On 25 November 2022, The Hong Kong Monetary Authority (HKMA) issued an additional guidance to authorised institutions (AIs) on protection against distributed denial-of-service (DDoS) attacks. In consideration of the growing incidence and sophistication of DDoS attacks, the HKMA provides more detailed guidance to complement the relevant requirements stated in “TM-E-1 Risk Management of E-banking” and “TM-G-1 General Principles for Technology Risk Management” Supervisory Policy Manual (SPM).
The HKMA developed the additional guidance based on the findings from the thematic reviews completed to assess the effectiveness of the anti-DDoS protective measures maintained by AIs. The additional guidance is grouped and summarised into four key principles:
