![4 INDUSTRYANDBUSINESS.CA
V
irtual Private Network (VPN)
services have grown in popu-
larity with consumers for
their ability to provide great-
er freedom online, and for businesses
who can utilize the additional privacyto
protect sensitive data.
More recently, VPNs have largely been
consumer-focused because of how they
anonymize activity online and— in some
instances—circumventgeo-restrictedcon-
tent.WithanIPaddressinadifferentcoun-
try,the users can access that content as if
theylivedthere.However,VPNusagestart-
ed out almost exclusively for business,al-
lowing employees to have a direct,secure
connection toworkplace systemswithout
compromising the data and communica-
tionsintransit.
Cybersecurity has grown in sophistica-
tion toward off more intricate attacks.The
cost of global ransomware damages was
expected to exceed $5 billion (U.S.) in 2017,
accordingtoacybercrimereportfromIDG
Communications.
“[Enterprises]needtolockdowntheirin-
ternal networkswith a securelyencrypted
layer placed over their Internet service,”
says Benjamin Van Pelt,Founder and CEO
of TorGuard, a VPN provider. “A VPN en-
crypts data so it can’t be used or under-
stoodbycorporatespies.YourInternetSer-
viceProvider(ISP)mightalsoroutinelylog
anythingfromsensitivecorrespondenceto
contracts and trade secrets thatyou trans-
mit.Encryption makes the data worthless
toanyonewhohacksyourISP.”
Building a tunnel
Employees are increasingly mobile and
using multiple devices, meaning attack-
erscanexploitthevulnerabilitiestheycre-
ate.PublicWi-Finetworks—particularlyat
hotels and airports— are among the riski-
est because attackers could set up dummy
networks that route traffic through them,
VanPeltadds.
Unsuspecting employees connecting
to such networks could expose more than
justthedatastoredontheirdevicesifthey
“phonehome”andlogintotheircompany
systems. VPNs can encrypt information
betweenuserssothatitisanonymizedand
indecipherabletoanunauthorizedviewer.
It is also possible to use an encrypted
VPN that identifies each user logging in-
to the company’s system through unique
IPs assigned to specific users. “Each of
these unique IP addresses can be assigned
to specific employees who have access to
sensitive systems,” he says. “If I assign a
specific VPN IP address to the system ad-
ministrator,only that person is able to ac-
cessareasofthenetworkassignedtothem.
Access using any other IP address will be
denied.It’s one of the most effective ways
to improve security and protect business
portalsfromunauthorizedaccess.”
Ensuring data protection
New data protection and privacy regula-
tions in Canada under the Personal Infor-
mation Protection and Electronic Docu-
ments Act (PIPEDA) sets out rules on how
businesses handle and store personal in-
formation.The European Union’s General
Data Protection Regulation (GDPR) will go
intoeffectonMay25,2018.
Therearenospecificrulesgoverningthe
use of VPNs, but doing business in other
countries can pose other risks.Both China
and Russia moved to ban allVPNs outright
in2017,withChinarecentlyoptingtoallow
only state-approved VPN services to oper-
ateinthatcountry.
Sincebusinessesprimarilyusetheseser-
vices so employees can secure data when
working remotely, the restrictions could
also block certain applications or pro-
grams theyare required to use for their re-
spectiveroles.VanPeltbelievesdouble-lay-
ered encryption technology could be a
workaround that blocks government cen-
sorsfromspottingthesecureVPNtunnel.
“The primary reason that these busi-
nesses use a VPN is to keep their data se-
cure when employees are working out-
sidetheoffice,”hesays.“Myadvicetobusi-
nesses is the same,whether they operate
entirely in Canada or internationally: If
you’re not fullyin control ofyour network,
thenyouwanttouseaVPN.”
Benjamin Van Pelt
Your Internet Service Provider
(ISP) might also routinely
log anything from sensitive
correspondence to contracts and
trade secrets that you transmit
Businesses Look to VPNs
for Secure Data Protection](https://image.slidesharecdn.com/theimportanceofinformationsecurity-210524052409/85/The-importance-of-information-security-4-320.jpg)
![8 INDUSTRYANDBUSINESS.CA
Future of Data Security
With businesses embracing the Internet of Things (IoT), a great-
er level of connectivity should provide an impetus to prepare for
inevitable cyberattacks.
A Forbes report found that 32 percent of top tech CEOs felt IT secur-
itywasamong thegreatestchallengetheircompaniesfaced—aconcern
compoundedbynewmalwareattacksaimedatexploitingvulnerabilities.
Malware family
Gamarueisanexampleofa“malwarefamily,”whichmeansthatit’s
thecodebasefordifferentvariantstrainstocreatebotnetstolaunch
cyberattacks.Availableforsaleinundergroundmarkets,itispossible
foranyonetobuyitandbuildtheirownbotnet,saysAlexisDorais-
Joncas, SecurityIntelligenceTeamLeadatESET,anITsecurityfirm.
“Lastyear alone,therewere about 500 different peoplewho acquired
the [Gamarue] kits and deployed it in the wild to control their own
little botnets,” he says.“We pooled our telemetry data with other part-
ners and built a list of domain names and addresses used to control the
botnets.Withhelpfrommultiplelawenforcementagenciesaroundthe
world,wewereabletoseizecontrolofmanyofthesedomainnamesand
IPaddressesandredirectallthetrafficintoonesinkholeserver.”
A sinkhole is one large server that accepts connections from the
infected machines and keeps them dormant.It records who is con-
necting to it,allowing ESET to determine the total scope of infections
aroundworld.
Protective practices
Protectionagainstthistypeof“crimeware”needstobemultifacetedbe-
causeitwillgetintothecompanynetworkthroughtheweakestlink,he
adds.Largeorganizationswithabigstaffareespeciallyvulnerableeven
ifonlyafewemployeesarecareless.
“There's no one solution to block every infection vector,so compan-
ies should be on the lookout for the latest threats and how theywork,”
hesays.“Allthesame/bestpracticesapply—patchingworkstationswith
thelatestsoftware,anti-spamandmalwareblocksattheemailgateway
anddeployingendpointandnetworkprotectionslikefirewalls.”
Ted Kritsonis
In today’s world,digital technologies and the internet are increasing-
lyimportanttoinnovationandeconomicgrowth.Accordingly,cyberse-
curity has become a mainstream issue in both the public and private
sectoralike,andtoCanadiansmoregenerally.
Cybercompromises,whentheyoccur,takeuptime,money,andother
valuableresources.Theycanimpedethegovernment’sobjectives,dam-
ageanorganization’strustandreputation,andaffectthepersonalinfor-
mationorfinancesofindividualCanadians.
Cyber threats evolve at an incredible pace and the challenge of pro-
tectingcybersystemsandinformationwillgetalotharderinthefuture.
