QUARTERLY MAGAZINE SEPTEMBER 2017 THE CYBERSECURITY ISSUE Experts point to key gaps in knowledge CONTENTS SEPTEMBER 2017 | CYBERSECURITY EDITION Preventing the next billion-dollar cybersecurity breach 5 As Canada prepares for cyber reset, experts Liberals look point to key gaps in ready for small business tax knowledge 1 changes fight 8 If Scheer wants to Canada’s stay leader, he has looming to knock Trudeau cannabis down to a minority: supply Northern Strategists 10 crunch 12 homecoming 15 CONTENTS What does it An insider’s mean to call look at Pierre Reaching yourself a Trudeau’s tough for the next conservative times with Canadarm 24 these days? 25 Alberta 28 War of words: O Canada lyrics 30 A job in bloom 32 AS CANADA PREPARES FOR CYBER RESET, EXPERTS POINT TO KEY GAPS IN KNOWLEDGE AP Photo/Mark J. Terrill BY AMANDA CONNOLLY “We believe the U.S. government and private sector The words may be aimed at condemnation of the American collectively have the tremendous cyber capabilities status quo, but they could just as easily reflect the challenges facing and resources needed to defend critical private Canada today. systems from aggressive cyber attacks—provided While experts have been sounding the alarm over the need for they are properly organized, harnessed, and stronger and more collaborative cyber infrastructure for years, focused. Today, we’re falling short.” the last 12 months have brought malicious attacks to the forefront of the public consciousness. ast month, the U.S. Where it stands out is in tone, in a president’s National willingness to condemn the status Wikileaks released the CIA’s Infrastructure Advisory quo of just studying cybersecurity treasure trove of hacking how-tos Council (NIAC) issued a and wave a red flag urging policy in March. Shadow Brokers released Lfirecracker report assessing what makers to actually do something to similar data on the NSA in April. can and should be done to prepare start fixing it — before it is too late. In May, hackers broke into the emails of now-French president for a cyberattack on the scale of “There is a narrow and fleeting the September 11, 2001, terrorist Emmanuel Macron two days window of opportunity before a before the election and dumped the attacks that killed more than 3,000 watershed, 9/11-level cyberattack people. contents online. That same month, to organize effectively and the WannaCry attack walloped the What it found was nothing new: take bold action. We call on the globe and crippled National Health many of the key challenges in administration to use this moment Service facilities in the United cyberspace are well-documented. of foresight to take bold, decisive Kingdom. Experts know, more often than they actions,” the council wrote. do not, where the holes are. They And that doesn’t even include “The time to act is now. As a the hacking cluster$&@ during even know what should be done nation, we need to move past to start filling them, though most the 2016 American presidential simply studying our cybersecurity campaign. acknowledge their ideas are by no challenges and begin taking means definitive. They are starting meaningful steps to improve our “We’re generally underprepared,” points in the race to close the gaps. cybersecurity to prevent a major said Stephanie Carvin, assistant The report lays out exactly that. debilitating cyberattack.” professor of international relations IPOLITICS MAGAZINE SEPTEMBER 2017 1 AS CANADA PREPARES FOR CYBER RESET, EXPERTS POINT TO KEY GAPS IN KNOWLEDGE at Carleton University and a network — to volunteer that will be affected in the sense that specialist in cybersecurity. “The information? if it goes down, gas stations will threat is actually becoming more Kabilan says the reluctance go down, trucks will not arrive at and more sophisticated. We saw often comes from a number of hospitals, the patient will not have that this year.” factors: fear of how stakeholders the medicines,” said Ali Ghorbani, In Canada, large-scale malicious might react, concern about a loss the Canada Research Chair in attacks have been relatively of confidence in their services Cybersecurity at the University rare. However, data indicates and a lack of trust about what of New Brunswick. “You see that that Canadian companies are will happen to the information cascade is enormous in terms of increasingly finding themselves and their brand if they do come effects deep down into the society.” targeted. forward. With the vast majority of Canadian According to the 2017 Cybersecurity “Part of it is who do you trust in this critical infrastructure held in private Readiness Study of Canadian space. What is going to happen to hands, the question facing the Organizations by security firm information?” he said. “It is very government as it works to craft a Scalar Decisions, the number of difficult to get people around to this new cybersecurity strategy is what organizations reporting a breach idea that it is in all of