Public Safety Committee on April 1st, 2019

[The Chair, Liberal, John McKay]

Ladies and gentleman, we have quorum, and we have lost half an hour.

I'm just going to ask all the witnesses to come up to the table directly.

My proposal, colleagues, is that we mash the panels. I've spoken to all the witnesses and asked that they be prepared to speak for less than 10 minutes. My thought is to give the panellists seven minutes each to make their presentations.

The first round of questions will be six minutes, and the next round, four minutes. We'll just run as long as we can.

I think there's another vote. We're not sure.

[David Graham, Liberal, Laurentides—Labelle, QC]

Are we not going all night tonight?

[The Chair, Liberal, John McKay]

Did you bring your cot?

[An hon. member]

Oh, oh!

[The Chair, Liberal, John McKay]

Okay, with that, the meeting has come to order.

I'll simply call the witnesses in the order that we have on the agenda, which starts with Mr. Green from Mastercard, followed by Mr. Davies from EY, Mr. Finlay from Cybersecure Catalyst and Mr. Gordon from Canadian Cyber Threat Exchange.

With that, Mr Green, you have seven minutes, please.

[Ron Green, Executive Vice-President and Chief Security Officer, Mastercard Canada]

Good afternoon, and thank you for the opportunity to be here today.

First, I want to praise the committee for launching this study. Cybersecurity is one of the greatest challenges governments and businesses are facing at the present time, with serious implications for national security, financial stability and consumer protection.

I also want to congratulate the Government of Canada for launching its national cybersecurity strategy and establishing the Canadian Centre for Cyber Security. I had the opportunity to meet with the leadership of the centre today, and we at Mastercard look forward to supporting their work however we can.

Cybersecurity is a top global priority for Mastercard. Safety and security are foundational principles for every part of our business and the innovative technology platforms and services we enable. We know that secure products and services are essential to the trust our customers, cardholders, merchants and other partners place in us. Let me contextualize this.

As you probably know, Mastercard does not issue credit cards or have a direct relationship with consumers. That is the purview of the banks that issue our cards.

Mastercard is a technology company. We provide the network that allows consumers to use their Mastercard virtually anywhere in the world, in more than 210 countries and territories, and have those transactions processed in seconds, connecting 2.5 billion cardholders with tens of millions of merchants.

For us to provide value to banks, merchants and consumers who use our network, we must provide safety and security. We cannot afford to have any interruptions in the operations of our network.

We are also investing in innovation: enhancing our capabilities in-house; acquiring cutting-edge technology companies; and nurturing our Start Path group of curated start-ups, including five in Canada, connecting with our issuing partners to grow their business. Just last month, Mastercard entered into an agreement to acquire Toronto-based Ethoca, a fraud solution powered by collaboration between banks and merchants.

At a very high level, that's what we're doing. Please let me now turn to our advice for government, which falls into six main areas.

First, in a networked, interconnected digital world, we need cybersecurity solutions tailored to small and medium-sized businesses. Cybercriminals will seek out the weakest point in the system to launch an attack. Therefore, we need to provide a framework for small businesses to protect their operations. Mastercard is playing a leading role in defending SMEs as we stand up our Cyber Readiness Institute, which emphasizes the practical application of tools for small and medium-sized businesses. The institute also facilitates the workforce development needed to implement these cybersecurity risk management tools.

In addition, keeping with this focus, in February, Mastercard and the Global Cyber Alliance released a new cybersecurity tool kit specifically designed for SMEs. This is a free online resource available worldwide. It offers actionable guidance and tools with clear direction to combat the increasing volume of cyber-attacks. There are operational tools, how-to materials and recognized best practices, all with an action focus. This tool kit will be updated regularly.

Second, global companies frequently confront an expanding and overlapping set of cybersecurity regulations in different jurisdictions. Those need to be harmonized using a baseline framework. We understand good trilateral progress was made here in the context of the NAFTA renegotiation, developing a common framework to align and manage cybersecurity risks, which is encouraging.

