As a sign it is taking cyber security more seriously Ontario has hired a former Canadian Security Intelligence Service (CSIS) assistant director of intelligence to be its first provincial security advisor.
Ray Boisvert, who has headed a security consulting company iSECIS for four years since leaving CSIS, was named to the post — which will make him an associate deputy minister in the Ministry of Community Safety and Correctional Services — by the government this morning. He begins his duties Jan.2
In his role he will provide advice and intelligence on areas of public safety and national security that fall within provincial responsibility, the government said in a statement. “He will support efforts to protect provincial assets from events that could affect services, networks and facilities that are critical to Ontario’s economy, public safety and security.” He will also engage with key partners on security-related matters.
Boisvert will report to the deputy minister of Community Safety and Correctional Services.
As a former intelligence operative Boisvert has been a popular interview for news media who doesn’t pull his punches.
At a conference last year on the state of Canada’s critical infrastructure he warned that governments, utilities and financial institutions aren’t doing enough to defend critical infrastructure for online attacks. However, he did add that Ontario, New Brunswick and Alberta are ahead of the other provinces and territories.
In 2014 he told the annual SecTor security conference that “Western hegemony is under threat” from the wide range of nation-states, terrorists and criminals hacking their way into the public and private sectors — although he also said it isn’t hopeless.
“Stop trying to keep the bad guys on the outside at the perimeter,” he advised. “You’re just going to have to accept that a lot of them will get by all those defences.” Instead organizations should use behavioral analytics to analyze behavior on the internal network to detect suspicious activity.
“It’s easy for the non-tech people to tell CIO buy an appliance to make the network safe,” he said. But “proactive cyber defence is a combination of a lot of things. It’s about layers, keep on building and refurbishing, and its about going on the dark Web and finding out what others are saying about you.”
His appointment comes after the province was embarrassed in October by a distributed denial of service (DDoS) attack that caused the cancellation of an online literacy test for tens of thousands of Ontario students.
It also comes after a hacker claimed in November to have stolen customer, employee and vendor information from an aboriginal-owned and run casino resort. The provincial lottery and gaming corporation regulates casinos. The resort said none of the casino games were breached.
In addition a small Ontario hospital admitted in March its website could have been dispensing links to malware and ransomware due to an unpatched content management system.
Meanwhile the federal government is preparing to draft new cyber security policies and framework which could impact provinces. For example, Public Safety Canada is talking about creating a national cyber crime centre to co-ordinate online investigations which would include provincial and territorial participation, and about possibly helping the public and private sectors share threat intelligence. A separate public consultation, which ends Thursday, is asking — among other things — if local police forces should be given more power to get basic subscriber information from Internet service providers.
