CyberResilience

Cyber resilience is critical for innovation and economic sustainability

viviandufour, , , , Leave a comment

The events of the last few years have highlighted the world’s vulnerabilities and shown the importance of building resilience into organisations, supply chains and the global economy. COVID-19 and the war in Ukraine have exposed issues we’d chosen to ignore, thought we’d fixed forever or hadn’t even considered before. Growth is no longer guaranteed. The global economy’s increasing reliance on technology to enable the world to function extends the attack surface and opens up new cyber security threats.

The need for cyber security to protect sustainable growth

Governments are struggling with plans for sustainable economic growth against a background of conflict, continuing supply chain problems, climate change, rising prices and interest rate increases. Typical sustainable development goals include; economic growth measured by GDP; business innovation and infrastructure renewal; creating sustainable cities and communities; and responsible consumption of products.

From smart cities, to renewable energy, financial infrastructures and driverless transport, cutting-edge technology is at the heart of our drive for sustainable growth. This provides exciting opportunities but has also exposed existing systems’ weaknesses and created new vulnerabilities to malicious actors. Sustainable development goals are all put at risk by the increased threat from cyber attacks.

Organisations have become familiar with safety and security measures which protect their physical environment such as installing early warning sensors, security cameras, fire safety equipment and intruder alarms. There’s a need for a cultural shift for executives, investors, employees and regulators to recognise the increasing importance of cyber security. The war in Ukraine has brought into sharp relief the importance of having both strong physical and cyber defences. Cyber resilience is absolutely necessary for modern civilisation to survive and flourish. 

How big is the cyber threat?

Recent research and headlines point to cyber crime being very big business indeed. One study showed cyber criminals raking in $1.5 trillion every year. To put that in context that’s exactly the same amount proposed for the US Congress’ bipartisan package to help Ukraine and finance federal agencies for the second half of 2022. Another study from Cybersecurity Ventures expects global cybercrime costs to reach $10.5 trillion annually by 2025. This led Steve Morgan, Editor-in-Chief at Cybercrime Magazine to comment, “This represents the greatest transfer of economic wealth in history, risks the incentives for innovation and investment, is exponentially larger than the damage inflicted from natural disasters in a year, and will be more profitable than the global trade of all major illegal drugs combined.”

Innovation is a growing target for cyber criminals

Innovation and invention are seen as good things for businesses and the wider economy. They power economic growth and prosperity around the world but by their very nature they can open the door to cyber criminals. Innovation is all about new technologies, products and ways of working. The cloud gaming sector is a prime example of an industry that has attracted the attentions of hackers, due to its  constant growth, developing new platforms and introducing new products almost daily. As the industry transitions to cloud infrastructures, the market size was estimated at $609.67 million in 2021, and is expected to grow to $7.382 billion by the end of 2028 according to research by Brandessence. Change, as in this case, often comes at dizzying speed. This means that procedures, controls, security and monitoring may lag behind. Ripping up the rule book to innovate can have huge positives but organisations need to watch for the negatives too. Indeed, some of the largest cyber security incidents in 2022 were targeted at the gaming sector, with breaches reported by such behemoths as Rockstar, Roblox and NVIDIA, to name just a few. 

Rapidly expanding sectors and businesses naturally also attract huge investment. This makes them even more attractive for wily cyber criminals as the rewards from attacks can be particularly lucrative. Another pertinent example is the renewable energy sector. This growing industry promises great things for our hopes of preserving the world we live in. Massive investment means it is also shaping up to be a very attractive market for cyber criminals. 

Jim Guinn, global managing director for cyber security in energy, chemicals, utilities and mining at Accenture has noted, “The cybersecurity conversation in the renewable energy engineering and construction business is almost nonexistent today.” It is imperative that such industries underpin their expansion with the appropriate focus on defence against cyber attacks.

Protecting your software stack

The way today’s technology solutions are created using a jigsaw puzzle of multiple pieces including published APIs, integration with proprietary products, cloud applications from different vendors, open source components all combined with in-house developments means that many organisations are unsure about their complete Software Bills of Materials (SBOMs). This means vulnerabilities are literally built into critical systems introducing undocumented threat vectors which can be used by hackers to gain access to proprietary systems and data.

