White House wants Ottawa to update air defence more quickly, ambassador to U.S. says

On the same subject

• 

  September 9, 2019 | Local, C4ISR

  Norad asked Canada to 'identify and mitigate' cyber threats to critical civilian sites

  by Murray Brewster The U.S.-led North American Aerospace Defence Command (Norad) asked the Canadian military to do an inventory of its bases and the surrounding civilian infrastructure, looking for critical systems vulnerable to a cyberattack. The letter to Canada's chief of the defence staff, written by then-Norad commander U.S. Admiral William Gourtney just over three years ago, was obtained by CBC News under access to information legislation. Despite the passage of time, two leading cyber experts said the request highlights an enduring concern of both defence planners and people in high-tech industries. The notion that a cyberattack could shut down civilian infrastructure — such as power grids, water treatment plants or traffic systems — in the vicinity of a military base is nothing new. What is unusual is that Norad sought reassurance, at the highest levels of the military, that Canada was on top of the evolving threat. The Norad commander asked Gen. Jonathan Vance to "identify and mitigate" Infrastructure Control Systems (ICS) vulnerabilities on Canadian military bases, particularly at "installations that are critical for accomplishing Norad missions." The March 24, 2016 letter also urged Canada's top military commander to "advocate developing capabilities to respond to cyber incidents on CAF [infrastructure control systems] and defend CAF [infrastructure control systems] if required." Gourtney's concern was not limited to defence installations; he asked Vance to "work with Public Safety Canada to identify civilian infrastructure that is critical to CAF and Norad missions. This includes developing processes for reporting cyber incidents on the identified civilian infrastructure." Vance responded to Gourtney (who has since retired and was replaced by U.S. Air Force Gen. Terrence O'Shaughnessy) three months later and directed the military to hunt for vulnerabilities. "I share Norad's concerns for the cybersecurity" of critical defence infrastructure, Vance wrote on June 10, 2016, in a letter obtained by CBC News under access to information legislation. He noted that the Canadian government has identified "adversaries" that pose "a significant threat and efforts have been made to identify and develop protective strategies for Canadian critical infrastructure." The Liberal government — through its defence strategy and overhaul of security legislation — tackled some of the concerns raised by Norad. It gave the Communications Security Establishment (CSE) and the military new powers to conduct offensive cyber operations. Perhaps more importantly, it set up the Canadian Centre for Cyber Security for civilian infrastructure, which — according to CSE — aims to "be a place where private and public sectors work side-by-side to solve Canada's most complex cyber issues." David Masson, a cyber expert, said minimizing the vulnerability of civilian, privately operated infrastructure continues to be an extraordinarily complex task. The major vulnerability is in what's known as operational technology systems, the kind of computer-driven tasks in utilities and other infrastructure that open and close valves or perform remote functions. The task of securing them is made extraordinary difficult in part by the wide variety of operating systems out there. "There's lots of them," said Masson, the director of technology at Darktrace, a leading cybersecurity company. "Look at it as 50, 60, 70 different bespoke communications systems. There's no real standardization because they're so old. Many of them were never expected to be connected to the internet." He pointed to the 2015 and 2016 cyberattacks on Ukraine's power grid, which in one instance cut electricity to 225,000 people, as examples of what's possible when hackers go after operational technology systems. It is also the kind of event that Norad is concerned about. "The kinds of equipment and machinery that supports the transport of natural gas or the provision of air conditioned services, or our water supply — all of those are critical to Canadians and our militaries," Lt.-Gen.Christopher Coates, the Canadian deputy commander, said in a recent interview with CBC News. He said Norad is focused on the capabilities that are essential to doing its job of defending North America against attack, and they try to "minimize those vulnerabilities where we can." There is, Coates said, an interesting discussion taking place at many levels of the military about what constitutes critical infrastructure. "You asked if we're satisfied. I get paid to be concerned about the defences and security of our nations. I don't think I should ever be satisfied," he added. 'Inauthentic activity' in Alberta election a possible preview of tactics in the federal campaign, report warns Privacy commissioner launches investigation into licence plate breach With ransomware on the rise, RCMP urging victims to 'be patient with police' Christian Leuprecht, a defence expert at Queen's University in Kingston, Ont., said defining critical infrastructure is a complex and evolving task. He pointed to Russian interference in the 2016 U.S. presidential election; prior to that event, he said, the definition of critical infrastructure was limited to power plants, electricity grids and even the financial system. "A lot of things people are wrestling with the question of what institutions — take, for example, democratic institutions — become critical infrastructure," said Leuprecht. The Ukrainian attacks, in the view of many defence experts, are a blueprint of what the opening shots of a future war would look like. "There's a considerable and growing awareness that our defence and critical infrastructure systems are closely tied together because countries, such as China, preserve cyberattack as a first-strike option," Leuprecht said. Masson said there are ways to limit the vulnerability of operational technology systems. Not connecting them to the internet would be a start, but many companies are choosing not to do that for efficiency reasons. He said they also can be protected with "robust" security systems. https://www.cbc.ca/news/politics/norad-cyber-civilian-1.5273917

• 

  July 27, 2022 | Local, Aerospace

  Canada’s new Space Division: Evolution not revolution

  Even as Canada acknowledges growing importance of space in defense, Jessica West of Canada's Project Ploughshares said, "The creation of a division within the military [structure] rather than a standalone force points to the integration of space across military functions rather than a ‘warfighting’ orientation."

