CYBERSECURITY
Protecting Canada from Cyber Threats Means Protecting SMBs
The threats we face in cyberspace are rapidly evolving. In a world where our economy and essential services are increasingly online, cybersecurity is critical to ensuring the viability, continuity, and growth of Canada’s economy.
In this interview, Ulrike Bahr-Gedalia, Senior Director of Digital Economy, Technology & Innovation and Cyber. Right. Now. (CRN) campaign policy lead at the Canadian Chamber of Commerce interviews Marjorie Dickman, BlackBerry’s Chief Government Affairs and Public Policy Officer.
Dickman discusses how BlackBerry, a partner and co-chair of the CRN campaign, can help secure Canada’s digital future by protecting Canada’s small- and medium-sized businesses (SMBs). Small businesses comprise 98 per cent of Canadian businesses — highlighting the importance of protecting them from cyber threats.
ULRIKE BAHR-GEDALIA: What’s needed to strengthen Canada’s resilience to cyberattacks? Which sectors do you see as most vulnerable?
MARJORIE DICKMAN: The Government of Canada has made important strides to protect critical infrastructure from cyber threats over the past year. The ongoing review of the National Cyber Security Strategy and the introduction of the Critical Cyber Systems Protection Act (Bill C-26) will help protect Canada’s critical infrastructure from cyberattacks, particularly in key sectors like banking, energy, telecommunications, and transportation.
Additionally, BlackBerry encourages an increased focus on securing Canada’s smalland medium-sized businesses (SMBs) from cyber threats. SMBs are the backbone of Canada’s economy. In 2021, SMBs made up 98 per cent of all businesses in Canada and employed almost 85 per cent of the total labour force. Supporting the growth of SMBs is critical for Canada’s economic prosperity.
Yet, Canada’s SMBs are increasingly vulnerable to cyberattacks. According to the
Insurance Bureau of Canada, 47 per cent of Canadian small businesses did not invest in cybersecurity protection in 2021. The following statistics highlight why more needs to be done to help Canada’s SMBs establish cyber defences:
• SMBs face an average of 11 cyber threats per day (BlackBerry 2022 Threat Report
The average cost of a cyber breach is $7 million (IT World Canada)
Only 14 per cent of businesses have cyber insurance coverage limits above $600,000 (BlackBerry Cyber Insurance Study)
• 59 per cent of businesses hope that the government will cover damages for attacks linked to nation-states (BlackBerry Cyber Insurance Study)
Cyberattacks are devastating to SMBs. 60 per cent of SMBs that fall victim to a cyberattack are out of business within six months (BlackBerry 2022 Threat Report) With the rapid pace of digitalization — especially since the start of the pandemic — Canada cannot afford to leave SMBs exposed to cyber threats.
BAHR-GEDALIA: How can SMBs better protect themselves from evolving and increasingly complex cyber threats? How can using Artificial Intelligence (AI)-driven solutions reduce risk and costs?
DICKMAN: By adopting an AI-driven, prevention-first approach to cybersecurity, SMBs can increase their cyber resilience and focus on their growth. With the application of AI-driven cybersecurity solutions, it’s possible to neutralize malware threats before they have a chance to execute on a business’ systems. In addition, AI-driven cybersecurity solutions can help SMBs dramatically reduce the cost associated with recovering
from a cyberattack. If malware cannot execute, then the downstream consequences, and the resulting efforts to trace, contain, and remediate the damage from cyberattacks, are dramatically reduced. For example, a Forrester Consulting study of BlackBerry’s CylancePROTECT Endpoint Protection (EPP) solution, which uses advanced AI, found that CylancePROTECT helped a customer achieve a 95 per cent reduction in lost employee time due to faster threat investigation and remediation. In short, AI-driven cybersecurity solutions give SMBs the ability to protect themselves from highly sophisticated cyber threats and achieve cost savings.
BAHR-GEDALIA: As a partner and co-chair of Cyber. Right. Now., could you summarize in one sentence what the initiative is trying to achieve?
DICKMAN: The Cyber. Right. Now. campaign aims to make Canada one of the most cyber-secure countries on the planet. It’s a unique initiative championed by the Canadian Chamber of Commerce, BlackBerry, and more than two dozen leading technology and cybersecurity organizations, including Microsoft Canada, Amazon Web Services (AWS), General Dynamics Mission Systems-Canada, Cenovus Energy, Sun Life, BMO, Calian, and eSentire. Together, we’re urging the Government to make cybersecurity a top priority and Canada, a world leader in cyber protection.
