Cyber resilience

What is cyber resilience?

The National Institute of Standards and Technology (NIST) defines cyber resilience as “the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources.” In short, cyber resilience is an umbrella term that encompasses how well an organization prepares for, manages, and returns to normal operations after a disruption or cyberattack. Cyber resilience involves protecting and maintaining availability, including continuity of operations, integrity, and confidentiality of systems and data. Because the threat landscape is constantly evolving and becoming more sophisticated, it is essential for organizations to take a proactive approach to cyber resilience. 

8 steps to strengthen cyber resilience

To improve cyber resilience, organizations can take the following steps to anticipate, withstand, and recover from cyberattacks and disruptions:

1. Conduct a risk assessment. Organizations should conduct a comprehensive cyber risk assessment to identify vulnerabilities and single points of failure and to prioritize risk mitigation efforts. This assessment should be a holistic evaluation of the organization’s cybersecurity posture, including a review of current countermeasures, an analysis of potential attack vectors, and an assessment of the potential impact of a cyberattack or disruption. Assessments also include penetration testing, vulnerability scanning, recovery testing exercises, tabletop exercises, and threat modeling.   


2. Implement security controls. Security controls, also known as countermeasures, are essential to preventing attacks and protecting an organization’s systems and data. Security controls should be based on industry standards and best practices such as the NIST’s Cybersecurity Framework, the Cybersecurity and Infrastructure Security Agency’s Critical Infrastructure Cyber Community (C3) Voluntary Program, the Center for Internet Security’s benchmarks, and best practices from specific technology vendors. Such guidance provides a structured approach for identifying and addressing cybersecurity risks and offers direction for implementing security controls and incident response procedures. Organizations should make sure their security controls are properly configured, regularly updated, and continually monitored via penetration testing, purple team exercises, and vulnerability scanning. 


3. Develop a robust incident response plan. An incident response plan outlines the steps to follow in the event of a cyberattack, including containment measures, communication protocols, and recovery procedures. It should be tailored to the organization’s specific needs. The incident response plan should include procedures for incident management, incident response, and incident recovery. This information is important for organizations to understand the causes of the incident and to learn from them to prevent future incidents.
   
   
   • Incident management process. The incident management process should include procedures for identifying, responding to, and containing incidents as well as procedures for reporting incidents to the appropriate parties. 
   
   
   • Incident reporting process. The incident reporting process should include procedures for documenting incidents, including the type of incident, the time and date it occurred, and the actions taken in response.
   
   
   • Incident recovery process. Incident recovery is a critical step in the incident response process, as it helps organizations quickly return to normal operations and minimize the impact of an incident on their systems and data. Having a clear and well-communicated plan in place for restoring operations after a cyberattack involves identifying the systems and data that are most critical to the organization’s operations, establishing a prioritized list of recovery priorities, and setting a timeline for restoring each element. This process should include measures to help prevent the incident from recurring, such as reviewing and updating security controls, implementing security patches and updates, and reviewing and updating incident response plans.
   
   Once the incident response plan is set, teams should regularly test and update the plan through tabletop exercises and simulations to help confirm that the plan is effective and that all relevant parties are familiar with their roles and responsibilities. By having a plan in place, organizations can minimize the impact of a cyberattack or disruption and return to normal operations as quickly as possible. 


4. Get a cyber incident response team in place. Incident response teams are critical to quickly identifying and mitigating the effects of a cyberattack or disruption, so organizations should establish a dedicated team before incidents occur. This team should be well trained and equipped to handle different types of incidents, such as ransomware or a major power outage, because it will be responsible for quickly identifying and containing incidents and for coordinating the organization’s response and recovery efforts to restore systems. If the organization identifies any gaps in capabilities through the design or testing process, relationships with third parties should be established to complement internal teams.   


5. Maintain availability. Maintaining availability is essential for organizations to continue functioning during and after a cyberattack. A disruption of availability can cause organizations to lose revenue and customers, and it can damage their reputations. By maintaining availability, organizations can continue to provide services to their customers and stakeholders.
   
   Organizations should proactively implement highly available system design and strong security controls to ensure the availability of their systems and data. They should make sure that robust backup and disaster recovery measures are in place for critical systems and data to be restored quickly, including establishing offsite backups, implementing replication technologies, and testing recovery processes on a regular basis. Other measures that can help maintain availability include DDOS mitigation and advanced endpoint detection and response solutions to reduce the risk of a disruption during an attack. Finally, organizations should consider investing in cyber insurance plans to help mitigate the financial impact to the business during and after an attack. 


6. Adopt a proactive, layered approach to cybersecurity. A holistic approach to cybersecurity involves knowledge, design, and action. First, having a well-informed staff that subscribes to relevant intelligence feeds, maintains a network of industry contacts, and uses threat intelligence platforms to gain a deeper understanding of the evolving threat landscape is critical. Second, organizations can incorporate security by design principles into all aspects of the organization’s technology infrastructure by designing systems and processes with security and availability in mind from the outset, rather than adding security measures as an afterthought. Third, organizations can act by implementing a layered defense strategy, which involves a combination of technical measures (such as firewalls, antivirus software, and network security protocols) and nontechnical measures (such as employee training and policies).


7. Train employees. Organizations should train their employees on cybersecurity best practices and incident response procedures. Employee education and awareness is crucial to the overall security of an organization. Cybercriminals often use social engineering tactics to trick employees into divulging sensitive information or installing malware. By training employees how to recognize and respond to these tactics, organizations can reduce their risk of an attack. In addition to training, organizations should verify that their employees are aware of the incident response plan and know how to follow the appropriate procedures in the event of an attack. 


8. Communicate with stakeholders. Broad communication regarding security events should be prepared in advance and be ready to send in the event of an attack or disruption. In the aftermath of an attack, stakeholders will need to be made aware of how the organization has dealt with the attack and what measures are being put in place to avoid similar attacks in the future. Stakeholder communication might include alerting customers, partners, and other relevant parties as well as managing the public perception of the incident through transparent and timely communication.

Why cyber resilience matters

When organizations do not prioritize cyber resilience, they risk experiencing a cyberattack, which can cause downtime, data leakage, or data loss and result in significant disruptions to operations, damage to reputation, potential regulatory scrutiny, and financial losses. In some cases, organizations face challenges when trying to improve cyber resilience. They might face a lack of funding, a shortage of skilled personnel, and a lack of awareness among employees. Additionally, organizations might struggle to keep up with the constantly evolving threat landscape or to implement and maintain security controls. 

Even if organizations are well staffed, cyber resilience is an ongoing process. They should regularly assess their systems and data, update their security controls, and train their employees to prepare them for the inevitable cyber incidents. 

Cyber resilience is critical for organizations – no matter their size – to prevent the adverse consequences of cyberattacks. By taking a proactive approach to cyber resilience, organizations can protect their systems and data, maintain continuity of operations, and minimize the impact of security events.