Few fear cyber threats, poll finds

Concerning but not a surprise, CSE says

• Canada’s digital spy agency says it’s concerned after internal polling shows barely one in 10 Canadians say they are concerned about being the victim of a cyber attack at a time when cyber threats are at an all-time high.

According to an Ekos poll conducted for the Communications Security Establishment (CSE) in the early part of this year, a large majority of Canadians “do not feel it is likely” that they or their personal data could be affected by a cyber threat.

Specifically, only 16 per cent think it is “likely” that their personal information could be compromised by a cyber threat over the next year, and even less believe they are likely to be the victim of a cyber attack causing the loss of files (seven per cent), financial loss (six per cent) or having their data held for ransom (four per cent).

Ironically, in the same poll, one in four respondents say they’ve already been a victim of a cyber threat such as a virus or malware on their computer (26 per cent) or an email scam (24 per cent) and less than half said they had not been a victim of cyber attacks at all.

“I think yes, the results are concerning,” said Sami Khoury, the head of CSE’S Canadian Centre for Cyber Security, or Cyber Centre. “Am I surprised by the results? Probably not.”

“The threat is getting more sophisticated,” he added, and cyber criminals rarely target individuals specifically, but more often go about “indiscriminate backshooting of phishing emails or luring or any other way to attract somebody to give up personal information or credit card information.”

The results are concerning to him and cybersecurity expert David Masson because they show a low level of concern from Canadians at a time when cyber threats targeting Canada and its allies are on a clear rise, particularly since Russia’s invasion of Ukraine in February.

CSE has repeatedly warned that cyber criminals, including ones backed by states such as China, Russia, Iran and North Korea, are targeting Canadian individuals and organizations, with a particular eye for critical infrastructure.

In a threat bulletin issued last month, CSE admitted that “the scope and severity of cyber operations related to the Russian invasion of Ukraine has almost certainly been more sophisticated and widespread than has been reported in open sources.”

CSE has also noted a 151 per cent increase in reported ransomware attacks in 2021 (304), but also warns that the number is “way, way under-reported” by affected companies and individuals.

Speaking to MPS in March, the head of the Canadian Security Intelligence Service revealed that Canadian organizations are the victims of “thousands” of cyberattacks every single day, and that number is only going up.

The Ekos poll also polled business owners, where almost half said they were not concerned because they think their company isn’t an attractive threat to cyber criminals.

That’s a common and potentially costly misconception, says Masson, president of cyber-defence company Darktrace.

“I’ve been hearing that said for years, and it’s based around the idea they’ve never been hacked,” Masson said in an interview. “You’re making the wrong assessment.”

“The bad guys, if they think you’re worth it, for whatever reason, they will do it,” he added. “We’re probably the most interconnected internet-connected population of users in the world. If the threat actors think you can make a good stepping-stone to get somewhere else, they’ll do it."

While most Canadians think they’re safe from cyber threats, Masson said he’s happy to see in the poll that many are taking the right steps to protect themselves online.

According to Ekos, almost 60 per cent say they look for websites from a “trustworthy source,” and almost half say they specifically check to make sure a website begins with “https” to ensure the website is secure.

He also called on CSE and the Cyber Centre to be more forthcoming with examples of cyber incidents affecting Canadians so that others can learn from them.

“They probably got some cracking examples which they can easily anonymize. And people would be more attracted to what is otherwise a pretty bland website,” he said about the centre’s website. “The report shows individuals and businesses want examples.”

THE THREAT IS GETTING MORE SOPHISTICATED.