Keeping the lights on: Canada’s OT cybersecurity wake-up call

Control systems are the backbone of Canada’s critical infrastructure — but they’re increasingly vulnerable to cyber threats. PHOTO: GETTY IMAGES

Article content

When Canadians think of cybersecurity, we picture stolen passwords, hacked emails or corporate data breaches. But a far greater threat lurks in the background, one that could disrupt transportation, poison water supplies or plunge entire regions into darkness.  

Article content

This is the realm of operational technology (OT) cybersecurity.  

Article content

Article content

According to a new national report from the Canadian Cybersecurity Network (CCN) titled State of OT: Securing Canada’s Critical Infrastructure, it is the country’s most urgent and overlooked digital battleground. 

Article content

Article content

The hidden systems that keep Canada running 

Article content

Article content

OT systems don’t just move data; they move the country. They control the electricity that powers our homes, the pipelines that fuel our economy, the mining equipment that extracts our resources and the ports that move goods. They even support the hospital systems that sustain life. 

Article content

As information technology (IT) and OT converge, the risks multiply. A single phishing email can cascade into an industrial shutdown. A ransomware attack on a hospital can delay surgeries or divert ambulances. In 2024 alone, 73 per cent of reported cyber incidents in Canada affected OT systems, up from 49 per cent the year before.  

Article content

Public safety and human lives increasingly depend on the integrity of OT systems.  

Article content

Two recent incidents underscore the stakes: the U.S. Colonial Pipeline hack, which disrupted fuel supplies across the country and the Black Basta ransomware attack on Ascension Health, which hindered care for millions.  

Article content

These are stark reminders of the consequences when OT is left exposed. 

Article content

The State of OT: Securing Canada’s Critical Infrastructure outlines Canada’s most urgent and overlooked digital battleground, operational technology.

Article content

Canada is falling behind global peers 

Article content

While countries like the U.S., U.K., and Germany have prioritized OT with national strategies and funding, Canada has yet to follow suit. Many systems remain outdated and unpatched.  

Article content

Article content

Small and mid-sized operators, such as local utilities, often lack the expertise and budget to defend themselves. And there is no national inventory of OT risks, making coordinated response nearly impossible. 

Article content

Legislation may be on the horizon. The Critical Cyber Systems Protection Act (CCSPA), reintroduced in Parliament as part of Bill C-8, promises to impose mandatory cybersecurity obligations on federally regulated infrastructure, from energy and telecom to banking and transportation.  

Article content

But the bill has yet to be enacted and, until it is, Canada remains without a national framework for securing OT systems.  

Article content

As one section of the CCN report warns, ransomware and nation-state probing of critical infrastructure are “almost certain” to continue.  

Article content

Without decisive action, Canada risks being left dangerously exposed. 

Article content

A national vulnerability 

Article content

The report makes clear that OT vulnerabilities stretch across every sector. 

Article content