BY JAMES CARELESS

Where Canada’s Cyber Defences Stand Now

The cyber domain has become as much a military battlespace as the air, land, and seas — and winning here is becoming just as strategically important for Canada and its allies. At the same time, the cyber domain is an extremely dynamic battlespace, due to advances in the technology and aggressor software that shape it. Those ‘forces’ are constantly on the move and unlike tanks, jets, or ships, what worked in the cyber defence sphere six months ago may no longer be effective today.

            This is why this year’s CDR Cyber Report is providing news and views from some of the most pivotal Canadians in this domain. Rather than adhere to a common set of questions, we’re letting the experts focus on what they think CDR’s readers need to know.

THE BIG PICTURE

            As Canada’s first line of defence against hostile nations, the Canadian Armed Forces (CAF) are a natural target for cyber attacks. Repelling and countering these threats is the job of the CAF’s Cyber Forces. Under the leadership of RAdm Luciano Carosielli — appointed Cyber Forces Commander (CFC) in July 2022 — the Cyber Forces respond to cyber incidents on DND/CAF networks; integrate defensive cyber operations into broader military operations; strengthen DND/CAF cyber defence systems, network monitoring and control; and conduct offensive cyber operations against potential adversaries in the context of government-authorized military missions.

            Asked about the cyber threats currently confronting DND and the CAF, Radm Carosielli was understandably discreet. “To safeguard our national security and operations, the Department of National Defence/Canadian Armed Forces does not release information related to specific incidents, vulnerabilities, or other technical details of the networks or security measures taken to defend them against alleged or actual cyber threats,” he told CDR. “I can say that cyber threat actors are a constant for any Internet-facing network. Cyber threats are evolving rapidly as threat actors adapt their behaviour and tactics to the ever-expanding use of technology and growing opportunities for individuals to connect to the Internet.”

            The twin forces of technological evolution and widely available Internet access are making life harder for the CAF and its allies in a number of ways. For instance, “as more smart devices connect to the Internet, cyber threat actors are presented with an ever-increasing number of attack surfaces to exploit and opportunities to access networks that were otherwise protected,” said RAdm Carosielli. As well, “espionage technology that was previously accessible only to a select group of nations is now available off-the-shelf from a wide range of cyber threat actors who either provide or purchase the access and services.”

            Meanwhile, the combination of outdated legacy IT security practices, requirements for software to be easy to use and understand, and overall complacency, have resulted in poor ‘cyber hygiene’. “Too often, cyber hygiene lacks the increasingly complex and innovative methods cyber threat actors employ to compromise networks,” he noted.

            That’s not all: Supply chains that were relatively safe from physical threats have become increasingly vulnerable to disruption as they continue to be accessible through the Internet. At the same time, well-funded state-sponsored cyber threat actors are launching selective cyber attacks that are efficient and cost-effective, while falling below the threshold that would trigger an armed response. “This means that threat actors can disrupt military operations without firing a single shot,” said RAdm Carosielli. Add in the use of artificial intelligence (AI) to crack passwords, and Canada’s Cyber Forces are being assaulted by cyber threats on many fronts.

            In response to these many cyber attacks, the CAF’s Cyber Forces are now focussed on understanding evolving threats and responding to incidents on DND/CAF’s Information Management/Information Technology networks.

            “We have a strong cyber security posture, which employs a layered defence model encompassing multiple capabilities,” RAdm Carosielli said. “Examples of such capabilities include physical access controls, firewalls, and antivirus software. These tools are supported by enhanced monitoring, detection, and response. Simultaneously, we are developing capable CAF Cyber Forces to deter, defend against, and defeat Canada’s adversaries in and through cyberspace,” he continued. “DND/CAF has been working for over a decade to develop a military cyber capability and we continue to evolve our understanding of the cyber domain, which DND/CAF recognizes as a domain of war.”

            In cyber warfare, as with physical warfare, going alone is not a path to military success. “This is why Canada needs to be interoperable with allies and partners,” RAdm Carosielli told CDR. “The rapidly evolving threat landscape and the close, integrated coordination in the cyber domain among the CAF’s closest partners and allies necessitates dedicated, agile leadership and an operational focus on delivering effects in joint, integrated operations.”

            To strengthen Canada’s military cyber defences, the recently-released Defence Policy Update ‘Our North, Strong and Free’ will see DND/CAF establish a CAF Cyber Command to help maximize Canada’s effectiveness in the cyber domain. “CAF Cyber Command will consolidate our cyber warfighting capabilities into a single, adaptive and interoperable command structure,” RAdm Carosielli said. “This structure will provide strategically relevant, operationally responsive, and tactically decisive cyber forces and effects as part of government-authorized military missions and in accordance with domestic and international law. Echoing similar moves by allies, a dedicated cyber command will reflect the essential role of cyber in modern operations and demonstrate to our allies, partners, and adversaries, Canada’s commitment to operating in a contested cyber domain.”

