The Government of Canada released an Enterprise Cyber Security Strategy last month. Unfortunately, most media outlets overlooked or did not understand what enterprise cyber security means or is about. So, I decided to write an introduction to the first Canadian Enterprise Cyber Security Strategy. https://lnkd.in/gQ4nP7dc #Canada #defence #defenceindustrialbase #enterprise #cybersecurity #cyberdefence Canadian Cyber in Context #innovation #cyber #treasuryboard
This is a great read out, Alexander. Thanks for sharing.
Although it has a couple of issues around the parallels between PB and Secret information and confuses issues around national security interests, this is a good read and should be considered: https://www.cgai.ca/canadas_security_classification_framework_the_biggest_impediment_to_realizing_our_digital_ambition
Now I feel silly for having read the whole thing when it came out, I should have just waited for you to do it and distill it into something so much more palatable. Thanks!
Very informative Alex!
I'm not confident that the continued use of ITSG-33 - IT Security Risk Management: A Lifecycle Approach is going to provide the foundational coverage in Risk Management they think it does. Been using it for quite some time now and how many Federal breaches have there been? Natural question to that is "So Pete, what's missing?". What I would have like to see was a realization that the complexity of the digital environment and the array of potential solutions for security requires that proper systems engineering and systems security engineering to develop adequately secure solutions for a business context. To quote a colleague of mine "I think the GC risk management framework was used as a technique not so much to make departments accountable for risk elements like security, but to allow them to ignore fundamental risk elements like security. That philosophy is coming home to roost and will take a lot more than what is articulated in the Cyber Security Strategy to fix. There is little in the document that points to proper engineering as a solution to improving cybersecurity."