New cyber bill requires careful finessing

In today’s world, understanding and addressing the danger and implications of cyberattacks on Canadian companies and government organizations has never been more important. To understand the impact of hacks, the Canadian Centre for Cyber Security conducted a study as part of its 2020 National Cyber Threat Assessment. The study found that cyberthreat actors (both state-sponsored and other) are increasing in number—as well as in technical sophistication—to target critical infrastructure providers and Canadian enterprises to both disrupt systems and operations, and steal information. This study aligned with others that found a sharp increase in cyberattacks over the past several years, such as one report on rising attacks against consumers that we published earlier this year. These findings led the Government of Canada to table new legislation, Bill C-26, An Act Respecting Cyber Security, to proactively address this threat and promote cybersecurity practices amongst four federally regulated critical infrastructure sectors: telecommunications, finance, transport, and energy. The bill has two parts, with the first designed to empower the government to direct what type of equipment telecommunication providers can and cannot use. The second part, The Critical Cyber Systems Protection Act, proposes to establish a baseline of cybersecurity preparedness by obligating designated sectors to take actions to reduce their vulnerability. These actions include maintaining a robust cybersecurity program, reporting cyber incidents to the respective regulator and to the Canadian Center for Cyber Security when they occur, and mitigating supply chain and third-party risks. The bill also has “teeth,” providing regulators with the power to enforce the Act through audits along with penalties for non-compliance that include hefty monetary consequences as well as the possibility of imprisonment for directors or officers. Similar legislation has already been introduced in Europe, which gives some indication of what to expect in Canada once the bill is adopted. For one, it will elevate cybersecurity mindshare and eliminate any remaining pockets where cybersecurity is still an afterthought. It will also generate more transparency by requiring that affected organizations not only report on their current cybersecurity capabilities, but also when cyber incidents occur. As the bill is refined over the coming months, there are many variables that legislators seem likely to expand on when they reconvene. One relates to the type and severity of incidents that would need to be reported. Attacks on organizations happen every day and the materiality of security incidents—in the national cybersecurity context—would need to be carefully assessed and handled, determined to avoid inadvertently distracting all parties involved with irrelevant noise and negating the intended purpose of the act, which is to engage the right parties to address national cyber threats. Organizations affected by the Act will also need to think through how they will handle all the reporting requirements while trying to contain a cybersecurity incident. Adhering to these requirements becomes even more complex when an organization operates across multiple jurisdictions—such as banks and insurance providers—where other contractual and regulatory reporting requirements exist. Something else to watch out for is how cybersecurity programs will be evaluated by the regulators in practice, and what qualitative and quantitative techniques will be employed. Relying on a maturity score and technical metrics will likely no longer be sufficient for organizations to understand their current state or to report on their cybersecurity program’s effectiveness. This is something that, in my view, will have to be defined further as consultations proceed, since there is no single holistic or universally accepted method to evaluate a cybersecurity program. These considerations come at a time where cybersecurity talent is already scarce. There is substantial work involved to meet the proposed level of rigor for cybersecurity oversight and incident management across multiple sectors, and this will challenge government, regulators, and other public target entities to expand their teams and capabilities. This is beyond what legislation can tackle and points to the drive for a broader national cybersecurity strategy. Like the European experience, this legislation seems likely to expand in scope to more industries. The minister of public safety has already indicated that the four sectors included were an initial list and that others could be added; water treatment companies and cloud providers might be obvious additions. At the provincial level, parallel legislation to address the health-care sector is likely. Bill C-26 is long overdue and will drive critical industries to elevate their cybersecurity programs. Over the coming months, the government will define more specifically how cybersecurity programs will be evaluated and additional pragmatic guidance on what incidents should be reported. This guidance will provide organizations with some clarity on what they need to do to be compliant. Until then, and especially in a world where cybersecurity talent is in short supply, there is plenty for organizations to do today to run more cyber-resilient businesses. Yaz Alattia is the managing director of Accenture Security Canada. The Hill Times

New cyber bill requires careful finessing

As the bill is refined over the coming months, there are many variables that legislators could expand on, including the type and severity of incidents that would need to be reported.

Canada’s aging crisis and a call for reform in eldercare

As COP29 wraps up, will Canada finally stop funding fossils this fall?

Addressing the threat of antimicrobial resistance

The wisdom of Homer Simpson and Aaron Sorkin

Climate finance should target resilient food systems

Trump’s ‘America First’ plans may undermine global trade

Canada must partner with allies, private sector to better protect against growing cyber attacks

Recent cyber-attacks show that we need to get on with Bill C-26

Cybersecurity needs faster, seamless public-private collaboration, say cyber experts

Improving Bill C-27, and fighting cyber threats facing Canada

Safeguarding national security and protecting critical infrastructure is an urgent priority

News

Get free news updates

Opinion

Submit a guest opinion article

resources

Advertise

subscribe

get help

Get free news updates

Submit a guest opinion article

New cyber bill requires careful finessing

As the bill is refined over the coming months, there are many variables that legislators could expand on, including the type and severity of incidents that would need to be reported.

Get The Weekend Point of View Newsletter