This lack of knowledge about an organisation’s SBOMs means that even when a bug or vulnerability is identified in the open source community and patches created, the business can be completely unaware  of the fact that it needs to take remedial action. There are many examples of this type of oversight resulting in huge costs and disruption for business.

Secure by default – building resilience

In 2023, developers and publishers of software must focus on Secure by Default principles if systems are to avoid the kind of failures due to poor security posture and an over reliance on end-users to act in a secure manner. The user experience is an integral part of the security features of a system, because if security makes software inconvenient to use, end-users will simply find a workaround. If security isn’t second nature then it’s no security at all.  The UK Government has introduced tough new regulations in the Telecommunications (Security) Act which includes the requirement to have a deep understanding of security risks, including those within the supply chain. This builds on the premise that ‘edge’ devices such as radio masts, internet equipment, or wifi routers supplied to customers should be protected from cyber attack. 

NCSC Technical Director Dr Ian Levy made the point: “We increasingly rely on our telecoms networks for our daily lives, our economy and the essential services we all use. These new regulations will ensure that the security and resilience of those networks, and the equipment that underpins them, is appropriate for the future.”

Online risks spill over into the physical world

Increasingly, online services are impacting people in the real world.  A high profile example is the fall out from the 2017 Equifax data breach, which it is estimated to have cost the company at least $1.38 billion, with some sources suggesting the final bill could be closer to $2 billion. The root cause of the data breach was the failure to patch a known open source web application security flaw. This left the cyber doorway open for criminals to enter and cause havoc. Over 140 million U.S. consumers’ data was affected, putting them at risk of future financial instability—being unable to rent housing, being denied a loan, having to pay higher interest rates on credit cards or mortgages, and greater difficulty in getting a job, not to mention the distress and anxiety identity theft causes.

A more recent example, described as the biggest hack in history that affected telco Optus, led to one in three Australians at risk of identity theft or fraud. As a result, 10,000 victims have had their personal details published online and millions of people are scrambling to change their online driving licenses.  T-Mobile data breach that affected 37 million accounts was detected in January 2023 but the weakness in the API had been exploited since November 2022.

Automating Development & Security Operations (DevSecOps)

As software development accelerates and the attacks of malicious actors continue to increase in speed and intensity, organisations must ensure their security operations are equipped to respond equally fast. Preventative strategies can be built into the development workflow to ensure that DevSecOps processes are efficient and maintain the appropriate vigilance without wasting human resources.  Such processes become operationally effective if for every critical patch released, the security and development teams are ready with normal business practice to identify the threat, confirm its presence in their application software estate and remediate as quickly as possible as part of business as usual.  Without DevSecOps, such operations can take days to weeks, but forward thinking teams will have worked this out so such incidents take minutes to hours, thus preventing unauthorised access or infiltration of malware via an open source vulnerability.

With some 64% of companies impacted in 2021 by supply chain attacks, mostly due to increased reliance on open source software components, organisations must be scrupulous about checking that underlying dependencies are safe from vulnerabilities. A further study showed such attacks were up 300% compared to the preceding year.  Businesses that prepare thoroughly against such risks will be well rewarded.  Not only are they underpinning their own operations, ensuring that their business can continue to grow and innovate without hindrance from malicious attacks, they protect their reputation by providing reliable products and services to their customers. In turn, customers know that they can trust their supplier, building loyalty in the business that transcends a purely transactional relationship. 

Ensuring that technology works as it should has long been a given. Now it is an expectation that tech works securely, protecting personally identifiable information, while still providing a great user experience, so that people can get on with their lives, knowing that their trusted suppliers are looking after their data securely. It is a challenge for the entire technology industry, but one on which our very way of life depends.

Visit www.meterian.io to learn how Meterian can help secure your businesses’ open source components to reduce the threats of cyber attacks.