Third, there is a need to improve identity management and authentication as more devices are connected online. We need a robust identity ecosystem to enable easier and more secure digital interactions and transactions that safeguard the privacy of our cardholders.

Fourth, with the Internet of things there will soon be 30 billion connected devices. This creates enormous opportunities for the digital economy, but it also increases cyber-risk. Therefore, governments and the private sector should develop standards to improve the interoperability and cyber-threat detection and prevention while removing friction from commerce.

Fifth, as cyber-threats grow, governments and the private sector face a shortage of employees with cybersecurity skills. The world needs to start training the next generation of cybersecurity experts, and government has a role to play. If you have kids or grandkids, get them hooked on cybersecurity and they can make a lot of money in their lifetime, because right now the needs are there but the qualified security personnel are not.

Finally, collaboration, information-sharing and bringing all stakeholders to the table are required to fight cybercrime. President Obama commissioned an expert task force on cybersecurity on which our CEO sat. The task force issued a series of recommendations. The CRI, which I mentioned earlier, is a direct offshoot of the task force's emphasis on securing SMEs.

I believe this issue is so fundamental to the future of our economy and society that it needs attention from leadership at the highest levels. Mastercard is ready to lend its expertise to the Government of Canada in much the same way.

I could talk for hours on the subject but I will stop here and happily take questions on the areas that are of most interest to you. I have tried to provide a snapshot of what we are doing and what we think governments should be doing.

Thank you again to the committee for having me here, and I look forward to your questions.

[The Chair, Liberal, John McKay]

Thank you, Mr. Green, and thank you for respecting the time.

Mr. Davies is next for seven minutes, please.

[Thomas Davies, National Financial Services Cyber Leader, EY]

Thank you for inviting us to this session to provide insights and field questions on cybersecurity in the financial sector.

My name is Thomas Davies, and I am the National Financial Services Cybersecurity Leader for EY in Canada. I'm also a special adviser for financial crime for the firm globally with a focus on insider and outsider threats. Prior to joining EY, I spent eight years as a director of Scotiabank, supporting all three lines of defence.

Cyber-attacks are on the rise and the financial services industry is considered a high value target globally. The number of individuals, organizations and nation states with access to advanced tools has grown exponentially as service offerings for hacking have been developed and optimized by criminal organizations. Attacks on financial services are not limited to cyber-breaches. They can quickly move to fraud and money-laundering activities, which then create a strain on the talent and financial resources of any organization. These concerns are exacerbated by the shortage of skilled professionals across financial crime domains. A successful breach of payment systems, transaction networks or customer data could have a material impact on the economy.

Consider for a moment the implications of not being able to use your debit or credit card for a day or even a week. Imagine over one million Canadians trying to withdraw cash to pay for groceries, gas or medicine. Many global regulators consider the resiliency of financial services against a cyber-event to be a top priority for ensured economic health, as exhibited by new security requirements in Hong Kong, the United Kingdom and New York.

As Canadians demand greater access to financial services through digital platforms such as open banking, we need to consider embedding security and privacy principles into the design phase of a solution. In doing so, we will help to build customer trust, encourage adoption and proactively reduce the likelihood of costly fixes later. Implementing preventative measures such as training and awareness, access management, system hygiene, third party risk and corporate governance will reduce both the attack surface of these platforms and the maintenance required to support them.

Canada has an opportunity to become a global leader in security and privacy while continuing to be a great innovator of fintech. Through the continued support of shared intelligence, the development of talent through early and continuous education, and by enhancing public awareness of cyber-threats leading to financial crime, we can ready ourselves against this growing threat.

Thank you.

[The Chair, Liberal, John McKay]

Thank you, Mr. Davies.

I encourage colleagues to take note of the way in which these presentations are made in a timely fashion.

Mr. Finlay from Cybersecure Catalyst, please.

[Charles Finlay, Executive Director, Cybersecure Catalyst]

Chair and members of the committee, thank you very much for the opportunity to speak with you today.

Cybersecure Catalyst is a new centre for cybersecurity activities that was established last year by Ryerson University. It is permanently located in Brampton and will open its physical footprint in Brampton later this year. The centre will collaborate closely with governments and government agencies at all levels, private sector partners and other academic institutions across Canada to drive growth and innovation in the Canadian cybersecurity ecosystem.

