Digital Brain
digital brain
digital brain

Canadian Centre for Cyber Security Releases Ransomware Playbook

December 21, 2021 Privacy and Data Security Bulletin 3 minute read

Ransomware attacks are on the rise.

In the first half of 2021, global ransomware attacks increased by a staggering 151%.[1] Throughout the year, the world has seen many high profile ransomware attacks on large organizations, including the widely publicised attacks on Kaseya and Colonial Pipeline.

The Canadian Centre for Cyber Security (“CCCS”) has proposed several reasons for the increase in ransomware activity, including the shift towards online operations throughout the pandemic and the increasing sophistication of cybercriminals.[2] Perhaps most troubling is the emergence of “ransomware-as-a-service”, in which developers sell or lease their ransomware programs to other cybercriminals, taking a percentage of the victim’s ransom payment in return.[3]

Nonetheless, as the CCCS has noted, organizations can prevent or mitigate the vast majority of ransomware attacks by implementing basic cyber security measures. This is why on November 30, 2021, the CCCS released a ransomware playbook (the “Playbook”) to help organizations prepare for and respond to ransomware attacks.[4]

What is Ransomware?

Ransomware is a type of malicious software that threatens to publish a victim’s data assets or perpetually block access unless a sum of money is paid. Ransomware incidents can devastate organizations by disrupting their critical functions reliant on network and system connectivity.

What Companies Do Cybercriminals Target?

Businesses of all sizes can be targets of ransomware attacks. While attacks on larger corporations can be more lucrative for cybercriminals, as the Playbook notes, cybercriminals often consider small and medium sized organizations to have weaker security protection measures, making them easier targets.[5]

The following factors make a company a more likely target for a ransomware attack:

  • The company has access to sensitive data that can be directly exploited, such as social insurance numbers, credit card numbers, or other financial information;
  • The company has access to personal information that individuals would not want to be exposed, such as medical or religious information;
  • Data is a crucial component of the company’s business, such that a disruption to the company’s systems would halt their entire business (making the company more likely to pay the ransom);
  • The company holds valuable client data, or intellectual property, such as trade secrets;
  • The company takes part in critical infrastructure, such as vital medical services; or
  • The company is connected to a company that meets one of the descriptions above.[6]

The first half of the Playbook focusses on how a company can defend against ransomware. It covers cyber defence planning and basic cybersecurity controls. On the subject of cyber defence planning, the Playbook provides a useful overview of the principles to consider when developing (i) a backup plan, (ii) an incident response plan, and (iii) a recovery plan.[7]

In terms of cybersecurity controls, the Playbook provides a list of useful data security measures, including, without limitation:

  • Perimeter defences, such as firewalls, anti-phishing software, and virtual private networks;
  • Logging and alerting, to track activity throughout the system, which helps establish an audit trail;
  • Penetration testing, to assess vulnerabilities;
  • Network Segmentation, to control and restrict access to information within your IT system; and
  • Password management, to ensure stronger passwords are used throughout your organization.[8]

The second half of the Playbook focusses on how to recover from ransomware attacks. It covers immediate response actions that companies should take in the event of a breach and actions that will help a company get their business back online as quickly as possible following an attack.[9]

The Playbook is a useful tool for companies of all sizes to assess their readiness for a ransomware attack, and prepare themselves accordingly. However, companies need to employ a contextual approach to data security, taking into account the nature of their business, as well as their data and security systems. Developing and maintaining a comprehensive ransomware strategy requires input from legal and IT professionals.

If you have experienced a ransomware attack, or you have any questions about how to prepare for potential ransomware attacks, a member of our privacy and data security group would be happy to assist you.

[1] As compared with the latter half of 2020: Canadian Centre for Cyber Security, Cyber Threat Bulletin: The Ransomware Threat in 2021.
[2] Canadian Centre for Cyber Security, Cyber Threat Bulletin: The Ransomware Threat in 2021, s.v. “Evolving Trends”.
[3] Canadian Centre for Cyber Security, Cyber Threat Bulletin: The Ransomware Threat in 2021, s.v. “Ransomware-as-a-Service”.
[4] Canadian Centre for Cyber Security, Ransomware playbook ITSM.00.099.
[5] Canadian Centre for Cyber Security, Ransomware playbook ITSM.00.099 at 1.1.2.
[6] Canadian Centre for Cyber Security, Ransomware playbook ITSM.00.099 at 1.1.2.
[7] Canadian Centre for Cyber Security, Ransomware playbook ITSM.00.099 at 2.1.
[8] Canadian Centre for Cyber Security, Ransomware playbook ITSM.00.099 at 2.2.
[9] Canadian Centre for Cyber Security, Ransomware playbook ITSM.00.099 at 3.

by Mitch Koczerginski and Robbie Grant

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2021

Insights (5 Posts)

Featured Insight

Upfront Compensation for Segregated Funds: Is a Total Ban on the Horizon?

Insurance Regulators are exploring regulatory changes to Segregated Funds compensation arrangement on Insurers, Intermediaries and Consumers.

Read More
Sep 28, 2022
Featured Insight

Too Quick to (Summary) Judge: The Shortcomings of Summary Judgment in Patent Actions in Canada

The FCA addresses the shortcomings of summary judgment in patent cases, along with issues relating to "common general knowledge" and experimental testing.

Read More
Sep 27, 2022
Featured Insight

Land Use Planning and BOMA Standards: Issues and Possible Solutions

McMillan’s Commercial Real Estate and Litigation & Dispute Resolution teams are offering a conference on a variety of current issues relating to real estate development and BOMA Standards.

October 27, 2022
Featured Insight

Just Say No (to Fixed-Term Employment Contracts): Court Awards 23 Months’ Pay to Former Business Owner

The Ontario Superior Court of Justice has issued another warning to employers who enter into fixed-term contracts with their employees.

Read More
Sep 26, 2022
Featured Insight

Single Proceeding Model Trumps Contractual Rights – Arbitration Clause Held “Inoperative” in Insolvency Proceeding

Ontario's highest court has held that an arbitration clause may be unenforceable in an appropriate insolvency proceeding, introducing contractual uncertainty.

Read More
Sep 26, 2022