Cyber resilience is critical for innovation and economic sustainability

Cyber Security and IoT

viviandufour, , , , , , , , 1 Comment

Last updated: 07/07/2021

How can we enjoy social gatherings in restaurants or busy spaces again?  This is possible with robots, devices, space partitions and humans occupying the same space.  With imagination, we will re-create the bustling spaces redefined with IoT technology.

What is IoT? 

If you’re new to IoT, see from Wikipedia: “The Internet of things (IoT) is a system of interrelated computing devices, mechanical and digital machines provided with unique identifiers (UIDs) and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction.”1  

Basically, an IoT device is one that has an internet connection, even though normally it wouldn’t.  Your smart boiler and smart thermostat are examples of IoT devices. You talk to them using an app on your smartphone. You tell the smart boiler to heat water so you can take a shower, and the smart thermostat to warm up the room to a cosy temperature by the time you arrive home.

In recent months, as the reach and severity of the COVID-19 pandemic increased, adopting IoT solutions started joining the frontline in many countries outside Asia in order to manage the crisis. With the boost in increased use of digital and remote technologies, videoconferencing has become the norm for office meetings, school lessons and exercise classes.  The capabilities of video conferencing, email and messaging technologies has shown just how productive remote work can really be, with studies showing that 65% of pandemic remote workers wished to continue working from home and only 2% wished to return to the office.2

These efforts are likely to take a step further with IoT.  Many countries have set up temperature measurement systems at the entrance of public places such as airports and train stations.  Restaurant managers are also recording the temperature of staff who are preparing food.  If this collected data (temperature) could be transferred and analysed in the cloud through an app, it could result in real-time analysis. 

To orchestrate such a system requires planning and a clear understanding of what is most valuable to protect and why.  There are many benefits and use cases of IoT.

Benefits of IoT

IoT, artificial intelligence, and the analysis of vast amounts of real-time data sets (aka Big Data) can be used to slow down proliferation of pandemics to avoid future global health crises.  Such real-time connected intelligence, dubbed “nowcasting”, could be gained from medical devices connecting over the internet.  Trend monitoring of wearable devices could analyse population-level influenza trends daily according to a recent study from Scripps Research scientists.3

As seen during COVID-19 isolation period, this preventive action to stop the virus spread combined with telehealth services lets health care providers advise patients without risking exposure.

Robot surveillance for social distance monitoring can alleviate the stress on police or community patrol since robots don’t get tired of doing repetitive tasks — observe, record, count, report and take action. 4


Key reasons for implementing IoT projects are summarized in Microsoft Azure’s IoT survey featured in their IoT Signals report, which highlight the top three reasons as improving Safety and security, Operations optimization, and Quality assurance.

 Source: 2019 Microsoft Azure IoT Signals

During COVID-19 crisis, we have seen that doctors and health care providers can maintain some employees’ productivity while social distancing and relying on the right connected devices and computing systems.  Logistics companies, supermarkets and the food supply chain can track the quality and quantity of goods and produce from shore to shop or farm to market with minimal manual effort.  Eventually, the click-pick-and-collect journey of groceries delivered by Ocado5 will be done entirely with robotics. Another instance in which IoT can act as a useful tool for retail stores is by tracking consumer and employee location data. Michele Pelino, senior analyst in infrastructure and operations research at Forrester said, “The idea is to use information about location: GPS capabilities in phones. Over time, there will be more opportunities to create location-based experiences to interact with a brand”. Possibilities for the next year include the ability for customers to use GPS to check in, allowing them to maintain distance by avoiding queues.

IoT Risks

As with all new technology, great progress comes with risks in uncharted fields.  

Since the explosion of the internet of things (IoT) across industries, companies providing products or services in any IoT ecosystem must carefully evaluate and examine possible threats of malicious intent.

We have been warned children’s toys6 and baby monitors’7 cameras have been hacked by strangers invading privacy and security of the home.  In the UK, regulations for IoT devices are gradually being introduced to catch up with the 300% surge in cyberattacks using IoT devices8, and similarly in the US9.

