What is cyber resilience?

Cyber resilience is an organization’s capacity to maintain effective operations in the event of a major disruption to digital systems. An organization’s cyber resilience is measured in terms of how long it takes to identify, respond, and recover from an IT security incident.  

Cyber resilience strategies also focus on understanding risk, as organizations should be prepared to face a significant cyber incident from any number of disruptive events, including:

• Cyber attacks that result in a data breach
• Damage purposely caused by a malicious insider 
• Extreme weather that disrupts power to data centers 
• Innocent human errors 
• Natural disasters 
• Political conflicts 
• Public health emergencies 
• Ransomware attacks 
• System failures 

An organization is considered to have cyber resilience when it can ensure business continuity during and after cyber incidents. The objective of cyber resilience is that the organization is able to deliver goods and services regardless of what happens to IT systems. 

How cyber resilience relates to enterprise resilience

Cyber resilience and enterprise resilience are inextricably connected. Cyber and enterprise resilience hinge upon sustained access to data regardless of what incident occurs. Like a well-run enterprise, a good cyber resilience program takes a data-centric approach to enterprise data protection and security.  

A key objective of cyber resilience is to keep data available and recoverable if needed while an incident is being mitigated and resolved. Cyber resilience programs should include policies, methods, and solutions to ensure an enterprise can identify, respond, and recover from a cyberattack. At its core, a cyber resilience framework drives end-to-end security approaches that maintain the highest possible enterprise data and system availability. 

Why cyber resilience is important

Cyber resilience is important because technology is foundational to nearly every business’s operations. Downtime can have negative to critical impacts on organizations. A cyber resilience plan has become a must-have rather than a nice-to-have program.  

Cybersecurity programs can help plan how to handle a broad range of cyber risks. Cyber resilience aims to ensure readiness to act effectively and quickly in the event of a cyber incident by being prepared for it, able to respond to it, and quickly recover from it. Businesses can continue operations with minimal disruption to workflows and processes. 

The need for cyber resiliency is well summed up by Lt. Gen. Ted F. Bowlds, Former Commander, Electronic Systems Center, USAF: 

“You are going to be attacked; your computers are going to be attacked, and the question is, how do you fight through the attack? How do you maintain your operations?”

Several important reasons for businesses to embrace cyber resilience are: 

• Adhering to compliance regulations 
• Ensuring continued customer trust 
• Maintaining business continuity 
• Meeting data protection requirements 
• Protecting sensitive information, such as credentials and personally identifiable information (PII) 

How cyber resilience enables enterprise resilience

Cyber resilience enables enterprise resilience by ensuring that systems downtime is minimized and business continuity is maximized. Because enterprise resilience relies on systems uptime, cyber resilience plays an important role.  

In many cases, cyber resilience plans augment enterprise resilience plans that are tied to disaster recovery plans. Cyber resilience plans provide a framework and processes to resume normal operations quickly after a disaster strikes. 

Cyber resilience and digital transformation

Cyber resilience is crucial even for businesses in the early stages of digital transformation. The pervasive role of technology has increased risks with new vulnerabilities, expanded attack surfaces, and heavy reliance on systems’ continuous uptime. Cyber resilience allows businesses to reap the benefits of digital transformation while significantly mitigating a variety of risks. 

Components of cyber resilience

Robust cyber resilience frameworks and strategies include the following capabilities. 

Protection

Protection is a foundational element of any cyber resilience strategy. The first step in establishing a cyber resilience program is to ensure that appropriate and effective security measures are in place to protect all systems, applications, and data from unauthorized access.  

Among the many protection tactics that can be used to bolster protection and cyber resilience are identifying, assessing, and managing cyber risks across all systems. This also applies to third and fourth parties, which can bring risks. 

Detection

Detection is also a key part of cyber resilience. Early detection of a cyber threat provides the best chance to stop it before damage is done. Continuous monitoring and attack surface management help identify malicious or unintentional threats to prevent cyber incidents and keep operations running without interruption.   

Recoverability

The ability to recover from an incident in a timely manner is one of the most important functions of cyber resilience. Many organizations will experience a serious incident at some time. Being prepared with a recovery plan results in cyber resilience.  

This requires developing and implementing a detailed incident response plan and taking time to test it. Infrastructure redundancies and data backups are also imperatives for business continuity. 

Adaptability

With a rapidly changing threat ecosystem, businesses must build adaptability into their cyber resilience plans. Adaptability plays an important role in cyber resilience, whether it is proactively changing or adding defenses in response to a new threat or shifting course to respond to an attack rapidly. Another adaptability component is learning from past events and threat-related data to adjust plans.   

Solutions, programs, and processes for cyber resilience

To effectively execute a cyber resilience strategy, a number of solutions, programs, and processes need to be in place, including: 

• Backing up data automatically to expedite recovery from breaches (e.g., malware, ransomware) or other disruptive incidents (e.g., human error, network outages, natural disasters)   
• Detecting and blocking threats before they can infiltrate systems and networks  
• Enhancing cyber resilience by making improvements and ensuring optimization of systems, configuration management, vulnerability management, and attack surface management  
• Improving security by taking measures to make it more difficult for attackers to gain access to systems and networks   
• Protecting endpoints from the latest threats
• Recovering from attacks in a timely manner to minimize downtime and impact on operations   
• Responding to attacks quickly by having a detailed cyber resilience plan in place   
• Training to remind users how important security is and to educate them about threats, how to spot them, and how to respond to them 

Improving cyber resilience

Cyber resilience can be improved by implementing and continually assessing security practices, such as: 

