Empowering Defence in the Digital Age

SYNOPSIS

The most significant challenge facing the Canadian Armed Forces is leveraging digital technologies to its advantage. No matter what platforms and combat capabilities Canada acquires, they will not be optimized without the digital tools to enable pan domain command and control. This paper makes the case that the vast majority of the barriers preventing that sit outside Defence's own authorities, responsibilities and accountabilities. It works through the government-wide instruments that bind Defence, ITSG-33, the cloud security profiles, the administrative and operational data distinction, and the absence of Zero Trust and data centric security from the framework, and shows that Canada's cyber security posture is not only sub-optimal but costs roughly a half billion dollar premium relative to peers. It argues that Defence should have its own digital policy framework, and makes six recommendations.

KEY FINDINGS

1. 1

   The barriers sit outside Defence's own authorities. Despite some policy exemptions in recognition of its unique requirements, Defence still complies with numerous government-wide policies that do not reflect or support military needs. Defence's digital progress is therefore a direct reflection of the Government of Canada's ability to realize its own digital ambitions, and an aggregated approach to policy, infrastructure and requirements does not serve the unique needs of the CAF.

2. 2

   The posture is sub-optimal and Canadians pay a premium for it. A comparative study of ten national cyber security strategies ranked Canada ninth. Drawing on the government's own Enterprise Cyber Security Strategy, the paper places Canada's posture in the bottom or second bottom of the four tiers of the NIST Cyber Security Framework 2.0, on which Canada based its own 2025 strategy. A 2018 Shared Services Canada sponsored Gartner study found SSC's network and security model 19 per cent, or $427 million, more costly than peers. The paper puts the premium at roughly half a billion dollars.

3. 3

   The framework the strategy rests on is obsolete. The Enterprise Cyber Security Strategy anchors its execution to ITSG-33, released in 2012 and last updated in 2015. Neither Zero Trust nor data centric security is referenced in it, even though the United States has mandated Zero Trust by executive order and Australia, New Zealand and the United Kingdom have all issued direction on it.

4. 4

   The control profiles carry substantially more than allied equivalents. Canada's Protected B profile has 436 controls against NIST moderate's 257, and Secret 516 against NIST high's 339, roughly 180 additional controls for baselines described as equivalent. The cloud profiles repeat the pattern: Canada's low baseline has 253 controls against FedRAMP low's 156, and once supply chain controls are counted requires 108 more; PBMM has 357 against FedRAMP Moderate's 323, with 80 controls that do not map across at all.

5. 5

   The administrative and operational data distinction does not survive contact with Defence. The paper calls it “an overly simplistic and a foolish characterization”. Data that is administrative to a policy maker is operational to a practitioner. Since Defence owns the national security risk, the paper argues it should own the risk of where it hosts its data, rather than having that approved by departments delivering against goals that have nothing to do with national security.

6. 6

   Accountability without the corresponding authority is not accountability. Defence carries responsibility for the national defence and security of the nation, but many of the authorities governing its digital environment reside elsewhere. The paper concludes that the current accountability framework, “characterized by split accountabilities, unclear and often contradictory policies essentially delivers no accountability at all”, leaving Defence accountable for outcomes without control over many of the decisions required to produce them.

RECOMMENDATIONS

The paper makes six recommendations.