In the United States, FBI warned 10 the US private sector in February: “Software supply chain companies are believed to be targeted in order to gain access to the victim’s strategic partners and/or customers, including entities supporting Industrial Control Systems (ICS) for global energy generation, transmission, and distribution”. Recently we have seen this exact industry area targeted in oil pipeline system company Colonial Pipeline’s Ransomware attack. This led to the take down of the largest fuel pipeline in the U.S., and Colonial Pipeline paying out a huge $4.4m crypto currency ransome.

 In addition to attacks against supply chain software providers, the FBI said the same malware was also deployed in attacks against companies in the healthcare, energy, and financial sectors.

The Most popular supply chain attack is 2017’s NotPetya ransomware attack11. Due to a lack of patches to keep software in their Windows computer systems up to date, cyber criminals were able to gain access to computers and install a malware that spread through the networks of organizations like wildfire.  Multinational companies, AP Moller-Maersk, Reckitt Benckiser and FedEx, were crippled and they were not even the target of the state-sponsored attack.  Just collateral damage, and the estimated loss is $10 billion12.  

Gavin Ashton recently wrote in his personal blog about his insider view of the NotPetya experience, which cost Maersk $300 million: “you should put up a damn good fight to stop these attacks in the first case. … Staying with the home analogy; Yes, there’s security cameras and wizard cloud-connected ‘Internet of Things’ (IoT) devices and all kinds of expensive measures and widgets, but a lot of organisations fail simply on the basics. Lock the damn door.”13

The Value Security Adds to Systems

Such risks and misfortunate events are avoidable and can be mitigated.  

There is a range of use cases in which security indeed adds value to IoT systems.  For example:

  1. Need to prove authentic origin of products such as fresh produce or medications? Eliminate loss by tracking products with encrypted data.
  2. Need to guarantee the integrity of data?  Prevent tampering and fraud by ensuring systems have security controls for identification, authentication and authorization.
  3. Prevent cloning/faking/tampering of trackers or meters?
    • Ensure data of logistics/transport/utility/food services is confidential end-to-end
    • individual contact tracing. Ensure tracker data is confidential end-to-end
    • Prevent device/software tampering that could affect pricing and billing
  4. At home and with health care providers, 
    • Safeguard customer privacy by preventing intrusion into home systems
    • Comply with patient privacy regulations by protecting data at rest (stored on devices/systems)  and in motion (when sent from a device over the network to another device/system).

In the IoT ecosystem, it is crucial for organizations to have visibility into all connected devices and systems. As more employees use cloud apps and mobile devices for work, the traditional network security perimeter has lost relevance. This means more attention is needed on endpoint monitoring and protection, which includes not only employees’ devices to perform work, but also devices in the worker’s environment whether at home or at work. At work the environment may be an open plan of office desks, a clinician’s patient room, or on the assembly line of a manufacturing plant.  Each environment will have its unique characteristics.  For more on the role of IoT and the fight against COVID-19 in sensitive areas, read our blog: Cyber Security and IoT: Health Care and Well-Being in our Shared Spaces.

The user/actor in the environment may also vary and the device’s mobility would affect its position and environment.  IoT system design must take many of these factors into consideration and use secure-by-design principles to protect the value of the information that is being moved around the ecosystem.  There is no panacea to protect all aspects because in the IoT ecosystem the hardware, software, and services are provided by different vendors.   Each aspect will need to be secured to be fit for its purpose within the context of its environment and ecosystem.  Methods to update and/or remove devices are required to keep up with the pace of business and technological advancements.

Just as hardware devices come with basic security benefits that can be used and will need to be updated over time, the software of open source components used by IoT devices must also be maintained.  Continuous updates are essential.  New aspects of information and human security will need to be included.  In the context of autonomous vehicles, software must be resilient against both malicious actors as terrorists as well as unauthorised but friendly users, such as a child who could use a smartphone to direct the car to go to school, for example.

Look Out Ahead for CyberSecurity in IoT

The future is not promising to be better in terms of cybersecurity threats and malicious attacks.   Globally there were nearly 27.5 billion installed IoT devices number of installed IoT devices at the end of 2020, which is set to rise to 45.9 billion by 202514. So, with both of these figures growing, it is clear to see that IoT devices are the perfect vessel for cyber criminals to carry out attacks.

