Evidence of meeting #152 for Public Safety and National Security in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was cybersecurity.
A video is available from Parliament.
Liberal
The Chair Liberal John McKay
It's my privilege to open the meeting and invite the Canadian Bankers Association and the Canadian Chamber of Commerce to address the committee. Both groups have been instructed on the parameters of their presentations.
Did you do rock, paper, scissors as to who will go first, or will we just go with the Canadian Bankers Association?
Mr. Docherty.
Charles Docherty Assistant General Counsel, Canadian Bankers Association
Thank you very much. Good afternoon.
I would like to thank the committee for the opportunity to speak with you today about cybersecurity in the financial sector.
My name is Charles Docherty. I am the assistant general counsel for the Canadian Bankers Association, or CBA. Joining me is my colleague Andrew Ross, director, payments and cybersecurity.
The CBA is the voice of more than 60 domestic and foreign banks that help drive Canada's economic growth and prosperity. The CBA advocates for public policies that contribute to a sound, thriving banking system to ensure Canadians can succeed in their financial goals.
Banks in Canada are leaders in cybersecurity and have invested heavily to protect the financial system and the personal information of their customers from cyber-threats. Despite the growing number of attempts, banks have an excellent record of protecting their systems from cyber-threats. Banks take seriously the trust that has been placed in them by Canadians to keep their money safe and to protect their personal and financial information.
Canadians have come to expect greater convenience when using and accessing financial services, and banks have embraced innovation to provide Canadians faster and more convenient ways to do their banking. Now consumers can bank any time from virtually anywhere in the world through online banking and mobile apps that provide real-time access to their financial information. Today 76% of Canadians primarily do their banking online or on their mobile device. That's up from 52% just four years ago. As more and more transactions are done electronically, networks and systems are becoming interconnected. This requires banks, government and other sectors to work together to ensure that Canada's cybersecurity framework is strong and able to adapt to the digital economy.
The CBA was an active participant in the Department of Public Safety's consultation on the new national cybersecurity strategy. Our industry is a willing and active partner that supports the government in working to achieve the outcomes outlined in the strategy with the common goal of improving cyber-resiliency in Canada.
The banking industry is strongly supportive of the federal government's move to establish the Canadian centre for cybersecurity under the Communications Security Establishment as a unified source of expert guidance, advice and support on cybersecurity operational matters. We also welcome the creation of the centralized cybercrime unit under the RCMP.
A key priority for the new centre will be to ensure cyber-resiliency across key industry sectors in Canada. Encouraging a collaborative environment with the centre providing a focus where the public and private sectors can turn for expertise and guidance will enhance Canada's cyber-resiliency.
The security of Canada's critical infrastructure sectors is essential in order to protect the safety, security and economic well-being of Canadians. The banking industry counts on other critical infrastructures such as telecommunications and energy to deliver financial services for Canadians. We encourage the government to leverage and promote common industry cybersecurity standards that would apply to those within the critical infrastructure sectors.
We recognize that critical infrastructures such as energy cross jurisdictional boundaries, and we recommend that the federal government work with the provinces and territories to define a cybersecurity framework across all critical infrastructure sectors. Having consistent, well-defined cybersecurity standards will provide for greater oversight and assurance that these systems are effective and protected.
Effective sharing of information about cyber-threats and expertise about cyber-protection is a critical component to cyber-resiliency and increasingly important to Canada's digital and data-driven economy. The benefits from sharing threat information extend beyond the financial sector to other sectors, the federal government and law enforcement agencies. Sharing information is a highly effective means of minimizing the impact of cyber-attacks. Banks are supportive and active participants in initiatives such as the Canadian Cyber Threat Exchange that promotes the exchange of cybersecurity information and best practices between businesses and government as a way to enhance cyber-resiliency across sectors.
To foster information sharing and for such forums to be effective, we recommend the government consider legislative options such as changes to privacy legislation and the introduction of safe harbour provisions to ensure that appropriate protections are in place when sharing information related to cyber-threats.
