André Boucher

All

right, so who is CSE? Now, surprisingly to me, only 4% Canadians in the survey knew what CSE is. So just show of hand, who in this room knows about the Communication Security Establishment already?

And

here's the 4%, right here, right now. Fantastic. So I will zoom through those parts of the remarks, because you know that already. For the three or four of you who don't know what the CSE is, I'll mention it very briefly. So the Communication Security Establishment

is

the National Cybersecurity and Foreign Signals Intelligence Agency.

We

play an integral role in helping to protect Canada, Canadians against cyber threats, terrorism, foreign espionage, attacks on our democracy, and our way of life. Told you I got a cool job.

We

work with the Canadian Armed Forces in overseas military operations, like Afghanistan, Iraq, Mali, recently. CSE also is the lead technical and operational cybersecurity agency for the government of Canada.

Maybe

you knew that.

As

of 1 October, we are now the home of the Canadian Center for Cybersecurity, my new job. And I am proud to say today is the 1st of November, and we've survived month number one. And that's fantastic.

I

wasn't bragging so much a month ago, I'll tell you that. So the intent here is we're supposed to be and become the cornerstone for the federal government in cybersecurity. CSE is home to some smart, and I mean really, really smart people.

We

have top shelf code makers,

we

have top shelf code breakers, we have mathematicians, computer scientists, linguists, analysts, and a gigantic support team.

And

of course, some of Canada's best cybersecurity experts.

Our

expertise is rooted in over 70 years of proud history,

from

the complex Cold World War II environment, through the Cold War, through 9-11, all the way to the complex environment that we live in today, with multiple diverse threats that we face.

The

men and women of CSE were there along the way. We protect Canada's most sensitive information and infrastructures in many ways,

but

we don't do it alone. According to a 2017 report by the Canadian Chamber of Commerce, the Canadian economy loses more than $3 billion each year to cybercrime. And if I'm not mistaken, I read a report early this week from Stats Canada, that number is now $4 billion, estimated each year.

This

is the reality we face, and the cost of cybercrime worldwide is expected to hit,

hold

your hat, $6 trillion annually by 2021.

While

CSE works to protect Canada against a host of foreign threats, the world needs to counter cybercriminals by leveraging law enforcement. Which is why, to do this,

we

will collaborate with the RCMP's Cybercrime Coordination Unit,

also

announced in the National Cybersecurity Strategy.

I

think I'm supposed to use that at some point.

There

we go.

My

apologies, but since you all knew this already, let's go to the next one.

To

help galvanize Canada's national cybersecurity posture, the government launched an updated National Cybersecurity Strategy in June of this year.

Informed

by over 2,000 submissions from folks like you and from corporations, the strategy addresses the gaps and areas for improvement in Canada's current cybersecurity climate.

The

end result will be better defense against cyber threats, greater security, prosperity for Canadians. Of course, it will be.

Three

main themes. Security and resilience, innovation, research, skill, talent,

and

leadership and collaboration.

So

let me start and walk through that.

Building

secure and resilient Canadian systems is really the first step to defense against cyber threats. But what type of threats are we facing? Well, you in this room know this as much as I do. Today's threats are coming at us more often from more places and for more reasons. Threat actors range from sophisticated foreign states to criminals and even unskilled but highly motivated individual hackers.

Some

are looking for personal information. Others want intellectual property or research.

Others

are simply in it to make some bucks, make some money. And as you heard, there's lots of money to be made.

Still

others want to manipulate, confuse, misinform, and divide.

I

can share a couple of real-world examples that you all know already today. Ransomware has become increasingly popular among threat actors. Why? Because it makes money. It generates income. It's a business. You can go online on the dark web. Oh, I'm slipping again. It's in the script. You can go online on the dark web. You can buy cyber enablers for bad things, right? It is a market.

This

was illustrated by the global WannaCry attack back in May 2017. WannaCry affected over 200,000 victims in 150 countries. An estimated global $4 billion in lost productivity. WannaCry attack used worms, made it to self-replicate, and moved pretty fast across.