80% of data breaches can be prevented with basic actions, such as vulnerability assessments, patching, and proper configurations.  Getting basic cyber hygiene right is critical to help prevent cyber attacks.  There are always those who destroy unity and stifle positive progress.  Cyber criminals unfortunately will continue to innovate with artificial intelligence to increase their attacks at machine speed from anywhere in the world and on a scale comparable to that of a pandemic.

How a Software Bill Of Materials can help prevent cyber attacks

The National Telecommunications and Information Administration (NTIA) defines a Software Bill Of Materials (SBOM) as “a complete, formally structured list of components, libraries, and modules that are required to build (i.e. compile and link) a given piece of software and the supply chain relationships between them. These components can be open source or proprietary, free or paid, and widely available or restricted access.” A bill of materials such as this acts as a comprehensive compilation of all internal parts of the software, including third party contributions. This would facilitate the tracking of individual components such as libraries or source code within software programs. With a complete and traceable inventory, companies can see and manage the risks associated with open source libraries by identifying vulnerable systems as early as possible. Furthermore, it allows developers to monitor what components they use by vetting the code in their projects. Finally, this level of transparency would allow for a more informed purchasing experience for consumers. President Biden recently formalized the importance of SBOMs through the Executive Order on Improving the Nation’s Cybersecurity15, in which it was made mandatory that all software used by the US government came with its own SBOM— so as to prevent from SolarWinds type hacks in the future.

If you are interested in automated auditing of your software applications for open source compliance risks and security vulnerabilities, get in touch.

1 Wikipedia, https ://en.wikipedia.org/wiki/Internet_of_things

2 Mlitz, Kimberly. “Work from home & remote work- Statistics and Facts”. Statistica, 30 March 2021, https: //www.statista.com/topics/6565/work-from-home-and-remote-work/.

3 “Fitness wearables may improve real-time tracking of seasonal influenza outbreaks.” Scripps Research, 16 January 2020, https ://www.scripps.edu/news-and-events/press-room/2020/20200116-wearable-flu.html.

4 Stieg, Cory. “This $75,000 Boston Dynamics robot ‘dog’ is for sale—take a look”. Make it, 22 June 2020, https ://www.cnbc.com/2020/06/22/75000-boston-dynamics-robot-dog-for-sale-take-a-look.html.

5 Banks, Martin. “Google Solving Together – Ocado Technology readies clients for more changes to online retail’s ‘new normal”. 15 June 2020, https ://diginomica.com/google-solving-together-ocado-technology-readies-clients-more-changes-online-retails-new-normal

6 “What did she say?! Talking doll Cayla is hacked”. 30 January 2015, https ://www.bbc.co.uk/news/av/technology-31059893 .

7 “Smart camera and baby monitor warning given by UK’s cyber-defender”. BBC News, 3 March 2020, https ://www.bbc.co.uk/news/technology-51706631.

8 Kelly Early. “What do the UK’s newly proposed IoT laws look like?”. Silicone Republic, 28 January 2020, https ://www.siliconrepublic.com/enterprise/uk-iot-internet-of-things-regulation-laws.

9 https ://www.nist.gov/internet-things-iot

11 Cimpanu, Catalin. “FBI warns about ongoing attacks against software supply chain companies”. ZD Net, 10 February 2020, https ://www.zdnet.com/article/fbi-warns-about-ongoing-attacks-against-software-supply-chain-companies/

12 Hall, Kat. “Largest advertising company in the world still wincing after NotPetya punch”. The Register, 7 July 2017, https ://www.theregister.com/2017/07/07/ad_giant_recovering_from_notpetya/.

