Canada’s National Cyber Security Strategy: Securing Canada’s Digital Future

Canada’s New Approach to National Cyber Security

In the recent years, all aspects of Canadians’ lives have and continue to transfer online at an accelerated pace. As a result of this technological acceleration that has increasingly interconnected Canada’s critical infrastructure, cyber threat activity has followed at a progressive and sophisticated manner. To address these ever-evolving cyber security risks, the Government of Canada’s new approach to cyber security through the NCSS prioritizes the two following overarching principles:

Whole of Society Engagement: Under the principle, the Government of Canada will deepen partnerships with key stakeholders to comprehensively bolster Canada’s cybersecurity landscape. This includes advancing relations with other levels of government, Indigenous communities, the private sector, academia, and civil society.

Agile Leadership: Under this principle, Canada aims for all efforts undertaken to be agile, collaborative, engaging, holistic, and containing a series of issue-specific action plans with targeted initiatives and outcomes for the coming years. Through this evolving approach, Canada will be at the forefront of cyber security leadership and ensure that its efforts remain relevant and effective for the years to come.

The NCSS’ Three Pillars

Pillar 1: Work With Partners to Protect Canadians and Canadian Businesses from Cyber Threats

With an acknowledgement that collaboration will be key to advancing Canada’s cyber security efforts, the Government of Canada will lead an unprecedented level of public-private partnerships to support the following three cyber objectives:

Objective: Forge Whole-Of-Society Partnerships

To comprehensively establish whole-of-society partnerships, the Government of Canada will engage, collaborate, and coordinate with provinces, territories, and Indigenous communities on cyber security action plans. As part of this whole-of-society shift, Public Safety Canada and the Canadian Centre for Cyber Security will establish the Canadian Cyber Defence Collective (CCDC), which will serve as the national multi-stakeholder engagement body on Canada’s cyber resilience. The CCDC will include direct public-private partnerships on the national-level regarding cyber security challenges, policy priorities, and defence efforts, and will be actively leveraged by the federal government.

To utilize the expertise of academia, the Government of Canada funded the Cybersecurity Attribution Data Centre at the Canadian Institute of Cybersecurity at the University of New Brunswick. Through this partnership, Canada’s long-term cyber posture will be positively advanced through the Centre’s abilities to identify malicious cyber threat activity, application of cyber analytics data, and training of the next generation of specialists.

Objective: Defend and Advocate for Canadian Interests and Values Internationally

The Government of Canada will continue its leading role of engaging with like-minded global partners to champion international laws, norms-based behaviours, and standards in the cyberspace. Under Canada’s vision for this, there will be a promotion of open, free, secure, and reliable Internet. Additionally, this will promote international consideration for the role that sanctions and listing regimes can have upon online threats. As part of this effort to build cyber capacity with other nations, greater cooperation in the Indo-Pacific region will follow.

To support the increased collaboration with international partners, Global Affairs Canada has created a new role, a foreign policy Senior Official for Cyber, Digital, and Emerging Technology. This senior official will coordinate Canada’s international engagements across government and represent Canada internationally.

Objective: Advance National Cyber Awareness and Hygiene

The Government of Canada will strive to make cyber security more accessible to all Canadians. Actions to achieve this will include building on the success of the “Get Cyber Safe” program and Canadian Anti-Fraud Centre, as well as publishing cyber-related materials on pertinent topics, such as artificial intelligence.

Pillar 2: Make Canada a Global Cyber Security Industry Leader

Under this Pillar, the Government of Canada recognizes the growing need for cyber security professionals, and to explore further legislation, regulations, and incentives that will foster the adoption of secure technologies and practices. This will be advanced through the Pillar’s three objectives:

Objective: Make Canada a Trusted Innovator That Prioritizes Cyber Security

Canadian businesses of all sizes must embrace a cultural shift that prioritizes secure-by-design products, and the mindset of being the “first to secure” instead of the “first to market” in effort to bolster the digital ecosystem. Through a multi-step approach, the Government will work with industry to draft a strategy that will facilitate this society-wide shift towards shared cyber responsibility, which will include the consideration of incentivized measures, cyber security certifications, and designating trusted companies with preferred contractor status.