We will deliver programming in four pillars. We will provide cybersecurity training for existing cybersecurity professionals, and introductory cybersecurity training for newcomers to the sector. We will support scaling-up Canadian cybersecurity companies through a unique commercial accelerator program. We will support applied cybersecurity R and D partnerships between academic institutions and private sector partners. Finally, we will deliver public education in cybersecurity, focusing on private citizens and small businesses.

In developing the mandate of Cybersecure Catalyst, Ryerson University engaged in a lengthy consultation process with industry and government, including a number of financial institutions. I think the results of this consultation process are important for our discussion of cybersecurity in the financial sector as a national economic security issue. When we asked major financial institutions and other private sector entities what they needed most from a university-based cybersecurity centre, the answer wasn't some specific technological tool or identified advance in the science. The overwhelming answer was more people. You have heard this from other witnesses before the committee today. In particular, we heard from financial institutions that they need their existing personnel to be upskilled to meet emerging threats, and they need more people to come into the sector to staff entry-level positions within their organizations. Every one of the major financial institutions in Canada has many current openings for cybersecurity personnel.

The anecdotal evidence taken from our consultation process is supported by the empirical evidence. As you have already heard from other witnesses in this hearing, in July of 2018 Deloitte and the Toronto Financial Services Alliance released a report that estimated that the demand for cybersecurity personnel in Canada was increasing by 7% annually and that 8,000 cybersecurity positions need to be filled by 2021.

It is important to note that this shortage is not just a security problem; it is an economic development problem. The lack of trained cybersecurity personnel creates staffing challenges for the regular operations of these financial institutions, but it also impacts these institutions' ability to create new and safe products and services for domestic and international markets. Crucially, the lack of trained personnel seriously impacts the ability for small and medium-sized Canadian cybersecurity companies to grow.

An interesting way to see the Canadian labour market problem in cybersecurity is to travel to Israel. Israel is generally acknowledged to have the strongest cybersecurity technology ecosystem in the world. The Israeli government has established a new major centre for cybersecurity activities in a small town in the Negev Desert about an hour by car from Tel Aviv, called Beersheba. In January, I travelled Beersheba to meet not with Israeli companies but with representatives of Canadian financial institutions that have established offices at Beersheba because they can find cybersecurity talent in Israel much more readily than they can in Canada.

That is the bad news. The good news is that this problem is well understood and efforts are being made to address the issue. This federal government's investments in cybersecurity in the 2018 budget were significant, in particular with the establishment of the Canadian Centre for Cyber Security. The centre is already acting as an important partner and voice for the cybersecurity sector in Canada. In the recently released 2019 budget, this government made cybersecurity a priority, allocating $80 million to post-secondary institutions to expand the pipeline of cybersecurity talent in Canada, among other measures.

Of course there is always more to do. In our view, training programs should focus on two key cohorts: young people in K to 12 and demographic groups that are seriously under-represented in the cybersecurity sector. Young people are not necessarily inclined to view cybersecurity as an interesting or exciting field of study or future employment, but this can change with the right engagement.

We will not solve the labour market issue of cybersecurity for financial institutions or for any other institutions if we don't open the cybersecurity sector to more women, racialized groups, new Canadians, indigenous Canadians, veterans and to those who have been displaced from legacy sectors. Efforts should be made to focus specifically on opening training and industry placement opportunities to individuals from these groups, and we will focus on that at Cybersecure Catalyst.

Finally, as our economy continues to transform, we see exciting opportunities to build talent pipelines between sectors where human labour is being displaced, and the cybersecurity sector where the need for qualified personnel is growing.

Thank you very much.

I'd be pleased to take your questions.

[The Chair, Liberal, John McKay]

Thank you, Mr. Finlay.

Mr. Gordon, you have seven minutes, please.

[Robert Gordon, Executive Director, Canadian Cyber Threat Exchange]

Thank you, Chair.

