Review by Hong Kong police reveals how critical infrastructure operators are vulnerable to online attacks.