13 Ashton, Gavin. GVNSHTN, Maersk, me & notPetya, 21 June 2020, https ://gvnshtn.com/maersk-me-notpetya/.

14 Belton, Padraig. “In 2021, as you work from home hackers eye your IoT”. Light Reading, 1 April 2021, https ://www.lightreading.com/iot/in-2021-as-you-work-from-home-hackers-eye-your-iot/d/d-id/766350

15 “Executive Order on Improving the Nation’s Cybersecurity”. The White House, 12 May 2021, https ://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/.

Cyber Security and IoT

How can your organization become more Cyber Resilient? 

Victoria C., , , 1 Comment
Image of skyscrapers in the city with people on the top of each building. Represents the infrastructure of a company and the need to keep it cyber resilient.
Image from Free Vectors via Vecteezy.com

Cyber Resilience is demonstrating to be a very important concept within organizations’ strategies. Keeping up with the increasing investment in security is demanding investment in new technologies that can defend organizations faster. Meterian is one of them. But what really is Cyber Resilience? What does it entail? And why is it so important?

What is Cyber Resilience?

Cyber Resilience is the ability to prepare for, respond to, and recover from cyber attacks. It involves a strategic view, addressing the life cycle of data when it is created, dispersed and stored. More importantly, a cyber resilient approach will incorporate the collaboration of people, processes and technology. Careful not to confuse this concept with cyber security, which is the action of preventing an attack from happening. On the other hand, Cyber resilience is more about being persistent in your defensive strategies, to produce a preventive and reactive defense against threats and vulnerabilities.

Cyber attacks are only on the rise! According to Forbes Insights survey more than 50% of surveyed organizations have experienced at least one cyber incident in the last three years and only 27% believe that their top management understands the difference between mitigating cyber risk and working towards a more organised cyber resilient strategy. Normally, hacked victims have a better idea of how to prevent attacks as they have learnt from previous incidents. But this is no excuse for organizations to wait until the worst! Here are some steps which can boost your cyber resilience!

Identify, Protect, Detect, Respond, Recovery 


1. Identify

The first stage in adopting a cyber resilient strategy begins with the preparation and identification of the potential security risks within the framework of your organization. This involves spotting vital information and conducting assessments on vulnerabilities. Prioritising your most urgent issues will make you less appealing to attackers! Urgent issues might include securing your customers’ data such as financial credentials, passwords or emails.  Also, check how well do you understand the risks of each of the devices and digital assets identified in my company. 

What is sometimes overlooked, is the diversity needed within a team when understanding your organizations’ potential vulnerabilities. Accenture made a study which demonstrates how the immediate cybersecurity team only identified 64% of the breaches.  So involving groups beyond the cybersecurity team is vital to create a united front between IT and business. This will increase an organization’s resilience at all levels. Industry research supports this, highlighting how due to the variety of software services and devices used by users or staff, users must take responsibility to identify and act on risks. We need to make sure strong defence is across all user levels. After all, ‘Many Eyes Make All Bugs Shallow’! 

With identification, comes attention to detail. It is not enough to list ‘hacking’ as a risk, for this action could range from phishing to exploited databases. Without this attention to detail, organizations are vulnerable to more acute attacks. Checklists are useful practical tools to help identify the people, processes and technology within the organization needed to form an effective defense.  If you can identify these entities, then it’s easier to talk about the risks and do something about them. Review the NCSC Cloud Security Guidance which provides a framework of 14 cloud security principles for enterprises to evaluate the security of any cloud service.  The UK ICO provides a useful self-assessment checklist for SMEs to evaluate their data protection assurance. Discuss these lists with your teams to get visibility on what could be vulnerable to attacks and what the team can do to build an effective defense. 

2. Protect

Protection will help minimise chances of breaches succeeding. It will contain the impact of the attack. Develop safeguards for critical infrastructure and make sure to enforce regular checks to understand the strength of the organization’s cyber resilience. This will help keep good cyber hygiene within your organization.

People, process and technology are essential for this step. In particular, new technology solutions are important to protect infrastructure and assets. Continuously investing in upgrading and refining protective systems should become a normal cost of business. However, experts feel that these technologies are not being bought or implemented to the fullest extent. Maybe this is because cybersecurity technologies need to make business sense; they cannot work in isolation. Yet, there are many tools in place to help with the five NIST framework categories, meaning you don’t have to waste time with a platform that has things you don’t need. You can simply choose cyber security products customized to your business needs. 

