保護信息安全指引

Hot Topics

• How to Continue Your Work Securely during COVID-19 Pandemic
• Phishing Email / Web Fraud Alert

Actions for Vulnerabilities

• Google Chrome Vulnerability (CVE-2022-0609)

Top important good practices for general users:

• Stay Alert and Use Encryption to Protect Confidential Data
• Keep your Data out of Hackers’ Reach!
• Security Tips while Using Smart Phones and Tablets
• Best Practices on Using Cloud Storage Services

Good practices for using electronic devices:

• Security Tips while Using Wi-Fi Network
• Security Tips while using Smart Phones and Tablets
• Guidelines to Secure USB Devices
• Guidelines for Securely Removing Data & Disposing Storage Device
• Guidelines for Data Protection
• Guidelines for Securely Configuring your Computers (Home and Office)
• Guidelines for Securely Managing Mobile / Removable Devices
• Good Practices in Using Internet

Good practices in daily life:

• Beware of Ransomware Variants
• Security Guidelines for Using CU Link Card
• Guidelines to Safeguard Your Password
• Guideline for using 2-Factor Authentication – Google Authenticator
• Guideline of Creating An Online Form
• Be Alert to the Email Attachment You Received
• Computer Security Tips While Traveling Abroad
• Best Practices on using Cloud Storage Services
• Best Practices on Sending Bulk Emails

Step-by-step guidelines for general users:

• Guidelines for Configuring Kaspersky Antivirus on Client
• Procedure to Turn Off Attachment Preview in MS Outlook
• Step-by-step procedures for configuring remote working environment of office computer
• Step-by-step procedures for encrypting data on USB device by using “BitLocker-to-Go”
• Step-by-step procedures for securely erasing data by using “DBAN”
• Step-by-step procedures for setting, opening, and removing a password on MS Office 2010 documents
• Step-by-step procedures for setting, opening, and removing a password on Adobe PDF files
• Step-by-step procedures for setting a password, and opening a password-protected Winzip files

External References:

• [HKCERT] Cyber Security Animation Videos: “Hack me if you can“ ^[new]

Joint University Computer Centre (JUCC) Newsletters*:

• Physical Security
• Cryptography
• Information Right Management
• Fraud Prevention from the Internet
• Wireless Security
• Protection of Personal Computer
• Phishing Scam
• Password Management
• Cloud Computing
• Social Media
• Mobile Security

*[Copyright Statement]:

All the above newsletters, unless otherwise stated, are the property of the Joint Universities Computer Centre (“JUCC”). Copyright and other intellectual property laws protect these materials. Reproduction or retransmission of the materials, in whole or in part, in any manner, without the prior written consent of the copyright holder, is a violation of copyright law.

A single copy of the materials available through this document may be made, solely for personal, noncommercial use. Individuals must preserve any copyright or other notices contained in or associated with them. Users may not distribute such copies to others, whether or not in electronic form, whether or not for a charge or other consideration, without prior written consent of the copyright holder of the materials. Contact information for requests for permission to reproduce or distribute materials available through this document is: copyright@jucc.edu.hk, Joint Universities Computer Centre Limited (JUCC).

Actions for Vulnerabilities

• • Apache Log4j 2 Vulnerabilities (CVE-2021-44228, CVE-2021-45046 & CVE-2021-45105) ^{[ new ]}
  • PAN-OS Vulnerabilities
  • Apache HTTP Server Vulnerabilities
  • Microsoft MSHTML Remote Code Execution Vulnerability (CVE-2021-40444)
  • Windows Elevation of Privilege Vulnerability (CVE-2021-36934)
  • Remote code execution (“PrintNightmare”) vulnerabilities in Microsoft Windows
  • F5 Vulnerabilities in BIG-IP and BIG-IQ products

Actions for Preventing Ransomware Variants

• Petya
• WannaCry / DoublePulsar: exploited by Windows vulnerability MS17-010 – SMBv1 vulnerability
  • Indicators of Compromise (IOC) Associated

Guidelines to Make Your Systems More Secure

• Security Baseline for Windows 10 and 11 Client ^{[ new ]}
• Security Baseline for Windows Server 2019 ^{[ new ]}
• Guidelines on Firewall to mitigate DDoS attack
• Remote Work Environment for Office Computers
• Guidelines on Setup of SFTP
• Security Baseline for Windows Server 2016 and 2012R2
• Guidelines for Securing Domain Controllers
• Guidelines for Configuring Kaspersky Antivirus on Server
• Guidelines on Applying, Using and Managing of Server Certificate
• Guidelines for Server Protection and Security Hardening
• Guidelines for Performing a System Health Check
• Guidelines for using 2-Factor Authentication – Google Authenticator
• Guidelines for Printer Protection and Security Hardening
• Red Hat Enterprise Linux 5

Good Practices for Technical Professional

• Good Practices for Computing Assets Inventory Record Keeping
• Good Practices for Change Records Keeping
• Good Practices for Network Firewall System
• Good Practices of Business Continuity Management
• Good Practices of Audit Logging
• Good Practices of Managing Accounts and Passwords
• Good Practices of Session Timeout for Web Application
• Good Practices of Cisco Switch
• LAN Administrators Resources Page
• Security policy and guidelines for acquisition of selected computer equipments and their maintenance plan
• Remote working policy and guidelines

Joint University Computer Centre (JUCC) Newsletters*:

• Man-in-the-Middle Attack
• Database Security
• Data Protection / Data Centric Security
• Network Forensics
• IP Traceback
• Internet Of Things
• Wireless Security
• Secure Application Development
• Security Risk Assessment
• Security Management and Operations
• Migrating to Cloud
• Advanced Persistent Threat
• Mobile Security – Bring Your Own Device (BYOD)

*[Copyright Statement]:

All the above newsletters, unless otherwise stated, are the property of the Joint Universities Computer Centre (“JUCC”). Copyright and other intellectual property laws protect these materials. Reproduction or retransmission of the materials, in whole or in part, in any manner, without the prior written consent of the copyright holder, is a violation of copyright law.

A single copy of the materials available through this document may be made, solely for personal, noncommercial use. Individuals must preserve any copyright or other notices contained in or associated with them. Users may not distribute such copies to others, whether or not in electronic form, whether or not for a charge or other consideration, without prior written consent of the copyright holder of the materials. Contact information for requests for permission to reproduce or distribute materials available through this document is: copyright@jucc.edu.hk, Joint Universities Computer Centre Limited (JUCC).