3. AGENDA NCSIP Mandate IT Security Threats Specific Action Items Additional Initiatives

4. NCSIP Mandate: Create and champion policies, standards, procedures and tools to ensure all jurisdictions in Canada maintain the highest standards of information infrastructure protection Exchange information, share best practices, and recommend programs and priorities on information protection for the governments of Canada

5. IT Security Threats Malicious code up 500 % in last 6 months Web application attacks increasing Average time between announcement of vulnerability and the exploit code last year was 5.8 days - now approaching ‘zero day’ Malicious code is morphing as it propagates Spyware and botnets are widespread 33% rise in phishing in 2004 over 2003

6. Spyware Keystroke Loggers (a.k.a., Keyloggers or Snoopware) –software that runs in background, recording all keystrokes of user, potentially stealing passwords and other confidential data Remote Access Trojans (RATS) –allows an attacker to remotely control user’s computer

7. Phishing Sites Increasing Source: www.antiphishing.org

8. First comes the e-mail…

9. Then a redirection to a false site…

10. Spam is increasing

11. However: The threat picture is not unique to Canada Regular contact with NCSIP members re: –Emerging vulnerabilities, viruses, threats, incidents, best practices –Weekly collaboration through GovIRT sponsored by PSEPC, alerts/advisories, trends, incident management coordination, Qs & As etc –Operational cooperation with EMOs, other committees Industry is working aggressively to combat threats through iimproved products such as SPAM filtering, Spyware cleaning tools etc.

12. Specific Action Items

13. Common Self Assessment Tool PURPOSE: Assess current state of security Create a cross country, high level report on the state of IT Security Establish a base line for determining required improvements and measuring future progress Identify gaps and set priorities Assist in developing an improvement plan

14. Common Self Assessment Tool STATUS: High level tool developed as planned, based on the Quebec model Alberta, PEI and MISA will pilot the tool and report results Delayed due to copyright issues related to the Quebec model Concurrently, jurisdictions are building on the growing ISO 17799 tools being produced

15. Education and Awareness PURPOSE: Support Continuing Education and Awareness of IT Security issues at all levels across all jurisdictions

16. Education and Awareness STATUS: Quebec Videos have been re-taped and support material is being translated Exploration with CSE college re: training courses available/to be developed Increased collaboration with municipalities (MISA) Additional resources identified in some jurisdictions National Awareness Framework planned Ongoing work is required here as we are all dealing with the same citizen

17. Coordinate ITS Standards PURPOSE: Coordinate ITS standards, including adoption of national and international standards (e.g. NIST, ISO 17799)

18. NCSIP linkage with PSEPC National Security Policy –Government Operations Centre National Emergency Response System –Cyber Security Task Force National Cyber Security Strategy Canadian Cyber Incident Response Centre –Federal/National focal point and coordination centre Cyber Incident Response 7X24 Threat monitoring Enhanced readiness and response to cyber events nationally

19. National Emergency Response Structure Prime Minister Cabinet Ministerial Committee with DM participation as required for National Policy Direction Minister( s) Regional Interface Strategic Coordination National Policy Direction OGDs EOCs Including Agencies Regional federal offices Simple Incident Complex Incident Government Operations Centre (GOC) Department (s) DMs/ADMs ADM Public Safety Committee with DG participation as required for National Policy Direction

20. Emergency Response PURPOSE: Liaise and coordinate with emergency response organizations

21. Emergency Response STATUS: Call out exercise February 2004 Meeting with EMO officials April 2004 Effective CISO/EMO relationships developed Inter-jurisdictional cyber exercise group working expanded to include more EMO staff NCSIP exercise conducted October 2004 Briefing with EMOs November 2004 Joint exercise planned Fall 2005

22. Additional Initiatives Security clearance policies and practices Liaison with ITAC through GOC-TBS Spam, Spyware Wireless Security Mobile Devices