Withadvancesintechnologysuchasquantumcomputing,thefutureis
quicklybecomingtoday’sreality.
To combat cyber threats,the Government of Canada has announced
the creation of the new Canadian Centre for Cyber Security (the Cyber
Centre) in Budget 2018.As part of the Communications SecurityEstab-
lishment(CSE),theCyberCentrewillbeasingleunifiedsourceofexpert
advice, guidance, services and support on cyber security operational
matters.Itwill be outward-facing,open to collaborationwith industry
partners,and a trusted resource for faster,stronger responses to cyber-
securityincidents.
WiththeCyberCentre,Canadianswillhaveaclear,unified,andtrust-
edplacetoturntoforcybersecurityissues.
This important investment will benefit all Canadians as it reinfor-
ces federal government cyber security capabilities and improves the
detection of,and response to,continually evolving cyber threats.The
pervasive and interconnected nature of the internet means we must
all think of cyber security more often,and work together to raise our
collectivedefences.
The Cyber Centre will be the country’s authority on cybersecurity
operationsandtogetherwithindustrypartners,willbebetterprepared
to take on complex,ever-evolving cybersecurity challenges— because
it’severyone’sbusiness.
Scott Jones
Protecting digital assets is challenging for all companies,
especially when dealing with evolving cyber threats— pushing
executives to stay two steps ahead.
The most valuable asset in most instances is a company’s
digital data,notes Bob Gordon,Executive Director of the Canadian
Cyber Threat Exchange. However, emerging trends indicate that
cyber threats are no longer solely about extorting a ransom from
compromised firms.
“A company executive or business owner needs to have a good
understanding of what the critical information is within their
organization,” says Gordon.“What kind of data could they lose that
would cost them their competitive edge? Where is that information
stored and who has access to it? Making that data accessible across
thespectrumofthebusinesswidenstherisk,becauseeveryenduser
andworkstationbecomesapotentialdoorintocorporateITsystems.”
He adds that many of the cyber breaches that took place earlier
last year could largely have been prevented had patches been
installed on the infected systems ahead of time.Canadian boards
are becoming more engaged and assessing cyber threats in the
samewaytheylook at traditional risks.
“It has to become a board level issue because it's a business
issue,” says Gordon.“This is not just an IT problem— if you leave it
solely in the realm of IT professionals,you're not going to solve it.
You need the business side to get involved,from the board all the
waydown.”
IT departments can’t make those decisions, he adds. The
business unit determines what data and processes are critical,
making decisions about the risks and solutions involved should it
be compromised.
“It'sathree-wayconversation:board,businessunits,andIT,”says
Gordon.“Andthequestionisnotifyouwillbeattacked,butwhen.”
Ted Kritsonis
Cyberattacks, like ransomware, have become a daily threat to
organizations of all sizes. IT security teams struggle to keep up
with the changing threat profiles and constant attacks leaving
organizations vulnerable to cyber threats such as phishing,
vishing, whaling, and other internet crimes.
“Cybercrime is a booming business, and the latest techniques
used by cybercriminals have an impressive ability to manoeuvre
pasttraditionalsecuritydefences,”saysJimStechyson,co-founder
of HostedBizz, who, along with business partner Paul Butcher,
runs one of Canada’s leading cloud service providers. “Despite
the best efforts of IT teams to protect their organizations with
traditional perimeter defence systems, the key to better data and
security protection lies with systems and processes that assess
vulnerabilities, educate end users on them, and include data
protection strategies that ensure full recovery,” adds Butcher.
The co-founders agree that using a multi-layered approach
to data security and protection that includes a commitment to
ongoing end user education and testing to identify potential
threats plays a big part in reducing the risk of cyberattack and
penetration. The following tactics to augment an organization’s
security and defence are essential:
• Assess vulnerability by conducting phishing simulations. These
provide valuable insight into risk. They also identify where
education and testing programs should be implemented to raise
awareness and train users on how to recognize and react to
potential threats. These simulations are often available through
service providers and are surprisingly affordable.
• Build a protection plan that includes the ability to restore
infected data and systems into a pre-attack production state.
Data backup policies that include an offsite copy with a
DRaaS provider ensure 100 percent confidence that critical
systems can be recovered onsite or in the cloud promptly
should a significant corporate-wide security breach occur.
Paul Butcher
Jim Stechyson
Paul Butcher
Co-Founder,
HostedBizz
Jim Stechyson
Co-Founder,
HostedBizz
Bob Gordon,
Executive Director,
CCTX
Bringing Together Board, Business, and IT
How Businesses Are Getting One Step Ahead of Cyberattacks
Smarter Protection Key to Battling New Malware Threats
Government Announces New Canadian Centre for Cyber Security
Alexis Dorais-Joncas,
Security Intelligence Team Lead
at ESET
Scott Jones
Deputy Chief of IT Security,
Communications Security
Establishment
Four leading Canadian cybersecurity experts
investigate the security trends of tomorrow for
enterprise executives to prepare today.](https://image.slidesharecdn.com/theimportanceofinformationsecurity-210524052409/85/The-importance-of-information-security-8-320.jpg)
The importance of information security
- 1. A sponsored feature by Mediaplanet MARCH 2018 | INDUSTRYANDBUSINESS.CA DATA SECURITY Network Security Converged Infrastructure IT Security Services VMWare Consulting Open stack Consulting VA’s & Pen Testing Trustsec is an Ottawa-based IT consulting firm catering to Both public and private sector clients. Our resources are highly skilled IT practitioners committed to driving value for our customers. Converged Infrastructure VMWare Consulting Penetration Testing Our Services VDI Implementations Openstack Development Network Security Matthew Hoerig, Trustsec Inc. President & Chief Executive Officer T 877.304.3734 E mhoerig@trustsec.ca READY FOR GDPR? Advanced cloud security protects sensitive data and streamlines compliance p06 MACHINE LEARNING Next-generation securitysolutions for automated, real-time,and predictive threat detection p03 We live in a digital world in which our happiness, health, and even our lives can depend on the performance of technology. From medical equipment to cars, and home security systems to smartphones, computerized equipment plays a greater role in the human experience with each passing year. Yet the increased convenience and benefits of the digital age come at a cost.New threats— many of which were the domain of science fiction movies just a decade ago— have become real-world problems on a massive scale, with new dangers arising on a regular basis.Ten years ago,the notion that a foreign power could potentially alter the results of an American presidential election through hacking and the spreading of misinformation would have sounded absurd. But in 2018, many have come to realize that thepotentialforsuchanattackondemocracy is very real,and perhaps a historical fact.Not longago,artificialintelligencewasthestuffof fictional movies— but it is now