our benefit, role it can — or should — play in that resulted in the loss or exposure and that’s why it’s actually good fostering a stronger cyber landscape. of sensitive information has that we do have organizations like The former government’s Action increased 46 per cent since 2014. CCTX.” Plan for Critical Infrastructure Of the 658 IT and IT Canadian CCTX, or the Canadian Cyber Threat expires at the end of 2017. The last security professionals surveyed Exchange, is an independent, cybersecurity strategy came out in for the study, 79 per cent said their not-for-profit organization that 2010 with its associated action plan anti-virus or anti-intrusion systems launched in December 2016. It aims expiring in 2015. had failed to prevent the attack. to act as a sort of clearing house Public Safety Minister Ralph Only 34 per cent said they believe where companies can disclose Goodale launched cybersecurity their organizations are winning the details of attacks and trust the consultations last summer as part of war against hackers, down from 41 information will be anonymized a two-pronged outreach effort aimed per cent in 2014. before being analyzed and shared. at reshaping Canadian national Despite that, experts say one of the The goal is to begin filling in the security policy — the other being biggest challenges is getting those gaps and help paint a clearer consultations on national security who are hacked to share their picture of the threats facing more broadly. data with others — and that leaves Canadian cyberspace and critical While the results of the consultations critical infrastructure vulnerable. infrastructure right now. culminated in the announcement of “If we don’t know what someone Those tend to revolve around three Bill C-59, which will both overhaul else knows and how they chose to core areas of vulnerability: to and build from scratch many of protect themselves, we’re creating a attacks, to espionage and to crime. the core foundations of Canadian vulnerability where we don’t have national security, experts are As it stands, the systems most often still watching and waiting for the to have one,” said Satyamoorthy named as potentially catastrophic Kabilan, director of national government to announce a new targets are Canadian power grids strategy for tackling cybersecurity. security and strategic foresight at and health care systems, along with the Conference Board of Canada. the financial sector. Some have speculated it could be out by this spring, but the government Under Canadian law, companies There are tie-ins between those, are required to disclose breaches of is not confirming any timeline for its however, and any attack on release. their systems when an individual’s something like a power grid would personal information and privacy is have devastating consequences “Work on a renewed cyber strategy compromised. stretching to everything from is on-going,” said Scott Bardsley, That data then goes to the privacy how people can pay for goods and press secretary for Goodale. commissioner, but if there is no services with electronic payment Experts say they are watching indication that consumer privacy systems, whether emergency carefully and hoping that strategy has been breached, there is no duty service vehicles can refuel at gas will craft a plan that finds a balance to disclose in the first place. stations, to whether doctors can between what the private sector The question then becomes, how access the records of a patient in is best suited to do and what the do you get companies — especially need of urgent surgery. government can do to shape and those whose holdings make up part “When something goes wrong, encourage overall industry or of Canada’s critical infrastructure almost every other infrastructure market conditions. 2 IPOLITICS MAGAZINE SEPTEMBER 2017 AS CANADA PREPARES FOR CYBER RESET, EXPERTS POINT TO KEY GAPS IN KNOWLEDGE One of the challenges remains insurance as a way to encourage to encourage better cyber security. the rapid-fire evolution of cyber companies and individuals to But at the same time, the risks threats, and the difficulties that up their game and meet certain and the levels that are set are in a means for efforts to set clear minimum security standards. rather vague environment where standards for best behaviour. Carvin and Kabilan both agree the we don’t quite know the true “What’s interesting is that industry legislative crawl of government risks.” would love for the government to makes it ill-suited to actually set Carvin noted similar concerns, say yes, tell us what to do. And I those standards. And while cyber but said she is optimistic the think Public Safety Canada, which insurance might be a viable option government will take a sound is in charge of putting this out, it also brings with it a conundrum: approach to revamping Canadian is like well, that changes,” said how to you assess risk without cybersecurity — whenever the Carvin.