Being ready for technological and commercial changes in the 2020s means what exactly? How can your company recover quickly?
A change in the standard definitions of cybersecurity best practices began a few years ago. When defending against “cyber dangers,” terminology like “cyber defense” and “cyber safeguards” have been frequently used, but one new phrase has seen a sharp increase in usage and popularity: “cyber resilient,” which means “resilience against cyber attacks.”
For instance, Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency (CISA), reportedly said, “Cyber threats cross borders and oceans, and so we look forward to building on our existing relationship with SSSCIP to share information and jointly build global resilience against cyber threats,” when the agency recently signed a cybersecurity cooperation agreement with Ukraine.
But you might be wondering if this is actually a significant change that merits attention. Why, therefore, is resilience so important? What being “cyber resilient” actually entails is equally essential.
But first, let me give you a few explanations and instances to show you that I’m not just picking phrases at random to start a trend.
First, what is cyber resilience?
The Department of Homeland Security published “Providing a Roadmap for the Department in Operational Resilience and Readiness” back in 2018. “Simply put, resilience is the capacity to adapt to changing situations and to endure and quickly recover from disturbance,” is how they defined it. Natural, technical, and human-caused risks and dangers all have the potential to cause disruptions. These include things like extreme weather, power outages, accidents on the road, terrorism, and cyberattacks.
The World Economic Forum (WEF) issued an essay titled “How Organizations Can Use Vulnerability to Create Cyber Resilience” in the middle of July. Here are some highlights:
- Organizations with leaders who emphasize and foster a culture of cyber resilience will become market leaders in the digital economy.
- Building this resilience will depend on organizations working together across the ecosystem.
- To achieve this, corporate experiences about cyber risks and difficulties must be shared.
Additionally, the Global Cybersecurity Outlook 2022 research from the World Economic Forum (WEF), which was created in partnership with Accenture, revealed that:
- Only 19% of cyber leaders are assured that their company is resilient to cyberattacks.
- 58 percent of respondents believe that their suppliers and partners are less resilient than their own company.
- The cyber resilience of small and medium-sized businesses (SMEs) in their ecosystem is a concern for 88% of respondents.
There are also more reports on cyber resilience from the WEF. They released “3 principles to help construct a cyber resilient organization” in November of last year. Their three primary arguments were as follows, with the article providing details:
- Managing cyber resilience must start at the top.
- The corporate operating model needs to be built with cyber resilience in mind.
- Business outcomes are enabled by cyber resilience.
Increasing collaboration between the public and private sectors is necessary for being cyber resilient.
Over the years, there have been numerous requests for increased government and industry cooperation to bolster cyber defenses. A recent piece in The Hill that stated “To make the US more cyber-resilient, government and business require significantly greater coordination” drew my attention.
Here is a sample:
“Cybercrime is now so pervasive that the question is no more whether a firm, person or government will be attacked; rather, it is whether the victim is robust enough to deal with the repercussions.
“Recent incidents have just made the cyber dangers more serious. Since Russia’s invasion of Ukraine in February, increased attention has been paid to the security of international digital networks. As of now, only Europe has been affected by the most disruptive Russian strikes, which were centered on Ukrainian communications networks. However, the conflict is still escalating, and Ukraine, Europe, and the rest of the world continue to be at serious risk from aggressive Russian cyber activities. Government authorities are acutely aware of the threats that exist from cyber actors, particularly Russia, as the U.S. midterm elections near.
A new national virtual cyber academy is one suggestion they make at the end of the article: “The virtual academy would be based on partnerships with colleges and universities. Cybersecurity cadets would be given a free college education in exchange for government service after graduation, much like the U.S. military academies. To complete their commitments, graduates would be hired in cybersecurity posts with the federal, state, or local governments.
“Achieving cyber resilience implies a corporation works to put all required cybersecurity precautions into place and:
- Teaches team members the significance of their contributions to preventing cyberattacks
- Commits to spending money and changing the company’s principles to include a key element of cybersecurity
- Data backups and other monotonous cybersecurity procedures are automated
- Constantly enhances internal cybersecurity procedures and infrastructure
- Interacts with the larger cybersecurity community to learn about and exchange attack trends and tactics
- Looks into outsourcing options with MSPs or the IT community to reduce the stress that comes with administering a cybersecurity programme for small business owners and workers.
LAST THOUGHTS
I want to leave you with another free resource even though there are many other excellent papers on cyber resilience. This CISA Cyber Resilience Review (CRR) can assist you in moving your organization’s analysis to the following stage.
The awareness that you will be attacked, you will lose some battles, that you will give certain enemies access to important data, or even that a ransomware attack will succeed through some ways, is at the core of cyber resilience.