Protecting against threats from industries or other nations requires a defensive response that is coordinated between the government and the private sector. The government can play a pivotal role in coordinating among critical infrastructure partners and other stakeholders, building upon existing efforts to respond to cyber-threats. Establishing clear and streamlined processes among all major stakeholders will enhance Canada's ability to effectively respond to, and defend against, cyber-threats.
We understand that the government plans to introduce a new legislative framework that addresses the implications and obligations in a world that is increasingly connected. We look forward to engaging with the government on the framework.
The CBA also believes that raising awareness about cybersecurity among Canadians is imperative. Educating Canadian citizens is, and should be, a shared responsibility between the government and the private sector. General knowledge of the issues and an understanding of personal accountability to maintain a safe cyber environment are required to help ensure that comprehensive cybersecurity extends to the individual user level. The banking industry looks forward to further collaboration with the government on such common public awareness initiatives as incorporating online cybersecurity safety into federal efforts to promote financial literacy.
A skilled cybersecurity workforce that can adapt to a changing digital and data-driven economy is equally important, not only for our industry but for all Canadians as well. Every year the CBA works with members to organize one of Canada's largest cybersecurity summits, bringing banks together with leading experts to share the latest intelligence about threats and to deepen the knowledge of our cybersecurity professionals.
As cybersecurity threats continue to rise, there's a growing demand for cybersecurity talent in Canada and abroad. Canada's new cybersecurity strategy recognizes that the existing gap in cyber-talent is both a challenge and an opportunity for our country. To address this shortage, we encourage the federal government, in co-operation with provincial and territorial governments, to promote and establish cybersecurity curricula in grade schools, colleges, universities and continuing education programs to enable students to develop cybersecurity skills.
In conclusion, I want to reiterate that cybersecurity is a top priority for Canada's banks. They continue to collaborate and invest to protect Canadians' personal and financial information. Banks support the government's work to protect Canadians while promoting innovation and competition. However, the industry recognizes that threats and challenges are constantly evolving. We want to work more collaboratively with the government and with other sectors to ensure that Canada is a safe, strong and secure country to do business in.
Thank you very much for your time. I look forward to your questions.
Liberal
Dr. Trevin Stratton Chief Economist, Canadian Chamber of Commerce
Thank you very much, Mr. Chair and members of the committee. It's a real pleasure to be here with you today.
I'm Trevin Stratton. I'm the chief economist at the Canadian Chamber of Commerce. The Canadian chamber is the voice of business in Canada, and represents a network of over 200,000 firms from every sector and region and every size of business. I'm here with my colleague, Scott Smith, the senior director of intellectual property and innovation policy at the chamber.
Banking transactions are increasingly being conducted in new ways, with 72% of Canadians primarily doing their banking online or through their mobile device. Disruptive or destructive attacks against the financial sector could, therefore, have significant effects on the Canadian economy and threaten financial stability. This could occur directly through lost revenue, as well as indirectly through losses in consumer confidence and effects that reverberate beyond the financial sector, because it serves as the backbone of other parts of the economy. For example, cyber-attacks that disrupt critical services, reduce confidence in specific firms, or the market itself, or undermine data integrity could have systemic consequences for the Canadian economy as a whole.
Banks have invested heavily in state-of-the-art cybersecurity measures to protect the financial system and the personal information of their customers from cyber-threats. In fact, cybersecurity measures and procedures are part of the banks' overall security approach, which includes teams of security experts who monitor transactions, prevent and detect fraud and maintain the security of customer accounts.
The sophisticated security systems in place protect customers' personal and financial information. Banks actively monitor their networks and continuously conduct routine maintenance to help ensure that online threats do not harm their servers or disrupt service to customers.
However, cybersecurity issues are marked by significant information asymmetries, where a disproportionate amount of intelligence and capacity resides with large institutions like the federal government, the Bank of Canada and a few large private sector companies, including financial institutions. Yet, small and medium-sized enterprises are no less vulnerable. It is important for them to secure a cybersecurity ecosystem. They are also disproportionately subject to mounting asymmetries in resources, technologies and skills to defend against nefarious adversaries who, with relatively primitive skill sets and resourcing, can inflict excessive financial and reputational damage.