I would like to thank the committee for giving me the opportunity to speak today about cybersecurity in the financial sector.

I'm the Executive Director of the Canadian Cyber Threat Exchange, CCTX. I'll highlight the work of the CCTX because I believe it has a direct bearing on the current focus of this committee's inquiries.

The CCTX is a not-for-profit organization established by the private sector with two broad mandates. First, we operate a cyber-threat information exchange to deliver actual intelligence to our members. Second, we provide a collaboration hub for the sharing of best practices among cybersecurity professionals. We're a relatively new organization, having commenced basic operational capacity just two years ago. I'll provide a few additional comments on our services in a minute.

The founding principles of the CCTX make it unique. First, our aim is to attract members from all sectors of the economy, not just those from critical infrastructure. We currently have members from accounting companies, law firms, the health sector, construction firms, entertainment companies, airport authorities and technology companies, among others.

Second, the large companies that founded the CCTX made it clear that the CCTX cannot be just for large organizations. We need to attract small and medium-sized organizations. In every sector of the economy, all sizes of organizations are experiencing cyber-attacks. We've grown from the initial nine founding members to just under 60 today, with additional applications being processed weekly.

In January this year, we changed our membership and fee structures to make membership more attractive to small and medium-sized organizations. Those changes have been really well received. Small organizations now represent 28% of our membership, and we're working to ensure this number grows significantly. As we increased the number of small organizations, we were developing cybersecurity reports and services specifically tailored to meet the needs of the small business owner.

I'll briefly highlight two of the service delivery areas.

We operate a cyber-threat information-sharing hub. Threat information is provided by participating member organizations. The threat intelligence received does not contain personal information, and the source of the information is anonymized.

The CCTX also receives cyber-threat information from the new cyber centre. We're pleased to be the first organization to sign a collaboration agreement with the new cyber centre. This is an important partnership for the CCTX and the government. We believe we will benefit from the full cybersecurity capability the government offers, and the government is going to benefit by our being able to extend the reach of what they're doing to small parts of the economy they no longer service, particularly those areas outside the core critical infrastructure.

The CCTX also offers its members an opportunity to provide threat-related information to the government, while keeping their identities anonymized. As we continue to grow, we'll provide the government with a broader understanding of how cyber-threats are impacting the entire Canadian economy.

This committee previously heard from witnesses on the importance of developing the cyber workforce required to defend the Canadian economy. The CCTX plays a role in assisting the private sector in developing and retaining the skills they require. Our cross-sector collaboration capability provides a variety of forms to bring together cybersecurity professionals to share best practices and ideas. Practitioners get together to discuss new topics such as the new techniques that are being used by attackers, new defence technologies and strategies, and changes in the legal landscape that companies should be aware of. We deliver this capability through monthly webinars and in-person collaboration events. The time employees devote to participating in these events contributes to their retention of their professional certifications.

Financial institutions understand the importance of collaboration, which is why all six of Canada's largest banks belong to the CCTX. The banks recognize that through collaboration they can raise their own defences and make it more expensive for the attacker. We provide a unique cross-sector sharing forum. As an example of the beneficial and unique relationship of the CCTX, work is being done through our portal between the financial institutions and telecommunications companies on a very specific cyber-threat.

Banks have built an impressive capability to defend their networks from cyber-attack, and they are now launching a new initiative through the CCTX. They would like to share their expertise with SMEs and are working with us in helping to raise the maturity of SMEs in every sector's supply chain, not just those relating to financial services. Each bank has identified an area of expertise and presentations have been developed that focus on the needs of small and medium-sized enterprises. We're currently working on the delivery mechanism for this important initiative.

Collaboration starts with building a trusted relationship. The CCTX provides an environment where the trust can flourish. We're building a community where members don't have to be operating in isolation. When a crisis occurs, they have a community to which they can reach out for assistance. Creating this organization that shares threats and best practices across sectors and all sizes of companies is a key pillar to achieving the desired level of security in order to protect Canada's economic prosperity. Collaboration means you don't have to do it all yourself because “none of us is as smart as all of us”.

I look forward to your questions.

