Thank you for the question.
I would say the number one thing that Canada needs to do is to state its position on persistent engagement. This is the U.S. strategy of constantly engaging adversarial elements in cyberspace. When you hear about U.S. Cyber Command or NSA conducting offensive attacks in order to arrest or target ransomware operators, this is the type of action that is under persistent engagement.
Canada has voiced certain ways of supporting this, but it's very unclear. The supports to such actions have been very inconsistent.