May

2018, cybercriminals contacted two Canadian banks and claimed to have accessed the personal information of tens of thousands of clients. The cybercriminals threatened to release the information unless the banks paid them $1 million

in

ransom.

We

had universities in Canada that were

taken

for ransom. We had private institutions taken for ransom.

We

had government entities taken for ransom.

This

is growing, and this is a big business place.

These

are more than just attacks on our infrastructures. They are more than just attacks on our company's net worth.

It's

about attacks on employees, on reputation. It's about attacks on our economy and security, our fundamental freedoms.

And I

think, most importantly, it's about attacks on our trust and confidence.

The

good news is it can be defended against.

The

impact can be contained,

and

we can do this together. Now, how can Canadian system owners begin to keep their network secure and be resilient against cyber threats like these?

This

is where I get to brag a little. I'm going to brag throughout the presentation, of course.

The

Canadian Center for Cybersecurity publishes advice and guidance to help them do just that. What you have behind me is one example amongst many of those advice and guidance. It's not just advice for government. It used to be.

But

with the creation of a cyber center, we want to make that available for Canada and Canadians.

It's

for any network owner. One of the most frequently accessed pieces of advice on our website is this, the top 10 IT security actions. 10 simple steps to a more secure and resilient network.

And

some folks in the room will confirm to you that what I've tasked my team to do is make it simple. Find the things that get us the most security for the least effort, the easiest to understand.

Find

things that you can do at scale that help Canada and Canadians.

In

fact,

back

to this one, in many cases, doing just the top four actions can reduce your threat surface by as much as 80%.

As

I manage the cybersecurity partnership portfolio for the last three years,

I

met a lot of private sector industries and government representatives. And let me tell you, a lot of people need help.

They

want to do the right things. Often they just don't know what to do.

I

became best friends with many of them because I was willing to go and sit down with the board of directors and the presidents

and

present the value proposition

of what

you protect when you do something and what you put at stake when you don't protect yourselves. Most, I say most, cyber adversaries are not that sophisticated.

The

goal is to make it more difficult, more expensive for them to succeed.

If

you can check them even a bit,

they're

likely to move on easier targets.

It's

the old bear analogy. We're all running as a pack. You don't want to be the slowest runner.

And

God forbid, you don't want to cover yourself in honey.

So

just keep running. IT security basics are just that, basics. They're not sexy.

They

may make

you

less likely to become a victim. And in a world where cyber risk equates business risk and where cyber attack often means stolen assets, recovery costs, penalties, loss of confidence and productivity,

why

not invest in straightforward, achievable approaches, the basic things I talked about earlier?

One

of those things is moving to cloud. It's an opportunity to step up our security,

but

there could also be some barriers to cloud adoption. Business owners need to understand what sort of risk or vulnerabilities their organization may face.

and

which risks they are comfortable accepting.

The

Cyber Center works in collaboration with Treasury Board already

and

Public Service Procurement Canada to help reduce those barriers by developing security requirements for contracting, making cloud available for government agencies.

The

Cyber Center's advice regarding that protection,

I think

there's a summary there and some key bullets, includes some of this kind of advice. Making sure users are using proper identification and authentication. Making sure the cloud service providers and administrators are properly cleared to manage your data. Making sure the business owners has the opportunity to inspect the physical security of data centers to make up the cloud.

Not

all clouds are created equal.

Make

sure the processing of offshore data is properly protected. Make sure the data that you've identified goes to where it should go and that you're comfortable with

where

it's going.

Make

sure the departments that follow an IT security risk management framework process.

Now,

this is the advice that we put together for government and government procurement. So the next challenge, Jeff,

is

to make that available

to

everybody and everyone in this room. Jeff,

you're

dozing up there, buddy. Keeping an eye on you.

The

second pillar of cybersecurity strategy is about innovation. Innovation is key to being effective in cybersecurity. And in turn, cybersecurity drives innovation and economic activity in Canada. Making money is a good thing. It pays more taxes. It's a good thing. Having a thriving economy is a good thing. Innovation is therefore a good thing.

