Botnet-blocking provides security for Canadians: CSE

The Communications Security Establishment (CSE) has argued that the average Canadian’s cybersecurity will benefit from telecom service providers blocking botnet traffic, a requirement currently being considered by the CRTC, and which has been opposed by several companies. The CSE, which calls itself the national lead agency for foreign signals intelligence and cyber operations as well as the technical authority for cybersecurity, claims outright blocking results in fewer incidents and compromises from known threats. In an intervention filed April 12 -- almost a month after CRTC’s original deadline -- the CSE said that robust mechanisms meant to identify, reduce, and remove false positives are a necessary element of a blocking framework. The CRTC extended its deadline on the proceeding in order to accommodate the intervention from the CSE. “We judge that ransomware directed against Canada will almost certainly continue to target large enterprises and critical infrastructure providers. These entities cannot tolerate sustained disruptions and are willing to pay up to millions of dollars to quickly restore their operations,” the CSE said. “Many Canadian victims will likely continue to give in to ransom demands due to the severe costs of losing business and rebuilding their networks and the potentially destructive consequences of refusing payment.” The CRTC classifies botnets as a network of malware-infected computers that are under the control of a command and control server operated by a malicious actor. However, they can also be used to perform a number of repetitive tasks to keep websites operating, most often in connection with Internet Relay Chat, according to anti-virus software developer Norton Antivirus. In its call for comments on its consultation over a potential framework for dealing with botnets, the regulator reiterated its support for the principle of net neutrality, but also acknowledged that “a limited exception to net neutrality may be warranted in order to offer Canadians additional protections from these threats” and proposed that internet service providers be required to block malicious botnet traffic. The CSE recommended that blocking not be limited only to domain name server or IP blocking to make sure the threat is sufficiently addressed and that any model selected maximizes its national-level benefit for as many Canadians as possible, perhaps by not considering an opt-in model for blocking. The technology chosen should be “flexible and evolve in-line with requirements” plus be a “resilient data-resident solution” as it believes that it is difficult to predict how technology will change and that it is important to avoid operational risks of Canadian data leaving Canada, the CSE said. “The ability to support blocking at an IP or domain level is primordial, and the ability to pivot quickly with technology changes is also essential,” it said. The CSE claimed using the term “botnet” is too narrow and recommends that phrasing be expanded “to permit the blocking of general indicators of compromise much in the way that the Cyber Centre blocks such indicators of compromise for the Government of Canada.” Some of the CSE’s recommendations are in contrast to the submissions of other intervenors including the Internet Society (ISOC) and multiple telecom providers. For its part, the ISOC, an American nonprofit, claims there are significant risks in the CRTC’s proposal and cautioned against any approach that centres around blocking or filtering internet traffic in its own intervention. ISOC, which advocates for an open internet, suggested that the CRTC’s idea could violate section 36 of the Telecommunications Act, which prohibits control of content by ISPs. Multiple telecoms have indicated they’re concerned that a blocking requirement would overzealously restrict Canadians’ access to legitimate websites, possibly undermining the principle of net neutrality and that a one size fits all plan would likely be ineffective. Their interventions also raised concerns over other aspects including false positives and over-blocking and potential reputational impacts on telecoms as they deal with a system out of their control. In its own intervention, the CSE wrote that it recommends the framework “incorporate an element of standard decision-making around blocking decisions and that there be a process to vet problematic indicators.” It acknowledged false positives would be challenging for telecom service providers under a blocking framework and recommends that these challenges be addressed as part of the consultation. While most telecom companies opposed the framework, one intervention from Saskatchewan Telecommunications Holding Corp. generally supported a botnet blocking framework and suggested it would be more efficient than making end-users responsible for protecting against botnet infections, though it also cautioned the regulator to tread carefully. The CSE also recommended that the CRTC align any framework conditions with guidance from other formats including PIPEDA and the Canadian Security Telecommunications Advisory Committee’s security best practices that are already in place and that any solution should be as transparent as possible to Canadians. “The Cyber Centre believes that there needs to be transparent reporting accessible to Canadians on the source of indicators used for blocking, what is blocked, some indication of how, and how often. There should also be transparency on what gets reported to whom from this program,” said the CSE, which offered to share information such as its indicator of compromise feed with the CRTC and any interested service providers. Because the CRTC decided to allow CSE’s late intervention based on its argument that it could offer beneficial expertise to the issue, the regulator has also extended its deadline for replies from April 14 to May 5, 2021. -Reporting by Hannah Daley at hdaley@thewirereport.ca and editing by Michael Lee-Murphy at mleemurphy@thewirereport.ca

Botnet-blocking provides security for Canadians: CSE

News | April 13, 2021

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Botnet-blocking provides security for Canadians: CSE

News | April 13, 2021

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Freedom Mobile no longer pursuing full MVNO status

Federal arbitrator releases paid time political broadcast schedule

TV broadcasters denounce streamers’ appeals of CRTC’s broadcasting contribution decision

CRTC considering expanded mandate for Broadcasting Participation Fund

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us