War games

For a long time, audits mainly served to check compliance with certain standards, such as ISO 27001, or specific norms adapted to different sectors of activity. It was therefore about comparing strategies to a fixed framework. But a cyberattack is anything but fixed.

"There are always humans on one side trying to bypass the company's defenses, and on the other side, humans striving to prevent them," says Amir Belkhelladi, Associate and National Leader of Cybersecurity Services at Deloitte Canada. Therefore, cybersecurity audits have become very dynamic to better correspond to this reality."

Of course, audits continue to analyze policies, security procedures, and data management practices in place and verify that they comply with recognized standards or adhere to industry regulations. They also thoroughly examine different computer systems. But blind technological tests are becoming more common.

A firm like Deloitte, for example, will use "red teams," meaning ethical hackers, to conduct fake attacks on a company. These operations can last several weeks. The hackers take the time to study their target, understand what is valuable to it, or could be valuable to attackers, assess defenses, and then attempt to breach them. The employees of the targeted company are unaware that it's a test.

"Financial services are very eager for these exercises, as the stakes are enormous for them in case of a security breach," notes Amir Belkhelladi.

Increasing risks

Technological tests conducted within audits or simple cybersecurity assessments thus aim to replicate the cat-and-mouse game between attackers and defenders in this type of situation as closely as possible.

"The advantage always goes to attackers, as defenders must ensure they spot and patch up numerous potential vulnerabilities, while attackers only need to find one to cause damage," Yassir Bellout states. For this reason among others, it's necessary to multiply tests.

Could artificial intelligence (AI) upset the balance of power in favor of one side or the other? In the short term, both KPMG and Deloitte experts doubt it, but the consequences in the medium and long term remain harder to predict. "There's a lot of cybersecurity data that could eventually be used to train AI tools that would help with defense, but that remains to be seen," believes Amir Belkhelladi.

In its most recent risk analysis, the Office of the Superintendent of Financial Institutions (OSFI) is more concerned about the repercussions of several complicated geopolitical situations, notably the war in Ukraine. "With the emergence of new regional or global conflicts, risks attributed to targeted cyberattacks, and their repercussions, could become more common," the organization writes.

In April 2023, the Laurentian Bank's website, that of Prime Minister Justin Trudeau, as well as Hydro-Québec's website and mobile application, were all hit by a Russian group's cyberattack that rendered them inaccessible for a certain period.

"Company leaders become more aware of risks after they've been attacked," notes Yassir Bellout. As attacks multiply, the cybersecurity culture should continue to strengthen over the next few years.