密、強密碼與雙重驗證等防護措施，並說明香港個人資料私隱的保障原則。
§Text Passage
1Every step online carries risk. Malware is software built to damage or steal: a computer virus attaches itself to files and spreads when an infected file is opened; a worm needs no host file, copying itself across networks; a Trojan horse disguises itself as useful software and opens a back door once installed; spyware quietly collects user behaviour and data; ransomware locks files with encryption and demands money for release.
2Phishing is the classic social engineering attack: attackers pose as banks, schools or government bodies, sending email or text messages that lure recipients to click a link and enter passwords and card details on a convincing fake site. Spotting phishing checks three things: whether the link address matches the official domain, whether the message manufactures urgency or fear, and whether it asks for passwords or one-time codes.
3Protection works in layers. Anti-virus software detects and removes malware, and its virus definitions must be updated regularly; a firewall monitors traffic in and out of the network, blocking suspicious connections by rules; operating systems and applications need prompt updates to patch security holes; important files should be backed up regularly to an offline location so recovery is possible even after a ransomware attack.
4Encryption turns plaintext into ciphertext readable only with the right key — the core technology protecting confidentiality: web traffic uses HTTPS, and disks and backups can be encrypted too. Authentication verifies identity: passwords are the commonest method, and a strong password is long, mixes upper- and lower-case letters, digits and symbols, avoids personal data, and is never reused across accounts; two-factor authentication adds a one-time code on top of the password, sharply cutting the risk from leaked passwords.
5Personal data privacy is protected by Hong Kong law. The Personal Data (Privacy) Ordinance lays down six Data Protection Principles, broadly requiring: collection for a lawful purpose by lawful and fair means, with no excessive data; accuracy and no indefinite retention beyond the purpose; use limited to the original purpose; practicable security measures; open and transparent policies; and the data subject's right to access and correct the data.
1Summary 重點摘要
Cyber threats include malware such as viruses, Trojans and ransomware, plus phishing; protection relies on anti-virus software, firewalls, encryption, strong passwords and two-factor authentication. Hong Kong's Personal Data (Privacy) Ordinance lays down data protection principles governing how personal data is collected and used.
2Vocabulary cards Vocabulary
Software designed to damage systems, steal data or extort money, including viruses, worms and Trojans.
Malicious code attached to files, spreading when an infected file is opened and causing damage.
An attack luring users to fake sites through spoofed messages, harvesting passwords, card numbers and other sensitive data.
Security hardware or software monitoring network traffic in and out and blocking suspicious connections by rules.
A tool detecting, blocking and removing malware; its virus definitions need regular updates to meet new threats.
Turning plaintext into ciphertext readable only with the right key, protecting the confidentiality of data.
A password that is long, mixes letter cases, digits and symbols, avoids personal data and is never reused across accounts.
Requiring a second credential, such as a one-time code, beyond the password at login, so leaked passwords alone cannot be abused.
Data identifying a living person directly or indirectly, such as name, phone number, address and identity card number.
Six principles under Hong Kong's Personal Data (Privacy) Ordinance governing collection, retention, use, security, transparency, and access and correction of personal data.
3Step by step Steps
- Step 1: Knowing the malware familyMalware is the umbrella term for destructive programs, and answers must tell the types apart. A computer virus attaches itself to other files, striking and spreading when an infected file is opened; a worm needs no host file, copying itself across networks and draining resources; a Trojan horse disguises itself as useful software and opens a back door after installation; spyware quietly records user behaviour and sends it out; ransomware encrypts the victim's files and demands money for release. For example, the same malicious parcel can be a virus (opened with an attachment), a worm (crawling the network by itself) or a Trojan (dressed as a gift) — the key is how it spreads and disguises.
- Step 2: Phishing and social engineeringPhishing attacks the mind rather than the machine: attackers pose as banks, schools or public bodies, sending email or texts claiming an account will be frozen or a prize is waiting, luring the user to click a link and enter passwords and card details on a fake site indistinguishable from the real one. Three checks help: inspect whether the link address matches the official domain, since fakes tamper with domain names; beware wording that manufactures urgency and fear; remember that legitimate bodies never ask for passwords or one-time codes by message. For example, on receiving a bank text with a link, type the official address yourself to verify instead of clicking the link inside.
- Step 3: How anti-virus and firewall divide the workBoth are basic protections with different duties. Anti-virus software stays inside the device, scanning files and programs to detect known malware and remove it; its virus definitions must be updated regularly, or new malware goes unrecognised. A firewall stands at the network doorway, inspecting traffic by rules, blocking suspicious connections and ports, refusing unauthorised access. For example, the firewall is the building gatekeeper admitting and turning away by list, while anti-virus is the in-house guard patrolling whoever has already entered — used together they cover inside and outside, and omitting either leaves a gap.
