Know What Is Needed To Maintain Viability: Most organizations have reasonably clear ideas about which systems are mission-critical, but fewer organizations have a clear idea about what they would need to maintain to remain viable. During a widespread cyberattack, for example, it may simply not be possible to repair or recover everything quickly, so organizational leaders must understand what they absolutely need.

Defining what represents a minimum viable organization will help to focus effort on the capabilities required to keep the organization operating. Determining minimum viability typically results in identifying the subset of critical business processes (and associated applications, infrastructure and data) where leaders should really focus their investments in cyber resilience and recovery. 

Become a Moving Target: Cyber resilience is not only about making targeted platforms more resistant to sustained attack; it’s also about making them harder to attack in the first place.  When organizations continue to deploy and protect targeted applications, systems and data in predictable ways, they make things easier for the attackers.  Given time, even highly complex environments may be breached by persistent attackers. As highly adaptive, AI-driven attacks become more common, organizations will have even less time and resources for their defense.

AI-driven adaptability is also essential to newer cybersecurity solutions that can leverage a moving-target approach. By using adaptive techniques, often also driven by AI approaches, organizations can provide shifting defenses that alter the attack surface or change vulnerable assets to make it more difficult to get a foothold. They may also use similar techniques to adapt to new attacks more quickly, helping vulnerable systems to be self-healing.

Build Up Organizational Resilience: While cyber resilience efforts tend to focus on applications, systems, data and infrastructure, it’s just as important to make an organization — particularly its people — more resilient under pressure.

This typically starts by recognizing that response to a serious cyber incident is almost always driven by a few key individuals. They must respond well in a crisis, be quick to make decisions and take action, and have strong knowledge about what can be done and how. Organization leaders also must understand that during an incident, they may overuse these individuals and should instead increase their reliance on their wider teams.

By focusing on developing the strengths of the team, organizations can improve overall resilience under pressure.

Improved Cyber Recovery: Older disaster recovery capabilities have proved to be a weak point for most organizations, since they rely on backups and replication that may be compromised during an attack.

Cyber recovery tools focus on extending traditional backup and recovery solutions to add immutability, as well as more advanced security and anomaly testing. They also provide additional infrastructure to rebuild or restore systems in isolated clean rooms before either moving them back into normal operations or into alternative recovery rooms for use by the business. They also implement the application, security and data quality tools needed to provide the organization with a higher assurance of a safe recovery.

Resilience Training and Exercises: The best way for people to establish resilience is to develop their strengths and test them under real-world conditions. This typically means moving beyond simple tabletop exercises (where teams who respond to major cyber incidents discuss how they might respond) to more complex simulations (such as purple team testing) that require them to take action under pressure and put their defensive, detection and responsive techniques and tools to the test.

Such simulations do a lot to help improve overall organizational and team resilience, but it’s important to also invest in the individuals who drive response.  Organizational leaders should work closely with key individuals to develop training and development paths that reinforce their areas of strength and tackle opportunities for improvement.

The Benefits of Resilience: A mature cyber resilience program leads not only to robust cybersecurity tools and practices but also to resilience throughout an organization. Resilient people and teams collaborate cross-functionally, have a shared understanding of their roles and can adapt under pressure, even in unfamiliar and high-stakes situations. Meanwhile, resilient processes and workflows are backed by documented and tested playbooks that allow organizations to remain effective even when things don’t go as planned. And resilient technologies and systems are architected for recovery, with security controls that adapt and self-heal. Together, these resilience capabilities can deliver outcomes such as accelerated transformation, secure remote and hybrid work, improved IT performance, and disruption-ready systems that can adjust to and recover from a wide range of unexpected events.