With

a global cybersecurity industry forecast to grow by 66% in the next couple of years, thousands of additional jobs could be created for Canadians.

That's

both great news and bad news. Thousands of new jobs means that education and research institutions are gearing up to train and equip the next generation of cyber experts. It also means we will all be competing for this new environment, for this new cyber expertise and these folks. And if you'll forgive me about people,

I'm

going to boast a little bit about CSC.

Our

mission has required us to innovate for more than seven decades and to respond to changing government requirements in a very dynamic technical environment.

This

is possibly our greatest strength and sets us apart from many others

in

government with 84% of CSC employees feeling that they are strongly encouraged to be innovative

in

their day-to-day work. And I challenge you to ask the folks in the room today if that's true or not. That's 17% higher than the average government response.

The

way our teams are set up, the way our building is designed, the way our computing platforms are configured, all fosters innovation.

Well,

of course, we have red lines. Our employees operate within the law.

They

must demonstrate integrity and value diversity.

But

we ask them to think

at

managing audacity,

not

managing risk.

And

we expect them to fail on the road to success.

They

need to take smart chances and solve tough problems. Diversity also helps drive innovation.

And

CSC is a very diverse in culture, skills, and gender.

That

brings us fresh perspectives, creative ideas, interesting ways of looking at problems.

In

fact, CSC has been named one of Canada's top employers for young people in part because of our diversity, particularly in gender. Almost 40%,

40

% of our employees are women.

On

the surface, that may not look like

a

very impressive number,

but you

might not know that the same metric in Silicon Valley is 30%.

So

that's 10% more than Silicon Valley. CSC has a higher percentage of women working in technical roles than Google, Facebook, or Twitter.

But

we know there's more that needs to be done.

It's

fine to be innovative, but if we don't find ways to share the fruits of our innovation, we're not effective. Because much of what CSC does,

has

been doing for 70 years, is classified.

We

have struggled to share our technical expertise and innovation outside of our top secret walls.

We're

improving, though. And again, ask the folks in the room. CSC was proud to publicly release one of our innovative cybersecurity tools, Assemblyline, behind me, developed and built in-house. Assemblyline is a malware tool that automates a detection and analysis of malicious files as they hit a network or system.

That

is a project,

a

proof of concept

that

we can move our tools

from

top secret, highly classified, to unclassified,

and

shift to co-development and co-design. Assemblyline allows system owners to better protect their data from theft and compromise. It allows cybersecurity community to jointly develop this open source software. Cyber experts from academia and the private sector can customize it, improve it, for the benefit of the entire community, give back.

And

I can tell you that it's been downloaded thousands of times in dozens of countries, including Russia and China.

It

is now used by a Norwegian bank, representing about a quarter of that country's clients.

It's

used by Nalcor Energy, large provincial corporate equated in Newfoundland, Labrador,

that

manages the province's energy resources. Even Target, the second largest department store retailer, acknowledged using Assemblyline. And the Cyber Center will continue to work with our critical infrastructure partners to integrate Assemblyline,

and

we encourage our partners to provide feedback on the quality and relevance of the tools.

The

challenge I gave the team is, take this, go open source, and learn how to do open source.

Take

the feedback, be humble,

get

the community engaged.

If

all of us in this room are co-developing and co-designing, we stand a better chance of winning this battle. Assemblyline is one of

many

examples that by working together, we are stronger and more resilient.

It

demonstrates that cybersecurity really is a team sport.

That's

the third pillar of the cyber strategy, leadership

and

collaboration.

Here

we are.

On

1 October,

that's

where the Canadian Center for Cybersecurity really comes into play. Cybersecurity experts from the Canadian Cyber Incident Response Center, Shared Services Canada, that's SOC from Shared Services Canada, and the IT security branch of CSE.

Those

three organizations were removed from their parent organizations and brought together as the Canadian Center for Cybersecurity under CSE.

The

Cyber Center modernizes the government of Canada's approach to cybersecurity into a unique, innovative, forward-looking, open organization.

