Public Safety Committee on April 3rd, 2019

[Glenn Foster]

As an industry, we don't present pop-ups within the log-in transaction. We all provide guidance on our online banking websites about what strong passwords are. We do proactively disable accounts if we suspect there's nefarious activity, or we've identified these credentials on the dark web or what have you. That would force a customer to go through their password reset flow and reauthenticate themselves through other means that they are legitimately who they say they are. Then we reinstate their accounts.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

I'm just trying to think about my sense, and what other people have said, and it doesn't strike me as being untrue that people might use a certain number of go-to passwords. That is one of the biggest compromises of their personal cybersecurity.

[Glenn Foster]

[Inaudible--Editor] usually gets passwords or password reuse. It's commonly obtained through various breaches at less sophisticated companies.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

I know that when you sign on to different sites, they all say, “You need stronger passwords.” You've used a capital letter and thrown in some type of symbol, a number sign or something, and a certain number of characters, but there's nothing I can picture that says, “Hey, have you used this password before?” Is that not a simple way to at least jog people's memory? Sure, you're doing this because it's convenient, but you're reducing your security. Is there not something you could put in there, as part of those eight symbols or letters, or whatever thing you prompt people on?

[Glenn Foster]

We obviously can look at additional ways to educate customers and consumers along the way.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

Thank you.

You talked about the need to have more programs to train people. What hasn't been clear for me is what training is required. It seems there are different types of standards and that some places might hire without a person's having a specific cybersecurity degree, and some places might not. What do you need as training for your workforce? What are you looking for, as training?

[Glenn Foster]

It would be to have more academic institutions offering cyber-related programs, and that goes to your point on different depths. Some are on basic security operations, as offered by local colleges, or basics of cybersecurity and networking. You could talk about the ethical hackers or the white hats that we talked about before. Moreover, there's the far more technical level of security that we commonly refer to as “application security”. That would be beneficial.

If you look at the number of schools that offer these types of programs, you see that although we have some leading programs within Canada, they're not as broad as they need to be, and the number of students going in there is not what we need it to be.

I see talent, over the next decade, as probably being the number one crisis within large institutions in how we're going to meet the growing cyber-threat.

[The Chair, Liberal, John McKay]

We have about four minutes left, and I'm sure Mr. Spengemann would appreciate the generosity of Mr. Eglinski to split that four minutes.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Sure.

[The Chair, Liberal, John McKay]

You can have one question each.

[Jim Eglinski, Conservative, Yellowhead, AB]

I have three questions, but I guess I'm going to have to work really quickly.

You talked about Israel and how collaboration works very well there because a lot of these people came through back-door military training and such.

Do you have a collaboration among the other major lending institutions in Canada? Do you work together and feed information back and forth, for example on what's a bad thing, a good thing, etc.?

[Glenn Foster]

Yes, we do.

[Jim Eglinski, Conservative, Yellowhead, AB]

And in your system, do you have the capability of finding out if someone is hacking the customer's system at home? Can you let your customers know through your ability to check them?

[Glenn Foster]

On the first part of that question of whether we share information with each other, yes, there is a threat-intelligence working group under the CBA cybersecurity specialty group, which all the banks and CSE attend and provide updates to as well, which we find very helpful.

We share indicators of compromise. These are technical indicators on the types of threats and bad actors that we see and how to identify them. We find there's a great strength in doing that. We know that adversaries, criminals, share very broadly in the dark web and in other chatter about vulnerabilities they find in institutions and banks. I think likewise, we should take advantage of that.

On your second question of whether we see vulnerabilities that occur in the customer's home, no, we do not. Typically all we see is the transaction as it comes into our servers.

[Jim Eglinski, Conservative, Yellowhead, AB]

Did that sound like two minutes?

[The Chair, Liberal, John McKay]

Almost, but Mr. Spengemann is going to appreciate your generosity. He might even send you a birthday card.

[Jim Eglinski, Conservative, Yellowhead, AB]

Thank you. That's very nice of you, Mr. Chair.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

I'll send candles.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Thank you, Chair, and thank you, Mr. Eglinski.

Thanks very much, Mr. Foster. As a former employee of TD, it's a pleasure to welcome you.

I'll roll my questions into one. We have the privilege of having you here as the chief information security officer of a major bank. Can you give us some insights into how your role is structured, what your responsibilities are and how you intersect with other major parts of the bank?

In the same breath, can you give us an appreciation of how much room there is for a major bank to be creative to develop its own security platforms? To what extent are you really constrained by the realities of the use of digital technology in limiting, first of all, the percentage of expense on security, but also the options that exist in terms of what you do to protect daily operations?

[Glenn Foster]

Where I sit organizationally, I report to the head of enterprise operational excellence, who reports to our group head, who reports directly to our CEO. My group has a head of innovation technology and shared services at TD Bank.

We felt that for strong governance, it was important to separate the CISO role from the technology organization, both for objectivity and as a reflection that cyber is really a business risk, not a technology risk.

We find that business engagement, in terms of process and products and how we engage our customers, is paramount to the success of our cybersecurity program.

As far as your other question is concerned, I had a bit of difficulty understanding whether you were talking about a percentage of spending or caps on spending.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

It was on the cost of providing security. In other words, are your options effectively prescribed or constrained by the current marketplace, or are there creative options and even differences among the major banks in terms of how much they spend on security as a percentage of total operating costs?

[Glenn Foster]

I think there is variability among banks, partly because we're not necessarily all organized exactly the same way. If you look at any information security organizations, it's the 80-20 rule: 80% of us have the same things in our organization, and 20% may be federated or decentralized in other areas. It's very difficult to track apples to oranges.

At TD bank, cyber is the top risk. Getting budgets is not a problem for me. We have top executive support, we have board support, for the program. Any constraint I face would probably be in the form of two things.

First is the amount of change the organization can go through in a given year. This is a fast evolving space. My spend has been growing at a compound annual growth rate of about 35% to 40% year over year. That's a lot of change to try to push into the organization.

Second is the availability of commercial products. The explosion, as I would call it, of security products within the industry is a lot to weed through to decide what's more hype than legitimate protection. I would find that for the most advanced organizations—we talked about big data and AI—the most uplift in the coming years would be in investments in our own skills and our people with data science and to be able to solve the problems of our bespoke applications as opposed to the general use vendors.

[The Chair, Liberal, John McKay]

Thank you, Mr. Spengemann.

Unfortunately, we have to bring our time with Mr. Foster to a close.

I want to thank you for your patience with us.

With that, the meeting is adjourned.