To learn more about BlackBerry’s AI-Driven Cybersecurity solutions, visit BlackBerry at blackberry.com/us/en/ products/cylance-endpoint-security
To learn more about the Cyber. Right. Now. campaign, visit the Canadian Chamber of Commerce at chamber.ca/ campaign/cyber-right-now
This article was made possible with support from the Canadian Chamber of Commerce
Diversifying Talent Pool Key to Solving Cyber Talent Shortage in Canada
Long thought of as the domain of people with specific technical skills, the cybersecurity industry welcomes people with diverse backgrounds and perspectives.
Demand for cyber talent in Canada is high because of the increased number and complexity of threats facing organizations of all sizes. And for employers trying to meet the growing needs of the sector, figuring out how to attract, recruit, and retain qualified cybersecurity talent is an ongoing challenge.
Rogers Cybersecure Catalyst — Toronto Metropolitan University’s national centre for training, innovation, and collaboration in cybersecurity — is working to solve this problem. “We bridge the talent gap by working to ensure there’s a consistent supply of cyber professionals with in-demand skills,” says Rushmi Hasham, Director of Accelerated Cybersecurity Training Program and CyberStart Canada at the Catalyst.
To diversify the talent pool and provide access to training, the Catalyst launched the Accelerated Cybersecurity Training Program (ACTP) in 2020. “The program is specifically designed to give women, newcomers to Canada, and individuals who’ve recently lost employment the opportunities and skills needed to launch a successful career in the sector,” says Hasham. ACTP learners earn three GIAC Certifications within seven months, which qualifies them for entrylevel cybersecurity roles.
While many may perceive cybersecurity as restricted to people with highly developed technical skills, there’s no single cybersecurity persona. The field is open to virtually anyone who is interested, regardless of their professional background, education, and industry experience. In recent research conducted by Blueprint — a non-profit research organization — in partnership with Future Skills Centre, the top three non-technical skills that cybersecurity employers look for are verbal communication skills, problem-solving and critical thinking, and attention to detail.
“Cybersecurity is one of the most welcoming industries, and the more we bring in diversity of thought and background, the more we’re able to create solutions that are as diverse as the problems that are coming at us,” says Hasham. Cybersecurity employers are invited to connect with the Catalyst to gain access to a talent pipeline of certified and employment-ready cyber professionals.
The Search for True Randomness: Quantum Hardening of Cybersecurity’s Weakest Link
With cybercrime skyrocketing, cybersecurity experts are working overtime to not only protect systems against sophisticated attacks but also against the unprecedented threat of quantum computing. Fortunately, innovation in quantum security is helping them stay ahead of the curve.
Join the conversation by taking our cyber talent survey or learn more about hiring skilled cyber talent at cybersecure catalyst.ca
Why a Career Transition to Cybersecurity Is Not a Far-Fetched Idea
Deloitte’s
Protecting Canada against cyberattacks is a daunting challenge. Cyber breaches have increased by 4,379 per cent between 2015 and 2020, according to Risk Based Security — costing billions of dollars from ruined reputations, lost sales, and legal costs. Aware of the threats, organizations are stepping up their cybersecurity. However, they face the problem of not having enough skilled talent in the industry.
Discover the quantumsafe future of cybersecurity at quantum emotion.com
The quantum computing revolution is imminent, and it brings with it an existential threat to traditional encryption and cybersecurity, even as we find ourselves in an era of unprecedented cybercrime. It’s vital that we evaluate today the quantum vulnerabilities of our systems, and that we be equally cognizant of the opportunities to bolster these systems with quantum reinforcement.
Significantly, the advent of quantum random number generators (QRNGs) is providing an opportunity for immediate future-proofing by enabling cryptographic systems that are truly secure against all random number attacks.
“Currently, encryption seeds are generated by pseudorandom number generators that are essentially algorithms using mathematical formulas to produce sequences of seemingly random numbers,” explains Francis Bellido, CEO of Canadian quantum-safe cybersecurity innovator Quantum eMotion. “We have produced a second-generation QRNG based on the quantum tunneling phenomenon created by electrons, unlike other competitive technologies which depend on photonics physical properties. This new approach shows distinctive advantages in terms of robustness, speed, scalability, and cost.”
Quantum eMotion’s QRNG technology is just 10 microns across, making it possible to enjoy this added layer of security in all contexts, embedding it into pre-existing chips in computers, smartphones, or any other device that connects to the Internet.
Tomorrow's essential security is today’s peace of mind
Adopting this type of quantum-enabled security measure today not only provides essential future-proofing to sensitive digital systems, it also functions as a key safeguard against the ever-increasing assault of conventional cyberattacks. “Cyber threats are growing more sophisticated by the day, and the cost of breaches to North American businesses is measured in the billions of dollars,” says Bellido. “The difficulty in sourcing truly random numbers has long been known to be a existential vulnerability to our digital security systems, and embracing the power of quantum randomness today is the only way to get a full step ahead of the most dangerous cybercriminals, before they have access to next generation quantum tools of their own.”
