Elevating Your Cyber Security Posture: A Deep Dive into the Cyber Centre's Cross-Sector Readiness Toolkit

In today's complex digital landscape, cyber security isn't just an IT concern; it's a fundamental aspect of organizational resilience and compliance, especially for Canada's critical infrastructure. The Cyber Centre's Cyber Security Readiness Goals (CRGs) Cross-Sector Toolkit offers a comprehensive framework designed to help Canadian critical infrastructure owners and operators, across any sector, prioritize their investments and significantly elevate their cyber security posture. This toolkit is an invaluable resource for establishing robust defenses and ensuring adherence to best practices.

What is the Cross-Sector Toolkit?

The Cross-Sector Toolkit is directly linked to the Cyber Centre’s broader CRGs publication. It outlines 36 specific Cyber Security Readiness Goals that organizations can use to assess and improve their cyber defenses. Crucially, this toolkit is provided as a fillable PDF form, enabling organizations to document their progress without submitting any information back to the Cyber Centre. This empowers organizations to privately track their journey towards enhanced security.

Each of the 36 goals within the toolkit is meticulously detailed, including:

• Intended outcome: What the goal aims to achieve.
• Recommended action: Concrete steps to implement the goal.
• Associated risks: Identified threats, often using tactics, techniques, and procedures (TTPs) from MITRE ATT&CK, that the goal addresses.
• References: Links to relevant Cyber Centre guidance and the NIST Cybersecurity Framework (CSF) 2.0.

The goals are organized into six key functions, mirroring common cybersecurity frameworks: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER. Let's explore some key areas within these functions that are vital for compliance and robust cyber security.

1. GOVERN: Establishing the Foundation

Effective cyber security begins with strong governance. The toolkit emphasizes that without clear leadership and accountability, investments may lack effectiveness.

• Privacy Leadership: A single leader or team should be responsible for managing cyber-related privacy risk, establishing policies and procedures that consider applicable privacy legislation and support operational decisions.
• Supply Chain Incident Reporting & Vendor Security Requirements: Organizations must stipulate in contracts that vendors and service providers notify them of security incidents within a risk-informed timeframe. Furthermore, cyber security requirements should be integrated into procurement processes to prefer more secure products and suppliers, even potentially at a higher cost. This directly addresses risks like Supply Chain Compromise (T1195, ICS T0862).
• Organizational and Operational Technology (OT) Cyber Security Leadership: It's critical to identify a named role accountable for planning, resourcing, and executing cyber security activities. For organizations with OT assets, a dedicated OT-specific cyber security leader is also recommended, though one individual might cover both roles. Poor relationships between IT and OT security can increase risk, so fostering collaboration between these teams is also a readiness goal.

2. IDENTIFY: Understanding Your Landscape

Before you can protect your assets, you must know what they are and their vulnerabilities.

• Asset Inventory and Network Topology: Maintaining a regularly updated inventory of all IT (including IPv6) and OT network assets, along with accurate network topology documentation and identified data assets, is crucial. This enables rapid detection and response to new vulnerabilities, aiding in service continuity.
• Mitigating Known Vulnerabilities: Prioritizing patching of known exploited vulnerabilities in Internet-facing systems is a critical action. For OT assets where patching isn't feasible, implementing compensating controls like segmentation or monitoring is essential.
• Incident Response (IR) Plans: Organizations must develop, maintain, update, and regularly drill IT and OT cyber security IR plans for various threat scenarios, ensuring they are as realistic as feasible. This helps prevent the inability to quickly contain, mitigate, and communicate about incidents.
• Third-Party Validation: Regularly engaging third parties with demonstrated expertise in IT and/or OT cyber security to validate the effectiveness and coverage of your cyber defenses (e.g., through penetration tests, incident simulations) helps identify TTPs that lack proper defenses.

3. PROTECT: Implementing Core Defenses

This section details numerous technical and procedural controls to safeguard systems and data.

• Changing Default Passwords: Enforcing a policy to change all default manufacturer passwords for hardware, software, and firmware before deployment is fundamental. For existing OT, prioritize new devices and implement compensating controls where changes aren't feasible.
• Minimum Password Strength & Unique Credentials: Implement system-enforced policies requiring a minimum password length of 15 or more characters for IT assets and feasible OT assets. Length is more important than complexity or frequent rotations. Additionally, provision unique and separate credentials for similar services and asset access across IT and OT networks to prevent lateral movement via compromised credentials.
• Phishing-Resistant Multi-Factor Authentication (MFA): Implement MFA using the strongest available methods (e.g., hardware-based like FIDO/WebAuthn, then mobile app-based soft tokens, with SMS/voice as a last resort). Prioritize high-risk accounts and remote access to OT systems. MFA adds a critical layer of security against compromised credentials.
• Network Segmentation: Deny all connections to the OT network by default unless explicitly allowed, ensuring necessary IT-OT communications pass through closely monitored intermediaries like firewalls or demilitarized zones. This reduces the likelihood of IT compromises leading to OT network access.
• System Backups and Redundancy: Regularly back up all critical operational systems, storing backups separately and testing them annually. Implement adequate redundancies for network components and data storage, ensuring secondary systems are not collocated and can be activated without disruption. This is crucial for recovery from data destruction or denial of control.
• Secure Administrator Workstations (SAWs): Provide administrators with dedicated SAWs that are isolated from the public IT network, restrict software installation, and limit Internet/email access. This significantly reduces risks from malware, phishing, and credential attacks.

4. DETECT: Maintaining Situational Awareness

The ability to detect threats quickly is paramount.

• Detect Relevant Threats and TTPs: Organizations must document relevant threats and cyber threat actor TTPs (based on industry, sector, etc.) and ensure they have the capability to detect instances of these key threats through rules, alerting, or commercial prevention and detection systems. Without this, threat actors can remain undetected for extended periods.

5. RESPOND: Acting Decisively

Once detected, a swift and coordinated response is essential.

• Incident Reporting: Maintain codified policies and procedures for reporting all confirmed cyber security incidents to appropriate external entities, including the Cyber Centre. Timely reporting is crucial for the Cyber Centre to assist affected organizations and gain insights into the broader threat landscape.

6. RECOVER: Ensuring Business Continuity

The final stage focuses on returning to normal operations after an incident and learning from the experience.

• Incident Planning and Preparedness: Develop, maintain, and execute plans to safely and effectively recover and restore business or mission-critical assets or systems impacted by a cyber security incident. After any incident, perform a "hotwash" to determine lessons learned and integrate these into governance processes and IR plans to prevent future incidents. This mitigates the risk of prolonged disruption to availability.

Compliance and Beyond

By systematically working through the Cyber Security Readiness Goals, organizations can not only strengthen their defenses against evolving cyber threats but also demonstrate due diligence and adherence to recognized best practices, which are often foundational for regulatory compliance. The toolkit provides a structured, actionable path to enhancing your organization's resilience, ensuring you are better prepared to prevent, detect, respond to, and recover from cyber incidents. It's a proactive investment in your organization's future security and operational continuity.