• Allowing access by exception (i.e., enforce the principle of least privilege) 
• Applying role-based access policies with contextual rules  
• Creating multiple protected instances of critical resources 
• Diversifying components and vendors to reduce vulnerabilities 
• Educating users about cyber attack vectors and how to avoid them
• Employing a defense-in-depth strategy that limits attackers’ ability to exploit a breach 
• Installing patches promptly 
• Monitoring systems for threats and unusual behavior continuously 
• Regularly upgrading to the latest versions of software  
• Requiring different multi-factor authentication for all systems 
• Segmenting networks to provide separation for sensitive resources and data 
• Separating user functionality and system management functionality— physically, logically, or both 
• Staying apprised of new external threats and common vulnerabilities and exposures (CVE) 
• Using encryption to protect sensitive data 

Measuring effective cyber resilience

Cyber resilience effectiveness is ultimately measured by the time lapse between detecting, mitigating, and resolving a threat or attack. Accurately measuring the efficacy of cyber resilience starts with understanding and collecting data related to several key metrics, including the following. 

Technical metrics 
Quantitative cyber resilience measurements can be gathered by evaluating the performance and identifying potential risks and vulnerabilities. Technical systems to measure include: 

• Data protection
  Number of data breaches, number of records compromised, and how long it took to detect and resolve incidents
• Disaster recovery
  Recovery time objective, disaster recovery tests conducted, and number of incidents that required disaster recovery
• Network security
  Successful and attempted attacks, number of vulnerabilities identified, severity of identified vulnerabilities, and how long it took to detect and respond to incidents
• System availability
  Systems’ uptime and downtime, mean time between failures, and number of system crashes

Human-related metrics 
Cyber resilience can be measured by recording and assessing data related to human behavior and decision-making related to cybersecurity. These cyber resilience metrics focus on the role of employees and end-users as related to: 

• Incident response
  Measures an organization’s ability to respond to cybersecurity incidents and minimize the impact of a breach
• Phishing awareness
  Programs in place and frequency of an organization’s ability to educate employees on the dangers of phishing scams and how to avoid them 
• User training
  Assesses an organization’s investment in cybersecurity training for employees and end-users

Model-based metrics 
Model-based metrics are used to measure the overall cyber resilience of an organization. Incorporating technical, organizational, and human-related metrics, model-based metrics provide a comprehensive view of an organization’s cybersecurity posture and cyber resiliency. Examples of model-based metrics are:  

• Cybersecurity Maturity Model (CMMC) 
• Net Assessment Score 
• NIST Cybersecurity Framework 

Organizational metrics 
Organizational metrics refer to characteristics and processes that contribute to cyber resilience, such as internal structure and governance of an organization, including:  

• Data privacy
  Organization’s ability to protect sensitive information and comply with data privacy regulations 
• Policies and procedures
  Extent to which an organization has documented and implemented its cybersecurity policies and procedures
• Risk management
  Organization’s ability to identify, prioritize, and manage cybersecurity risks

Threat intelligence metrics 
Monitoring and measuring threat intelligence is essential to protecting systems, networks, and data. There are a number of key metrics organizations use to measure cyber resilience, including: 

• Cost per incident
  Cost of each incident that the organization experiences 
• False positive rate
  Number of false positives that the organization’s threat intelligence systems generate 
• Threat detection rate
  Percentage of threats that are detected and prevented
• Time to detect
  Amount of time it takes for the organization to detect a threat 
• Time to respond
  Amount of time it takes for the organization to respond to a threat once it has been detected

Benefits of cyber resilience

Regardless of size, all businesses can benefit from prioritizing cyber resilience. Five of the most commonly cited benefits of cyber resilience include: 

1. Improved compliance 
2. Increased productivity 
3. Minimized financial impact of unexpected disruptions 
4. Protecting reputation and client trust 
5. Upleveling overall cybersecurity 

Cyber resilience FAQ

What is the difference between cybersecurity and cyber resilience? 

Cybersecurity	Cyber resilience
Consists of information technologies, processes, and measures designed to protect systems, networks, and sensitive data from cybercrimes	Encompasses cybersecurity, data security, IT infrastructure, business functions, and business continuity and disaster recovery (BCDR)
Reduces the risk of cyberattacks and protects entities from the deliberate exploitation of systems, networks, and technologies	Shows businesses recognize that attackers may have the advantage of innovative tools, zero-day threats, and the element of surprise
Deals with how to protect business-critical data, systems, and applications	Provides a strategy to run business operations with minimal disruption when such instances happen
A defense strategy that involves using different tools, technologies, and processes to protect against and prevent unauthorized access to data and networks	Helps businesses prepare, prevent, respond, and successfully resume pre-incident processes and operations
Aims to keep threats away and prevent disasters from occurring in the first place	Focuses on rapid recovery and business continuity in the face of an attack
Protects against and avoids attacks from ransomware, malware, or other threats from cyber criminals	Mitigates damage and gets mission-critical systems up and running quickly following a breach

While there are many differences between cybersecurity and cyber resilience, the two work best together. Most cyber resilience tactics assume, leverage, or enhance cybersecurity measures.  

Together, cybersecurity and cyber resilience ensure that an organization’s critical systems and data are protected from internal and external threats, as well as minimize disruption and damage when the unexpected occurs. 

What is cyber risk?

Cyber risk is the chance of financial loss, disruption, or damage to an organization’s reputation caused by information system issues. There are two types of cyber risk—external and internal. These can take many forms, including cybercrime, cyber terrorism, corporate espionage, third-party vulnerability, malicious insiders, and simple human error.   

Upleveling business operations with cyber resilience

The benefits of and need for cyber resilience are undeniable. The good news is that the effort required to implement or enhance cyber resilience results in better security and system uptime. Businesses with a robust cyber resilience program see overall operations improve.    

You might also be interested in: