Pierre-Paul Ferland

𝗧𝗵𝗲 𝗿𝗲𝗮𝗹 𝗖𝗜𝗦𝗢𝘀 𝗲𝗮𝘁 𝗺𝗮𝗺𝗺𝗼𝘁𝗵!!! I just read the recent article by Monique Angeli Mendoza highlighting the “10 CISOs to watch in Montreal.” Interesting piece, and a good spotlight on strong local professionals. But once again, we see the same recurring mistake: confusing an Information Technology Security Director with a real Chief Information Security Officer. And to be honest, I do not fully understand this platform. It talks about CISOs, but almost everything published focuses only on cybersecurity. That is not information security. That is only one part of it. Let us recall a basic fact. Information security is not a modern invention. It started more than 100 000 years ago with the emergence of human language. The ability to share or restrict information created the first pillar of information security: personnel security screening. Around 40 000 years ago, symbolic representation appeared, and with it came the second pillar: physical security to protect physical information. And less than 100 years ago, the rise of information technologies introduced the third pillar: technology security, what we now call cybersecurity. Real security has always been bigger than IT. I know several people on that list (Eric Parent, Martin Laberge, Adm. A, CISM, CCISO, CDPSE, etc.) The majority are exceptional experts who excel in protecting information technologies. Their work deserves full recognition. But let us be clear. If you are not the one overseeing the director of physical security, the director of cybersecurity, and if employee security screening does not fall under your authority, you are not a CISO. You are an Information Technology Security leader. Traditional espionage and counter-espionage also fall under the responsibility of a real CISO because they target the core information assets of the organization. And this is not just my view. It is the definition supported by National Institute of Standards and Technology (NIST), by ISO - International Organization for Standardization and by ASIS International. A real CISO owns the entire information security program: personnel security, physical protection of information, governance, integrity, availability, anti-espionage posture and cybersecurity as only one component. A CISO should ideally report to the CSO, the top executive responsible for everything related to security including fire safety, active shooter preparedness and information security. If you report to an IT department, it is wrong. You, do you eat mammoth or tofu? #CESTMAL #InformationSecurity #PhysicalSecurity #CISO

53

5 Comments

New privacy laws in Canada and globally make a robust privacy management programme essential. Are you ready? In 2025 alone, new provincial laws have mandated privacy management programs (PMPs) in: - Ontario - Bill 194 - comes fully into effect on July 1st. - Alberta - Bill 33 - expected to be proclaimed this spring and in the past 2 years: - BC requires PMPs for public bodies under FOIPPA - Quebec's Law 25 requires a Data Privacy Officer and a PMP - Federally, C-27 (though dead) required a PMP Internationally, the EU GDPR, the UK GDPR, several US state privacy laws, including the CCPA/CPRA (California), India's DPDPA, China's PIPL (just to name a few), all require PMPs. If you don't already have a privacy management program, what are you waiting for? Reach out if you need some help accelerating the development of your PMP.

35

Excited to see new cybersecurity workforce data released in CyberSeek today, along with a snazzy new interface! What do the latest numbers show? 👉 514,359 cybersecurity job postings in the U.S. over the past 12 months, an increase of over 50k since the last update. 👉 1,337,400 existing skilled cybersecurity workers in the U.S., and an estimated 4.4-5.5 million skilled cybersecurity workers globally. 👉 Only 74% of cyber demand can be filled with existing workers. 👉 58% of cyber job openings request at least 4+ years of experience. My takeaways: 💡 The growth in job postings and employment shows that demand for cyber workers remains robust. Although job postings are lower than their post-pandemic highs of over 700k, they are beginning to increase again. At the same time, employment has been steadily growing, suggesting that employers never reduced demand for cyber workers - they simply had an easier time filling cyber openings than in the past. Look for that trend to change as demand ticks upward more strongly and cyber workers become scarcer once again, forcing employers to get more creative with their talent sourcing strategies. 💡 The strong demand and employment growth flies in the face of the narrative that AI is reducing demand for cyber and other tech jobs. It also suggests that the reduction in cyber job postings since 2022 was less about AI and more about economic uncertainty stemming from inflation, rising interest rates, and other factors. 💡 The high-level supply/demand gap masks a painful reality for many recent graduates of cyber programs: entry-level cyber jobs are hard to find. My prior work has found that, despite an overall talent gap in cyber, we have a surplus of entry-level cyber workers. The latest CyberSeek numbers confirm that employers continue to recruit primarily from a limited pool of experienced workers. Fixing this chicken and egg problem remains one of the most critical barriers to expanding the cyber talent pipeline. Huge shoutout to everyone at NICE, CompTIA, and Lightcast who was behind the updates to CyberSeek. The design refresh and data enhancements are looking great! #cybersecurity #cybersecurityjobs #cyberseek