a technology utilized by cyber attackers and defenders alike. Our world is rapidly transforming from an industrial economy to a digital society, in which cyberattacks have emerged as a major threat to businesses, individuals, and governments alike. In fact, cybersecurity challengesusinwaysthatnothreathasdone before. Nearlyallpeople,forexample,outsourcea great deal of their physical security to others. We pay taxes to fund fire departments, law enforcement agencies, and intelligence services—andwhilewemayutilizededicated volunteers for local patrols, we are not expected to assume personal responsibility to deliver the security provided by the organizations thatwe help fund. Cybersecurity, however, cannot be outsourced.Wecannotrelyonthegovernment to protect our personal computers,devices,or data— indeed it is difficult to imagine how an outside party could adequately shield us against hacking and social engineering attacks, cryptocurrency theft, or hijacked online banking sessions.The global diffusion of data and its systems continue to blur the borders of sovereign states. Who holds responsibility for the security of data that belongs to a Canadian company, regarding theaffairsofaFrenchcitizenthatisstoredon acomputerinAustralia,beingservedtoauser in Cameroon? Understanding what we must protect, how we must protect it, and who must be the protector is no simple matter, especially when it comes to information stored in the cloud. To be cyber-secure, therefore, we— the people, businesses, and organizations of the developed world— must be vigilant.We must comprehend the threats as best we can and explore the optimal practices for situations inwhich the securityof our data is at risk.We must understand roles and responsibilities for the protection of information, from the personal level to the national level. Perhaps most importantly, we must also know what we do not know— and understand who to call when situations we could never have imagined arise. Cyberattacks will continue to occur on a frequent basis— such is the nature of the digital age. However, by learning to distinguish good advice from bad, listening to experts, and protecting ourselves from cybersecurity fatigue, we can become more adept to the changes of technology as they develop. While forthcoming threats may seem ominous, one thing is certain: understanding and working in tandem with cybersecurity professionals is key to North America’s success in the 21st century. TheImportance ofInformation Security Joseph Steinberg Advisor to Cybersecurity, Blockchain, & Emerging Technology Companies VPN’S SECURING ENTERPRISE Leverage VPN technology to secure data flows outside organization network.p04 RobertHerjavec,FounderandCEOof HerjavecGroupandInvestoronABC's SharkTank,shareshisexpertiseon howCanadianenterprisescansecure organizationaldataintoday’sdigital environment. P05
- 2. 2 INDUSTRYANDBUSINESS.CA Publisher: Kaileigh Baines Business Developer: Samantha Blanford Country Manager: Jacob Weingarten Content Production Manager: Ellen Asiedu Lead Designer: Mike Shea Designer: Bianca Chamberlain Digital Content Manager: Camille Co Contributors: Paul Butcher, Ken Donahue, Colin Ellis, Ted Kritsonis, Jim Stechyson, Joseph Steinberg, Benjamin Van Pelt Photo credits: All images are from Getty Images unless otherwise accredited. Send all inquiries to ca.editorial@mediaplanet.com This section was created by Mediaplanet and did not involve National Post or its Editorial Departments. Please recycle after reading Stay in Touch facebook.com/MediaplanetCA @MediaplanetCA @MediaplanetCA pinterest.com/MediaplanetCA E veryoneistalkingaboutthecloud.Butare you ready?That’s the question organiza- tionsshouldbeaskingthemselvestoday. Successful businesses know that they must transform to stay relevant.That’s why more Canadian enterprise-level companies and governments are adopting cloud-based services systems. Over the past 30 years,Trend Micro has grown into one of Canada’s leading cybersecurityorgan- izationsandamarketleaderinhybridcloudsecur- ity."It’sanexcitingtime,becausecloudadoptionis rapidly gaining steam in this country,” says Mar- cia Sequeira,Trend Micro’s Country Manager for Canada.“Thebigthreecloudcomputingproviders –Amazon,Microsoft,andnowGoogle–haveener- gized the Canadian market.” Sequeira adds that moreorganizationsareseeingthevalue in mi- grating to the cloud,with executives asking how theycandoitandhowfasttheycanshift. Using the cloud requires a different security platform than traditional security tools. Having worked closely with the major cloud service pro- viders,Trend Micro has built solutions that are uniquely designed for the cloud,optimizing sec- uritywithoutsacrificingallthebenefits,including businessagility. Whilethecloudhasimmensecompetitivevalue fororganizations,includingreducedITcosts,flex- ibility of work practices, and collaboration effi- ciency,it requires a different skill set to manage. “Business leaders need to understand the basics and know what the cloud can mean for their or- ganization,” says Sequeira. “We’re seeing more people hiring cloud specialists or working with partiesthathavetheexpertise.” Securing your cloud “Given the scrutinyaround cloud security, controls,and compliancy requirements and with thoughtful implementation planning,I can’t think of a more se- cureITenvironmentthanthecloud, but we need to get into the mind- set that there are real consequences concerningdatabreaches,”saysMatt Hoerig, President of the non-profit Cloud Secur- ity Alliance and President/CEO of the consulting firmTrustsec.“With the cloud,you don’t own the underlyingITinfrastructure,sotherecanberisks todatasecuritybeyondthethird-partycloudinfra- structure.Theimpactofdatalossissignificantand canleadtofinancialandreputationalloss.” Hoerig believes that business leaders should be looking at cloud readiness as part of an organiza- tion’sITroadmap.Hestressesthatthereshouldn’t be complacency when it comes to data security as threats from cyber criminals are increasing in both scale and complexity. Organizations must establishasharedresponsibilitywiththeircloud- providerpartners,toensuretherightmechanisms areinplacetoprotecttheirapplicationworkloads, and develop an internal,organic culture of secur- itywithintheirorganizationandbyextensionthe cloudprovideritself. A commitment to innovation WithcybersecurityresearchcentresinCanadaand worldwide,Trend Micro is committed to develop- ing innovative solutions to cloud security.This is especially critical during this transition period, where many organizations are utilizing hybrid cloudsolutionswhereindataisstoredbothlocally andonthecloud.Thisrequiresspecificcapabilities andintegrationpointsthataredesignedforanor- ganization’s environment and can be challenging forbusinessestonavigate. There are many innovative solutions to cloud security,includingtheuseofartificialintelligence (AI) and machine learning, in which algorithms and a data source are used to identify security threats.This is one area inwhichTrend Micro has made significant investment.While there are lots of benefits to AI,including its ability to provide a levelofautomationandtopotentiallyidentify“ze- ro-day”vulnerabilities,itcan’tbetheonlysolution. That’swhyalayeredapproachtosecurityoracom- binationofdifferenttoolsisrequired. “With Canadian businesses wanting to opti- mize their investment in IT infrastructure,we’ll continuetoseeanincreaseincloudserviceprovid- ersandagrowthinorganizationsmigratingtothe cloud,”saysSequeira.