In 2020 Deloitte made a goal to make Canada a safer place. To do that the company has taken actions to help fill the skill gap, through various hiring programs, partnerships with post-secondary, and developing cybersecurity skills base with new individuals not traditionally found in cyber or IT. To help fill the skills gap, Deloitte — a worldwide leader in cyber strategy consulting and cyber intelligence — is inviting professionals from different industry backgrounds to make a career transition.
Existing skills, additional training, and supportive culture ensure successful transition
Lillian Piao, Senior Manager with a cybersecurity team in Deloitte’s Risk Advisory practice, is one of them. With a degree in electrical engineering, she spent six years in the energy sector within the operational technology field. As she reflected on her career path, she realized she was starting to feel a bit repetitive. Shortly thereafter, Justin Fong, a partner in Deloitte’s cybersecurity practice, reached out to her with an opportunity. “I was curious, but I didn’t have
careers.
a lot of background in the area,” says Piao. She decided to give it a try, and nearly six years later, Piao is enjoying a rewarding career, supporting clients on large cybersecurity programs to mature their cybersecurity practice. She was able to use some of her prior professional background and industry knowledge to fill her skills gap. The rest she did through additional training, coaching, and certification. Piao credits Deloitte’s open and supportive culture with helping to ease the transition. “It can be really nerve-wracking when you’re starting in an area where you don’t have a lot of knowledge, but my peers and superiors were amazing and made me feel very comfortable,” she says.
Right now, we have people who’ve been in the industry for many years as well as a lot of new talent just coming out of school, but the real gaps are in the middle, and one way to fill those gaps is through career change.
background. This is not the case. “There are many different types of roles and jobs in the field,” says Piao. These range from technical roles in IT to roles in strategy, business development, incident response, and risk management, which require soft skills. Other traits such as analytical and critical thinking and the willingness to build skills through self learning will make this transition a rewarding one. “I’m constantly learning and developing, especially as we evolve our Cyber Target Operating Model.” she says.
A burgeoning industry with high demand for talent Cybersecurity is a burgeoning industry. A 2018 Deloitte report estimated that 1.8 million cybersecurity jobs would need to be filled by 2022. “There’s still a talent shortage in cybersecurity,” says Piao. “Right now, we have people who’ve been in the industry for many years as well as a lot of new talent just coming out of school, but the real gaps are in the middle, and one way to fill that gap is through career change,” she says.
In being the catalyst for training and nurturing cybersecurity leaders, Deloitte is ensuring a broader cybersecurity talent pool for Canada as a whole, thereby helping to keep Canada safe from cyber
All Hands on Deck: The Skyrocketing Demand for Canadian Cybersecurity Skills
The impact of cybercrime on the Canadian economy is measured in the billions of dollars, but so too is the economic contribution of the rapidly growing cybersecurity jobs sector. As cyber threats and cybersecurity systems continue to multiply and grow ever more advanced, the biggest question is how to fill thousands of available cybersecurity positions with appropriately skilled workers.
D.F. McCourt
Cybercrime in Canada is reaching crisis levels. The federal government estimates the damage to the country’s economy somewhere north of $3 billion annually. With the cost of an individual breach or ransomware attack on a business usually measured in millions of dollars, companies — large and small — are scrambling to hire the most qualified cybersecurity experts. That’s easier said than done. Job openings in the field appear faster than people can be trained with the specialized skills needed to fill them.
“From supply chain disruptions in the private sector to ransomware attacks on governments, cybercriminals have become increasingly sophisticated and the threat landscape more diverse,” says Kevin Magee, Chief Security Officer at Microsoft Canada.
a whole is more vulnerable to cyberattacks,” Mondou says.
Solving the talent time-to-market problem
With the demand for cybersecurity professionals doubling every year, the immediate need requires a better approach to training cyber talent. The first step is to fully leverage the cybersecurity talent we already have available in Canada. TECHNATION’s Career Ready Program, funded by the Government of Canada’s Student Work Placement Program, is one important way to address the growing time to market challenge.
“As part of TECHNATION’s Career Ready Program, we worked collaboratively with SkyHive, who are developing some of the world’s most advanced reskilling technology based on Quantum Labour Analysis, to develop and deploy CareerFinder,” says Mondou.
The job gap Canadian industries are experiencing across the board means that Canada as a whole is more vulnerable to cyberattacks.
“These cybersecurity challenges are compounded by a workforce shortage; there simply aren’t enough people with the cybersecurity skills needed to fill open jobs. This is a global problem. By 2025, there will be 3.5 million cybersecurity jobs open globally, representing a 350 per cent increase over an eight-year period, so there will be no shortage of career opportunities in the field in Canada.”
