Cyber resilience is urgently needed for Canada’s critical infrastructure regime

A robust cybersecurity ecosystem is the foundation of a resilient and competitive Canadian digital economy. The COVID-19 pandemic forced many Canadian businesses to accelerate their digital transformation timetable, whether it was enabling remote work for employees, increased e-commerce presence, or contactless, smart supply chains. The number of Canadian businesses using information and communication technologies (ICT) rose from 80 per cent in 2019 to 85 per cent in 2021. The rush to digitize has left some Canadian businesses with new cybersecurity threats that they may not be aware of, let alone prepared to address. In 2021, a total of 18 per cent of Canadian businesses reported they had been affected by cybersecurity incidents, with an unknown number of businesses unaware of attacks they experienced. With more small enterprises embracing networked technologies through a COVID-19 pivot or leveraging Canadian government programs available to recover from the pandemic, like the Canadian Digital Adoption Program (CDAP), more unreported cybersecurity incidents are to be expected as small businesses have limited budgets for detection and prevention technologies. With small businesses comprising 98.1 per cent of employer businesses in Canada, more federal and provincial attention must be paid to small business cybersecurity protection and supportive services, including cybersecurity awareness campaigns and financial incentives. Cyber resilience is an urgent imperative for the Canadian critical infrastructure regime. Critical infrastructure encompasses the utilities, finance, food, transportation, government, ICT, health, safety, and manufacturing sectors. At the onset of the Russian-Ukrainian conflict, the Canadian Centre for Cyber Security recommended critical infrastructure providers shore up detection and protection efforts against Russian state sponsored cyber threats. Although the Russian-Ukrainian conflict has raised the profile of cyberthreats to Canadian critical infrastructure, these threats are not new, and the cyberthreat landscape gets more complex and complicated to manage as critical infrastructure providers deploy new and networked technologies. To emphasize the growth in critical infrastructure technologies, 27 per cent of Canadian manufacturers and 33 per cent of Canadian financial businesses plan to adopt new or additional digital technologies in 2022. Operational Technology (OT) is the operational basis for many critical infrastructure providers. Canadian critical infrastructure providers need to develop OT cybersecurity framework plans that fit their sector from finance to transportation. Federal Bill C-26, currently at second reading, looks to address aspects of the critical infrastructure cybersecurity challenge. Job-ready cybersecurity talent is in chronic short supply in Canada and globally. In 2021, it was estimated that Canada was short 25,000 cybersecurity professionals, with a global deficit of 1.42 million professionals. The cybersecurity talent shortfall is not easily filled by college and university graduates, as businesses are apprehensive to hire inexperienced talent to protect critical business processes and assets. Relevant and evolving Work Integrated Learning (WIL) opportunities must be a core component of post-secondary cybersecurity programs to help overcome the experience gap businesses attribute to graduates. In British Columbia, BCIT and Cisco have created an innovative program to help address the experience gap issue by building and offering students a lab that provides real-world scenario experiences. To ensure a sufficient flow of students into post-secondary cybersecurity-oriented programs, provinces like British Columbia and New Brunswick have included cybersecurity in their high school curricula. To push cybersecurity career awareness and preparation deeper into the Canadian K-12 system, the CyberTitan competition provides Canadian middle-school and secondary-school students with learning opportunities to develop important digital and cybersecurity skills. Big technology companies are turning to previously untapped cybersecurity talent sources by developing programs that support underrepresented populations in the technology industry. In the United States, IBM has teamed with 20 Historically Black Colleges and Universities to develop cybersecurity talent. Microsoft is expanding its cybersecurity skill development program to 23 countries, including Canada, with a focus on opening cybersecurity opportunities for all genders. The Canadian federal and provincial governments need to provide ever-evolving cybersecurity support for Canadian businesses, especially small businesses that do not always have the financial or technical resources to sufficiently address their cybersecurity responsibilities. Clear guidance and support for OT cybersecurity framework plans will provide a base to protect Canada’s critical infrastructure. Canadian governments also need to support innovative talent development programs to fill the cybersecurity talent cap. Rob Davidson is the director of data science at the Information and Communications Technology Council, an independent, non-profit think tank. Davidson has more than 25 years of experience in the high technology sector and has spoken at national and international events on emerging technologies, cybersecurity, AI, and open government. The Hill Times