“We’reexcitedthatconversa- tions about data security are happening and that companies are reaching out to subject matter ex- pertsastheyembracenewtechnologies.” Ken Donahue The Future Is in the Cloud: What Canadian Companies Need to Know Marcia Sequeira, Canadian Country Manager, Trend Micro Cloud-friendly Security of mid-to large enterprises look to consolidate controls to a single vendor to assure consistent, efficient, and cost-effective security across their hybrid cloud environment. We work closely with cloud vendors to optimize security and agility in these environments, providing deep API integra- tion, automation templated, and multiple host-based security capabilities. Protective Security Streamlined compliance of mid-to-large enterprises feel assuring compliance with internal governance best practices as the biggest business driver behind investing in third-party cloud. Our streamlined compliance accelerates and maintains continuous compliance for your hybrid and multi-cloud environments. of mid-to-large enterprises expect their hybrid cloud security spending to increase over the next Our software as a service and hybrid cloud offerings include an hourly pricing option, so you only pay for the workloads you’re protecting, giving you more of what you like about the cloud. 79% 36% 86% 12 months. *Stats taken from 1,000 Mid-large enterprises in North America + Western Europe of mid-to-large enterprises have experienced a cybersecurity attack to their organization within the last Detection and prevention are the pillars of a strong security strategy. Our market leading server security proactively detects and prevents network intrusion and data exploitation, and increases visibility to sophisticated attacks. 12 months. Hour ly Pricing 71%
- 3. MEDIAPLANET 3 Companies with digital assets have faced cybersecurity threats since the dawn of the internet, but mitigation may be closer than they think. Through cross-sector collaboration, Canadian companies can find success in fending off even the most sophisticated of attackers by leveraging peer-to-peer information-sharing and collaboration through the Canadian Cyber Threat Exchange (CCTX). As industries diversify and cross-pollinate, theycollectdigitalassetsthatcancarryvalueon the black market.Some experts believe effective collaboration can mitigate the chances of a breach,orthedamageitcouldcause. “Businesses have become more diversified, so we've now got telecom companies that run retail stores, or retail stores that provide financial services, or hydro companies that provide internet services,” says Bob Gordon, Executive Director of the CCTX. “Their vulnerability to attack changes at the same time.Attackerswon'tneedtouseacertaintool exclusively against a bank; they'll be able to use it across any sector. So there's real profit in different industries learning what they're mutually experiencing from a cyber-threat perspective.” Evolving malware has victimized well- known firms foryears,and the current target- rich environment in cyberspace can affect anyone. A worrisome trend in ransomware has emerged,as exhibited by a variant of the Petya malicious program in 2017 that was designed to destroy data rather than extort money.Attacks can come from anyone, with any purpose— be it a disgruntled former employee, an angry customer, or someone with rogue intentions. Working in tandem Companies have started to recognize that working with others is not a competitive disadvantage because the security risks are collective, says Gordon. Sharing information allows participating firms to look at attacks “through the front door” as a blatant cyberattack, or as an unauthorized presencewithin the network. For example, a larger enterprise could share information that small and medium sized businesses (SMBs) may find pertinent for their own defence, or vice versa. Either way, executives and business owners would be aware of the risks, vulnerabilities, and threats, having a greater understanding of whether they might need to bolster their defences,which could include turning to an external provider for help. “The digital economy we now live in depends on the public having confidence in the system,” says Gordon. “It doesn't matter what company you are or how big you are. If people start to lose confidence in the system, then all companies suffer.” Gathering intelligence Humza Teherany, President of the CIO Association of Canada, says that increasing industrydigitization puts more sensitive data in play. He believes the data leaks associated with the high-profile attacks have been a wake-up call for companies. “It’simportanttohavethoseconversations in a friendly environment, behind closed doors, and, naturally, without divulging any corporate secrets,” says Teherany. “It’s just talking about the trends,because theychange every year. The basic tenet of what cyber attackersaregoingfordoesn'tchange,buthow they get there does, and I think having that peer group to talk through helps immensely, especially in the Canadian marketplace.” He acknowledges seeing more Canadian companies including IT and cybersecurity risks with overall corporate risk, putting it front and centre in day-to-day operations. Some have also started to hire Chief Information Security Officers. Given the significant increase in cyberattacks worldwide avnd increasing maturity of new malicious programs every day, preparing for the cyber threat du jour can be challenging for businesses to navigate. The CCTX supports the sharing and analytics of cyber threat information across all sectors and serves as a collaboration hub for cyber professionals to exchange best practices, techniques and insights to mitigate current cyber security issues. Ted Kritsonis "Working with others is not a competitive disadvantage because the security risks are collective". Bob Gordon, Executive Director, CCTX Companies Respond to Cybersecurity Threats in New Ways M achine learning serves as a re- al turning point in assessing cybersecurity risks as business- esarelookingtoadopttheevolv- ingtechnologytowardoffintruders. Cybersecurity has largely been a cat-and- mouse game with IT personnel scrambling to pre-empt attacks or deal with system breach- es of varying magnitudes. Some of that work requires addressing simple threats that,while relativelyeasytonullify,takeupvaluabletime. Machine learning capabilities can identify attacks as they appear, alerting cybersecurity experts who can take appropriate action,and predictfutureattacks. “You don't need a person to analyze some- thingwhenamachinecandistinguishbetween good or badwith high certaintyand determine whether the program is malicious,” says Peter Košinár,Senior Virus Researcher at ESET,an IT securityfirm.“Itcanalsotelluswhat'sbad,and alsowhat'sgood.Ifyouknowthat,youcanhone inonthegreyzonewhereAImaynotbeableto figure everything out,thus requiring some hu- maninteraction.” Collaborative efforts Cybersecurityexperts,likeKošinár,believeit's besttocombinemachinelearningcapabilities withhumanexpertiseandinstinctbecause thetechnologymaynotbepreciseenoughto arbitrarilydeducethesignificanceofathreat orattackvector.Fortunately,machinelearning isdesignedtobeadaptable. Machine learning can parse information faster than humans can, which could effect- ively eliminate some of the tedious monitor- ing work humans have had to do,however he cautionsthatmachinelearningtoolsaren’tyet capable of stopping attacks independently of humans. “You can apply them along with existing tools, actions and response procedurestogetthemdonefast- er or more efficiently,” he notes. “For example,ifyou’re alerted to suspicious behav- iour on one computer,like certain files being encrypted,youcanactonthatmuchfasterand stop the same damage from happening on the other computers without actually seeing it in thefirstplace.” Protective practices Computersandsmartphonestendtobethe mostvulnerabletoattackbecausetheycan actasgatewaysintoawiderbusinesssystem. However,theInternetofThings(IoT)means thereareprinters,scanners,cameras,routers, andothernetworkcomponentsthatcouldbe targetedentrypointsforcybercriminals. Government institu- tions, banks, or other enter- prises should use methods that are tailored to theirownusebecausethethreatstheyfaceare different,headds. For Košinár, deploying smarter tools like machine learning does require a strategic ap- proach,noting that “attacks are often not dis- covered for quite some time after they hap- pen,soit'simportanttobeabletolookbackand understand what was going on in your own network,what assets the attackers were going afterandhowtoprotectthem.” Ted Kritsonis Machine Learning is Valuable in Combating New Malware Threats
