Alexander Rudolph’s Post

View profile for Alexander Rudolph, graphic

PhD Candidate | Cyber Defence & Pan-Domain Policy Researcher | CGAI, Triple Helix, NAADSN Fellow

The Government of Canada released an Enterprise Cyber Security Strategy last month. Unfortunately, most media outlets overlooked or did not understand what enterprise cyber security means or is about. So, I decided to write an introduction to the first Canadian Enterprise Cyber Security Strategy. https://lnkd.in/gQ4nP7dc #Canada #defence #defenceindustrialbase #enterprise #cybersecurity #cyberdefence Canadian Cyber in Context #innovation #cyber #treasuryboard

An Overview of Canada’s First Enterprise Cyber Security Strategy

An Overview of Canada’s First Enterprise Cyber Security Strategy

canadiancyber.substack.com

I'm not confident that the continued use of ITSG-33 - IT Security Risk Management: A Lifecycle Approach is going to provide the foundational coverage in Risk Management they think it does. Been using it for quite some time now and how many Federal breaches have there been? Natural question to that is "So Pete, what's missing?". What I would have like to see was a realization that the complexity of the digital environment and the array of potential solutions for security requires that proper systems engineering and systems security engineering to develop adequately secure solutions for a business context. To quote a colleague of mine "I think the GC risk management framework was used as a technique not so much to make departments accountable for risk elements like security, but to allow them to ignore fundamental risk elements like security. That philosophy is coming home to roost and will take a lot more than what is articulated in the Cyber Security Strategy to fix.    There is little in the document that points to proper engineering as a solution to improving cybersecurity."

Dom Spiers

Canada Public Sector at Wiz | Secure everything you build and run in the cloud

6mo

This is a great read out, Alexander. Thanks for sharing.

Although it has a couple of issues around the parallels between PB and Secret information and confuses issues around national security interests, this is a good read and should be considered: https://www.cgai.ca/canadas_security_classification_framework_the_biggest_impediment_to_realizing_our_digital_ambition

Like
Reply
Chris F.

Senior Security Consultant @ RHEA Group | Technology Security, Organizational Leadership

6mo

Now I feel silly for having read the whole thing when it came out, I should have just waited for you to do it and distill it into something so much more palatable. Thanks!

Bill E. Featherstone, M.A.

Author and Research Fellow, Centre for Defence and Security Studies (CDSS) and Research Affiliate, Centre for Earth Observation Science (CEOS), University of Manitoba. [email protected]

6mo

Very informative Alex!

See more comments

To view or add a comment, sign in

Explore topics