My colleague, Scott Smith, will now outline the cyber-threat landscape facing Canada's small and medium-sized enterprises.
Scott Smith Senior Director, Intellectual Property and Innovation Policy, Canadian Chamber of Commerce
I believe you've heard from several witnesses over the past few months about the evolving cyber-threat landscape, some of the attacks that are being experienced across the board and how that's changing, and the challenge that represents. Instead, today I'm going to draw your attention to the growing attack surface and how economic disruption that impacts national security can come from unexpected places.
Canada depends on small business for economic well-being. There are 99.7% of businesses in Canada that have fewer than 500 employees, but they employ over 70% of the total private labour force. Small to medium-sized enterprises contribute 50% of Canada's GDP, 75% of the service-producing sector and 44% of the goods-producing sector. They also represent 39% of the financial, insurance and real estate sector.
Fintech has a projected continuous annual growth rate of 55% through 2020. Canada is a hot spot for fintech growth, especially in mobile payments, and most of the emerging companies are SMEs. SMEs collectively constitute a very large attack surface. This attack surface has attracted the attention of hackers.
With regard to some examples of the link between supply chains and major disruptions, in 2018, five natural gas pipeline operators in the U.S. had their operations disrupted when a third party supplier of electronic data and communications services was hacked in the spring of that year. The hacking of a third party vendor to more than 100 manufacturing companies was discovered in July 2018. Approximately 157 gigabytes of data that Level One Robotics was holding was exposed via rsynch, a common file transfer protocol used to mirror or back up large datasets.
The 2017 NotPetya malware outbreak forced shipping giant Maersk to replace 4,000 new servers, 45,000 new PCs and 25 applications over a period of 10 days, causing major disruption.
Why is this happening? Criminals are a bit like flood water; they follow the path of least resistance. Small to medium-sized enterprises have several challenges when it comes to security: limited financial resources, limited human resources and a culture of disbelief, the so-called “we're too small to be hacked” syndrome.
The digital economy has been a boon to small business growth, enabling rapid entry to global supply chains. However, this innovation and growth comes with significant risk if security concerns are not addressed, particularly given the increasing sophistication of cybercriminals. They've moved from the disruption of viruses, trojans and worms 10 years ago, which were common to hear about, to now generating usable digital trust certificates that bypass the human element.
The goal must be to reduce the attack surface, making Canadian business a less attractive target to criminals. The solution is a culture shift, through education, awareness and setting achievable industry-led standards, without stifling innovation. It's a big challenge. It also means investing in international criminal enforcement relationships and capabilities.
I'll stop there, and I'm happy to answer any questions.
Liberal
The Chair Liberal John McKay
Thank you to both of you.
Our first questioner is Monsieur Picard.
You have seven minutes.
Liberal
Michel Picard Liberal Montarville, QC
Thank you, Mr. Chair.
Gentlemen, welcome to our committee.
I will ask my question in French, if you have your earpiece for translation.
My question is for the representatives of the Canadian Bankers Association, since they work in the financial sector, which is the topic of our study.
What strategy did you use to develop your cybersecurity program? What are the aspects or operations of your clients' activities that you took into account to develop the steps of the cybersecurity measures?
Assistant General Counsel, Canadian Bankers Association
The banking industry takes its responsibilities for protecting clients' information extremely seriously. We appreciate the trust that customers have put in us to protect their personal information.
In terms of a strategy, the banks—in addition to protecting their own systems and infrastructure—are contributors to ensuring cyber-resiliency across Canada as well. They're heavy contributors to the Canadian Cyber Threat Exchange, which allows not only banks but also other industries to access information related to cyber-incidents and threats. Of course, they've invested billions of dollars in ensuring that their IT infrastructures are safe and secure.
