Cyber Safety - Critical Infrastructure Systems: Toronto Water SCADA System

The Public Gallery wrote no story on this item. What follows is the city’s own record of what happened to it, as filed: nothing on this page is summarised or scored by us.

The decision

2020-06-29 · Toronto City Council · amended

As filed

City Council on June 29 and 30, 2020, adopted the following: 1. City Council adopt the confidential instructions to staff in Confidential Attachment 1 to the report (January 24, 2020) from the Auditor General. 2. City Council adopt the confidential instructions to staff in the Confidential letter (February 10, 2020) from the Audit Committee. 3. City Council direct that Confidential Attachment 1 to the report (January 24, 2020) from the Auditor General and the Confidential Letter (February 10, 2020) from the Audit Committee be released publicly at the discretion of the Auditor General after discussing with the appropriate City officials.

Show the rest of As filed, 1,266 more characters as filed

4. City Council direct that Confidential Attachment 1 to the supplementary report (June 23, 2020) from the Auditor General remain confidential. Confidential Attachment 1 to the report (January 24, 2020) from the Auditor General and the Confidential Letter (February 10, 2020) from the Audit Committee remain confidential at this time in accordance with the provisions of the City of Toronto Act, 2006, as they concern the security of property belonging to the City of one of its agencies and corporations. Confidential Attachment 1 to the report (January 24, 2020) from the Auditor General and the Confidential Letter (February 10, 2020) from the Audit Committee will be made public at the discretion of the Auditor General after discussing with the appropriate City officials. Confidential Attachment 1 to the supplementary report (June 23, 2020) from the Auditor General remains confidential in accordance with the provisions of the City of Toronto Act, 2006, as it pertains to the security of property belonging to the City or one of its agencies and corporations, and it contains information explicitly supplied in confidence to the City of Toronto which, if disclosed, could reasonably be expected to impact the safety and security of the City and its services.

On the agenda

As the city filed it

Some critical infrastructure at the City, such as the Toronto Water treatment plants, use Operational Technology (OT) systems called industrial control systems (ICS). ICS systems include supervisory control and data acquisition (SCADA) systems. SCADA systems monitor and control the equipment and devices used in critical infrastructure. The Canadian Cyber Security Centre describes how ICS and SCADA systems are vulnerable if appropriate cybersecurity protections are not in place: "As part of the drive for modernization and efficiency, critical infrastructure providers are continuing to automate their processes and connect IT and OT devices to the Internet.

Show the rest of As the city filed it, 931 more characters as filed

While connecting OT, such as ICS and SCADA devices, to the Internet provides several advantages - for example, remote management - it can also expose critical infrastructure to cyber threat activity". The objectives of the audit were to assess the adequacy of controls in place to address potential threats to the Toronto Water SCADA network, systems and applications, and to review the actions taken by Toronto Water to address concerns raised during the 2019 cybersecurity audit. This public report contains two administrative recommendations. The confidential audit findings and recommendations to improve physical security and cybersecurity controls are presented separately to this report in Confidential Attachment 1. Management has already initiated actions to address the identified risks. The confidential report will be made public at the discretion of the Auditor General after discussing with appropriate City Official.

Staff recommended

The Auditor General recommends that: 1. City Council adopt the confidential recommendations contained in Confidential Attachment 1 to the report (January 24, 2020) from the Auditor General. 2. City Council direct that all information contained in Confidential Attachment 1 to the report from the Auditor General be released publicly at the discretion of the Auditor General after discussing with the appropriate City Official.

Considered

2020-02-10 · Audit Committee · amended
Decision as filed
The Audit Committee recommends that: 1. City Council adopt the confidential recommendations contained in Confidential Attachment 1 to the report (January 24, 2020) from the Auditor General. 2. City Council adopt the confidential recommendation contained in the Confidential letter (February 10, 2020) from the Audit Committee. 3. City Council direct that all information contained in the following confidential documents
Show the rest of Decision as filed, 277 more characters as filed
be released publicly at the discretion of the Auditor General after discussing with the appropriate City official: - Confidential Attachment 1 to the report (January 24, 2020) from the Auditor General; and - the Confidential letter (February 10, 2020) from the Audit Committee.
Clerk’s note
The Audit Committee recessed its public session and met in closed session to consider confidential information on this Item as it relates to the security of property belonging to the City or one of its agencies and corporations.
2020-06-29 · Toronto City Council · amended

On the record

The item as the City filed it

More from this meeting

The whole meeting