Public Accounts

Opening remarks

Thank you, Mr. Chair, for the opportunity to discuss the Auditor General’s Report on the Cyber Security of Government Networks and Systems. Before we begin, I would like to acknowledge that we are on the traditional, unceded territory of the Algonquin Anishinabe people. I’m here today with Patrice Nadeau, senior assistant deputy minister for SSC's Connectivity and Security Services Branch. Shared Services Canada, or SSC, welcomes the Auditor General’s findings and is working to address the issues raised. It’s important to underline that the Auditor General found that the government had tools in place to protect and defend its networks and that the government’s cybersecurity plan was sound and comprehensive. As the provider of IT services to departments and agencies, SSC plays a pivotal role in this work. Indeed, SSC blocks about 6.5 trillion cyber-threats annually, which is an average of 18 billion a day. This ensures the uninterrupted operation of government services. We do that through a state-of-the-art enterprise infrastructure and modern commercial cybersecurity solutions that defend government systems against a wide range of cyber-threats. SSC uses multiple layers of…

Opening remarks

Thank you. Good morning, Mr. Chair and members of the committee. Thank you for inviting me to appear today to discuss the Auditor General of Canada’s report on the Cyber Security of Government Networks and Systems. As mentioned, my name is Caroline Xavier, and I am the chief of the Communications Security Establishment, also known as CSE. I'm joined today by Rajiv Gupta, head of the Canadian centre for cybersecurity, also known as the cyber centre, which forms an integral part of CSE. We are pleased to appear alongside our colleagues from the Treasury Board Secretariat and Shared Services Canada, with whom we work closely on cybersecurity. Today I will provide a brief overview of CSE and our cyber centre, and then share how we are responding to an increasingly complex threat landscape, one that includes cyber-threats, risks to economic security, violent extremism, foreign interference, disinformation campaigns and more. Before we begin, I want to acknowledge that we are on the traditional unceded territory of the Algonquin Anishinabe nation. We acknowledge that this nation has been on this land since time immemorial. CSE is one of Canada’s key security and intelligence…

Opening remarks

Thank you for the question. The purple team allows us to effectively test in advance some of the techniques of bad actors. It helps us to put in place the right detection and protective measures to make sure that we are all staying ahead of the cyber-threats. Part of the policy on government security ensures that departments and agencies are putting in place the right baseline security controls. Cybersecurity is all about layers of controls—such as cyber-sensors that are put in place on end points in the network—but it's also about the protection of data within our information systems. That's outlined under the policy on government security.

Opening remarks

Thank you for the question. I can say without hesitation that we observed a very high level of co-operation between the entities. That said, it doesn't mean there's no room for improvement. We mention this in our report, particularly with regard to various projects that were delayed but are nonetheless very important for the country's cybersecurity needs. The three entities definitely co-operate well with each other.

Opening remarks

Actually staying ahead of the threat is very important to us. It does change all the time, and as we lock down certain areas, other areas become the target of threat actors. That's exactly what we see on a daily basis. To stay ahead of the groups, yes, we have the purple team. Treasury Board brings in first-class industry experts to come in and see if we detect them and if others detect them as well, which is an important exercise. The chief mentioned earlier the collaboration right across CSE and with our Five Eyes partners. We are tracking threat actors right around the globe all the time, trying to figure out what their next techniques are going to be and what exploitation efforts they're going to conduct, and we are implementing defences for this. We host innovation workshops with the best in industry right across Canada and around the world. For example, GeekWeek, which is hosted annually, includes members of critical infrastructure—banks, telcos, etc.—as well as security companies and cloud service providers. We all come and try to figure out what those next challenges will be. We do this on the classified side as well, with basically the best cyber-defenders in the world…