- 4. 4 INDUSTRYANDBUSINESS.CA V irtual Private Network (VPN) services have grown in popu- larity with consumers for their ability to provide great- er freedom online, and for businesses who can utilize the additional privacyto protect sensitive data. More recently, VPNs have largely been consumer-focused because of how they anonymize activity online and— in some instances—circumventgeo-restrictedcon- tent.WithanIPaddressinadifferentcoun- try,the users can access that content as if theylivedthere.However,VPNusagestart- ed out almost exclusively for business,al- lowing employees to have a direct,secure connection toworkplace systemswithout compromising the data and communica- tionsintransit. Cybersecurity has grown in sophistica- tion toward off more intricate attacks.The cost of global ransomware damages was expected to exceed $5 billion (U.S.) in 2017, accordingtoacybercrimereportfromIDG Communications. “[Enterprises]needtolockdowntheirin- ternal networkswith a securelyencrypted layer placed over their Internet service,” says Benjamin Van Pelt,Founder and CEO of TorGuard, a VPN provider. “A VPN en- crypts data so it can’t be used or under- stoodbycorporatespies.YourInternetSer- viceProvider(ISP)mightalsoroutinelylog anythingfromsensitivecorrespondenceto contracts and trade secrets thatyou trans- mit.Encryption makes the data worthless toanyonewhohacksyourISP.” Building a tunnel Employees are increasingly mobile and using multiple devices, meaning attack- erscanexploitthevulnerabilitiestheycre- ate.PublicWi-Finetworks—particularlyat hotels and airports— are among the riski- est because attackers could set up dummy networks that route traffic through them, VanPeltadds. Unsuspecting employees connecting to such networks could expose more than justthedatastoredontheirdevicesifthey “phonehome”andlogintotheircompany systems. VPNs can encrypt information betweenuserssothatitisanonymizedand indecipherabletoanunauthorizedviewer. It is also possible to use an encrypted VPN that identifies each user logging in- to the company’s system through unique IPs assigned to specific users. “Each of these unique IP addresses can be assigned to specific employees who have access to sensitive systems,” he says. “If I assign a specific VPN IP address to the system ad- ministrator,only that person is able to ac- cessareasofthenetworkassignedtothem. Access using any other IP address will be denied.It’s one of the most effective ways to improve security and protect business portalsfromunauthorizedaccess.” Ensuring data protection New data protection and privacy regula- tions in Canada under the Personal Infor- mation Protection and Electronic Docu- ments Act (PIPEDA) sets out rules on how businesses handle and store personal in- formation.The European Union’s General Data Protection Regulation (GDPR) will go intoeffectonMay25,2018. Therearenospecificrulesgoverningthe use of VPNs, but doing business in other countries can pose other risks.Both China and Russia moved to ban allVPNs outright in2017,withChinarecentlyoptingtoallow only state-approved VPN services to oper- ateinthatcountry. Sincebusinessesprimarilyusetheseser- vices so employees can secure data when working remotely, the restrictions could also block certain applications or pro- grams theyare required to use for their re- spectiveroles.VanPeltbelievesdouble-lay- ered encryption technology could be a workaround that blocks government cen- sorsfromspottingthesecureVPNtunnel. “The primary reason that these busi- nesses use a VPN is to keep their data se- cure when employees are working out- sidetheoffice,”hesays.“Myadvicetobusi- nesses is the same,whether they operate entirely in Canada or internationally: If you’re not fullyin control ofyour network, thenyouwanttouseaVPN.” Benjamin Van Pelt Your Internet Service Provider (ISP) might also routinely log anything from sensitive correspondence to contracts and trade secrets that you transmit Businesses Look to VPNs for Secure Data Protection
- 5. MEDIAPLANET 5 B lockchain might be the key to eliminating the kind of widescale data security breach- es that are making headlines worldwide.For large enterprises where siloed, centralized data is constantly under threat,cutting-edge organizations are leveraging blockchain technologies for advanced protection of sensitive data. “Decentralized data storage—particularly user authen- tication data—breaks down the attack surface of central- ized databases into individual,independent user credential verifiers,” says Locke Brown,CEO and Co-Founder of NuID. “Whenyoudecentralizedatastorage,youdrasticallyreduce the incentive for attackers.” The San Francisco-based start-up is at the peak of a new waveoftechcompaniesturningtoblockchaintechnologies for newparadigms in user authentication.While the public tends to associate blockchain with cryptocurrencies,a few cybersecurity companies are leveraging distributed ledg- er technology as an alternative to the centralized storage of user authentication data such as passwords in large,siloed databases. Hiding the jackpot from hackers “Centralized data storage creates an incentive for hackers and attackers,” he says. “An attacker that breaks into one database of, say, thousands of user credentials and other personally identifiable information (PII),gains access to all that data in one place—you have essentially created a mas- sive jackpot.” NuID is challenging the traditional security paradigm by combining distributed ledger technology with zero-know- ledge cryptography to create a state-of-the-art authenti- cation and digital identity solution.Like many companies in cybersecurity and fintech,NuID is leveraging the block- chain-based Ethereum network to test new applications and solutions including user authentication. “In our case,we consider decentralized authentication to mean that individual user authentication secrets, such as passwords,are distributed across a network of nodes using blockchain technologyso there’s no single point of failure,” explains Brown.“By returning credential ownership to in- dividual users,companies no longer need to store and pro- tect user authentication data internally.” TheNuIDprotocolleveragesadvancesinzero-knowledge cryptography to completely eliminate the need for large, siloed databases,thus redefining the foundational standard for authentication.A “zero-knowledge proof” is a way for a user to prove to a verifier—even an untrustworthy one— that they know something (e.g., a password) without re- vealing anyinformation about the thing itself. Reducing security risk with zero-knowledge cryptography NuID converts user credentials into tiny immutable pro- grams stored on Ethereum rather than on individual de- vices.