Cybercrime and Canadian Businesses Mohammad Lari & Economist October 23, 2018 Mark Uhrbach Program Manager

Canadian policy makers had to rely on statistics and data from outside of government to inform decision-making. Insufficient data for decision-making Cross-economy enterprise-based survey Feasibility study 2015-2016

Over 12,000 firms in the sample The Canadian Survey of Cyber Security and Cybercrime is the first of its kind in Canada and one of the first in the world. Firms with employees Across all sectors Over 12,000 firms in the sample 86% response rate 10+ Focus on economic impact of cybercrime, not social issues such as cyberbullying or online harassment.

Anti-malware software Nearly all (95%) businesses employed some form of cyber security to protect themselves, their customers and their partners. However, usage was not universal. A number of businesses did not use: Anti-malware software Email security Network security 24% 26% 32% 66% of businesses allowed their employees to use personally owned devices to carry out business-related activities, but less than half (47%) of these businesses had security measures in place to manage these devices.

Almost 29% of businesses were required to implement cyber security measures by their suppliers, customers, partners or regulators. These requirements were more common among: Banking institutions Health & personal care stores Pipeline transportation 81% 79% 67%

74% of businesses had employees primarily responsible for cyber security 72% 83% 91% Small (10 to 49 employees) Medium (50 to 249 employees) Large (250+ employees) 67% of businesses, regardless of size, reported having one to five employees primarily responsible for cyber security. Among the 26% of businesses that reported not having any employees primarily responsible for cyber security: 56% 31% Indicated that the business used consultants or contracts to monitor their networks Indicated cyber security was not a high enough risk

% of businesses that provided formal training, by size of business Cyber security training 51% of businesses shared general cyber security practices through email, bulletin boards or information sessions with employees. 19% of businesses provided formal training for employees to develop or upgrade their cyber security-related skills. % of businesses that provided formal training, by size of business 16% 32% 59% Small (10 to 49 employees) Medium (50 to 249 employees) Large (250+ employees)

13% of businesses had a written policy in place to manage or report cyber security incidents. Certain industries surpassed the average, including: Banking institutions Rail transportation Pipeline transportation 66% 55% 55% 28% of businesses reported having senior managers oversee cyber security risks and threats, and 89% of these businesses reported that they updated senior managers on actions taken regarding cyber security.

58% of businesses undertook activities to identify cyber security risks. Of these: 85% 38% Monitored their network and business systems Monitored their employees’ behaviours 25% 8% Complete audit of IT systems, undertaken by an external party Investment in threat intelligence 20% 11% A formal risk assessment, undertaken by an external party A formal risk assessment, undertaken by an employee 16% 7% Penetration testing, undertaken by an external party Penetration testing, undertaken by an employee

9% of businesses had cyber liability insurance to protect against cyber security risks and threats. 7% 14% 24% Small (10 to 49 employees) Medium (50 to 249 employees) Large (250+ employees) Cyber liability insurance was prevalent among certain industries: Natural gas distribution Data processing, hosting and related services Banking institutions 54% 50% 48%

$8 billion $4 billion $2 billion Canadian businesses reported spending $14 billion on cyber security in 2017. $8 billion on salaries for employees, consultants and contractors $4 billion on cyber security software and related hardware $2 billion on other prevention and recovery methods Annual average expenditures differed greatly based on size of business. Small (10 to 49 employees) Medium (50 to 249 employees) Large (250+ employees) $46,000 $113,000 $948,000

% of businesses impacted, by size of business 21% of businesses reported that they were impacted by a cyber security incident, which affected their operations. % of businesses impacted, by size of business 19% 28% Small (10 to 49 employees) Medium (50 to 249 employees) 41% Large (250+ employees)

Pipeline transportation % of businesses impacted, by industry Top 3 industries impacted Banking institutions Pipeline transportation Oil and gas extraction Telecom (Including ISPs) Universities (Excluding colleges) 47% 46% 45% 44% 39% Air transportation Legal services Utilities Hospitals Retail trade 35% 32% 31% 20% 16%

38% 39% Of those businesses that were impacted: Experienced an attempt to steal money or demand a ransom payment Could not identify the attack’s motive Method Used 46% Malicious software (e.g., viruses, adware, ransomware) 29% Scams and fraud (e.g., financial fraud, phishing) 20% Exploiting software, hardware or network vulnerabilities Method Used 48% Scams and fraud (e.g., financial fraud, phishing) 42% Malicious software (e.g., viruses, adware, ransomware) 20% Exploiting software, hardware or network vulnerabilities

23% 26% Of those businesses that were impacted: Method Used Experienced an attempt to access unauthorized or privileged areas Experienced an attempt to steal personal or financial information Method Used 36% Hacking or password cracking 34% Exploiting software, hardware or network vulnerabilities 31% Malicious software (e.g., viruses, adware, ransomware) Method Used 51% Scams and fraud (e.g., financial fraud, phishing) 30% Malicious software (e.g., viruses, adware, ransomware) 25% Hacking or password cracking

Businesses impacted by cyber security incidents experienced the following major impacts: 54% 53% Prevented employees from carrying out day-to-day work Prevented the use of resources or services 32% 30% Additional time was required by employees to respond to incidents Resulted in additional repair or recovery costs

Over half (58%) of businesses experienced some downtime as a result of an incident. 23 hours Average total downtime for businesses Most businesses (65%) reported that they believed an external party to be responsible for the incidents that impacted them.

Businesses did not report for the following reasons: About 10% of businesses impacted by a cyber security incident reported the incident to a police service in 2017. 8% 12% 15% Small (10 to 49 employees) Medium (50 to 249 employees) Large (250+ employees) Businesses did not report for the following reasons: 53% Incidents were resolved internally 35% Incidents were resolved through IT consultants or contractors 29% Incidents were considered to be too minor and not important enough

So who did businesses report their cyber security incidents to? 42% 11% Software or service vendor IT consultant or contactor 38% 2% Did not report to any external party Government department or agency 15% 1% Suppliers, customers or partners Canadian Cyber Incident Response Centre (CCIRC) 12% <1% Bank or other financial institution Office of the Privacy Commissioner

Thank you For further information, please contact: Howard Bilodeau Economist howard.bilodeau@canada.ca Mohammad Lari Economist mohammad.lari@canada.ca Mark Uhrbach Program Manager mark.uhrbach@canada.ca Data can be accessed through Research Data Centres (RDCs) or the Canadian Centre for Data Development and Economic Research (CDER)

Annex

About 92% of businesses reported using one or more of the following for their business: 79% 40% Website Internet-connected smart devices 61% 37% Social media accounts Intranet 53% 33% Cloud computing and storage E-commerce platforms and solutions 41% 20% Web-based applications Voice Over Internet Protocol (VOIP)

Of the 47% of businesses that used cloud storage, businesses stored: 27% 31% Confidential business information (e.g., inventory, financial statements) Non-sensitive or public information 30% 16% Confidential information about customers, suppliers, partners Commercially sensitive information (e.g., market position, sales and marketing plans) 28% Confidential employee information