[The Chair, Liberal, John McKay]

Thank you, Mr. Gordon.

With that, Mr. Spengemann, you have the floor for six minutes, please.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Chair, thank you very much. I'll be sharing my time with my colleague, Mr. de Burgh Graham.

My question is for Mr. Green.

Thank you for being with us. Thank you for your expertise. I'd also like to thank you for your past service as an officer in the United States Army. I also serve on our Standing Committee on National Defence, and from the perspective of our armed forces I just want to let you know how much we value our friendship and alliance with the United States.

[Ron Green]

Thank you.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

You had a chance to visit the Canadian Centre for Cyber Security. My interest is in small and medium-sized enterprises. From your perspective, having clients that are SMEs, how much of a structural obstacle do you think cybersecurity is for start-up companies in Canada? What should the Government of Canada do more of, or do better, in terms of facilitating access to market entry points for those companies that are data-centric and depend on cybersecurity?

[Ron Green]

As someone who has visited a number of small start-ups, I can say that for many of them security may not be top of mind. It needs to become part of everything we do, not just for small businesses, but just as people.

When you leave your house every day, you lock your door. You need to have a certain level of cybersecurity hygiene in your everyday life. For businesses, especially those that have data available to them, it needs to be a part of what they do now. We're at a point in time where we need to help them with that, through best-practice sharing and access to experts. That is one of the reasons we engage with Global Cyber Alliance. We are part of many groups that provide best practices and how-tos, but it's about making tools available to small businesses to actually help them do something, rather than just telling them, “These are the things you should think about.” Give them the tools and access to the expertise.

At the cyber centre, they're certainly working on ways to provide information to small businesses. They'll never have intelligence organizations like I have, but certainly, you can break down the information enough to help them on the journey to get more secure.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

That's very helpful.

I'm going to hand it over to my colleague.

[David Graham, Liberal, Laurentides—Labelle, QC]

Thank you.

Mr. Davies or Mr. Green, I'm not sure which of you can answer this. How does liability work for financial institutions that have losses related to cybersecurity?

[Ron Green]

With cybersecurity incidents and breaches, there's a place where the victim can be victimized twice. You have the threat actors that steal the money, and then you have the ensuing civil and criminal cases that take place afterwards. Sometimes, depending on the company, they are then taxed more, or they spend more time on it.

From our perspective, we work with a body comprised of our lawyers, the acquiring company's lawyers and the merchants that are involved in the issuing. We work out a reasonable compensation between all of the impacted organizations. That's for payment card breaches. It may differ depending on other breaches that take place.

[David Graham, Liberal, Laurentides—Labelle, QC]

Are the financial institutions insured for cybersecurity? Is there a separate insurance for that?

[Ron Green]

There is cybersecurity insurance. I guess it depends upon which country you are in and the insurance that's available to you. I go through a rigorous review annually with our insurance providers to make sure that I'm maintaining a proper level of security for the organization, so that we can then take advantage of the insurance opportunities that the company provides for us.

[David Graham, Liberal, Laurentides—Labelle, QC]

This question is more open. When you're hiring cybersecurity professionals, what level of vetting is done for these people? It's not a normal job interview, or is it? Do you do vetting to make sure they are not going to introduce vulnerabilities rather than fix them?

[Thomas Davies]

I can take that one.

We do a technical review of most...in our community. It's a small community, so we benefit from the fact that we typically know someone who has worked with these individuals before. It's a plus and a minus, a pro and a con, but we often look at references and understanding the environments that they worked in before and how that work has gone. Then we go through a technical vetting process to understand. It's usually a longer cycle, which also has its negatives, in that it takes us longer to board secure professionals in this area.

[David Graham, Liberal, Laurentides—Labelle, QC]

We're talking, Mr. Finlay, about the need to expand the number of people in cybersecurity. We're trying to make sure that as we go into a massive expansion—as we saw in 1999 with the technology bubble—we don't introduce a whole lot of people whose intentions are not necessarily what we're looking for.

Is there an intention to make a degree in cybersecurity separate from a degree in computer science at some point?