The
cybersecurity industry has long operated on the assumption that the goal of
security programs is to prevent attacks. Experience has demonstrated that this
assumption is fundamentally flawed. Sufficiently motivated and resourced threat
actors will eventually breach even the most carefully defended organizations.
The shift from a prevention-centric security philosophy to a cyber resilience
model accepts this reality and focuses organizational effort on the ability to
detect attacks quickly, respond effectively, and recover rapidly with minimal
lasting impact.
Cyber
resilience is a broader concept than cybersecurity. While cybersecurity focuses
on technical controls that prevent and detect attacks, cyber resilience
encompasses the organizational capabilities, processes, and culture needed to
withstand and recover from disruptions — including cyberattacks — while
maintaining essential business functions. A resilient organization anticipates
failure, designs systems to limit the blast radius of security incidents, and
has the organizational capacity to respond and recover faster than the damage
from an attack can compound.
Business
continuity planning and disaster recovery are foundational components of cyber
resilience. Every critical business process must have a documented continuity
plan that enables operations to continue — perhaps at reduced capacity — even
if the primary systems supporting that process are unavailable. Disaster
recovery plans define the technical procedures for restoring systems and data
after a significant incident, including recovery time objectives and recovery
point objectives that define acceptable levels of service disruption.
Backup
integrity and recovery capability are among the most important investments an
organization can make for cyber resilience. Many ransomware attacks
specifically target backup systems to eliminate the victim's ability to recover
without paying a ransom. Immutable backups that cannot be modified or deleted,
even by administrative users, provide protection against this tactic. Regular
testing of backup restoration — including full system recovery exercises — is
essential to ensure that backups will actually be usable when needed.
Organizations that discover their backups are corrupted or incomplete in the
middle of a ransomware recovery are in an extremely difficult position.
Crisis
communication capabilities are a frequently underinvested component of cyber
resilience. When a significant cyber incident occurs, organizations must
communicate quickly and accurately with customers, employees, regulators,
media, and other stakeholders. Pre-approved communication templates, designated
spokespersons, and clear escalation procedures enable organizations to manage
their communications effectively even under the stress of an active incident.
Poor crisis communication can amplify the reputational damage from an incident
far beyond what the technical impact would produce.
Supply chain
resilience is an important dimension of cyber resilience that extends beyond an
organization's own systems. If critical suppliers are disrupted by cyber
incidents, the resulting supply chain disruption can impact the organization
even when its own systems are functioning normally. Organizations should assess
the cyber resilience of their most critical suppliers and develop contingency
plans for scenarios where key suppliers are temporarily unavailable.
Tabletop
exercises and incident response simulations build the organizational muscle
memory needed to respond effectively under the stress of a real incident. These
exercises should involve not just security and IT teams but also legal,
communications, finance, and executive leadership — all of whom will play
important roles in a major incident response. Regular exercises that reflect
realistic attack scenarios help organizations identify gaps in their response
plans and develop the coordination and decision-making capabilities that
effective incident response requires.
Comments