Furthermore, the Government of Canada will explore Internet of Things labelling to be built into products to facilitate an easily identifiable and comparable cyber security protections for Canadians.

Cyber security in the defence sector will also continue to be supported through the Canadian Cyber Security Certification Program. The federal government will consider expanding the program and advance collaboration with the United States to ensure comparability with their respective program, thus easing the burden on Canadian industry when bidding on U.S. defence contracts.

As the final component of the objective, the Government of Canada is fortifying Canada’s private sector privacy regulations. This will include establishing new guidelines and continuously updating directives pertaining to the responsible development and deployment of AI.

Objective: Grow a Foundational Workforce of the Future

The NCSS recognizes that developing and retaining Canada’s cyber talent is critical for both businesses and government. As such, efforts will continue to ensure that Canada’s cyber talent pipeline is present with improved educational opportunities.

Through the Cyber Security Cooperation Program, Public Safety Canada will provide grants and contributions to a range of initiatives aimed at improving Canada’s cyber abilities and global competitiveness. Additional workforce improvement efforts will also continue, such as the Express Entry program for skilled foreign workers.

Objective: Identify and Support Targeted Areas of Research to Meet Canadian Needs

Although the Government of Canada recognizes that Canada’s position in the global market means that it may maintain cyber security products from foreign vendors, there is an underlying need to advance Canada’s domestic industry, cyber resilience, and economic security. This can be achieved through collaborating with other levels of government, academia, and industry to identify and support targeted cyber research.

To follow, a cryptography action plan will be developed to better secure Canadian communications and promote cryptographic research. Additional collaboration with civil society and academia will also be pursued to foster the necessary research pertaining to cyber threats in the criminal and economic context.

Pillar 3: Detect and Disrupt Cyber Threat Actors

Guided by the following Pillar objectives, the Government of Canada aims to improve its ability to deter, detect, identify, disrupt, and defend against a broad range of cyber threats. This will be supported by the following objectives:

Objective: Identify, Deter, and Defend Against Cyber Threats

Cyber threats to Canada’s national and economic security continue to grow every year. To reinforce domestic defence efforts, the Government of Canada will continue to grow its partnerships beyond the federal government and explore means to reduce faced inequalities through targeted investments. Furthermore, the Canadian Radio-Television and Telecommunications Commission intends to implement mandatory rules for blocking botnets by ISPs following consultations.

Objective: Improve Capacity to Combat Cybercrime

As Ransomware is the most prevalent and disruptive form of cybercrime in Canada, a strong response must be advanced to protect Canadians and secure economic growth. To improve its capacity, the Government of Canada is exploring additional means to discourage ransomware payments and impose costs on cybercriminals, such as improving Canada’s approach to cyber insurance policies and working with industry to dissuade ransom payments. Additional efforts to be explored include bolstering Canada’s national security and law enforcement capabilities, improving victim supports, collaborating with international allies against hostile states and organized crime groups, and releasing a new cybercrime and fraud reporting system.

Objective: Make Critical Systems More Resilient

As Canada’s critical infrastructure is owned and managed by a variety of organizations, the Government of Canada recognizes the importance of collaboration, including with private industry, to ensure that information, operational technology, industrial control systems, and software supply chains are secure. While Canada’s existing critical infrastructure protection initiatives will continue, in the future, the CCDC will serve as an important forum for critical infrastructure discussions across sectors. In addition, the Canadian Centre for Cyber Security is furthering critical infrastructure protection work and will strengthen critical non-government services, such as banking and telecommunications.

In Conclusion

The NCSS is intended to solidify, amplify, and advance Canada’s commitment to an agile whole-of-society approach to cyber security. With the commitment of advancing ongoing discussions with stakeholders to help design and implement cyber initiatives, there presents ample opportunity to engage with the federal government on ensuring that Canada’s cyberspace is safe, open, secure, stable, and accessible to all Canadians.