Ontario’s new advisory panel on improving cybersecurity maturity of municipalities, school boards, hospitals and other provincially-funded agencies has agreed as a first step that its final report will encourage organizations to take a risk-based approach to their efforts.
However, how the panel will recommend the government put teeth into that has yet to be determined.
In an interview Wednesday shortly after the panel’s first meeting, chairman Robert Wong — executive vice-president and chief information officer of Toronto Hydro — said a risk-based approach is what the Ontario Energy Board (OEB) mandated the 65 local electric distribution companies like Toronto Hydro to do starting in 2018.
Each company has to fill out an annual Readiness Report on its cyber and privacy risk status.
The self-assessment uses the Ontario Cybersecurity Framework’s security controls. It’s a framework similar to the U.S. National Institute of Standards and Technology’s (NIST) cyber framework for measuring an organization’s risk level. The Readiness Report shows each distribution company has established cybersecurity objectives and assessed its current capability in meeting those objectives.
Asked if his panel might recommend the same for the broader public sector, Wong said it’s possible, but he didn’t want to presume what the panel would decide.
Related:
Ontario electric utilities have to report on their cyber readiness
Financially-strapped public agencies would welcome cash to help hire infosec pros and buy equipment. On that topic, there was some hope from panel member Marc Coyle, IT manager for the City of Belleville. He spoke Wednesday briefly during a session of the annual cybersecurity conference of the Municipal Information Systems Association (MISA) of Ontario.
At Wednesday’s panel meeting, he recalled government officials saying, “funding cyberinfrastructure is a priority.”
Asked about that statement, Wong was cautious. “I didn’t hear it specifically in those terms. I think they acknowledged funding will be a consideration, but there are no specifics about that.”
What publicly-funded organizations don’t want, Wong suggested, is “a list of best practices.” Rather, he said, they want a roadmap to becoming more cyber mature. Many smaller organizations “are struggling to understand what their risks are.”
The advisory panel’s final report is due in two years, although Wong said it might issue interim reports.
Known as the expert panel on cybersecurity in the broader public sector (BPS), it was announced on Oct. 25 by Minister of Government and Consumer Services Lisa Thompson.
Wong said that at Wednesday’s meeting, Thompson asked the panel to assess and identify common and sector-specific cybersecurity challenges faced by BPS organizations and make recommendations on a provincial cybersecurity strategy.
“Our government is committed to strengthening our cybersecurity infrastructure,” Thompson said when the panel was announced. “As the threats of cyberattacks and hacking become more frequent globally, it’s imperative that we take action now to improve our defences within the broader public sector. Leveraging the skills and expertise of our panel members will allow us to strengthen the resiliency of our digital infrastructure as we collectively move more government programs and services online.”
The province has a number of tools at its disposal, including making grants or tax deductions to agencies for hiring more staff or buying cybersecurity software and hardware. It could also encourage sectors to follow the lead of Ontario’s universities and colleges, which share a CISO. The position could be supported by provincial funding.
The panel appointment comes as cyberattacks, particularly ransomware, are increasingly victimizing hospitals, universities, and schools.
In addition to Wong, the panel includes:
- Derek Bowers, chief information technology officer of the Town of Wasaga Beach;
- Marc Coyle, manager of information technology at the City of Belleville;
- Scott Currie, chief information officer at Toronto’s Hospital for Sick Children;
- Adam Evans, vice-president of cyber operations and CISO at the Royal Bank;
- Helene Fournier, executive director of Valoris for Children and Adults of Prescott-Russell;
- Antoine Haroun, CIO of Chief Information Officer of the Peel District School Board;
- Andrew Kirsch, founder of Kirsch Consulting Group;
- Carolyn Glaser, information technology services manager for the Thames Valley District School Board;
- Isaac Straley, CISO of the University of Toronto.
Wong said the invitation to be on the panel came suddenly in an email a few months ago.
Due to the COVID pandemic, Wednesday’s first-panel meeting was held online, and Wong expects much of the panel’s work will also be held virtually. The next session is scheduled for February. In between then, the panel will liaise with a working group of bureaucrats who will gather the requested information.