Digital Brain
digital brain
digital brain

Canadian Centre for Cyber Security Releases Ransomware Playbook

December 21, 2021 Privacy and Data Security Bulletin 3 minute read

Ransomware attacks are on the rise.

In the first half of 2021, global ransomware attacks increased by a staggering 151%.[1] Throughout the year, the world has seen many high profile ransomware attacks on large organizations, including the widely publicised attacks on Kaseya and Colonial Pipeline.

The Canadian Centre for Cyber Security (“CCCS”) has proposed several reasons for the increase in ransomware activity, including the shift towards online operations throughout the pandemic and the increasing sophistication of cybercriminals.[2] Perhaps most troubling is the emergence of “ransomware-as-a-service”, in which developers sell or lease their ransomware programs to other cybercriminals, taking a percentage of the victim’s ransom payment in return.[3]

Nonetheless, as the CCCS has noted, organizations can prevent or mitigate the vast majority of ransomware attacks by implementing basic cyber security measures. This is why on November 30, 2021, the CCCS released a ransomware playbook (the “Playbook”) to help organizations prepare for and respond to ransomware attacks.[4]

What is Ransomware?

Ransomware is a type of malicious software that threatens to publish a victim’s data assets or perpetually block access unless a sum of money is paid. Ransomware incidents can devastate organizations by disrupting their critical functions reliant on network and system connectivity.

What Companies Do Cybercriminals Target?

Businesses of all sizes can be targets of ransomware attacks. While attacks on larger corporations can be more lucrative for cybercriminals, as the Playbook notes, cybercriminals often consider small and medium sized organizations to have weaker security protection measures, making them easier targets.[5]

The following factors make a company a more likely target for a ransomware attack:

  • The company has access to sensitive data that can be directly exploited, such as social insurance numbers, credit card numbers, or other financial information;
  • The company has access to personal information that individuals would not want to be exposed, such as medical or religious information;
  • Data is a crucial component of the company’s business, such that a disruption to the company’s systems would halt their entire business (making the company more likely to pay the ransom);
  • The company holds valuable client data, or intellectual property, such as trade secrets;
  • The company takes part in critical infrastructure, such as vital medical services; or
  • The company is connected to a company that meets one of the descriptions above.[6]

The first half of the Playbook focusses on how a company can defend against ransomware. It covers cyber defence planning and basic cybersecurity controls. On the subject of cyber defence planning, the Playbook provides a useful overview of the principles to consider when developing (i) a backup plan, (ii) an incident response plan, and (iii) a recovery plan.[7]

In terms of cybersecurity controls, the Playbook provides a list of useful data security measures, including, without limitation:

  • Perimeter defences, such as firewalls, anti-phishing software, and virtual private networks;
  • Logging and alerting, to track activity throughout the system, which helps establish an audit trail;
  • Penetration testing, to assess vulnerabilities;
  • Network Segmentation, to control and restrict access to information within your IT system; and
  • Password management, to ensure stronger passwords are used throughout your organization.[8]

The second half of the Playbook focusses on how to recover from ransomware attacks. It covers immediate response actions that companies should take in the event of a breach and actions that will help a company get their business back online as quickly as possible following an attack.[9]

The Playbook is a useful tool for companies of all sizes to assess their readiness for a ransomware attack, and prepare themselves accordingly. However, companies need to employ a contextual approach to data security, taking into account the nature of their business, as well as their data and security systems. Developing and maintaining a comprehensive ransomware strategy requires input from legal and IT professionals.

If you have experienced a ransomware attack, or you have any questions about how to prepare for potential ransomware attacks, a member of our privacy and data security group would be happy to assist you.

[1] As compared with the latter half of 2020: Canadian Centre for Cyber Security, Cyber Threat Bulletin: The Ransomware Threat in 2021.
[2] Canadian Centre for Cyber Security, Cyber Threat Bulletin: The Ransomware Threat in 2021, s.v. “Evolving Trends”.
[3] Canadian Centre for Cyber Security, Cyber Threat Bulletin: The Ransomware Threat in 2021, s.v. “Ransomware-as-a-Service”.
[4] Canadian Centre for Cyber Security, Ransomware playbook ITSM.00.099.
[5] Canadian Centre for Cyber Security, Ransomware playbook ITSM.00.099 at 1.1.2.
[6] Canadian Centre for Cyber Security, Ransomware playbook ITSM.00.099 at 1.1.2.
[7] Canadian Centre for Cyber Security, Ransomware playbook ITSM.00.099 at 2.1.
[8] Canadian Centre for Cyber Security, Ransomware playbook ITSM.00.099 at 2.2.
[9] Canadian Centre for Cyber Security, Ransomware playbook ITSM.00.099 at 3.

by Mitch Koczerginski and Robbie Grant

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2021

Insights (5 Posts)

Featured Insight

Federal Privacy Commissioner Releases Key Recommendations for a New Federal Private Sector Privacy Law

The Office of the Privacy Commissioner of Canada released a summary of its key recommendations for a new federal private sector privacy law in Canada

Read More
May 17, 2022
Featured Insight

We Have a DPA: Prosecutors Agree to Deferred Prosecution Agreement With SNC-Lavalin

Canadian prosecutors have for the first time agreed to a deferred prosecution agreement with a Canadian company.

Read More
May 16, 2022
Featured Insight

Open Banking: What it is and what it means for you

As we have received a number of questions from clients regarding our open banking bulletins, we are putting together an interdisciplinary panel of experts to take a deep dive into the implications of an open banking system in Canada, exciting developments & expectations for further progression.

Thursday, June 2, 2022
Featured Insight

Court of Appeal: Single Incident of Sexual Harassment is Cause for Termination

Ontario’s Court of Appeal has upheld the termination of a 30-year employee for cause following a single incident of sexual harassment.

Read More
May 6, 2022
Featured Insight

What is the Capital Markets Tribunal?

This article provides further information about the new Capital Markets Tribunal.

Read More
May 5, 2022