Why Your Cyber Strategy Should Focus on Cybersecurity and Cyber Resilience

Written by Aditi Consulting | Feb 15, 2022 1:45:00 PM

Never before has the world been so reliant on the vast proliferation of information technology that enables us to work from anywhere, at any time, on any network, or any device. 

Given the current state of connectivity, it’s no longer a question of if but when a business will fall victim to a cyber attack. In 2021, the Harvard Business Review noted that “cyberattacks are inevitable” and asked the question every business needs to consider: Is your company prepared?

When you combine the increase in ransomware attacks with the number of employees who are now working in hybrid and remote work environments and then add the shortage in qualified IT talent, you have the makings for the perfect cybersecurity storm. 

The Great Acceleration, a recent Aditi Consulting survey of 300 IT professionals, found that even though an overwhelming number of respondents (93%) feel their organization is well-positioned to identify and deal with current and near-future IT security/cyber-attacks, 27% said cybersecurity expertise was in high demand at their organization, while 22% said their organization will increase spending on cybersecurity in the year ahead. 

Cybersecurity has become a major concern for organizations of all sizes and types, so much so that in 2021 U.S. President Biden signed Executive Order 14028, “Improving the Nation’s Cybersecurity” to support the nation’s cybersecurity and protect the critical infrastructure and Federal Government networks.

How to Build In Cyber Resilience

So, how do organizations protect themselves from the growing number of cyber threats? The answer lies in developing a comprehensive cyber strategy that focuses not only on cybersecurity measures, but also builds cyber resilience into processes and programs. 

Think about cybersecurity vs. cyber resilience as the difference between taking a reactive vs. proactive approach to protecting and securing businesses operations and data. 

With cybersecurity, organizations are focused on the most basic steps of a cyber strategy that includes developing disaster response and business continuity plans, as well as identifying and mitigating network vulnerabilities, and ensuring employees know how to protect themselves and the company from data breaches.

With cyber resilience, an organization is able to prepare for, respond to and recover from a cyber attack. It involves technology teams building security measures into the foundation of their network infrastructure and design. Cyber resilience can help limit the impact of an attack, and ensure an organization can not only continue operations but also execute the organization’s most critical functions. 

Organizations that have implemented a cyber strategy that focuses on resilience, in addition to cyber security are able to:

  1. Stop cyber-attacks before they breach existing security measures. 
  2. Surface data breaches faster.
  3. Mitigate data breaches faster. 
  4. Reduce the impact of a data breach. 

Increasing cyber resilience means mitigating the damage of a cyber-attack on an organization’s brand, reputation, and most importantly, its bottom line. 

The National Institute of Standards and Technology recently updated its framework on how to develop a cyber-resilient system:

  1. Adaptive Response: Implement agile courses of action to manage risks.
  2. Analytic Monitoring: Monitor and analyze a wide range of properties and behaviors on an ongoing basis and in a coordinated way.
  3. Contextual Awareness: Construct and maintain current representations of the posture of missions or business functions while considering threat events and courses of action.
  4. Coordinated Protection: Ensure that protection mechanisms operate in a coordinated and effective manner.
  5. Deception: Mislead, confuse, hide critical assets from, or expose covertly tainted assets to the adversary.
  6. Diversity: Use heterogeneity to minimize common-mode failures, particularly threat events exploiting common vulnerabilities.
  7. Dynamic Positioning: Distribute and dynamically relocate functionality or system resources.
  8. Non-Persistence: Generate and retain resources as needed or for a limited time.
  9. Privilege Restriction: Restrict privileges based on attributes of users and system elements, as well as on environmental factors.
  10. Realignment: Structure systems and resource use to align with mission or business function needs, reduce current and anticipated risks, and accommodate the evolution of technical, operational, and threat environments.
  11. Redundancy: Provide multiple protected instances of critical resources.
  12. Segmentation: Define and separate system elements based on criticality and trustworthiness.
  13. Substantiated Integrity: Ascertain whether critical system elements have been corrupted.
  14. Unpredictability: Make changes randomly or unpredictably.

If cybersecurity is about reacting, cyber resilience is about anticipating. As cyber-attacks become more sophisticated and common, organizations will need to take an agile and managed approach to update their current infrastructure to one that embraces cyber resilience. 

Just as hackers continue to adapt and evolve, so too should organizations when it comes to protecting themselves against cyber attacks.

Do you need help in developing a cyber strategy that encompasses a comprehensive approach to cybersecurity and cyber resilience? Aditi Consulting can help. Contact us to learn more today.

View full post