I first experienced the frustration inherent in Canada’s approach to cybersecurity education last year at the University of Waterloo’s CPI conference. There Charles Finlay from the CyberCatalyst talked about how other smaller countries focus on a collaborative approach to cybersecurity that creates a coherent ecosystem of partners who support rather than compete against each other. In the asymmetrical world of cybersecurity where attackers have every advantage in terms of anonymity, it isn’t just criminal organizations working the dark end of the internet in 2023, it’s authoritarian nation states with fully developed offensive cyber operations. Without collaboration, democracies will dissolve in the chaos of our networked world.
|We have the resources,
cooperation is what’s missing.
In the year since I’ve been working to establish connections between the many entities in Canada’s cybersecurity industry intent on education and career pathways illumination, but what I’ve found are siloed organizations (private, public and NFP) fixated on IP and market share whose idea of collaboration is creating partnerships to defeat what they perceive as competition. This isn’t collaboration so much as it’s about combining resources to compete more effectively.
|The majority of attacks are US focused, but if
you consider Canada has 1/10th the people, we
actually face similar numbers of attacks per capita.
One of the ways I’ve escaped Canada’s siloed approach to, well, pretty much everything, is to look internationally for organizations interested in working collaboratively on the cyber-problem. That would be the one where we put all our critical infrastructure onto a global network that was never designed to be secure and then struggle with wave after wave of increasingly automated cyber-attacks in an environment where the attack surface has become impossibly complicated post COVID.
I started by looking at the World Economic Forum’s review of the new US Cyber-Strategy, which is focusing on protecting critical infrastructure and improving collaboration both domestically and internationally to create more effective cyber-defences. Canada’s strategy is designed to encourage competition rather than collaboration and has resulted in our being one of the most targeted countries globally.
The US strategy seems to be aware of this North American predilection for relentless market dominance fixated competition and is attempting to put resources into a collaborative mindset. That approach became apparent to me when I attended the Global Conference on Cyber Capacity Building this fall.
Through looking into WEF and the UN I came across the Global Forum for Cybersecurity Excellence (GFCE). In June I pitched this proposal on helping cybersecurity practitioners become aware of the coming threats to encryption that quantum computing brings: GFCE Proposal – Cybersecurity in the Age of Quantum Advantage.docx. The elevator pitch is: quantum computing will break most of the encryption standards we depend on for everything from our online financial systems to military communications in the next decade, and likely much sooner.
The GFCE got back to me and said they felt that quantum awareness was an important piece of the puzzle and a good fit with their Global Conference on Cyber Capacity Building (GC3B) happening in Accra, Ghana at the end of November. They invited me to develop the research and present it at the event.. I’m currently seconded with both ICTC working on cyber-education outreach and the Quantum Algorithms Institute developing education for quantum readiness. QAI supported this research and I got in touch with Louise Turner, a former student now in the inaugural cohort of cybersecurity at Queens University, and she and I put the paper together.
While doing two jobs I beavered away on the paper in the background and Louise (who was juggling her third year course load) and I managed to get the paper in on time. While all that was going on we were both jumping through the hoops in terms of visas and medical requirements to take what would be both of our first trips to Africa.
It was snaining in Toronto when we left, but on the ground in Ghana after 12 hours of misery in a middle seat next to the only guy bigger than me on the plane (why don’t airlines use smart tech to arrange seating better?), we found ourselves on the ground in Africa! The VISA support by the Ghanese government had been spectacular in Canada and the hospitality was just as special at the Accra Airport. A senior military officer ushered us through customs in seconds and out to the GC3B desk where we got connected to our hotel and suddenly found ourselves tearing through Accra traffic, stunned by the sights and sounds… and heat (Accra is only 600kms north of the equator)!
|The conference flags were all around the city. From our anonymity in Canada, we suddenly found ourselves at a very welcoming international event.
The Accra City Hotel was where we’d been put up for the conference and was only a ten minute drive from the very fancy Kempinski Hotel where the conference was taking place. We had lunch and then collapsed in our rooms for the afternoon after over 24 hours on the road.