• 

  March 26, 2020 | Local, C4ISR, Security

  All-volunteer cyber civil defence brigade assembles to fight COVID-19 hackers

  Number of online attacks on health care institutions jumped 475 per cent in one month, says one report Murray Brewster Civil defence used to involve air raid wardens, ambulance drivers and rescue teams. That was at the height of the Cold War, and the hot wars of the 20th century that preceded it. These days, it means taking the fight online — against hackers and cyber criminals looking to take down or ransom critical infrastructure, such as hospitals. The COVID-19 crisis has prompted Canadian IT professionals to form an all-volunteer cyber defence team to protect Canada's hospitals, health-care providers, municipalities and critical infrastructure from online attacks during the COVID-19 crisis. The SecDev Group, which has pioneered advanced analytics and cyber safety, has been spearheading the recruitment effort and has asked information technology professionals to step up and provide preventative measures and remedial services. 'Preying on fear' "Hackers are targeting hospitals and health care providers, preying on their distraction, fear and anxiety and their hope for a cure," said Rafal Rohozinski, principal and CEO of the SecDev Group "Posing as public health officials from the World Health Organization, [the] Centers for Disease Control and UNICEF, cyber criminals are flooding hospitals, medical laboratories, vaccine testing facilities, municipalities and critical service providers with phishing emails, forcing some to shut down." Trudeau leaves door open to using smartphone data to track Canadians' compliance with pandemic rules Twelve companies and associations have signed on to the initiative. Together, they plan to set up a secure online exchange to match high-tech professionals — who will volunteer their services free of charge — with agencies and institutions that need help to shore up their cyber protection, or to deal with an intrusion. "It's both a patriotic and public service reflex," said Rohozinski. "If the internet goes down, and in particular if critical institutions that we count on — like hospitals, like cities, like utilities — start to be ransomed or start to go down because of cyber malfeasance, we're all in a lot of trouble." The exchange website is still in the process of being built, but Rohozinski said it will launch within days. Online attacks exploded since pandemic began Across the globe, the number of coronavirus-related attacks on health-care institutions has increased by 475 per cent in just the past month, according to a SecDev Group assessment. At the moment, no Canadian hospitals or institutions have reported being attacked. Rohozinski said there have been signs of trolling by both cyber criminals and so-called "state actors" — including some of the Russian groups identified by U.S. intelligence as being behind the tampering in the 2016 presidential election. The Communications Security Establishment (CSE), Canada's electronic intelligence service, has said it has taken down some fake websites that were posing as government departments and institutions and trying to scam people. The U.S. Health and Human Services Department was recently targeted and the FBI has warned that hospitals in the states with the highest rates of infection — California, New York and Washington — should be on the alert for attacks from foreign actors. Hammersmith Medicines Research, a British company that is on standby to perform medical trials on any potential COVID-19 vaccine, was hit with an online attack last week, according to published reports. Over the last few days, according to a Bloomberg news report, hackers targeted hospitals in Paris with a major cyberattack. A hospital in the Czech Republic was also hit last week in what is thought to have been a ransomware attack, which forced administrators to take the network offline. Forbes Magazine reported late last week that the cybercrime groups behind the DoppelPaymer and Maze ransomware threats had promised not to target health care organizations during the COVID-19 crisis — but at least one of the groups was reportedly linked to a recent attack. Remote work networks are vulnerable An executive at one of the companies now volunteering for the cyber civil defence initiative said one area where institutions likely need help is in protecting the virtual private networks (VPNs) of employees who've been forced to work from home because of the crisis. Robert Mazzolin, the chief cyber security strategist at the RHEA Group, said the VPN systems used by most hospitals, power plants and other utilities were never designed to support so many secure connections outside the workplace. "The world is fundamentally different than it was a week ago and I don't think any large corporation or institution realistically would have been prepared to see virtually its entire workforce be working from home via remote connections," said Mazzolin, a former brigadier-general who was responsible for cyber operations in the Canadian military. Canada's cyber spies taking down sites as battle against COVID-19 fraud begins Canada's health sector at risk of cyberattacks as COVID-19 fear spreads: CSE "That places a large stress on an institution's communications workforce. The threats out there, including ransomware — it's important to be able to defend VPNs that are stretched well beyond their normal capacity and limits." He said his company and staff, who regularly work for the European Space Agency, will be able to provide insight and capability that will complement existing networks. The mandate of CSE is to protect the federal government's electronic network and — through its cyber security centre — to provide advice and guidance to people and businesses looking for cyber security information. Rohozinski said there's a difference between providing advice and actively helping in the defence and the initiative has CSE's support. https://www.cbc.ca/news/politics/covid19-cyber-companies-1.5508570