65

5 Comments

ISO/IEC 27001 ISMS provides an excellent framework standard for information governance. I created the ISMS Reference Architecture to map 140 program management control points to seven critical program management procedures, governance, risk management, continual improvement, internal audit, program communications, training and awareness, information handling.

27

The Government of Canada has taken a great first step with the launch of the Canadian Program for Cyber Security Certification – a much-needed move in strengthening our national cyber defenses. But in today’s threat landscape, we must move faster. The rapid evolution of AI-driven threats means we don’t have the luxury of time. Governments must push themselves – and all enterprises – to do more, sooner, and smarter when it comes to cybersecurity. Cybersecurity is National Security. Every organization, public or private, must recognize that protecting digital assets is not just about compliance – it’s about resilience. The adversaries are evolving. Are we keeping up? #CyberSecurity #NationalSecurity #AI #Threats #Canada #stratejm #teambell https://lnkd.in/g4WGK7nJ

231

10 Comments

PSA - Otter.ai may cause a security breach in your organization. Have you received an invite or a notice from someone in your organization to log into otter.ai to receive meeting notes? Don't do it without first receiving a clear mandate from your CISO to use this application. Once you sign in, Otter.ai will forever automatically log you into meetings, record them, take meeting notes, and send them round as your avatar and without your knowledge. True, Otter.ai does a remarkable, spectacular job of taking meeting notes and assigning tasks, but depending on the nature of your meeting, this could constitute a serious security breach.

21

4 Comments

#cybersecurity #cctx #getcybersafe #risk Thank you ISACA Ottawa Chapter for bringing such a knowledgeable and reputable lineup of speakers today - Nour Kadri, Bob Gordon, Sami Khoury! My key takeaways 📝 💡 Deepfakes are coming, but not yet a big problem. The quality of phishing emails is outstanding thanks to AI so everyone should use a 10 second rule to resist the temptation to click on phishing emails. 💡 AI is pretty good for vulnerability discovery, but not very good at writing exploits yet. Maybe it gets C+ or B-, but it’ll get to A+ eventually. 💡 Ransomware is still #1 cyber threat facing critical infrastructure. Paying is a bad option because it supports the very “industry” we are fighting. 💡 Non-nation state threat actors “surprise” more and more with sophistication and scale. DDoS attacks are in the rise. 💡 Vendor concentration risk is becoming a big problem especially with big vendors aggressively buying small vendors. 💡 Quantum Q-Day is coming in 5 to 10 years, but there is no proven solution yet to replace RSA. Companies and governments should be (at last) making full inventories of their crypto solutions and asking their vendors what they are doing to protect from post-quantum threats.

135

8 Comments

Is your backup and recovery plan truly aligned with your clients' business needs? Don't wait for a disaster to find out. In this video, Roddy Bergeron, CISSP, CCSP, CSAP explains the importance of proactive planning and regular testing to ensure your recovery strategy meets client expectations before an incident occurs. These conversations are vital, especially when 60% of small businesses fail within six months of a cyberattack. Offering a well-planned backup service protects your clients and solidifies your role as a trusted partner. Learn more about why this service is a must-have for your security offering in our blog post: https://lnkd.in/gVSxuM4E #CybersecurityAwarenessMonth #Cybersecurity #MSP #BackupAndRecovery

17

Identity is becoming an increasingly attractive attack vector for threat actors. Canadian MDR provider eSentire recently published the Report "Identity Centric Threats: The New Reality Breaking down the rapid growth of identity-based attacks" Esentrie's TRU identity-driven threats have increased by 156% between 2023 and 2025, now representing 59% of all confirmed threat cases during Q1 2025. 78% of identified phishing-as-a-service operations originate from the United States. However, this reflects the use of legitimate hosting providers and content delivery networks rather than the actual location of threat actors. Overall, a great report worth checking out, despite their marketing folks clearly not understanding "less is more."

38

3 Comments