The

mission is to help reduce the cyber risk faced by Canada and Canadians in our digital world. Simply put, it will be the front door for cybersecurity at the federal level, a front door for government, but also for industry and academia. And if I can go off script for a second,

what

I've used as an analogy for others before, it's a lighthouse.

It's

a lighthouse with three floors.

My

first floor is my innovation and collaboration floor.

You

can walk in. There's no security guards that are going to pat you down and take all your electronics away. Quite the opposite.

They

welcome you into a room for innovation.

You're

private sector, you want to bring in some new tools, some great idea. You're from

the

local university or a foreign university and you have a project that you want to demonstrate.

You

come into our place. You actually show off. You bring your clients from this town. You show them the tool.

Now,

we'll put some bars for coming through the door. It has to be new. It has to address new problems. You have to bend together with others. There has to be a benefit for the community.

But

we have an open door policy on that first floor.

On

my second floor, I'm going to integrate operations and coordination.

So

as a national center, now what I want to connect is not just the federal government,

but

all levels of government and the critical infrastructure sector. Systems of importance to the government.

And

I'm making that a little more generic because really, there are things that change over time. And a good example of that is next year's election.

If

we're having elections coming up, of course, that's a critical infrastructure for Canada.

If

a few years later, there's the Olympics, of course, that's a critical infrastructure for Canada. That's what that second floor is about. My third floor might be a bit small, but it's a very important floor. And that's where I stay connected with communication security establishment.

And

the notes will talk about this in a second,

but

I don't think we'd be as successful at this game without our foreign intelligence awareness and knowledge. But I'll come back to that.

So

I do have to go back to the script at some point.

So

what will the cyber center do? It will provide advice, guidance, to help others bake security into system design. It will partner with vendors, system operators, telecommunications service providers, academia,

to

innovate on some of Canada's toughest cyber problems. It will certify advanced commercial and government cryptographic equipment and ensure that good crypt is built properly. It will defend the government of Canada's networks against a wide range of malicious activity. And most importantly, it will share what we learn with the private sector to help them defend themselves against threats.

It's

a hub for our community.

But

I would be remiss if I didn't acknowledge that part of the cyber center's unique advantage is CSE's other lines of business, foreign signals intelligence mission.

Now,

you might not know this if you're the four people in the room that didn't know about CSE, but we covertly monitor communications and signals of foreign targets, allowing us to detect and better understand foreign-based threats as they develop.

We

have an eye on the world.

We

see what bad looks like.

We

see it move around. We understand how it operates.

We

see it morph. We see it change. That's the foreign signals intelligence angle. That, in the middle of the circle,

is

the knowledge and expertise that brings CSE's effectiveness together.

And

there's no shortage of those threats facing the government of Canada. Interesting statistics.

Every

day, hundreds of millions of malicious activities directed at the government of Canada networks, including up to 1 billion, 1 billion, Ricky attempts for vulnerabilities. Every day, 25 million direct attempts to install malicious software on our networks.

Every

day, over 90,000 malicious attempts to get into our databases.

Every

single day.

It's

a busy world out there,

and

it's not getting quieter.

We

know that the Cyber Center can't do it alone.

We

ascribe to the idea of cybersecurity through collaboration.

That's

why we're building partnerships with academia and the private sector.

A

recent example of collaboration in our recent project between the Cyber Center,

the

Canadian Institute for Cyber Security at the University of New Brunswick,

and

Amazon Web Services.

In

working to test cyber defense technologies, we found that there was a lack of high-quality, publicly-available security data sets.

To

address this issue, we reached out to our partners, joined up with UNB. UNB indicated they might be interested in this problem.

We

needed to get some compute. We found a friend, AWS.

We

got all of us together

and

generated

a

data set that represents,

I

think it's

10

departments, 500 employees, 13 days of, or 10 days of hacking on 13 different scenarios.

That

data set is now available on AWS.

You

can,

if

you're a cybersecurity researcher,

and

you want, or you have a tool and you want to test it out, you can go on AWS,

access

this data set, and test your tools and demonstrate your theories and prove yourself to be worthy

to

go into the Innovation Center.