            Unfortunately, Canada and our allies are not the only ones spending money on the cyber domain. “I can confirm that our adversaries have made — and continue to make — significant investments in cyber capabilities,” said RAdm Carosielli. “Russia, China, and North Korea (DPRK), as well as others, are all active in the cyber domain in service of their own strategic goals.”

            Here’s the problem: Our adversaries are investing in cyber warfare because they see it as an effective way to hamper and hit back against the West — even though each one of them has different motivations for doing so.

“For example, Russia believes itself to be in a constant state of conflict with Western nations,” RAdm Carosielli said. “This is most apparent in the cyber and information environment. China sees competition in the information environment as a lever in its current and future foreign policy. Iran continues to build and employ cyber as a core component of its hybrid warfare capabilities, which it uses to influence its regional and strategic goals in the Middle East. [And] North Korea continues to develop increasingly innovative and complex cyber capabilities designed to steal and launder funds necessary to support its regime and weapons programs.”

            Although the methods used and intended targets differ, Canada’s adversaries commonly engage in the following cyber activities on a near-daily basis. These activities include the development of cutting-edge AI, machine learning (ML) and Quantum computing to ramp up the effectiveness of their cyber attacks; targeting non-military targets to influence Western government operations and foreign policy; spying on the West to steal advanced technology; ransomware attacks to gather intelligence, steal money, and sow chaos; and misinformation campaigns to manipulate our media and political processes. To make matters worse, “some of our adversaries have extensive links into criminal organizations that conduct criminal activities through the Internet to support the state,” said RAdm Carosielli.

            Faced with these multinational volley of threats, the CAF’s Cyber Forces have been seeking partners to assist with its cyber struggles within government and the private sector. “DND/CAF, in coordination with our fellow Government of Canada departments, industry and supporting agencies, keep a vigilant eye on the ever-evolving cyber domain to constantly assess and improve our network defences from all avenues of attack,” RAdm Carosielli told CDR. “To the best of our ability in a resource limited environment, we work with TBS (Treasury Board Secretariat), CSE (Communications Security Establishment) and CCCS (Canadian Centre for Cyber Security) and other government agencies to continuously improve our method of engagement with industry. Our goal is always to provide better safeguards for information and enact sharing of threat information to ensure that our operational capabilities and personnel are both secure and resilient and have the capacity to respond to cyber events.”

            Of course, all of this effort can be foiled if inattentive and/or uninformed employees click on phishing emails that open their networks to hackers. This is why DND/CAF has to keep investing in training and education to develop a cyber-savvy workforce that can spot and block cyber attacks, as well as constantly updating its own understanding of cyber threats.

            “More broadly, there is an ongoing need to invest in the people, core capabilities and processes to be able to do more for Canada in cyberspace and to ensure the CAF remains interoperable with allies and partners,” said RAdm Carsielli. He then pledged that, “from resilience to defence to offensive capabilities, DND/CAF will build CAF Cyber Forces capable of executing operations in the cyber domain in the same manner that traditional services execute operations in the land, air, maritime and space domains and come together jointly to achieve greater outcomes in support of Canadian interests.”

CCTX

“Cyber security has become a matter of national security,” observed Robert (Bob) Gordon, Strategic Advisor with the Canadian Cyber Threat Exchange (CCTX). “All conflicts involving DND/CAF now include a cyber component.”

            Considering that the CCTX is a national organization that shares cyber threat information and best practices across 15 economic sectors representing 1.5 million employees, Gordon knows what he’s talking about. His assessment of DND/CAF’s cyber challenges mirror those of RAdm Carosielli, but with some extra elements in the mix.

             A case in point: “Some non-state actors now have the cyber offensive capability of nation states,” Bob Gordon told CDR. Meanwhile, cyber threat actors can disrupt DND/CAF’s supply chains and critical infrastructure. That’s not all: “Cyber attackers can deploy deep-fakes to give a distorted perspective of the CAF thereby weakening public support,” he said. “All of this is taking place through the communications networks owned and operated by the private sector and used by the public.”

            The good news is that DND/CAF faces the same cyber security challenges as large corporations and municipalities. This means that the security solutions that protect business and government data/networks can protect our military as well.

            Moreover, “recognizing that they share similar risks provides an opportunity for DND/CAF to collaborate with the private sector in sharing cyber security best practices and experiences,” said Gordon. This is more good news, because “Canadian technology companies are leaders in innovation and are anxious to provide their capabilities to DND/CAF. For example, the private sector is undertaking research and development in advanced technologies, including artificial intelligence and quantum computing, which are essential for DND/CAF operational capability.”