The week before we’d built a powerpoint: QAI GFCE cyber in the age of quantum research presentation.pptx that was designed to gently introduce cybersecurity policy and technical practitioners to quantum computing. We went over it after our afternoon naps on the pool deck in the sweltering heat and humidity of an Accra evening. Louise helped pioneer women in cybersecurity in our school back in 2018/19 when she was in grade 10 and I’ve known her ever since, so we knew each other’s strengths and felt ready to go with the presentation the next morning. That night we had a fantastic Ghanan buffet and then hit the hay.
Since we were presenting on the periphery of the main conference we got to meet the Global Forum for Cyber Excellence working groups who were the organizers of the research presentations. This gave us ‘behind the scenes’ access to the conference before the main event kicked off the next day. It quickly became apparent that the research presentations needed more time to do them justice. We heard from researchers from all over the world studying everything from regionally specific cyber challenges to international projects on how cyber is presented in the media – to call it fascinating would be an understatement.
We must have done well because we were the only presentation who was asked questions by the reviewer running the event and we ended up late to lunch because we had a line of attendees wanting to ask further questions. There is a lot of curiosity out there around quantum technologies but not a lot of people developing accessible education for the public; it tends to be an academically isolated industry.
The rest of that first day at the Global Conference on Cyber Capacity Building was fascinating because it wasn’t really about the conference, but instead about the mechanics of the GFCE. By the time we were heading back to the hotel I felt like I’d found my tribe and was determined to see what else I could do with them. This was the collaboration and mutually supportive approach to cyber that I’d been missing.
I use Twitter as a way to bookmark ideas and resources so I can find them later when I’m building one of these blog posts. My feed from the conference probably tells the story better than a summary here, but to say it was engaging and eye opening would be underselling it. The GC3B worked every angle from policy and diplomacy to technical cooperation and regional partnerships all the way through to international collaboration. It changed the way I see cybersecurity because it moved me beyond the veiled, siloed and somewhat paranoid world of Canadian cyber.
|Kwame Nkrumah Mausoleum in Accra – well worth a visit.
On the bus ride over (which was an adventure in itself – African commuter buses have drop down seats so the bus is shoulder to shoulder in every row without an exit aisle), I was at a loss to understand how we appeared to be the only Canadians at an international conference where over 100 countries were in attendance. The US State Department had helped fund the event, as had the EU, and we’d met Australians and many other Commonwealth nationalities, but not a single Canadian. The Australian told us about how her government’s local office had picked her up at the airport, taken her out for lunch and made sure she was OK at her hotel. Ours sent us a PDF of things to do in Accra.
|Over 100 countries in attendance. Didn’t see a single Canadian in any of the dozens of presentations and none were presenting. I know for a fact that Canada has some of the top cybersecurity practitioners on the planet, but they don’t like to share?
You might not have watched that video, but this sort of brainstorming and mutual support is just what we need if we’re going to produce a cybersecure future. This doesn’t happen behind closed doors or at a distance. I hear a lot of Canadians talking about the Canadian government as though it’s distinct from them. This cool distance creates problems with how Canadians understand their own country and their role in it, but this distance also freezes out possibilities for international collaboration, which must be about more than sending money.
|An all-female team won Ghana’s student cybersecurity challenge!
|Winnie knows how it feels. Whoever is doing Xmas
decorating at Dulles is a bit… chaotic in their approach,
but I like it!
Doing the research outside of my regular working hours wasn’t easy, and managing the many logistical requirements both medical and paperwork wise was also a heavy load to carry, but it’s these extras that I always get the most out of in my work. If you look at my LinkedIn you won’t see me bragging about the work I’m paid to do, but rather the projects I chase beyond those expectations. At the end of the day I’m mission driven. After twenty-years in the classroom and building one of the most successful digital skilling programs in Canada in the most unlikely of places, I want to take what I’ve learned and spark opportunities like that nationally, so more Canadian students can access emerging technologies and make informed decisions about where to go next. That this is a struggle continues to baffle me, but I’m committed to climbing that mountain.
from Blogger https://ift.tt/ivjeWAJ