“The program is a mechanism that verifies you know your password,” explains Brown. Validation only occurs when successfullyunlocking the program originallystored on the blockchain. The beauty of the process is that users can authenticate from anydevice.While some companies are building block- chain-based authentication that rely on device-based pri- vate keys,the NuID protocol ensures lost or stolen devices do not present the risk of securitybreach. “Most solutions right now are patchwork solutions that attempt to protect the current paradigm of database solu- tions that are really antiquated,” says Brown.“You have all these patchwork solutions built on top of each other.What we’redoingisredefiningthefoundationalstandardforhow authentication and identitymanagementworks today.” NuID is a member of the Decentralized Identity Founda- tionandisworkingtocreatestandardsandeducatecompan- ies in enterprise data security solutions.While this rapidly evolving space is still nascent,forward-thinking companies from global consulting firms to financial service providers are collaborating with start-ups like NuID to create and test newblockchain-basedauthenticationprotocols. “In this modern digital age,data enterprises need to em- bracenewtechnologiestokeepthetrustoftheircustomers, protect their employees, and safeguard their internal sys- tems,” notes Brown.“If you want to build a foundation that giants can stand on,you needtoembracenewparadigms.” Colin Ellis Locke Brown CEO and Co-Founder of NuID Mediaplanet Whatkindofchangeshaveyouseen inCanadianorganizationsandtheiroutlookondata securityinthepastyear? Robert Herjavec Canadian organizations are ma- turing when it comes to data security requirements. There’s a clear understanding of the threat landscape and the need to balance multiple layers of technology along with processes and people for a proactive cyber defense. The recent communication around the Can- adian federal budget commitment to cybersecurity is another example of how the Canadian market is re- inforcing the value of threat intelligence and the de- velopment of talent.We’re used to hearing that Canada lags behind the US in terms of cybersecurity prepared- ness and technology adoption,but we’re seeing strides intermsofthird-partyserviceadoption(includingMan- aged Security Services and Identity Managed Services), emergingtechnologyadoption,andaproactivestanceto getaheadofcompliancerequirements—allofwhichare verypromising. MP HowshouldCanadianenterprisesmanage thesecurityoftheirdatawiththeupcoming implementationoftheGeneralDataProtection Regulation(GDPR)andamendmentstoPIPEDAinMay? RH Canadianorganizationsneedtobeawareofhowthese compliance directives impact them and their customers. Thereareseriousimplicationsfornon-compliance.Failure to comply with GDPR,for example,results in significant penalties — a $20M GBP fine, or 4 percent of annual turnover, whicheverisgreater. It’scommon that companies say ‘oh GDPR is a UK policy, it doesn’t apply to me’. That’s not the case. GDPR is a proactive reminder that all enterprises engaging with the data of a UK natural person— no matter their corporate location— should proactively assess their securityposturesintermsoftheir visibility,controls,andscope. MP TherecentmediaexplosionofBitcoinand cryptocurrencyin2017hasmorepeopleunderstanding blockchaintechnologyandthesecuritybenefitsit providestothefinancialindustry.Howcanenterprises leverageblockchaintechnologytosecureorganizational userdata? RH There’s been a lot of talk among cybersecurity pro- fessionals about using blockchain for identity and ac- cess management in the coming years. Instead of differ- ent institutions controlling different pieces of an individ- ual’s personal data,it will be the individual that controls all that information.This allows us to present the min- imumamountofidentifyinginformationneededtomake asecuretransaction.However,blockchainisn’tacomplete cure-all solution for enterprises. Executives with secur- ityresponsibilitiesshoulddotheirhomeworkandengage withfirmsdeepinBlockchaintechnology. Deployingand leveraging this new platform will require a major invest- mentandexperiencedstafffrommid-sizedtolargeorgan- izationsinvestinginit. MP Whenitcomestosecuringuseridentityand sensitivedata,howdoyoudefinethedifference betweenidentitymanagementandaccess/ authorizationmanagement? RH Identitymanagementistheprogramthatgoverns whoauseriswithinanorganization.Itsummarizes theaccesstiedtoeachuser’sidentityandcontrols whattheycanaccess,when,andforhowlong.Some accessmaybeprivilegedatanadminlevelormaybe non-privileged.Authorizationmanagementisthe grantingofthosevariouspermissions. MP HowcanadoptionoftrusteddigitalIdentity andAccessManagement(IAM)solutionspreventor eliminatelarge-scalebreaches? RH Safeguarding user identities and managing access permissions across the enterprise is one of the biggest challenges faced by security teams.Poor IAM leads to data breaches, causing financial damage and reputa- tional harm. Organizations require a solution that aligns identity governance with privileged access management to not only meet both policy and regulatory compliance— but more importantly, to avoid falling victim to a devastating cyberattack. MP Doyouthinkenterprise executivesshouldbefully knowledgeableonthetopicofdata security?Why? RH It’samust.Enterprise executiveshavearesponsibilitytotheprotection oftheirbusinessesintermsoffinancialreputation, brandreputation,andoverallcustomercredibility. CybersecurityisnotanIT-specificproblem.It’s abusinesschallengethatrequiresinvestment, commitment,andtrainingcompany-wide.Therehas tobeagovernanceattheexecutiveandboardlevel thatmonitorseachorganization’sprogressionon cyberinitiatives.Intheeventofacyberattack,itwill beunacceptableforC-levelexecutivestoblamethe ITdepartment.Everyonemustreportonitandbe responsibleforit. Blockchain Brings New Frontier for Secure Digital Identity and Authentication "Enterprise executives have a responsibility to the protection of their businesses in terms of financial reputation, brand reputation, and overall customer credibility". How to Protect Against Today’s Feeding Frenzy of Cyberattackers Founder and CEO of Herjavec Group, and Investor on ABC's Shark Tank, Robert Herjavec Educates Canadian Enterprises on
- 6. 6 INDUSTRYANDBUSINESS.CA R egulatory changes to Can- ada’s data protection and pri- vacy laws will require busi- nesses to complywith legislation gov- erning how they handle Canadians’ personalinformation. The Personal Information Protec- tion and Electronic Documents Act (PIPEDA) has been rolled out in stages since 2001, though the most recent provisions have spurred businesses in the country to act in accordance with thelaw. When the new regulations take ef- fect this year, businesses will be re- quiredtonotifyboththeindividualand theOfficeofthePrivacyCommissioner (OPC) when there's a breach.This rep- resentsasignificantchangeintermsof complianceobligations,withtheadded caveat that it can alter the perception ofcompanieswhohavebeenbreached, says Scott Smith, Director of Intellec- tual Property and Policy Innovation at theCanadianChamberofCommerce. “It’s going to be more prevalent in the media once those regulations are in place,” says Smith.