            Private sector input for cyber security could also help the CAF cope with human resources shortages. “Some of this technical capability, particularly the use of artificial intelligence, can be used to provide capability in areas where existing human resources are lacking,” Gordon said. “Employee retention can [also] be increased through the deployment of tools such as GenAI to reduce or eliminate some mundane tasks while creating a more satisfying work environment.”

            The CCTX’s bottom line cyber advice to DND/CAF? “Cyber security requires people, technology and policy,” said Gordon. “No organization has sufficient resources to meet these requirements on their own. Partnering with the private sector and taking advantage of their capabilities is one method to achieve positive results in all three areas.”

LASTWALL

            When it comes to cyber security issues and the CAF, Lastwall CEO Matthew Bentley also knows what he is talking about. Lastwall is an Identity and Access Management (IAM)/ Post-Quantum Cryptography (PQC) company that has successfully navigated the Innovative Solutions Canada (ISC) Testing Stream and been qualified to sell its quantum resilient identity platform directly to the Government of Canada through the Pathway to Commercialization (PTC) program. Prior to joining Lastwall, Bentley spent two decades with the CAF, including as an Information Operations Officer deployed to Latvia as part of OP REASSURANCE.

            Based on what Matthew Bentley told CDR, the biggest cyber threat to DND/CAF comes not from ingenious hackers halfway around the world, but rather those of its employees who don’t take cyber security seriously — namely by clicking on innocuous-looking emails and links that are anything but innocent.

            “The primary threat stems from identity attacks,” he explained. “Lost or stolen credentials account for the majority of cyber attacks and data breaches. These can range from simple phishing schemes to sophisticated social engineering and man-in-the-middle attacks, depending on the target’s value.”

            The reason identity attacks can be so dangerous is because, once inside the network, a hacker can gain access to sensitive information using legitimate credentials. “Once access is secured, the attacker’s actions depend on their goals: They might deny access and demand a ransom, contaminate information to undermine decision-making, or simply copy and extract the information,” said Bentley. “Without robust identity and access controls, it is imprudent to fully trust the integrity and accessibility of your information.”

            Another often overlooked threat involves subversion and misinformation operations by China and Russia, targeting DND/CAF employees and soldiers through suspect social media platforms. “The Canadian Government’s decision to ban TikTok from government phones is a step in the right direction, but this social media platform remains accessible to soldiers and citizens alike,” Bentley told CDR. “Coupled with open-source information that can be purchased and data already stolen from breaches like the one at the Royal Military College, this pose a serious threat. The more information our adversaries have on us, the better they can tailor their subversion and misinformation tactics.”

            Like CCTX’s Robert Gordon, Matthew Bentley does have some good news to offer about DND/CAF’s cyber defence efforts. “Although I retired from the CAF in 2021 and do not have a complete view of current measures, there are a few positive developments I have noticed,” he said. “The Pan Domain Force Employment Concept is driving the digital transformation of the CAF. The Cyber Mission Assurance Program is ensuring cyber threats are considered during procurement. Additionally, LCol Ted Dossev’s recent paper, ‘Defense Against the Dark Arts: Force Protection from Cognitive and Ideological Manipulation,’ offers a solution to cyber threats, particularly in building resilience against subversion and misinformation attacks. While more undoubtedly needs to be done, these initiatives are promising signs.”

            Also like Gordon, Bentley said the DND/CAF’s next best step is to tap into the private sector’s cyber expertise. “To enhance its ability to counter these threats, the DND/CAF should engage more meaningfully with industry, particularly small innovative companies rather than large prime contractors,” he explained. “Programs like IDEaS [Innovation for Defence Excellence and Security] and ISC/PTC are good in principle, but from my experience, the reporting burden on small businesses often outweighs the benefits of modest investments. Industry is ready to support, but a more substantial program to fund innovation is needed.

            “Despite these efforts, more needs to be done to bolster DND/CAF cyber security,” concluded Bentley. “Bureaucratic processes often lag behind the rapid pace of technological advancements, making it crucial to streamline decision-making and implementation processes. Increasing investments in cybersecurity training, enhancing inter-agency and international cooperation, and fostering a culture of cyber hygiene within the military are essential steps forward.”

THE BOTTOM LINE

            Despite their best efforts, DND/CAF need help from the private sector to bolster and boost Canada’s military cyber defences. On the positive side of this story, the people at DND/CAF have grasped this truth and are working to do more with industry to improve the cyber situation. On the negative side, much more could be done if DND/CAF were freed by the federal government to collaborate much more closely and proactively with the private sector on cyber security and cyber defence than they are now. On this matter, the ball is definitely in Ottawa’s court.

James Careless is CDR’s Ottawa Bureau Chief