Protection of the mobile workforce is also a crucial factor within cyber resilience. By controlling mobile access to the network, employees are restricted to sensitive corporate information. This ties in with monitoring and enforcing policy adherence, seeming as malicious insiders are one of the most frequent sources of cyber security breaches! There should also be regular staff training to avoid any human factors leading to an attack.

3.  Detect 

A rapid response to a cyber attack is crucial! The longer it takes the more cyber criminals can exploit your organization. For example, according to the 2019 Verizon Data Breach Investigations Report, the time of discovery tends to be months. Of course, it does depend on the type of attack in question. There is a difference between payment card compromises where discovery is based on the fraudulent use of the stolen data (taking weeks or months), and a stolen laptop. So be aware, slower detection will only make your systems more vulnerable. 

To avoid this time lag, there needs to be detection and response policies in place. These must be evaluated and updated frequently. New technologies and software are essential as we have to adapt to attackers becoming more advanced. Surprisingly, only 40% of companies are investing in areas such as AI, machine learning and automation to become more cyber resilient. Yet, we understand adopting new technology takes time. An organization will have to make sure new technology is implemented, setup and allocated accordingly to their employees. Then they can use it through training and the adoption of new policy definitions.

It might seem daunting, but if you find tools that are easy to use and set up, this will increase your organization’s agility to detect and mitigate risks faster.

4. Respond 

Create a response plan. This will help contain the impact of the attack once it has been detected. There should be a specific focus on: 

  • Who will be the single point of contact that takes on responsibility for the plan and for integrating incident-response efforts? This may be required across teams, business units and geographies, depending on the organization size and structure as well as the nature and consequence of the attack.
  • What will the incident response team look like? Which individuals are critical to involve and are there reasonable backup plans if an individual is unavailable?
  • How will relationships with key external stakeholders, such as law enforcement be maintained?
  • How will the organization work with external breach-remediation providers and experts?

These are all questions which should be coordinated amongst a Response Team, where roles should be assigned to competent members of your organization.

5. Recover 

Returning your organization back to normal after an attack can be tough. However, thinking ahead to these what-if incidents can make it easier to recover and get back to business as usual.  This is a good planning exercise for both organizations who have and haven’t suffered a cyber attack.

If your organization has suffered an attack: Was there anything missing that could have prevented the attack? What did you learn from the breach? What will you do differently next time? Or what is the organization in need of to resist a future attack? 

Having pre-defined strategies in place can help the recovery process.  For example, developing and implementing systems and plans to restore any lost data or disrupted services affected by the attack would help organizations recover systems as quickly as possible. This can be done through the use of backups, cloud storage and off-site archives. It is worrying that while most organizations perform regular backups, very few know exactly what it is they are backing up. Again, there is a need for prioritisation. What information being backed up is of most importance? And if a cyber attack occurs what information and services need to be restored first in order to return to normalcy? More importantly, this recovery plan needs to be re-evaluated and updated regularly. This will help meet any risk related aspects of an attack that an organization might encounter in the future. 

Image of work colleagues giving themselves a high five. Represents team work.
Image from Pexels.com

Put into Practice

Following these steps will help boost your cyber resilience. The combination of people, systems and technology collaborating together is vital to emphasize, as it shows a united IT and business front against cyber attacks. Yet, cyber resilience requires adaptability, so make sure complacency does not get in the way. 

  • Develop easily accessible quick-response guides for likely scenarios.
  • Establish processes for making major decisions, such as when to isolate compromised areas of the network.
  • Document response plans, update them regularly and make them available to the entire organization. 
  • Make sure all staff members understand their roles and responsibilities in the event of a cyber incident.
  • Train, practice, and run simulated breaches to develop response “muscle memory”, increase individuals’ awareness and fine-tune the organization’s response capabilities.

Be flexible, be proactive and cultivate cyber resilience.

How can your organization become more Cyber Resilient?