Give telecoms more power to deal with cyber threats: bankers’ association

OTTAWA — Telecoms should be able to block “bad data” and share information about threats with customers, such as banks, the Canadian Bankers Association (CBA) told a Senate standing committee on Thursday. “The delivery of financial services relies on other sectors, such as telecommunications and electricity. Canadians need to be assured that all critical infrastructure sectors are protecting them from cyber threats,” Andrew Ross, the director of payments and cyber security at the CBA, told the Senate Banking, Trade and Commerce standing committee in his opening statement. The committee is undertaking a study of cyber security and cyber fraud. The banking group called on the government to create a new “consistent set of standards and rules for all critical infrastructure sectors,” such as telecom and electricity, and to make one agency within the federal government take the lead on cyber threats. That would mean there would be a single point of contact for consumers and businesses to report cyber security issues, the group noted. The CBA also said it would also improve reporting and augment how law enforcement and different entities within the private sector share intelligence. “Within the current cyber security landscape there are many federal government departments and agencies that have oversight of different critical infrastructure sectors,” Ross said, noting that “an opportunity exists to integrate all of these government cyber activities across critical infrastructure sectors into one single government agency.” In a follow-up email comment, Ross said that it should be up to the government to determine where that agency should be within the federal government and how it would coordinate with others. It’s not the first time the government has heard a similar suggestion. The Canadian Chamber of Commerce has called for the creation of a government point person to conduct cyber security activities, following an earlier recommendation for the creation of a cyber czar. The CBA’s suggestions also included “allowing telecommunications providers to block known malicious traffic. According to the organization, blocking this “bad data” would stop the spread of viruses, botnets and “other forms of malicious software that target corporations and governments.” “It is our understanding that legislative changes are needed to allow telecommunications providers to proactively block bad traffic and we encourage the government to study legislative options for making this possible,” the group said in its opening statement. It also called for telecoms and banks to be able to share information about threats. Allowing the financial sector to share that info with telecoms, and then allowing telecoms to block “malicious end-points,” would stop that traffic from spreading to others, CBA said. “Within the financial services industry, I think we do a good job of sharing intelligence. Where there would be benefit is expanding that knowledge to other infrastructures and critical sectors, so that our knowledge can be shared with them and vice versa,” said Ross in reference to the role a larger oversight body might play. In response to a question from senator Howard Wetston, who highlighted the fragmented nature of responsibility sharing between the provincial and the federal governments, the witnesses pointed to the fact that telecoms are already under federal jurisdiction. That would make the inclusion of telecoms one of the easier components of creating a national cybersecurity oversight program, according to the CBA. But, Wetston pointed out, it would ride on how much any plan would protect against systemic risk (the chance of a single event causing extreme destabilization of a financial market) which a previous Supreme Court of Canada decision striking down the creation of a national securities body put under federal jurisdiction. Wetston also observed that other complicating matters like privacy, freedom of speech and charter issues emerge when proposing to regulate the internet. Ross acknowledged that there are frameworks currently in place like the Canadian Cyber Incident Response Centre (CCIRC) and the Canadian Cyber Threat Exchange (CCTX) which allow collaboration against cyber threats. In June, the government introduced Bill C-59, which would enable Canada’s Communications Security Establishment (CSE) to work more directly with telecoms on network security. The CBA also called for another look at the Personal Information Protection and Electronic Documents Act (PIPEDA). The witnesses claimed new rules hindered its ability to share the appropriate information when cyber threats occur. The revised PIPEDA rules still allow for information sharing, but “if you see anomalies or things that look odd, but may not be confirmed fraud, those are activities that aren't allowed to be shared as a result of the changes,” said Ross. — With reporting by Bryson Masse at bmasse@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

Give telecoms more power to deal with cyber threats: bankers’ association

News | October 27, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Give telecoms more power to deal with cyber threats: bankers’ association

News | October 27, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

CRTC will not change temporary wholesale decision; final decision still on the table

UPDATED: Alberta, B.C. ministers calls on federal government to halt high-speed access review

Matt Malone new director of uOttawa’s CIPPIC

Federal Court grants blocking order targeting pirate site copycats

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us