- Step 4: The baseline value of updates and backupsUpdates to operating systems and applications often carry security patches: once a software hole is disclosed, attackers rush to exploit it, so prompt updating is like replacing a broken lock; delaying leaves a device exposed to known holes indefinitely. Backups are the minimum insurance: copying important files regularly to an external or offline drive means recovery is possible even after ransomware encryption, disk failure or accidental deletion, with no ransom needed. For example, an organisation whose servers are locked by ransomware can rebuild from last night's offline backup, losing only a day of data.
- Step 5: Encryption and strong passwordsEncryption turns plaintext into ciphertext unreadable without the right key — the last line of confidentiality: web traffic is encrypted with HTTPS, and phone and computer disks can be fully encrypted so a lost device leaks nothing. Passwords are the commonest authentication, and a strong password follows three rules: long, at least twelve characters as a rule; mixed, combining upper- and lower-case letters, digits and symbols; personal-data-free and unique, never built from names, birthdays or phone numbers, and never reused across accounts, so one leak cannot cascade. For example, rewriting a private catchphrase with digits and symbols makes a password long, mixed and memorable.
- Step 6: Two-factor authentication and account securityTwo-factor authentication adds a second credential beyond the password, in common forms such as one-time codes sent by text message or generated by an authenticator application, time-based dynamic codes, and biometrics like fingerprints or face recognition. Both factors must succeed at login, so an attacker holding only the stolen password still cannot enter. In use, remember: a verification code is as good as a password, so any message asking for one is a danger sign; and after enabling two-factor authentication, keep the backup method safe. For example, with two-factor authentication on, a leaked social-media password is useless to the thief without the dynamic code on the phone, and the account survives.
- Step 7: Personal data privacy and the Data Protection PrinciplesPersonal data identifies a living person, and Hong Kong regulates its collection and use through the Personal Data (Privacy) Ordinance, whose core is six Data Protection Principles: collect only for a lawful, directly related purpose by lawful and fair means, without excessive data; keep data accurate and not beyond the purpose's duration; use it only for the original purpose unless consent is given; take practicable security measures; make policies open and transparent; and grant the data subject access and correction rights. For example, a prize draw demanding an identity card number and every contact method invites the question of purpose — the principle of not collecting beyond what is necessary; in daily life, review application permissions regularly and never grant contacts and location casually.
5Worked example Example
Scenario task: a Secondary 5 student's social media account is broken into; the password is the student's own birth date, and the same password is reused across three accounts — social media, email and an online game. Analyse the likely causes of the break-in and design a security plan for the student covering strong passwords and two-factor authentication.
- Identify the weaknesses: a birth date can be worked out from posts and profile details, making it guessable; reusing one password across three accounts means one leak opens every door.
- Set strong-password rules: at least twelve characters mixing upper- and lower-case letters, digits and symbols, free of personal data such as names and birthdays; a different password for each of the three accounts.
- Enable two-factor authentication: switch it on for all three accounts so login requires a one-time dynamic code from an authenticator app in addition to the password, keeping thieves out even if the password leaks.
- Add daily habits: never click links in suspicious messages, never reveal codes to anyone; keep device systems updated, and back up important data offline regularly.
- Answer: The break-in came from a guessable, reused password. The plan: set each account a different password of at least twelve characters mixing letter cases, digits and symbols with no personal data; enable two-factor authentication on every account with an authenticator dynamic code as the second factor; and in daily use avoid suspicious links, never reveal codes, keep systems updated and back up offline regularly. Layered protections reinforce one another and sharply reduce the risk of another break-in.
6Common mistakes Mistakes
7Quick check Quick check
Q1Which is more likely phishing: a text message asking you to click a link to verify bank details, or a statement notice inside the bank's official app?
Q2What is the typical behaviour of ransomware?
Q3How does two-factor authentication reduce the damage of a leaked password?
Q4Under the Data Protection Principles, what does 'use limited to the original purpose' mean?
Q5Which is a strong password: Amy2020 or kR7!vP2qXm94?
8Recap Recap
- Malware types are told apart by spread and disguise: viruses ride files, worms self-spread, Trojans disguise, spyware steals, ransomware extorts.
- Phishing attacks the mind: inspect domains, beware panic wording, and remember no genuine body asks for passwords or codes.
- Anti-virus detects inside, firewalls guard the doorway; updates patch holes, and offline backups are the last insurance.
- Encryption protects confidentiality; strong passwords are long, mixed and never reused; two-factor authentication blunts leaked passwords.
- The six Data Protection Principles of Hong Kong's ordinance: lawful fair collection, accurate proportionate retention, purpose-limited use, practicable security, transparency, access and correction.