“It’s incumbent on companies who are handling per- sonal information to be more diligent about their cybersecurity and internal privacypractices.We'renotjusttalking about electronic breaches, but rather anything that happens within a given businessenvironment.” Smith says the legislation’s intent is to determine whether a breach is ma- terial in nature— meaning it could cause significant harm. Up to this point, companies have made that de- terminationunilaterally. Personal data awareness Atthesametime,theEuropeanUnion’s new General Data Protection Regula- tion (GDPR) will go into effect on May 25, 2018, and will require businesses operating in its member states to com- plywithnewpersonaldataprivacyand protectionrules. PIPEDA and GDPR are not harmon- ized,soCanadianenterprisesshouldn’t assume complying with one is equal to the other,Smith notes.It also brings up one aspect he believes may be over- looked,whichistheideaofpersonalin- formation stripped of personally iden- tifiabledetails. “This is generallythe case for a lot of high-techcompaniesthatareusingbig data to generate new algorithms pro- tecting behaviours,” he says. “Similar totheappsyouuse,theylookatthebe- haviour of a large group of people that aredoingspecificthings,andhowthey can target a product to that individual thatfitstheprofile.” GDPR is more stringent in that,on- line, it affords individuals “the right to be forgotten”, which effectively al- lows them to have their personal in- formation erased when and where it’s nolongernecessarytoacompany’sori- ginalpurposeforcollectingit. It’s less clear with PIPEDA, and so, any business operating in both juris- dictions may face difficulty in staying ontopofbothregulatoryregimes. Seeing the cloud Enterprises looking to the cloud for providers who can navigate the new rules on both sides of theAtlantic may find willing takers.Cybersecurity and softwarefirmshaveanticipatedtheup- comingchanges. “The GDPR requires that organiza- tionsrespectandprotectpersonaldata – no matter where it is sent,processed or stored,” say Brendon Lynch, Chief PrivacyOfficeratMicrosoft. Lynch says it will take time, tools, processes and expertise for businesses tocomplywiththeGPPR,andtodothis organizations will need to make chan- ges to their privacy and data manage- mentpractices.But,hesays,cloudtech- nology can help businesses meet their GDPR obligations for areas including deletion, rectification, transfer of, ac- cess to and objection to processing of personaldata. “Complying with the GDPR will not be easy,” Lynch says,“but movingyour organization’s data to the cloud will help simplify and accelerate the path to GDPR compliance.In addition,with data now being such a critical asset, businesses should see moving to the cloud as an investment that will help create more agilityand support innov- ationacrosstheirorganizations.” Ted Kritsonis New PrivacyRegulationsPush Businessestothe Cloud Regulatory changes to Canada’s data protection and privacy laws will require businesses to comply with legislation governing how they handle Canadians’ personal information.
- 7. MEDIAPLANET 7 Mediaplanet Whatkindof changeshaveyouseeninCanadian organizationsandtheiroutlookon datasecurityinthepastyear? Giovanni Sansalone With increased media coverage of high visibility breaches and vulnerabilities, security has become a boardroom discussion for all organizations. Compliance with regulations such as GDPR, PIPEDA, and the Canadian mandatory breach notification continue to be top of mind, but companies are still in search of new ways to protect their data.It’s no longer about preventing thebreach,butaboutdetectingitand responding quickly. MPWhydoyouthinkhumanerror consistentlyranksastheleadingcause ofacyberintrusion? GSSinceemployeesarecontinuously handling systems, this is the most likely area for errors and therefore cyberrisk.Businessaretransforming thewaytheyoperateatamuchfaster pace than ever before in order to gain a competitive advantage in the market. Theyareconnectingtomore and more partners and adopting cloudtechnologiestodeliverservices faster–whilestilldealingwithlegacy systems in-house and the manual processneededtosupportthem. Due to these growing complexities, the skill set required to effectivelysecure these environments is continually evolving and it takes time to develop the level of expertise that is needed. MPHowcanenterprisesleveragecyber threatintelligencetoreducehuman error? GS We believe that effective defense against emerging threats must go beyond adding layers to an organization’s defense-in-depth strategy— it has to be rooted in an improved understanding of the threat landscape, and the potential impacts to an organization. Cyber Threat Intelligence (CTI) can provide alevelofinsightintopotentialthreats to an organization, allowing the organization to proactively address vulnerabilities and risks potentially causedbyhumanerror. MP Howhavethreatintelligence technologiesadvancedtokeepupwith thematurityoftoday’scyberhacker? GS Adversaries have become more sophisticated and better organized, with the attack methods constantly evolving to better evade defenses. Intelligence technologies have kept pacebydevelopingmachinelearning andartificialintelligencecapabilities that can identify potential threats sooner and reduce the number of falsepositives. Theoutputfromthese improvedmodelscanprovidetailored and actionable insight for customers that can be orchestrated directlyinto their defense mechanisms without humanintervention. MPWhatisDDoS?HowcanDDoS providereal-timethreatmitigationto reducewide-scalebreach? GS A distributed denial of service (DDoS) attack is one that attempts to prevent your customer from reaching your Internet-facing business websites and applications, resulting in a loss of reputation, brand equity, and profit for your business. DDoS attacks can also be used by attackers as a diversionary attack to take the response focus off the real intent of the attack which is to access other systems and data. By being configured with your internet connection, network DDoS protection can stop a wide variety of attacks before they ever reach your website— meaning business operations are never interrupted by malicious traffic and allowing your security personnel to more effectively manage the risk posture of the organization. MP WhatdoesitmeanforBellCanada toberecognizedasaleaderinsecurity? GS Bell, like many other Canadian organizations, is impacted by the expanding threat landscape in Canada andaroundtheworld. Being recognized as a leader in security reinforces our commitment to constantly protect our customers, our customer’s customers, and our partners. Moreover, it supports our goal to build a more secure Canada through leveraging our unique CTI capability built with the enormous amount of data traversing our network and helping to lead innovative initiatives such as the Canadian Cyber Threat Exchange (CCTX). In 2017, Bell was the only communications provider recognized by IDC as a category leader in security in Canada. Vice President of Product Management, Giovanni Sansalone, shares his expert insights on Bell’s commitment to securing business and consumer data every day. Photo | Gradyreese Photography Canadian Industry Leaders Are Advancing Threat Intelligence Solutions for Enterprises Giovanni Sansalone Vice President, Product Management Bell Canada