The

challenge of getting the right information to do research and innovation is one that's,

that

was probably the most dire need in the last two years.

So

that's why we picked this project to go first.

But

in fact, remember my first floor.

If

you have a bright,

complicated

problem,

don't

just bring solutions. Bring problems as well. Problem books are really important, part of the solution set.

What

you do is you come to the Center and you say, yeah, I have this problem.

Am

I the only one who has this problem?

You

find friends have a common problem.

And

then we band together to look for solutions. And we make these solutions available to the community.

The

Cyber Center also works with associations such as the cyber threat, the Canadian Cyber Threat Exchange, CCTX. CCTX, if you don't know, is a collective of Canada's largest banks, telcos, power, and other major organizations, collaborating to share cyber threat information across sectors.

We

don't stop there. We also work with international organizations like the Global Cyber Alliance,

the

various U.S. ISACs, FSISACs, and other, independent electricity system operators, and others.

The

key, once again, is creating these communities and getting people with different perspectives together.

We

don't claim to know it all, but we know that the power of the community knows it all. And if we can just harness and work it together, we can find better solutions.

So

we want to work with you.

We

have provided specific information to help you defend your networks in the past. We tip you when we see something that you need to address. We provide advice on specific cyber threats related to your sector when we see it.

These

are everyday actions

in

our partnerships and relationships. But these are early days as well for our relationship.

We

know we have a lot to offer based on our unique aperture and knowledge, and we need you to come to the door and ask us to help you.

We

are committed to raising public awareness about how we see cyber threat manifesting in Canada. In fact, we're preparing to release our first national cyber threat report in a few days.

The

report will discuss strategic cyber threats that face Canadian businesses, critical infrastructures, and public institutions.

And

without giving too much of it away here, it will focus heavily, of course, on cyber crime, the biggest threat facing all of us today.

The

report will be informed by CSE's cyber defense data, the expertise of our people, our assessment of the overall cyber threat landscape. And let me pause there for a second.

Our

knowledge is based on foreign signals, intelligence, awareness,

and

what we see of government networks in Canada.

That's

not enough.

I

see 250,000 clients and what they do every day. That's the federal government.

But

collectively, there are 37 million citizens in this country that we need to protect. So again, by joining together, by banding together, we can do much more.

Prominent

among our concerns are threats to Canada's democratic process

that

bears mentioning as we're about to enter an election year.

And

we've all seen and heard about cyber threats to elections and the democratic processes in other countries.

In

fact, last year, we published a first-of-its-kind public report on cyber threats to democratic processes and institutions. We'll be updating that report in early 2019. We're also delivering regular threat briefings to government officials, cybersecurity advice and guidance to political parties, and to those running or considering running for

office. As

CSE and the Cyber Center work to share knowledge and expertise, we're mindful that our role is not to duplicate your cybersecurity efforts. It's to fill the gap between the IT services that are provided today and the most sophisticated cybersecurity threats.

Our

goal is to partner with the Canadian security industry to make us all safer so we're all protected to the same degree as we have been able to protect the government of Canada.

Because

all Canadians and all of your customers want to connect online with trust and confidence.

In

closing,

I

want to leave you assured that CSE and the Cyber Center are playing critical roles in all three pillars of the government's national cybersecurity strategy.

Our

advice and guidance can help you and other Canadian critical system owners build more resilient and secure networks.

We

are dedicated to innovating as an organization, increasing diversity that drives innovation

and

sharing that innovation for the benefit of everyone.

We

are providing leadership for the government of Canada and collaborating

with

you and others in the private sector to help thwart today's cyber threats and to be ready to face those of tomorrow.

The

bottom line and ultimate goal is to make Canada unattractive to cyber threat actors,

but

we can't do it alone.

It

will take all of us in this room and all of us in this country

to

ensure Canadian cyberspace is trusted and resilient and we look forward to collaborating with you as partners in this noble pursuit. Collaborating for a secure Canada, it's not just important, it's essential. So, on that, I close and look forward to your questions.

Thank you.

Thank

you. Thank you. Thank you. Thank you. Thank you. Sous-titrage ST' 501