“CareerFinder is a first of its kind in Canada, a leading-edge digital labour market intelligence platform and unique national asset, which uses artificial intelligence and machine learning to identify critical workforce skills needed across all sectors both in the present and in the future.”
expedite the connection to talent between industry and academia to address the ongoing cybersecurity talent shortage. “We need more bold thinking like we see at Lassonde. Canadian post-secondary institutions must start modernizing curricula with WIL and closer industry partnerships now or we will continue to fall behind as a global tech leader.” says Mondou.
Injecting cybersecurity skills at every level
The CareerFinder platform shows over 4,000 open cybersecurity positions across Canada daily. To meet growing demand, TECHNATION is working with industry and academia to push new and innovative forms of Work Integrated Learning (WIL) to accelerate tech talent in critical areas. TECHNATION has also partnered with Microsoft Canada to pilot the Explore internship program, which helps students from diverse academic and cultural backgrounds to realize career pathways into the digital workforce and cybersecurity.
“Education and skilling-focused programs and tools like Explore and Career Ready are helping to equip and empower the next generation of digital leaders with the essential skills our economy needs to thrive in the future,” Magee says. “A challenge of this scale is significant, and to address it, tech companies like ours, governments, academia, and business will need to work together to provide skilling opportunities both to skill-up our own employees and to grow the cybersecurity workforce by attracting new people to the profession.”
The growing cybersecurity job gap and unfilled positions, is not a viable option. Angela Mondou, President and CEO of TECHNATION Canada, the leading national technology association, compares the current situation to a military with thousands of soldiers and aviators absent from the ranks during wartime.
“The job gap Canadian industries are experiencing across the board means that Canada as
TECHNATION has been advising on Lassonde School of Engineering at York University's work-integrated degree program in Digital Technologies, a first in Canada. Students earn a salary while working with the same employer throughout the fouryear degree and 20 per cent of their student worktime is allocated for academic learning — delivered in intensive, year-round blocks. This program is expected to produce many cybersecurity analysts and other cyber professionals. It’s an innovative program to
Rising cybercrime presents a tremendous challenge to Canadian businesses and government, but the skyrocketing demand for cybersecurity professionals also presents a tremendous economic opportunity. TECHNATION and its partners are hard at work finding innovative ways to meet this challenge and opportunity in ways that benefit Canada, Canadian businesses, and Canadian workers.
When security, privacy, and data management services (people undertaking process with supporting technology) work in harmony as part of a cohesive cyber framework, the organization moves from the tactical to the strategic.
What the Convergence of Cyber Risk Means for Your Business
“What’s next?” — The question plaguing businesses trying to manage corporate cyber risk. Complexity and risk are increasing as the domains of security, privacy, and data management converge. This is the convergence of cyber risk.
Keith Jonah
Businesses that don’t adapt to this new reality can face dire consequences: business-risk decisions made in isolation will drive up costs through redundancy and inefficiency. Projects initiated without context won’t deliver the highest return on cyber investment, nor address the most pressing corporate needs. As the lines between security, privacy, and data management dissolve, a decision in one area can affect multiple aspects of the enterprise.
Bringing order to chaos
But this “Convergence of Cyber Risk” creates opportunities as well. Adopting a holistic view of cyber breaks down the traditionally siloed areas of security (information technology, operational technology, internet of things, and more), compliance, business continuity, third-party/supply chain management, personnel, and privacy risk. Taking a riskbased approach — rather than chasing the latest technology or a flashy point solution — brings order to chaos. Security, privacy, and data management initiatives can be driven by well-coordinated and defined corporate requirements and shaped to address all cyber legislative/regulatory requirements, governance, corporate policy, industry standards, and control objectives. When security, privacy, and data management services (people
undertaking process with supporting technology) work in harmony as part of a cohesive cyber framework, the organization moves from the tactical to the strategic.
A new era equals new opportunity
The starting point for a comprehensive cyber program is “by-design” compliance with regulation and legislation. Then, applying a risk management paradigm ensures that the organization addresses real-world risks cost-effectively and balances those risks against other critical organizational imperatives, such as ensuring timely, effective, and efficient services.
ISA Cybersecurity’s Cyber Management Consulting (CMC) practice helps businesses benefit from the convergence of cyber risk. CMC is led by some of the most accomplished and experienced experts in Canada and backed by an extensive network of cyber professionals developed over 30 years in the business. We ensure appropriate rigour and internationally-recognized techniques are applied to the analysis and management of security, privacy, and data management risk and the development of programs and solutions. We can help you decide, “What’s next?”
