Éric Caire, the province’s minister for government digital transformation, said that the government faces a threat “with a critical level of 10 out of 10.” He added, “According to the new protocols by the head of government information security, [that rating] automatically calls for the closure of the targeted systems.”
Minister: Shutting Down of Websites as Preventive Measure
Caire added there was no indication that any websites were compromised as yet. According to the minister, the decision to shut down the websites is a “preventive measure,” and most of the sites will be back up very soon. All of the at-risk websites use the Apache Log4j logging library. The websites are currently being screened and will go back online once they are declared to be safe. The province’s COVID-19 vaccine appointment portal, ClicSanté, remains online, as it does not use the Apache Log4j library.
Security Specialists Agree with Quebec Government’s Strategy
Eric Parent, CEO and founder of EVA Technologies, commended the Quebec government’s systematic approach to the cyber threat. He said that every cybersecurity expert would recommend this strategy. “We’ve also seen attackers exploit [the vulnerability] in various parts of the world, which means they’re ready to use it,” Parent said. “The best scenario is to turn everything off and reset every system as you know that they’re OK,” he added. Caire said that, even though thousands of websites are at-risk, most of them are not “highly solicited” and will be back online soon. He added that it does not take long to detect the vulnerability in a website. However, checking whether they all use the affected logging library might take several days. This is because the government does not have an inventory to which it can refer. “It’s like saying how many rooms in all Quebec government buildings use 60-watt light bulbs,” Caire said. “I don’t know, so you go to each room and see if it’s a 60-watt.”
Cyberattacks and How to Protect Yourself
Canadian provincial governments are now facing significant and high-profile cyber threats to essential services. In this case, the at-risk websites include platforms related to health, education, and public administration. Attacks on government websites or portals have the potential to disrupt essential services and make it difficult for people to access them. Earlier this year, Newfoundland and Labrador faced a major cyberattack on its Healthcare IT system. The attack shut down the healthcare network across the entire province. Due to this, thousands of people could not avail of non-emergency surgeries, cancer treatments, and diagnostic imaging. If you want to learn more about cyberattacks and what you should do to protect yourself, we suggest taking a look at our resources on malware to get you started.
