Appoint cyber czar, endorse certification program: Chamber of Commerce

OTTAWA — Cyber security is everyone’s responsibility, but the federal government needs to take a leadership role to help stem the flow of money draining from the Canadian economy due to attacks on businesses, according to the Canadian Chamber of Commerce. Canada loses about $3.12 billion per year due to cyber crime, or 0.17 per cent of gross domestic product, the business association said in a report released Monday. The most obvious effects are the direct financial costs and reputational damage, the report said, but added that “other societal costs, which can be more complicated to place a value on, include increased consumer prices, job losses, IP and innovation crises, loss of confidence, damage to critical infrastructure and breach of national security.” Among the recommendations made in the report is the creation of a government point person to conduct cyber security activities. “It’s a policy, understanding, and directive. So they may not lead something like critical infrastructure, but that cyber czar would have responsibility or oversight of how critical infrastructure would function and would be the key point of contact. Same as if there’s going to be a relationship between government and business, and if there’s a requirement that business has certification, they would be the oversight of that certification program,” Scott Smith, the chamber’s director of policy and intellectual property and innovation policy and report author, said in an interview at a launch event for the report in Ottawa Monday. The creation of a cyber czar was also recommended during the federal government’s cyber security consultation last year. Such a person would help lead the government’s own internal policy direction, Smith said, which would ultimately help streamline things for businesses looking for assistance. “Right now, there’s probably five departments that have a role to play in cyber security, from a macro level, and then every department has its own role to play within their own department,” he said. “So we would like to see better co-ordination.” The report also recommends developing a national cyber policy framework and investing in the promotion of tools to help Canadians be more cyber savvy. The chamber is also backing an International Cyber Security Protection Alliance (ICSPA) initiative to bring to Canada a certification program developed in the United Kingdom. “Not everything can be protected, nor can everything be fixed. The goal is resilience,” the report said. “Government endorsement of this program in Canada is important in building resilience within Canadian business and our long-term economic success.” According to a British government summary, Cyber Essentials was created in 2014 for two reasons: to provide “a clear statement of the basic controls all organisations should implement to mitigate the risk from common internet based threats” and to offer groups a way “to demonstrate to customers, investors, insurers and others that they have taken these essential precautions.” Certification is required for all companies wanting to do business with the British government, Ken Taylor, ICSPA president for the Americas, said in an interview, and there is now a move towards making it mandatory for all U.K. businesses. The program already has a foothold domestically, with New Brunswick’s government announcing in February it was signing on through its CyberNB initiative to become a certification body for Cyber Essentials. Wendy Wagner, a partner at law firm Gowling WLG, said in an interview that businesses are left to navigate vague directives under the Personal Information Protection and Electronic Documents Act (PIPEDA), and that such a certification process could be helpful. “A lot of companies struggle with the laws don’t actually dictate exactly what you need to do to protect personal information, they just obligate you to do it,” Wagner said. “A lot of companies are looking for a framework that allows them to say ‘yes, we’ve taken measures to protect the personal information that my company holds.’” The country’s privacy commissioners are becoming more proactive on the issue of data security, she noted, as opposed to only overseeing the collection and preservation of data. Taylor said he is anticipating movement within the next couple of months on a broader scale for implementing the Cyber Essentials program in Canada, noting “the telco industry is fully engaged.” “They have to be at the end of the day, because they’re offering services to the small to mid-size community around anti-viral and around protection of data and so for us, it was imperative to partner and work with that industry itself.” — With reporting by Charelle Evelyn at cevelyn@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

Appoint cyber czar, endorse certification program: Chamber of Commerce

News | April 3, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Appoint cyber czar, endorse certification program: Chamber of Commerce

News | April 3, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Meta’s content moderation changes highlight challenges for Canadian digital regulation

Four cyber bills dead on the order paper as Parliament prorogued

Privacy commissioner says TikTok wind up has no impact on investigation as company takes government to court

As online harms bill splits in two, advocates continue seeking amendments

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us