- 8. 8 INDUSTRYANDBUSINESS.CA Future of Data Security With businesses embracing the Internet of Things (IoT), a great- er level of connectivity should provide an impetus to prepare for inevitable cyberattacks. A Forbes report found that 32 percent of top tech CEOs felt IT secur- itywasamong thegreatestchallengetheircompaniesfaced—aconcern compoundedbynewmalwareattacksaimedatexploitingvulnerabilities. Malware family Gamarueisanexampleofa“malwarefamily,”whichmeansthatit’s thecodebasefordifferentvariantstrainstocreatebotnetstolaunch cyberattacks.Availableforsaleinundergroundmarkets,itispossible foranyonetobuyitandbuildtheirownbotnet,saysAlexisDorais- Joncas, SecurityIntelligenceTeamLeadatESET,anITsecurityfirm. “Lastyear alone,therewere about 500 different peoplewho acquired the [Gamarue] kits and deployed it in the wild to control their own little botnets,” he says.“We pooled our telemetry data with other part- ners and built a list of domain names and addresses used to control the botnets.Withhelpfrommultiplelawenforcementagenciesaroundthe world,wewereabletoseizecontrolofmanyofthesedomainnamesand IPaddressesandredirectallthetrafficintoonesinkholeserver.” A sinkhole is one large server that accepts connections from the infected machines and keeps them dormant.It records who is con- necting to it,allowing ESET to determine the total scope of infections aroundworld. Protective practices Protectionagainstthistypeof“crimeware”needstobemultifacetedbe- causeitwillgetintothecompanynetworkthroughtheweakestlink,he adds.Largeorganizationswithabigstaffareespeciallyvulnerableeven ifonlyafewemployeesarecareless. “There's no one solution to block every infection vector,so compan- ies should be on the lookout for the latest threats and how theywork,” hesays.“Allthesame/bestpracticesapply—patchingworkstationswith thelatestsoftware,anti-spamandmalwareblocksattheemailgateway anddeployingendpointandnetworkprotectionslikefirewalls.” Ted Kritsonis In today’s world,digital technologies and the internet are increasing- lyimportanttoinnovationandeconomicgrowth.Accordingly,cyberse- curity has become a mainstream issue in both the public and private sectoralike,andtoCanadiansmoregenerally. Cybercompromises,whentheyoccur,takeuptime,money,andother valuableresources.Theycanimpedethegovernment’sobjectives,dam- ageanorganization’strustandreputation,andaffectthepersonalinfor- mationorfinancesofindividualCanadians. Cyber threats evolve at an incredible pace and the challenge of pro- tectingcybersystemsandinformationwillgetalotharderinthefuture. Withadvancesintechnologysuchasquantumcomputing,thefutureis quicklybecomingtoday’sreality. To combat cyber threats,the Government of Canada has announced the creation of the new Canadian Centre for Cyber Security (the Cyber Centre) in Budget 2018.As part of the Communications SecurityEstab- lishment(CSE),theCyberCentrewillbeasingleunifiedsourceofexpert advice, guidance, services and support on cyber security operational matters.Itwill be outward-facing,open to collaborationwith industry partners,and a trusted resource for faster,stronger responses to cyber- securityincidents. WiththeCyberCentre,Canadianswillhaveaclear,unified,andtrust- edplacetoturntoforcybersecurityissues. This important investment will benefit all Canadians as it reinfor- ces federal government cyber security capabilities and improves the detection of,and response to,continually evolving cyber threats.The pervasive and interconnected nature of the internet means we must all think of cyber security more often,and work together to raise our collectivedefences. The Cyber Centre will be the country’s authority on cybersecurity operationsandtogetherwithindustrypartners,willbebetterprepared to take on complex,ever-evolving cybersecurity challenges— because it’severyone’sbusiness. Scott Jones Protecting digital assets is challenging for all companies, especially when dealing with evolving cyber threats— pushing executives to stay two steps ahead. The most valuable asset in most instances is a company’s digital data,notes Bob Gordon,Executive Director of the Canadian Cyber Threat Exchange. However, emerging trends indicate that cyber threats are no longer solely about extorting a ransom from compromised firms. “A company executive or business owner needs to have a good understanding of what the critical information is within their organization,” says Gordon.“What kind of data could they lose that would cost them their competitive edge? Where is that information stored and who has access to it? Making that data accessible across thespectrumofthebusinesswidenstherisk,becauseeveryenduser andworkstationbecomesapotentialdoorintocorporateITsystems.” He adds that many of the cyber breaches that took place earlier last year could largely have been prevented had patches been installed on the infected systems ahead of time.Canadian boards are becoming more engaged and assessing cyber threats in the samewaytheylook at traditional risks. “It has to become a board level issue because it's a business issue,” says Gordon.“This is not just an IT problem— if you leave it solely in the realm of IT professionals,you're not going to solve it. You need the business side to get involved,from the board all the waydown.” IT departments can’t make those decisions, he adds. The business unit determines what data and processes are critical, making decisions about the risks and solutions involved should it be compromised. “It'sathree-wayconversation:board,businessunits,andIT,”says Gordon.“Andthequestionisnotifyouwillbeattacked,butwhen.” Ted Kritsonis Cyberattacks, like ransomware, have become a daily threat to organizations of all sizes. IT security teams struggle to keep up with the changing threat profiles and constant attacks leaving organizations vulnerable to cyber threats such as phishing, vishing, whaling, and other internet crimes. “Cybercrime is a booming business, and the latest techniques used by cybercriminals have an impressive ability to manoeuvre pasttraditionalsecuritydefences,”saysJimStechyson,co-founder of HostedBizz, who, along with business partner Paul Butcher, runs one of Canada’s leading cloud service providers. “Despite the best efforts of IT teams to protect their organizations with traditional perimeter defence systems, the key to better data and security protection lies with systems and processes that assess vulnerabilities, educate end users on them, and include data protection strategies that ensure full recovery,” adds Butcher. The co-founders agree that using a multi-layered approach to data security and protection that includes a commitment to ongoing end user education and testing to identify potential threats plays a big part in reducing the risk of cyberattack and penetration. The following tactics to augment an organization’s security and defence are essential: • Assess vulnerability by conducting phishing simulations. These provide valuable insight into risk. They also identify where education and testing programs should be implemented to raise awareness and train users on how to recognize and react to potential threats. These simulations are often available through service providers and are surprisingly affordable. • Build a protection plan that includes the ability to restore infected data and systems into a pre-attack production state. Data backup policies that include an offsite copy with a DRaaS provider ensure 100 percent confidence that critical systems can be recovered onsite or in the cloud promptly should a significant corporate-wide security breach occur. Paul Butcher Jim Stechyson Paul Butcher Co-Founder, HostedBizz Jim Stechyson Co-Founder, HostedBizz Bob Gordon, Executive Director, CCTX Bringing Together Board, Business, and IT How Businesses Are Getting One Step Ahead of Cyberattacks Smarter Protection Key to Battling New Malware Threats Government Announces New Canadian Centre for Cyber Security Alexis Dorais-Joncas, Security Intelligence Team Lead at ESET Scott Jones Deputy Chief of IT Security, Communications Security Establishment Four leading Canadian cybersecurity experts investigate the security trends of tomorrow for enterprise executives to prepare today.