Cyber resilience vs. cybersecurity: Which is more critical?
Today, it’s not ‘if’ but ‘when’ any organization will be compromised. So, while it’s essential to strengthen cybersecurity across the entire organization, it’s also imperative to plan for a significant cyber-attack and the worst-case scenario. No business can be 100 percent secure but they can be resilient. Resilience is about continuing to thrive amidst adversity. This is why cyber resilience can be more important than cybersecurity. Every organization can take positive actions to improve their cyber resilience today, ensuring they can continue to win even if they are affected by an incident. They can start by having the right mindset and instilling a culture of cyber security and cyber resilience.
Strong cyber resilience will enable an organization to continue to operate key business processes, even when they are under attack. This means keeping people safe, guaranteeing data security, and protecting their reputation with their customers, partners, suppliers, industry and government regulators and other key stakeholders. Having a strong cyber resilience will save stress, time and money -- it will give you a return on your investment -- and you’ll be better prepared for uncertainty in the future.
The best analogy to resilience is found in boxing. A champion doesn’t prepare a playbook based on all the ways they can get hit. A true champion works on their balance. So that it doesn’t matter where they get hit, they can quickly adapt and go on with the fight. The same applies to cyber resilience. The key isn’t to create an inventory of all the things that can go wrong, but to focus on business agility and balance, to ensure we can adapt quickly to any adversity. For this to happen we need to look at the organization holistically and accept there are going to be scenarios where it will be partly compromised and focus on enabling the business to continue operating. We suggest organizations start with their people and culture first, then assess the technological solutions later.
Many of the cybersecurity and cyber resilience actions that organizations can take are complementary -- it’s all about training the organization as a whole and not to think of this as silos that are delegated to “IT” or “Security”. Developing a stronger cyber security posture is essential -- we need to ensure we can stand strong against threats and respond effectively when they happen. Resilience will come when that capability starts talking to key business areas about how it can help them scaffold their service delivery, and spotting opportunities for further collaboration. This in turn will identify more opportunities to strengthen cyber security posture, and vice versa.
By thinking holistically for the long term, you’ll be able to identify the journey you need to embark on and milestones you need to take along the way. You’ll spot opportunities to improve culture and employee behaviors, communications within and between teams, systems and platforms that support that collaboration. Ultimately you want to get to a point where you can exercise the entire organization with table-top and live-fire exercises to put this to the test.
A common misconception is that cyber resilience means strong cybersecurity and that the organization won’t be compromised because their defenses are impenetrable. No defense is ever 100 percent secure because IT products have flaws and cybercriminals, and nation state-sponsored threat actors are continually changing their tactics, techniques and procedures (TTPs) to take advantage of any weaknesses they can find. And, of course, any organization with cyber resilience still needs quality cyber security in the first place. Resilience isn’t promising that bad things won’t happen; resilience promises that when they do, the organization can overcome that and continue to thrive. Cybersecurity is one of the foundations upon which resilience stands.
Although cyber threats have increased in frequency and sophistication in recent years, there’s a huge amount that businesses in every sector can do to reduce the chances of being compromised and to prepare for the worst. The investment in time, energy and resources to prepare for a cyber incident is well worth it for the results you’ll see. Being cyber resilient is becoming a selling point as well. Customers, partners, investors, stakeholders, and insurance companies are increasingly asking about how secure and resilient organizations are. So, businesses that become cyber resilient could gain a competitive advantage that enables them to grow faster than their rivals.
Furthermore, we are at an incredibly exciting moment in time, with the advent of AI and its impact on cybersecurity. For the first time in a long time, defenders are now equipped with a tool that is going to create a positive force differential in their benefit. This is a great time to be a cyber defender, as we finally get the upper hand.
Image credit: BiancoBlue/depositphotos.com
Federico Charosky is a risk and cyber security expert with a career spanning more than 20 years. He currently leads Quorum Cyber as its Founder and CEO. Quorum Cyber, a global UK-based cyber security firm with offices in the U.S., serves a clientele across diverse sectors, helping customers win in complex and hostile digital environments. Federico has held several high-ranking positions across the globe. He served as the Head of Security at a Middle East bank, took on the role of Company Director and Head of Consulting at a UK cyber security firm, and acted as a Senior Advisor for numerous prestigious blue chip and FTSE 100 companies. His breadth of experience covers the Americas, Europe, and the Middle East.