Liberal
Michel Picard Liberal Montarville, QC
I would like your approach to be more concrete.
The purpose of this study is to ask the private sector, including your association, to help us find ways to improve our financial services infrastructure.
You are in the financial sector. We know that you manage personal data. On the ground, you had to start somewhere; someone got up one morning and decided to begin by examining this or that operation, by using this tool, by examining this or that banking services sector. Indeed, there are a whole range of financial services. Could you summarize the process that led to the development of your cybersecurity strategy?
Andrew Ross Director, Payments and Cybersecurity, Canadian Bankers Association
This is obviously an evolving space and our strategy continues to evolve with it.
At the end of the day the banks go through rigorous risk management frameworks to assess the various threats they see.
As my colleague mentioned, one thing we believe we are very good at is detecting cyber-threats. We've contributed to the government's strategy as well. I think one area where we can to do more is information sharing, not only to improve the financial sector itself but beyond the sector.
At the end of the day it comes down to risk mitigation, identifying those areas that need to be dealt with, and assessing and defending against those.
Liberal
Michel Picard Liberal Montarville, QC
Okay.
I have a choice of two tricky questions.
First, why are banks asking for fees from their customers for additional insurance to protect their personal information from identification theft? I thought that when I was doing business with banks, since I have to give them all of my precious information, they would take care of it without my having to pay more to have the same information protected. Is it because your system does not protect my ID enough? Or is it just a marketing stunt?
Assistant General Counsel, Canadian Bankers Association
As I mentioned at the outset, banks take their responsibilities to protect the personal information of their clients very seriously. They do provide products and services to their clients to help ensure that their personal information remains safe.
I can't speak to exactly the economic model you're referring to of charging extra for personal identification monitoring specifically. But in some cases if a client wanted there to be more monitoring, then they should have that option to have their personal information monitored more closely. In that case, that is a product or service that a bank may be willing to offer to them.
Liberal
Michel Picard Liberal Montarville, QC
So, as I understand it, it's safe to say that my personal information is quite safe in any bank in Canada, because they have all the means and tools to protect me.
Liberal
Michel Picard Liberal Montarville, QC
Excellent.
On sharing information, we've talked more and more about open banking. What is your take on that?
Director, Payments and Cybersecurity, Canadian Bankers Association
Certainly, we are involved in the consultations the Department of Finance is undertaking in looking at the merits of open banking.
From our perspective the sector supports innovation and competition in financial services. As we have outlined, we need to look not only at the benefits, but also at the risks that are associated with open banking. Cybersecurity is one of those areas. We feel that through the consultation, if we're able as a country to mitigate those risks and the benefits are identified and seen, then we would support open banking.
Liberal
Michel Picard Liberal Montarville, QC
What is the nature of the risks that you have identified in your firm?
Director, Payments and Cybersecurity, Canadian Bankers Association
As mentioned earlier, there is the risk of others playing in the financial space that may not have the same resources as a bank. I think that's one.
Generally speaking, I think the more entities you have involved, the more interconnected channels that exist, then the greater the risk of a cyber-threat.
Conservative
Pierre Paul-Hus Conservative Charlesbourg—Haute-Saint-Charles, QC
Thank you, Mr. Chair.
Good afternoon, gentlemen. Thank you for being here with us.
Banks handle business banking and personal banking. Since I own some businesses, I know that technology like SecureKey is needed to access accounts. Access to a business account is very complex, as compared to accessing a personal account.
My colleague asked this question, but I would like to know whether, from the outside, it is easier to attack a business account than to attack a personal account, or whether it is the same thing.
Assistant General Counsel, Canadian Bankers Association
Certainly, I believe the risks would be the same. Corporations would necessarily need to have controls in place, as there are more people working within a corporation who might have access to the banking system of the corporation.
Conservative
Pierre Paul-Hus Conservative Charlesbourg—Haute-Saint-Charles, QC
Do you know what I mean?
I'd like to know whether in your opinion the protection of business accounts against cyber-attacks is superior to the protection of personal accounts.